2012-09-18 21:52:50 +08:00
|
|
|
//-----------------------------------------------------------------------------
|
|
|
|
// Copyright (C) 2012 Roel Verdult
|
|
|
|
//
|
|
|
|
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
|
|
|
// at your option, any later version. See the LICENSE.txt file for the text of
|
|
|
|
// the license.
|
|
|
|
//-----------------------------------------------------------------------------
|
|
|
|
// Low frequency Hitag support
|
|
|
|
//-----------------------------------------------------------------------------
|
2019-10-25 06:55:16 +08:00
|
|
|
#include "cmdlfhitag.h"
|
2019-08-08 22:57:33 +08:00
|
|
|
#include <ctype.h>
|
2021-01-10 05:45:17 +08:00
|
|
|
#include "cmdparser.h" // command_t
|
2018-09-07 03:43:20 +08:00
|
|
|
#include "comms.h"
|
2019-08-08 22:57:33 +08:00
|
|
|
#include "cmdtrace.h"
|
|
|
|
#include "commonutil.h"
|
|
|
|
#include "hitag.h"
|
2021-01-10 05:45:17 +08:00
|
|
|
#include "fileutils.h" // savefile
|
|
|
|
#include "protocols.h" // defines
|
|
|
|
#include "cliparser.h"
|
2012-09-18 21:52:50 +08:00
|
|
|
|
|
|
|
static int CmdHelp(const char *Cmd);
|
|
|
|
|
2020-05-03 07:13:28 +08:00
|
|
|
static const char *getHitagTypeStr(uint32_t uid) {
|
2020-04-17 16:29:54 +08:00
|
|
|
//uid s/n ********
|
2020-04-21 07:56:51 +08:00
|
|
|
uint8_t type = (uid >> 4) & 0xF;
|
|
|
|
switch (type) {
|
2020-04-17 16:29:54 +08:00
|
|
|
case 1:
|
|
|
|
return "PCF 7936";
|
|
|
|
case 2:
|
2020-04-21 07:56:51 +08:00
|
|
|
return "PCF 7946";
|
2020-04-17 16:29:54 +08:00
|
|
|
case 3:
|
|
|
|
return "PCF 7947";
|
|
|
|
case 4:
|
|
|
|
return "PCF 7942/44";
|
|
|
|
case 5:
|
|
|
|
return "PCF 7943";
|
|
|
|
case 6:
|
|
|
|
return "PCF 7941";
|
|
|
|
case 7:
|
|
|
|
return "PCF 7952";
|
|
|
|
case 9:
|
|
|
|
return "PCF 7945";
|
|
|
|
default:
|
|
|
|
return "";
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-04-11 06:10:21 +08:00
|
|
|
/*
|
|
|
|
static size_t nbytes(size_t nbits) {
|
2019-03-10 07:00:59 +08:00
|
|
|
return (nbits / 8) + ((nbits % 8) > 0);
|
2013-03-11 23:07:23 +08:00
|
|
|
}
|
2019-04-12 07:55:25 +08:00
|
|
|
*/
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2019-04-12 07:55:25 +08:00
|
|
|
static int CmdLFHitagList(const char *Cmd) {
|
2020-10-10 02:46:48 +08:00
|
|
|
char args[128] = {0};
|
2020-10-10 02:19:36 +08:00
|
|
|
if (strlen(Cmd) == 0) {
|
|
|
|
snprintf(args, sizeof(args), "-t hitag2");
|
2020-10-10 02:46:48 +08:00
|
|
|
} else {
|
|
|
|
strncpy(args, Cmd, sizeof(args) - 1);
|
2020-10-10 02:19:36 +08:00
|
|
|
}
|
|
|
|
return CmdTraceList(args);
|
|
|
|
|
2019-03-14 14:42:48 +08:00
|
|
|
|
|
|
|
/*
|
2019-05-01 03:10:11 +08:00
|
|
|
uint8_t *got = calloc(PM3_CMD_DATA_SIZE, sizeof(uint8_t));
|
2019-03-10 07:00:59 +08:00
|
|
|
if (!got) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "Cannot allocate memory for trace");
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_EMALLOC;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// Query for the actual size of the trace
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG response;
|
2019-07-24 03:45:06 +08:00
|
|
|
if (!GetFromDevice(BIG_BUF, got, PM3_CMD_DATA_SIZE, 0, NULL, 0, &response, 2500, false)) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "command execution time out");
|
|
|
|
free(got);
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
uint16_t traceLen = response.arg[2];
|
2019-05-01 03:10:11 +08:00
|
|
|
if (traceLen > PM3_CMD_DATA_SIZE) {
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t *p = realloc(got, traceLen);
|
|
|
|
if (p == NULL) {
|
|
|
|
PrintAndLogEx(WARNING, "Cannot allocate memory for trace");
|
|
|
|
free(got);
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_EMALLOC;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
got = p;
|
2019-07-24 03:45:06 +08:00
|
|
|
if (!GetFromDevice(BIG_BUF, got, traceLen, 0, NULL, 0, NULL, 2500, false)) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "command execution time out");
|
|
|
|
free(got);
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
PrintAndLogEx(NORMAL, "recorded activity (TraceLen = %d bytes):");
|
|
|
|
PrintAndLogEx(NORMAL, " ETU :nbits: who bytes");
|
|
|
|
PrintAndLogEx(NORMAL, "---------+-----+----+-----------");
|
|
|
|
|
|
|
|
int i = 0;
|
|
|
|
int prev = -1;
|
|
|
|
int len = strlen(Cmd);
|
|
|
|
|
|
|
|
char filename[FILE_PATH_SIZE] = { 0x00 };
|
2019-03-10 07:00:59 +08:00
|
|
|
FILE *f = NULL;
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
|
|
|
|
|
|
|
|
memcpy(filename, Cmd, len);
|
|
|
|
|
|
|
|
if (strlen(filename) > 0) {
|
2019-03-10 07:00:59 +08:00
|
|
|
f = fopen(filename, "wb");
|
2019-03-10 06:35:06 +08:00
|
|
|
if (!f) {
|
2019-07-14 06:35:18 +08:00
|
|
|
PrintAndLogEx(ERR, "Error: Could not open file [%s]", filename);
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_EFILE;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
for (;;) {
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (i >= traceLen) { break; }
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
bool isResponse;
|
2019-03-10 07:00:59 +08:00
|
|
|
int timestamp = *((uint32_t *)(got + i));
|
2019-03-10 06:35:06 +08:00
|
|
|
if (timestamp & 0x80000000) {
|
|
|
|
timestamp &= 0x7fffffff;
|
|
|
|
isResponse = 1;
|
|
|
|
} else {
|
|
|
|
isResponse = 0;
|
|
|
|
}
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
int parityBits = *((uint32_t *)(got + i + 4));
|
2019-03-10 06:35:06 +08:00
|
|
|
// 4 bytes of additional information...
|
|
|
|
// maximum of 32 additional parity bit information
|
|
|
|
//
|
|
|
|
// TODO:
|
|
|
|
// at each quarter bit period we can send power level (16 levels)
|
|
|
|
// or each half bit period in 256 levels.
