2011-05-18 20:33:32 +08:00
|
|
|
//-----------------------------------------------------------------------------
|
|
|
|
// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
|
|
|
|
// Copyright (C) 2011 Gerhard de Koning Gans
|
2014-06-29 04:57:48 +08:00
|
|
|
// Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
|
2020-07-09 06:21:26 +08:00
|
|
|
// Copyright (C) 2019 piwi
|
2020-02-27 23:35:17 +08:00
|
|
|
// Copyright (C) 2020 Iceman
|
2011-05-18 20:33:32 +08:00
|
|
|
//
|
|
|
|
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
|
|
|
// at your option, any later version. See the LICENSE.txt file for the text of
|
|
|
|
// the license.
|
|
|
|
//-----------------------------------------------------------------------------
|
|
|
|
// High frequency iClass commands
|
|
|
|
//-----------------------------------------------------------------------------
|
|
|
|
|
|
|
|
#include "cmdhficlass.h"
|
2019-08-08 22:57:33 +08:00
|
|
|
#include <ctype.h>
|
2020-07-09 06:21:26 +08:00
|
|
|
#include "cliparser.h"
|
2019-08-08 22:57:33 +08:00
|
|
|
#include "cmdparser.h" // command_t
|
|
|
|
#include "commonutil.h" // ARRAYLEN
|
|
|
|
#include "cmdtrace.h"
|
|
|
|
#include "util_posix.h"
|
|
|
|
#include "comms.h"
|
2020-05-25 05:23:55 +08:00
|
|
|
#include "des.h"
|
2020-04-19 18:53:46 +08:00
|
|
|
#include "loclass/cipherutils.h"
|
|
|
|
#include "loclass/cipher.h"
|
|
|
|
#include "loclass/ikeys.h"
|
|
|
|
#include "loclass/elite_crack.h"
|
2019-08-21 20:41:33 +08:00
|
|
|
#include "fileutils.h"
|
2019-08-08 22:57:33 +08:00
|
|
|
#include "protocols.h"
|
2020-02-27 23:35:17 +08:00
|
|
|
#include "cardhelper.h"
|
2020-02-04 07:41:57 +08:00
|
|
|
#include "wiegand_formats.h"
|
|
|
|
#include "wiegand_formatutils.h"
|
2021-04-08 15:34:11 +08:00
|
|
|
#include "cmdsmartcard.h" // smart select fct
|
2019-08-08 22:57:33 +08:00
|
|
|
|
2017-09-07 22:14:33 +08:00
|
|
|
#define NUM_CSNS 9
|
2015-10-08 05:00:46 +08:00
|
|
|
#define ICLASS_KEYS_MAX 8
|
2019-09-08 23:37:14 +08:00
|
|
|
#define ICLASS_AUTH_RETRY 10
|
2020-02-27 23:35:17 +08:00
|
|
|
#define ICLASS_DECRYPTION_BIN "iclass_decryptionkey.bin"
|
2021-04-04 23:01:43 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static picopass_hdr_t iclass_last_known_card;
|
|
|
|
static void iclass_set_last_known_card(picopass_hdr_t *card) {
|
|
|
|
memcpy(&iclass_last_known_card, card, sizeof(picopass_hdr_t));
|
|
|
|
}
|
|
|
|
|
2020-07-14 02:13:25 +08:00
|
|
|
static uint8_t empty[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
|
2017-08-19 22:13:36 +08:00
|
|
|
|
|
|
|
static int CmdHelp(const char *Cmd);
|
|
|
|
|
2015-10-08 05:00:46 +08:00
|
|
|
static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
|
2019-09-05 22:07:25 +08:00
|
|
|
{ 0xAE, 0xA6, 0x84, 0xA6, 0xDA, 0xB2, 0x32, 0x78 },
|
|
|
|
{ 0x76, 0x65, 0x54, 0x43, 0x32, 0x21, 0x10, 0x00 },
|
|
|
|
{ 0xF0, 0xE1, 0xD2, 0xC3, 0xB4, 0xA5, 0x96, 0x87 },
|
2019-03-10 07:00:59 +08:00
|
|
|
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
|
|
|
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
|
|
|
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
2020-11-21 02:15:50 +08:00
|
|
|
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
|
2020-08-08 17:46:22 +08:00
|
|
|
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