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
int bits = got[i + 8];
|
|
|
|
int len = nbytes(got[i + 8]);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
if (len > 100) {
|
2019-03-10 07:00:59 +08:00
|
|
|
break;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
if (i + len > traceLen) { break;}
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
uint8_t *frame = (got + i + 9);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
// Break and stick with current result if buffer was not completely full
|
|
|
|
if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
|
|
|
|
|
|
|
|
char line[1000] = "";
|
|
|
|
int j;
|
|
|
|
for (j = 0; j < len; j++) {
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
//if((parityBits >> (len - j - 1)) & 0x01) {
|
|
|
|
if (isResponse && (oddparity8(frame[j]) != ((parityBits >> (len - j - 1)) & 0x01))) {
|
|
|
|
sprintf(line + (j * 4), "%02x! ", frame[j]);
|
|
|
|
} else {
|
|
|
|
sprintf(line + (j * 4), "%02x ", frame[j]);
|
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
PrintAndLogEx(NORMAL, " +%7d: %3d: %s %s",
|
2019-03-10 07:00:59 +08:00
|
|
|
(prev < 0 ? 0 : (timestamp - prev)),
|
|
|
|
bits,
|
|
|
|
(isResponse ? "TAG" : " "),
|
|
|
|
line);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
if (f) {
|
2019-03-10 07:00:59 +08:00
|
|
|
fprintf(f, " +%7d: %3d: %s %s\n",
|
|
|
|
(prev < 0 ? 0 : (timestamp - prev)),
|
|
|
|
bits,
|
|
|
|
(isResponse ? "TAG" : " "),
|
|
|
|
line);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
prev = timestamp;
|
|
|
|
i += (len + 9);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (f) {
|
|
|
|
fclose(f);
|
2019-09-14 23:50:58 +08:00
|
|
|
PrintAndLogEx(NORMAL, "Recorded activity successfully written to file: %s", filename);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
free(got);
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_SUCCES;
|
2019-03-14 14:42:48 +08:00
|
|
|
*/
|
2012-09-18 21:52:50 +08:00
|
|
|
}
|
|
|
|
|
2019-04-12 07:55:25 +08:00
|
|
|
static int CmdLFHitagSniff(const char *Cmd) {
|
2021-01-10 05:45:17 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag sniff",
|
|
|
|
"Sniff traffic between Hitag reader and tag.\n"
|
|
|
|
"Use " _YELLOW_("`lf hitag list`")" to view collected data.",
|
|
|
|
"lf hitag sniff"
|
|
|
|
);
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
|
|
|
CLIParserFree(ctx);
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2019-08-04 01:17:00 +08:00
|
|
|
SendCommandNG(CMD_LF_HITAG_SNIFF, NULL, 0);
|
2021-01-10 05:45:17 +08:00
|
|
|
PrintAndLogEx(HINT, "HINT: Try " _YELLOW_("`lf hitag list`")" to view collected data");
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_SUCCESS;
|
2012-09-18 21:52:50 +08:00
|
|
|
}
|
|
|
|
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2021-04-04 23:05:35 +08:00
|
|
|
// eload , to be implemented
|
|
|
|
static int CmdLFHitagEload(const char *Cmd) {
|
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag eload",
|
|
|
|
"Loads hitag tag dump into emulator memory on device",
|
|
|
|
"lf hitag eload -f lf-hitag-11223344-dump.bin\n");
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2021-04-04 23:05:35 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str1("f", "file", "<filename>", "filename of dump"),
|
|
|
|
arg_lit0("1", NULL, "simulate Hitag1"),
|
|
|
|
arg_lit0("2", NULL, "simulate Hitag2"),
|
|
|
|
arg_lit0("s", NULL, "simulate HitagS"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
|
|
|
bool use_ht1 = arg_get_lit(ctx, 2);
|
|
|
|
bool use_ht2 = arg_get_lit(ctx, 3);
|
|
|
|
bool use_hts = arg_get_lit(ctx, 4);
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
|
|
|
uint8_t n = (use_ht1 + use_ht2 + use_hts);
|
|
|
|
if (n != 1) {
|
|
|
|
PrintAndLogEx(ERR, "error, only specify one Hitag type");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
2021-04-08 17:08:39 +08:00
|
|
|
DumpFileType_t dftype = getfiletype(filename);
|
2021-04-04 23:05:35 +08:00
|
|
|
size_t dumplen = 0;
|
|
|
|
uint8_t *dump = NULL;
|
|
|
|
int res = 0;
|
|
|
|
switch (dftype) {
|
|
|
|
case BIN: {
|
|
|
|
res = loadFile_safe(filename, ".bin", (void **)&dump, &dumplen);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case EML: {
|
|
|
|
res = loadFileEML_safe(filename, (void **)&dump, &dumplen);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case JSON: {
|
|
|
|
dumplen = 4 * 64;
|
|
|
|
dump = calloc(dumplen, sizeof(uint8_t));
|
|
|
|
if (dump == NULL) {
|
|
|
|
PrintAndLogEx(ERR, "error, cannot allocate memory");
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
|
|
|
res = loadFileJSON(filename, dump, dumplen, &dumplen, NULL);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case DICTIONARY: {
|
|
|
|
PrintAndLogEx(ERR, "error, only BIN/JSON/EML formats allowed");
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-03-14 03:16:11 +08:00
|
|
|
}
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2021-04-04 23:05:35 +08:00
|
|
|
if (res != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(ERR, "error, something went wrong when loading file");
|
|
|
|
free(dump);
|
|
|
|
return PM3_EFILE;
|
2019-03-14 18:20:44 +08:00
|
|
|
}
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2021-04-08 17:08:39 +08:00
|
|
|
// check dump len..
|
2021-04-04 23:05:35 +08:00
|
|
|
if (dumplen == 48 || dumplen == 4 * 64) {
|
|
|
|
struct {
|
|
|
|
uint16_t len;
|
|
|
|
uint8_t *data;
|
|
|
|
} PACKED payload;
|
|
|
|
payload.len = dumplen;
|
|
|
|
memcpy(payload.data, dump, dumplen);
|
|
|
|
|
|
|
|
clearCommandBuffer();
|
2021-04-08 17:08:39 +08:00
|
|
|
SendCommandNG(CMD_LF_HITAG_ELOAD, (uint8_t *)&payload, 2 + dumplen);
|
2019-04-19 23:03:39 +08:00
|
|
|
} else {
|
2021-04-05 14:14:59 +08:00
|
|
|
PrintAndLogEx(ERR, "error, wrong dump file size. got %zu", dumplen);
|
2021-04-04 23:05:35 +08:00
|
|
|
}
|
|
|
|
|
2021-04-05 14:14:59 +08:00
|
|
|
free(dump);
|
2021-04-04 23:05:35 +08:00
|
|
|
return PM3_SUCCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int CmdLFHitagSim(const char *Cmd) {
|
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag sim",
|
|
|
|
"Simulate Hitag2 / HitagS transponder\n"
|
|
|
|
"You need to `lf hitag eload` first",
|
|
|
|
"lf hitag sim -2"
|
|
|
|
);
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_lit0("1", NULL, "simulate Hitag1"),
|
|
|
|
arg_lit0("2", NULL, "simulate Hitag2"),
|
|
|
|
arg_lit0("s", NULL, "simulate HitagS"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
|
|
|
|
|
|
|
bool use_ht1 = arg_get_lit(ctx, 1);
|
|
|
|
bool use_ht2 = arg_get_lit(ctx, 2);
|
|
|
|
bool use_hts = arg_get_lit(ctx, 3);
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
2021-04-08 17:08:39 +08:00
|
|
|
if ((use_ht1 + use_ht2 + use_hts) > 1) {
|
2021-04-04 23:05:35 +08:00
|
|
|
PrintAndLogEx(ERR, "error, Only specify one Hitag type");
|
|
|
|
return PM3_EINVARG;
|
2019-03-14 05:48:51 +08:00
|
|
|
}
|
2019-03-14 18:20:44 +08:00
|
|
|
|
2021-04-04 23:05:35 +08:00
|
|
|
uint16_t cmd = CMD_LF_HITAG_SIMULATE;
|
|
|
|
// if (use_ht1)
|
|
|
|
// cmd = CMD_LF_HITAG1_SIMULATE;
|
|
|
|
|
|
|
|
if (use_hts)
|
|
|
|
cmd = CMD_LF_HITAGS_SIMULATE;
|
|
|
|
|
|
|
|
clearCommandBuffer();
|
|
|
|
SendCommandMIX(cmd, 0, 0, 0, NULL, 0);
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_SUCCESS;
|
2012-09-18 21:52:50 +08:00
|
|
|
}
|
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
static void printHitagConfiguration(uint8_t config) {
|
2019-03-28 21:19:41 +08:00
|
|
|
|
2019-03-15 07:27:26 +08:00
|
|
|
char msg[100];
|
2019-03-15 06:30:45 +08:00
|
|
|
memset(msg, 0, sizeof(msg));
|
2019-03-16 03:10:17 +08:00
|
|
|
|
|
|
|
char bits[9];
|
|
|
|
char *bs = bits;
|
|
|
|
for (uint8_t i = 0 ; i < 8 ; i++) {
|
2019-03-16 05:05:36 +08:00
|
|
|
snprintf(bs, sizeof(bits) - i, "%1d", (config >> (7 - i)) & 1);
|
2019-03-16 03:10:17 +08:00
|
|
|
bs++;
|
|
|
|
}
|
|
|
|
|
|
|
|
PrintAndLogEx(INFO, "\n\nHitag2 tag information ");
|
|
|
|
PrintAndLogEx(INFO, "------------------------------------");
|
2019-03-28 21:19:41 +08:00
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
//configuration byte
|
2019-03-28 21:19:41 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Config byte : 0x%02X [ %s ]", config, bits);
|
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
// encoding
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg, "Encoding : ");
|
2019-03-15 06:30:45 +08:00
|
|
|
if (config & 0x1) {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), _YELLOW_("Biphase"));
|
2019-03-15 06:30:45 +08:00
|
|
|
} else {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), _YELLOW_("Manchester"));
|
2019-03-15 06:30:45 +08:00
|
|
|
}
|
|
|
|
PrintAndLogEx(SUCCESS, "%s", msg);
|
|
|
|
memset(msg, 0, sizeof(msg));
|
2019-03-15 07:20:42 +08:00
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
// version
|
|
|
|
strcat(msg, "Coding in HITAG 2 operation: %s");
|
|
|
|
uint8_t foo = (config & 0x6) >> 1;
|
2019-03-15 07:20:42 +08:00
|
|
|
switch (foo) {
|
2019-03-15 06:30:45 +08:00
|
|
|
case 0:
|
2019-03-16 03:10:17 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Version : public mode B, Coding: biphase");
|
2019-03-15 06:30:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, msg, (config & 0x1) ? "biphase" : "manchester");
|
|
|
|
break;
|
|
|
|
case 1:
|
2019-03-16 03:10:17 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Version : public mode A, Coding: manchester");
|
2019-03-15 06:30:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, msg, (config & 0x1) ? "biphase" : "manchester");
|
2019-03-15 07:20:42 +08:00
|
|
|
break;
|
2019-03-15 06:30:45 +08:00
|
|
|
case 2:
|
2019-03-16 03:10:17 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Version : public mode C, Coding: biphase");
|
2019-03-15 06:30:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, msg, (config & 0x1) ? "biphase" : "manchester");
|
2019-03-15 07:20:42 +08:00
|
|
|
break;
|
2019-03-15 06:30:45 +08:00
|
|
|
case 3:
|
2019-03-16 03:10:17 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Version : Hitag2");
|
2019-03-15 06:30:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, msg, (config & 0x1) ? "biphase" : "manchester");
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
memset(msg, 0, sizeof(msg));
|
2019-03-15 07:20:42 +08:00
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
// mode
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg, "Tag is in : ");
|
2019-03-15 06:30:45 +08:00
|
|
|
if (config & 0x8) {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), _YELLOW_("Crypto mode"));
|
2019-03-15 06:30:45 +08:00
|
|
|
} else {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), _YELLOW_("Password mode"));
|
2019-03-15 06:30:45 +08:00
|
|
|
}
|
2019-03-15 07:20:42 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "%s", msg);
|
2019-03-15 06:30:45 +08:00
|
|
|
memset(msg, 0, sizeof(msg));
|
2019-03-15 07:20:42 +08:00
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
// page access
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg, "Page 6,7 : ");
|
2019-03-15 06:30:45 +08:00
|
|
|
if (config & 0x10) {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), "read only");
|
2019-03-15 06:30:45 +08:00
|
|
|
} else {
|
2019-04-12 16:55:09 +08:00
|
|
|
strcat(msg + strlen(msg), _GREEN_("RW"));
|
2019-03-15 06:30:45 +08:00
|
|
|
}
|
2019-03-15 07:20:42 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "%s", msg);
|
2019-03-15 06:30:45 +08:00
|
|
|
memset(msg, 0, sizeof(msg));
|
2019-03-15 07:20:42 +08:00
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
// page access
|
2019-03-28 21:19:41 +08:00
|
|
|
strcat(msg, "Page 4,5 : ");
|
2019-03-15 06:30:45 +08:00
|
|
|
if (config & 0x20) {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), "read only");
|
2019-03-15 06:30:45 +08:00
|
|
|
} else {
|
2019-04-12 16:55:09 +08:00
|
|
|
strcat(msg + strlen(msg), _GREEN_("RW"));
|
2019-03-15 06:30:45 +08:00
|
|
|
}
|
2019-03-15 07:20:42 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "%s", msg);
|
2019-03-15 06:30:45 +08:00
|
|
|
memset(msg, 0, sizeof(msg));
|
2019-03-15 07:20:42 +08:00
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
// OTP
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg, "Page 3 : ");
|
2019-03-15 06:30:45 +08:00
|
|
|
if (config & 0x40) {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), "read only. Configuration byte and password tag " _RED_("FIXED / IRREVERSIBLE"));
|
2019-03-15 06:30:45 +08:00
|
|
|
} else {
|
2019-04-12 16:55:09 +08:00
|
|
|
strcat(msg + strlen(msg), _GREEN_("RW"));
|
2019-03-15 07:20:42 +08:00
|
|
|
}
|
|
|
|
PrintAndLogEx(SUCCESS, "%s", msg);
|
2019-03-15 06:30:45 +08:00
|
|
|
memset(msg, 0, sizeof(msg));
|
2019-03-15 07:20:42 +08:00
|
|
|
|
2019-03-15 06:30:45 +08:00
|
|
|
// OTP
|
|
|
|
if (config & 0x80) {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg, "Page 1 : " _RED_("locked") "\n");
|
2019-03-15 07:20:42 +08:00
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), "Page 2 : ");
|
2019-03-15 06:30:45 +08:00
|
|
|
if (config & 0x8) {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), _RED_("locked"));
|
2019-03-15 06:30:45 +08:00
|
|
|
} else {
|
2019-03-16 03:10:17 +08:00
|
|
|
strcat(msg + strlen(msg), "read only");
|
2019-03-15 06:30:45 +08:00
|
|
|
}
|
|
|
|
} else {
|
2019-04-12 16:55:09 +08:00
|
|
|
strcat(msg, "Page 1,2 : " _GREEN_("RW"));
|
2019-03-15 06:30:45 +08:00
|
|
|
}
|
|
|
|
PrintAndLogEx(SUCCESS, "%s", msg);
|
|
|
|
PrintAndLogEx(INFO, "------------------------------------");
|
|
|
|
}
|
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
static bool getHitagUid(uint32_t *uid) {
|
2019-05-14 05:15:07 +08:00
|
|
|
hitag_data htd;
|
|
|
|
memset(&htd, 0, sizeof(htd));
|
2019-03-16 03:10:17 +08:00
|
|
|
clearCommandBuffer();
|
2019-08-04 01:17:00 +08:00
|
|
|
SendCommandMIX(CMD_LF_HITAG_READER, RHT2F_UID_ONLY, 0, 0, &htd, sizeof(htd));
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2019-03-16 03:10:17 +08:00
|
|
|
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
|
|
|
|
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2019-04-18 05:44:48 +08:00
|
|
|
if (resp.oldarg[0] == false) {
|
2019-03-16 03:10:17 +08:00
|
|
|
PrintAndLogEx(DEBUG, "DEBUG: Error - failed getting UID");
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2019-03-28 21:19:41 +08:00
|
|
|
if (uid)
|
2019-04-18 05:44:48 +08:00
|
|
|
*uid = bytes_to_num(resp.data.asBytes, 4);
|
2019-03-28 21:19:41 +08:00
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2019-04-12 07:55:25 +08:00
|
|
|
static int CmdLFHitagInfo(const char *Cmd) {
|
2021-01-10 05:45:17 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag info",
|
|
|
|
"Sniff traffic between Hitag reader and tag.",
|
|
|
|
"lf hitag info"
|
|
|
|
);
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
|
|
|
CLIParserFree(ctx);
|
2019-03-28 21:19:41 +08:00
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
// read UID
|
|
|
|
uint32_t uid = 0;
|
2019-03-28 21:19:41 +08:00
|
|
|
if (getHitagUid(&uid) == false)
|
2020-01-17 21:05:11 +08:00
|
|
|
return PM3_ESOFT;
|
2019-03-28 21:19:41 +08:00
|
|
|
|
2020-04-17 16:29:54 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-04-22 08:22:55 +08:00
|
|
|
PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------");
|
2020-04-17 16:29:54 +08:00
|
|
|
PrintAndLogEx(INFO, "-------------------------------------------------------------");
|
|
|
|
PrintAndLogEx(SUCCESS, " UID: " _GREEN_("%08X"), uid);
|
|
|
|
PrintAndLogEx(SUCCESS, " TYPE: " _GREEN_("%s"), getHitagTypeStr(uid));
|
2019-03-28 21:19:41 +08:00
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
// how to detemine Hitag types?
|
2019-03-15 06:30:45 +08:00
|
|
|
// read block3, get configuration byte.
|
|
|
|
|
|
|
|
// common configurations.
|
2020-01-17 21:25:07 +08:00
|
|
|
// printHitagConfiguration(0x06);
|
2019-03-15 06:30:45 +08:00
|
|
|
//printHitagConfiguration( 0x0E );
|
|
|
|
//printHitagConfiguration( 0x02 );
|
|
|
|
//printHitagConfiguration( 0x00 );
|
|
|
|
//printHitagConfiguration( 0x04 );
|
2020-04-17 16:29:54 +08:00
|
|
|
PrintAndLogEx(INFO, "-------------------------------------------------------------");
|
2020-01-15 05:08:43 +08:00
|
|
|
return PM3_SUCCESS;
|
2019-03-14 15:30:20 +08:00
|
|
|
}
|
|
|
|
|
2019-03-28 21:19:41 +08:00
|
|
|
// TODO: iceman
|
2019-03-16 03:10:17 +08:00
|
|
|
// Hitag2 reader, problem is that this command mixes up stuff. So 26 give uid. 21 etc will also give you a memory dump !?
|
|
|
|
//
|
2019-04-12 07:55:25 +08:00
|
|
|
static int CmdLFHitagReader(const char *Cmd) {
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2021-04-12 19:18:25 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag reader",
|
|
|
|
"Act like a Hitag Reader",
|
|
|
|
"Hitag S\n"
|
2021-04-12 22:17:37 +08:00
|
|
|
" lf hitag reader --01 --nrar 0102030411223344\n"
|
2021-04-12 19:18:25 +08:00
|
|
|
" lf hitag reader --02 -k 4F4E4D494B52\n"
|
|
|
|
"Hitag 2\n"
|
|
|
|
" lf hitag reader --21 -k 4D494B52\n"
|
2021-04-12 22:17:37 +08:00
|
|
|
" lf hitag reader --22 --nrar 0102030411223344\n"
|
2021-04-12 19:18:25 +08:00
|
|
|
" lf hitag reader --23 -k 4F4E4D494B52\n"
|
|
|
|
" lf hitag reader --26\n"
|
|
|
|
);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2021-04-12 19:18:25 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_lit0(NULL, "01", "HitagS, read all pages, challenge mode"),
|
|
|
|
arg_lit0(NULL, "02", "HitagS, read all pages, crypto mode. Set key=0 for no auth"),
|
|
|
|
arg_lit0(NULL, "21", "Hitag2, read all pages, password mode. def 4D494B52 (MIKR)"),
|
|
|
|
arg_lit0(NULL, "22", "Hitag2, read all pages, challenge mode"),
|
2021-04-12 22:17:37 +08:00
|
|
|
arg_lit0(NULL, "23", "Hitag2, read all pages, crypto mode. Key ISK high + ISK low. def 4F4E4D494B52 (ONMIKR)"),
|
2021-04-12 19:18:25 +08:00
|
|
|
arg_lit0(NULL, "25", "Hitag2, test recorded authentications (replay?)"),
|
|
|
|
arg_lit0(NULL, "26", "Hitag2, read UID"),
|
2021-04-12 22:17:37 +08:00
|
|
|
arg_str0("k","key", "<hex>", "key, 4 or 6 hex bytes"),
|
|
|
|
arg_str0(NULL,"nrar", "<hex>", "nonce / answer reader, 8 hex bytes"),
|
2021-04-12 19:18:25 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
// Hitag S
|
|
|
|
bool s01 = arg_get_lit(ctx, 1);
|
|
|
|
bool s02 = arg_get_lit(ctx, 2);
|
|
|
|
|
|
|
|
// Hitag 2
|
|
|
|
bool h21 = arg_get_lit(ctx, 3);
|
|
|
|
bool h22 = arg_get_lit(ctx, 4);
|
|
|
|
bool h23 = arg_get_lit(ctx, 5);
|
|
|
|
bool h25 = arg_get_lit(ctx, 6);
|
|
|
|
bool h26 = arg_get_lit(ctx, 7);
|
|
|
|
|
|
|
|
uint8_t key[6];
|
|
|
|
int keylen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
int res = CLIParamHexToBuf(arg_get_str(ctx, 8), key, sizeof(key), &keylen);
|
|
|
|
if (res != 0) {
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2021-04-12 19:18:25 +08:00
|
|
|
|
2021-04-12 22:17:37 +08:00
|
|
|
uint8_t nrar[8];
|
|
|
|
int nalen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
res = CLIParamHexToBuf(arg_get_str(ctx, 9), nrar, sizeof(nrar), &nalen);
|
2021-04-12 19:18:25 +08:00
|
|
|
CLIParserFree(ctx);
|
2021-04-13 00:39:15 +08:00
|
|
|
if (res != 0) {
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2021-04-12 19:18:25 +08:00
|
|
|
|
|
|
|
// sanity checks
|
|
|
|
if (keylen != 0 && keylen != 6) {
|
2021-04-12 22:17:37 +08:00
|
|
|
PrintAndLogEx(WARNING, "Wrong KEY len expected 0 or 6, got %d", keylen);
|
2021-04-12 19:18:25 +08:00
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
2021-04-12 22:17:37 +08:00
|
|
|
if (nalen != 0 && nalen != 8) {
|
|
|
|
PrintAndLogEx(WARNING, "Wrong NR/AR len expected 0 or 8, got %d", nalen);
|
2021-04-12 19:18:25 +08:00
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t foo = (s01 + s02 + h21 + h22 + h23 + h25 + h26);
|
|
|
|
if (foo > 1) {
|
2021-04-12 22:17:37 +08:00
|
|
|
PrintAndLogEx(WARNING, "Only specify one HITAG reader cmd");
|
2021-04-12 19:18:25 +08:00
|
|
|
return PM3_EINVARG;
|
|
|
|
} else if (foo == 0) {
|
2021-04-12 22:17:37 +08:00
|
|
|
PrintAndLogEx(WARNING, "Specify one HITAG reader cms");
|
2021-04-12 19:18:25 +08:00
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2021-04-12 19:18:25 +08:00
|
|
|
hitag_function htf;
|
|
|
|
hitag_data htd;
|
|
|
|
uint16_t cmd = CMD_LF_HITAG_READER;
|
|
|
|
if (s01) {
|
|
|
|
cmd = CMD_LF_HITAGS_READ;
|
|
|
|
htf = RHTSF_CHALLENGE;
|
2021-04-12 22:17:37 +08:00
|
|
|
memcpy(htd.auth.NrAr, nrar, sizeof(nrar));
|
2021-04-12 19:18:25 +08:00
|
|
|
}
|
|
|
|
if (s02){
|
|
|
|
cmd = CMD_LF_HITAGS_READ;
|
|
|
|
htf = RHTSF_KEY;
|
|
|
|
memcpy(htd.crypto.key, key, sizeof(key));
|
|
|
|
}
|
|
|
|
if (h21) {
|
|
|
|
htf = RHT2F_PASSWORD;
|
|
|
|
memcpy(htd.pwd.password, key, 4);
|
|
|
|
}
|
|
|
|
if (h22) {
|
|
|
|
htf = RHT2F_AUTHENTICATE;
|
2021-04-12 22:17:37 +08:00
|
|
|
memcpy(htd.auth.NrAr, nrar, sizeof(nrar));
|
2021-04-12 19:18:25 +08:00
|
|
|
}
|
|
|
|
if (h23) {
|
|
|
|
htf = RHT2F_CRYPTO;
|
|
|
|
memcpy(htd.crypto.key, key, sizeof(key));
|
|
|
|
}
|
|
|
|
if (h25) {
|
|
|
|
htf = RHT2F_TEST_AUTH_ATTEMPTS;
|
|
|
|
}
|
|
|
|
if (h26) {
|
|
|
|
htf = RHT2F_UID_ONLY;
|
|
|
|
}
|
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2020-01-17 21:05:11 +08:00
|
|
|
SendCommandMIX(cmd, htf, 0, 0, &htd, sizeof(htd));
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2021-04-12 19:18:25 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_ACK, &resp, 2000) == false) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
2020-01-17 21:05:11 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2019-04-18 05:44:48 +08:00
|
|
|
if (resp.oldarg[0] == false) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(DEBUG, "DEBUG: Error - hitag failed");
|
2020-01-17 21:05:11 +08:00
|
|
|
return PM3_ESOFT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2019-04-18 05:44:48 +08:00
|
|
|
uint32_t id = bytes_to_num(resp.data.asBytes, 4);
|
2020-01-23 01:43:20 +08:00
|
|
|
uint8_t *data = resp.data.asBytes;
|
2020-01-17 21:05:11 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " UID: " _YELLOW_("%08x"), id);
|
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
if (htf != RHT2F_UID_ONLY) {
|
2020-04-16 15:01:14 +08:00
|
|
|
|
2019-03-16 03:10:17 +08:00
|
|
|
// block3, 1 byte
|
2019-03-28 21:19:41 +08:00
|
|
|
printHitagConfiguration(data[4 * 3]);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-01-17 21:05:11 +08:00
|
|
|
return PM3_SUCCESS;
|
2012-09-18 21:52:50 +08:00
|
|
|
}
|
|
|
|
|
2019-04-12 07:55:25 +08:00
|
|
|
static int CmdLFHitagCheckChallenges(const char *Cmd) {
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2021-03-08 05:27:37 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag cc",
|
|
|
|
"Check challenges, load a file with saved hitag crypto challenges and test them all.\n"
|
|
|
|
"The file should be 8 * 60 bytes long, the file extension defaults to " _YELLOW_("`.cc`") " ",
|
|
|
|
"lf hitag cc -f my_hitag_challenges"
|
|
|
|
);
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2021-03-08 05:27:37 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str0("f", "filename", "<fn w/o ext>", "filename to load from"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2021-03-08 05:27:37 +08:00
|
|
|
int fnlen = 0;
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2021-03-08 05:27:37 +08:00
|
|
|
|
|
|
|
if (fnlen > 0) {
|
|
|
|
uint8_t *data = NULL;
|
|
|
|
size_t datalen = 0;
|
|
|
|
int res = loadFile_safe(filename, ".cc", (void **)&data, &datalen);
|
|
|
|
if (res == PM3_SUCCESS) {
|
2021-04-08 17:08:39 +08:00
|
|
|
if (datalen == (8 * 60)) {
|
2021-03-08 05:27:37 +08:00
|
|
|
SendCommandOLD(CMD_LF_HITAGS_TEST_TRACES, 1, 0, 0, data, datalen);
|
|
|
|
} else {
|
2021-04-08 17:08:39 +08:00
|
|
|
PrintAndLogEx(ERR, "Error, file length mismatch. Expected %d, got %zu", 8 * 60, datalen);
|
|
|
|
}
|
2021-03-08 05:27:37 +08:00
|
|
|
}
|
|
|
|
if (data) {
|
|
|
|
free(data);
|
|
|
|
}
|
|
|
|
} else {
|
2019-08-04 01:17:00 +08:00
|
|
|
SendCommandMIX(CMD_LF_HITAGS_TEST_TRACES, 0, 0, 0, NULL, 0);
|
2021-03-08 05:27:37 +08:00
|
|
|
}
|
2019-03-14 18:20:44 +08:00
|
|
|
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_SUCCESS;
|
2016-03-05 02:06:47 +08:00
|
|
|
}
|
|
|
|
|
2019-04-12 07:55:25 +08:00
|
|
|
static int CmdLFHitagWriter(const char *Cmd) {
|
2021-04-12 22:17:37 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag writer",
|
|
|
|
"Act like a Hitag writer"
|
|
|
|
"In password mode the default key is 4D494B52 (MIKR)\n"
|
|
|
|
"In crypto mode the default key is 4F4E4D494B52 (ONMIKR) format: ISK high + ISK low.",
|
|
|
|
"Hitag S\n"
|
2021-04-14 20:24:50 +08:00
|
|
|
" lf hitag writer --03 --nrar 0102030411223344 -p 3 -d 01020304\n"
|
|
|
|
" lf hitag writer --04 -k 4F4E4D494B52 -p 3 -d 01020304\n"
|
2021-04-12 22:17:37 +08:00
|
|
|
"Hitag 2\n"
|
2021-04-14 20:24:50 +08:00
|
|
|
" lf hitag writer --24 -k 4F4E4D494B52 -p 3 -d 01020304\n"
|
|
|
|
" lf hitag writer --27 -k 4D494B52 -p 3 -d 01020304\n"
|
2021-04-12 22:17:37 +08:00
|
|
|
);
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_lit0(NULL, "03", "HitagS, write page, challenge mode"),
|
|
|
|
arg_lit0(NULL, "04", "HitagS, write page, crypto mode. Set key=0 for no auth"),
|
|
|
|
arg_lit0(NULL, "24", "Hitag2, write page, crypto mode."),
|
|
|
|
arg_lit0(NULL, "27", "Hitag2, write page, password mode"),
|
|
|
|
arg_int1("p", "page", "<dec>", "page address to write to"),
|
|
|
|
arg_str0("d", "data", "<hex>", "data, 4 hex bytes"),
|
|
|
|
arg_str0("k","key", "<hex>", "key, 4 or 6 hex bytes"),
|
2021-04-14 20:24:50 +08:00
|
|
|
arg_str0(NULL,"nrar", "<hex>", "nonce / answer writer, 8 hex bytes"),
|
2021-04-12 22:17:37 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
// Hitag S
|
|
|
|
bool s03 = arg_get_lit(ctx, 1);
|
|
|
|
bool s04 = arg_get_lit(ctx, 2);
|
|
|
|
|
|
|
|
// Hitag 2
|
|
|
|
bool h24 = arg_get_lit(ctx, 3);
|
|
|
|
bool h27 = arg_get_lit(ctx, 4);
|
|
|
|
|
|
|
|
uint32_t page = arg_get_u32_def(ctx, 5, 0);
|
|
|
|
|
|
|
|
uint8_t data[4];
|
|
|
|
int dlen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
int res = CLIParamHexToBuf(arg_get_str(ctx, 6), data, sizeof(data), &dlen);
|
|
|
|
if (res != 0) {
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2021-04-12 22:17:37 +08:00
|
|
|
|
|
|
|
uint8_t key[6];
|
|
|
|
int keylen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
res = CLIParamHexToBuf(arg_get_str(ctx, 7), key, sizeof(key), &keylen);
|
|
|
|
if (res != 0) {
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2021-04-12 22:17:37 +08:00
|
|
|
|
|
|
|
uint8_t nrar[8];
|
|
|
|
int nalen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
res = CLIParamHexToBuf(arg_get_str(ctx, 8), nrar, sizeof(nrar), &nalen);
|
|
|
|
|
2021-04-12 22:17:37 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
2021-04-13 00:39:15 +08:00
|
|
|
if (res != 0) {
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
2021-04-12 22:17:37 +08:00
|
|
|
// sanity checks
|
|
|
|
if (dlen != sizeof(data)) {
|
|
|
|
PrintAndLogEx(WARNING, "Wrong DATA len expected 4, got %d", dlen);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (keylen != 0 && keylen != 6 && keylen != 4) {
|
|
|
|
PrintAndLogEx(WARNING, "Wrong KEY len expected 0, 4 or 6, got %d", keylen);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (nalen != 0 && nalen != 8) {
|
|
|
|
PrintAndLogEx(WARNING, "Wrong NR/AR len expected 0 or 8, got %d", nalen);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t foo = (s03 + s04 + h24 + h27);
|
|
|
|
if (foo > 1) {
|
|
|
|
PrintAndLogEx(WARNING, "Only specify one HITAG write cmd");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
} else if (foo == 0) {
|
|
|
|
PrintAndLogEx(WARNING, "Specify one HITAG write cmd");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
hitag_function htf;
|
2019-04-19 23:03:39 +08:00
|
|
|
hitag_data htd;
|
2021-04-12 22:17:37 +08:00
|
|
|
if (s03) {
|
|
|
|
htf = WHTSF_CHALLENGE;
|
|
|
|
memcpy(htd.auth.NrAr, nrar, sizeof(nrar));
|
|
|
|
memcpy(htd.auth.data, data, sizeof(data));
|
|
|
|
}
|
|
|
|
if (s04){
|
|
|
|
htf = WHTSF_KEY;
|
|
|
|
memcpy(htd.crypto.key, key, sizeof(key));
|
|
|
|
memcpy(htd.crypto.data, data, sizeof(data));
|
|
|
|
}
|
|
|
|
if (h24) {
|
|
|
|
htf = WHT2F_CRYPTO;
|
|
|
|
memcpy(htd.pwd.password, key, 4);
|
|
|
|
memcpy(htd.crypto.data, data, sizeof(data));
|
|
|
|
}
|
|
|
|
if (h27) {
|
|
|
|
htf = WHT2F_PASSWORD;
|
|
|
|
memcpy(htd.pwd.password, key, 4);
|
|
|
|
memcpy(htd.crypto.data, data, sizeof(data));
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-03-13 23:44:32 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2021-04-12 22:17:37 +08:00
|
|
|
SendCommandMIX(CMD_LF_HITAGS_WRITE, htf, 0, page, &htd, sizeof(htd));
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2021-04-12 22:17:37 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_ACK, &resp, 4000) == false) {
|
2019-03-13 23:44:32 +08:00
|
|
|
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-14 19:30:32 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-04-18 05:44:48 +08:00
|
|
|
if (resp.oldarg[0] == false) {
|
2019-03-14 05:48:51 +08:00
|
|
|
PrintAndLogEx(DEBUG, "DEBUG: Error - hitag write failed");
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_ESOFT;
|
2019-03-14 19:30:32 +08:00
|
|
|
}
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_SUCCESS;
|
2016-04-24 00:23:46 +08:00
|
|
|
}
|
2016-03-05 02:06:47 +08:00
|
|
|
|
2020-01-22 20:13:45 +08:00
|
|
|
static int CmdLFHitag2Dump(const char *Cmd) {
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2021-04-12 22:47:54 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "lf hitag dump",
|
|
|
|
"Read all card memory and save to file"
|
|
|
|
"In password mode the default key is 4D494B52 (MIKR)\n"
|
|
|
|
"In crypto mode the default key is 4F4E4D494B52 (ONMIKR) format: ISK high + ISK low.",
|
|
|
|
"lf hitag dump -k 4F4E4D494B52\n"
|
|
|
|
"lf hitag dump -k 4D494B52\n"
|
|
|
|
);
|
2020-01-22 20:13:45 +08:00
|
|
|
|
2021-04-12 22:47:54 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str0("f", "file", "<fn>", "file name"),
|
|
|
|
arg_str0("k","key", "<hex>", "key, 4 or 6 hex bytes"),
|
|
|
|
arg_str0(NULL,"nrar", "<hex>", "nonce / answer reader, 8 hex bytes"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
uint8_t filename[FILE_PATH_SIZE] = {0};
|
|
|
|
int fnlen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
int res = CLIParamHexToBuf(arg_get_str(ctx, 1), filename, sizeof(filename), &fnlen);
|
|
|
|
if (res != 0) {
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2020-04-16 15:01:14 +08:00
|
|
|
|
2021-04-12 22:47:54 +08:00
|
|
|
uint8_t key[6];
|
|
|
|
int keylen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
res = CLIParamHexToBuf(arg_get_str(ctx, 2), key, sizeof(key), &keylen);
|
|
|
|
if (res != 0) {
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2021-04-12 22:47:54 +08:00
|
|
|
|
|
|
|
uint8_t nrar[8];
|
|
|
|
int nalen = 0;
|
2021-04-13 00:39:15 +08:00
|
|
|
res = CLIParamHexToBuf(arg_get_str(ctx, 3), nrar, sizeof(nrar), &nalen);
|
2021-04-12 22:47:54 +08:00
|
|
|
CLIParserFree(ctx);
|
2021-04-13 00:39:15 +08:00
|
|
|
if (res != 0) {
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2021-04-12 22:47:54 +08:00
|
|
|
|
|
|
|
PrintAndLogEx(WARNING, "to be implememted...");
|
|
|
|
|
|
|
|
/*
|
2020-01-22 20:13:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Dumping tag memory...");
|
|
|
|
|
2021-04-12 22:47:54 +08:00
|
|
|
clearCommandBuffer();
|
|
|
|
//SendCommandNG(CMD_LF_HITAG_DUMP, &htd, sizeof(htd));
|
|
|
|
PacketResponseNG resp;
|
|
|
|
uint8_t *data = resp.data.asBytes;
|
|
|
|
if (fnlen < 1) {
|
|
|
|
char *fptr = filename;
|
|
|
|
fptr += sprintf(fptr, "lf-hitag-");
|
|
|
|
FillFileNameByUID(fptr, data, "-dump", 4);
|
|
|
|
}
|
2020-01-22 20:13:45 +08:00
|
|
|
|
|
|
|
saveFile(filename, ".bin", data, 48);
|
|
|
|
saveFileEML(filename, data, 48, 4);
|
2020-06-02 05:44:41 +08:00
|
|
|
saveFileJSON(filename, jsfHitag, data, 48, NULL);
|
2021-04-12 22:47:54 +08:00
|
|
|
*/
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_SUCCESS;
|
2019-03-14 03:16:11 +08:00
|
|
|
}
|
2020-01-22 20:13:45 +08:00
|
|
|
|
2019-03-14 03:16:11 +08:00
|
|
|
|
2020-01-20 18:37:10 +08:00
|
|
|
// Annotate HITAG protocol
|
2020-08-12 03:39:51 +08:00
|
|
|
void annotateHitag1(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, bool is_reader) {
|
2020-01-20 18:37:10 +08:00
|
|
|
}
|
|
|
|
|
2020-08-12 03:39:51 +08:00
|
|
|
void annotateHitag2(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, bool is_response) {
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-08-12 03:39:51 +08:00
|
|
|
// iceman: live decrypt of trace?
|
|
|
|
if (is_response) {
|
2020-01-20 18:37:10 +08:00
|
|
|
|
|
|
|
|
2020-08-12 03:39:51 +08:00
|
|
|
uint8_t cmdbits = (cmd[0] & 0xC0) >> 6;
|
|
|
|
|
|
|
|
if (cmdsize == 1) {
|
|
|
|
if (cmdbits == HITAG2_START_AUTH) {
|
|
|
|
snprintf(exp, size, "START AUTH");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if (cmdbits == HITAG2_HALT) {
|
|
|
|
snprintf(exp, size, "HALT");
|
|
|
|
return;
|
|
|
|
}
|
2020-01-20 18:37:10 +08:00
|
|
|
}
|
2020-08-12 03:39:51 +08:00
|
|
|
|
|
|
|
if (cmdsize == 3) {
|
|
|
|
if (cmdbits == HITAG2_START_AUTH) {
|
|
|
|
// C 1 C 0
|
|
|
|
// 1100 0 00 1 1100 000
|
|
|
|
uint8_t page = (cmd[0] & 0x38) >> 3;
|
|
|
|
uint8_t inv_page = ((cmd[0] & 0x1) << 2) | ((cmd[1] & 0xC0) >> 6);
|
|
|
|
snprintf(exp, size, "READ page(%x) %x", page, inv_page);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if (cmdbits == HITAG2_WRITE_PAGE) {
|
|
|
|
uint8_t page = (cmd[0] & 0x38) >> 3;
|
|
|
|
uint8_t inv_page = ((cmd[0] & 0x1) << 2) | ((cmd[1] & 0xC0) >> 6);
|
|
|
|
snprintf(exp, size, "WRITE page(%x) %x", page, inv_page);
|
|
|
|
return;
|
|
|
|
}
|
2020-01-20 18:37:10 +08:00
|
|
|
}
|
|
|
|
|
2020-08-12 03:39:51 +08:00
|
|
|
if (cmdsize == 9) {
|
2020-08-13 18:25:04 +08:00
|
|
|
snprintf(exp, size, "Nr Ar Is response");
|
|
|
|
return;
|
2020-01-20 18:37:10 +08:00
|
|
|
}
|
2020-08-12 03:39:51 +08:00
|
|
|
} else {
|
|
|
|
|
|
|
|
if (cmdsize == 9) {
|
2020-08-13 18:25:04 +08:00
|
|
|
snprintf(exp, size, "Nr Ar");
|
|
|
|
return;
|
2020-01-20 18:37:10 +08:00
|
|
|
}
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
|
|
|
}
|
2020-08-12 03:39:51 +08:00
|
|
|
|
2020-01-20 18:37:10 +08:00
|
|
|
|
2020-08-12 03:39:51 +08:00
|
|
|
void annotateHitagS(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, bool is_reader) {
|
2020-01-20 18:37:10 +08:00
|
|
|
}
|
|
|
|
|
2017-08-10 00:33:30 +08:00
|
|
|
static command_t CommandTable[] = {
|
2021-04-04 23:05:35 +08:00
|
|
|
{"help", CmdHelp, AlwaysAvailable, "This help"},
|
|
|
|
{"eload", CmdLFHitagEload, IfPm3Hitag, "Load Hitag dump file into emulator memory"},
|
|
|
|
{"list", CmdLFHitagList, IfPm3Hitag, "List Hitag trace history"},
|
|
|
|
{"info", CmdLFHitagInfo, IfPm3Hitag, "Tag information"},
|
2021-04-12 22:17:37 +08:00
|
|
|
{"reader", CmdLFHitagReader, IfPm3Hitag, "Act like a Hitag reader"},
|
2021-04-04 23:05:35 +08:00
|
|
|
{"sim", CmdLFHitagSim, IfPm3Hitag, "Simulate Hitag transponder"},
|
|
|
|
{"sniff", CmdLFHitagSniff, IfPm3Hitag, "Eavesdrop Hitag communication"},
|
2021-04-12 22:17:37 +08:00
|
|
|
{"writer", CmdLFHitagWriter, IfPm3Hitag, "Act like a Hitag writer"},
|
2021-04-04 23:05:35 +08:00
|
|
|
{"dump", CmdLFHitag2Dump, IfPm3Hitag, "Dump Hitag2 tag"},
|
|
|
|
{"cc", CmdLFHitagCheckChallenges, IfPm3Hitag, "Test all challenges"},
|
2019-03-10 07:00:59 +08:00
|
|
|
{ NULL, NULL, 0, NULL }
|
2012-09-18 21:52:50 +08:00
|
|
|
};
|
|
|
|
|
2019-04-12 07:55:25 +08:00
|
|
|
static int CmdHelp(const char *Cmd) {
|
|
|
|
(void)Cmd; // Cmd is not used so far
|
|
|
|
CmdsHelp(CommandTable);
|
2020-01-17 21:25:07 +08:00
|
|
|
return PM3_SUCCESS;
|
2019-04-12 07:55:25 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
int CmdLFHitag(const char *Cmd) {
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2019-04-19 06:47:51 +08:00
|
|
|
return CmdsParse(CommandTable, Cmd);
|
2012-09-18 21:52:50 +08:00
|
|
|
}
|
|
|
|
|
2019-04-12 07:55:25 +08:00
|
|
|
int readHitagUid(void) {
|
2021-04-14 20:24:50 +08:00
|
|
|
return (CmdLFHitagReader("--26") == PM3_SUCCESS);
|
2012-09-18 21:52:50 +08:00
|
|
|
}
|