|
2015-10-08 05:00:46 +08:00
|
|
|
};
|
|
|
|
|
2020-08-20 03:51:10 +08:00
|
|
|
static int cmp_uint32(const void *a, const void *b) {
|
|
|
|
|
|
|
|
const iclass_prekey_t *x = (const iclass_prekey_t *)a;
|
|
|
|
const iclass_prekey_t *y = (const iclass_prekey_t *)b;
|
|
|
|
|
|
|
|
uint32_t mx = bytes_to_num((uint8_t *)x->mac, 4);
|
|
|
|
uint32_t my = bytes_to_num((uint8_t *)y->mac, 4);
|
|
|
|
|
|
|
|
if (mx < my)
|
|
|
|
return -1;
|
|
|
|
else
|
|
|
|
return mx > my;
|
|
|
|
}
|
|
|
|
|
2020-09-07 16:35:09 +08:00
|
|
|
bool check_known_default(uint8_t *csn, uint8_t *epurse, uint8_t *rmac, uint8_t *tmac, uint8_t *key) {
|
2020-08-20 03:51:10 +08:00
|
|
|
|
|
|
|
iclass_prekey_t *prekey = calloc(ICLASS_KEYS_MAX, sizeof(iclass_prekey_t));
|
|
|
|
if (prekey == false) {
|
2021-01-28 21:18:44 +08:00
|
|
|
return false;
|
2020-08-20 03:51:10 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t ccnr[12];
|
|
|
|
memcpy(ccnr, epurse, 8);
|
|
|
|
memcpy(ccnr + 8, rmac, 4);
|
|
|
|
|
2020-09-07 16:35:09 +08:00
|
|
|
GenerateMacKeyFrom(csn, ccnr, false, false, (uint8_t *)iClass_Key_Table, ICLASS_KEYS_MAX, prekey);
|
2020-08-20 03:51:10 +08:00
|
|
|
qsort(prekey, ICLASS_KEYS_MAX, sizeof(iclass_prekey_t), cmp_uint32);
|
|
|
|
|
|
|
|
iclass_prekey_t lookup;
|
|
|
|
memcpy(lookup.mac, tmac, 4);
|
|
|
|
|
|
|
|
// binsearch
|
2020-09-07 16:35:09 +08:00
|
|
|
iclass_prekey_t *item = (iclass_prekey_t *) bsearch(&lookup, prekey, ICLASS_KEYS_MAX, sizeof(iclass_prekey_t), cmp_uint32);
|
2020-08-20 03:51:10 +08:00
|
|
|
if (item != NULL) {
|
|
|
|
memcpy(key, item->key, 8);
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
typedef enum {
|
|
|
|
None = 0,
|
|
|
|
DES,
|
|
|
|
RFU,
|
|
|
|
TRIPLEDES
|
|
|
|
} BLOCK79ENCRYPTION;
|
|
|
|
|
2020-07-14 06:16:25 +08:00
|
|
|
static inline uint32_t leadingzeros(uint64_t a) {
|
|
|
|
#if defined __GNUC__
|
|
|
|
return __builtin_clzll(a);
|
|
|
|
#else
|
|
|
|
return 0;
|
|
|
|
#endif
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
|
|
|
const char *card_types[] = {
|
2020-07-20 02:45:47 +08:00
|
|
|
"PicoPass 16K / 16", // 000
|
|
|
|
"PicoPass 32K with current book 16K / 16", // 001
|
|
|
|
"Unknown Card Type!", // 010
|
|
|
|
"Unknown Card Type!", // 011
|
|
|
|
"PicoPass 2K", // 100
|
|
|
|
"Unknown Card Type!", // 101
|
|
|
|
"PicoPass 16K / 2", // 110
|
|
|
|
"PicoPass 32K with current book 16K / 2", // 111
|
|
|
|
};
|
|
|
|
|
|
|
|
uint8_t card_app2_limit[] = {
|
|
|
|
0xff,
|
|
|
|
0xff,
|
|
|
|
0xff,
|
|
|
|
0xff,
|
|
|
|
0x1f,
|
|
|
|
0xff,
|
|
|
|
0xff,
|
|
|
|
0xff,
|
|
|
|
};
|
2020-07-14 06:16:25 +08:00
|
|
|
|
2021-04-04 23:01:43 +08:00
|
|
|
iclass_config_card_item_t iclass_config_types[14]= {
|
2021-04-08 15:34:11 +08:00
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
|
|
|
{"", ""},
|
2021-04-04 23:01:43 +08:00
|
|
|
// must be the last entry
|
2021-04-08 15:34:11 +08:00
|
|
|
{"no config card info available", ""}
|
2021-04-04 23:01:43 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
static bool check_config_card(const iclass_config_card_item_t *o) {
|
|
|
|
if (o == NULL || strlen(o->desc) == 0) {
|
|
|
|
PrintAndLogEx(INFO, "No data available");
|
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass config -l") "` to download from cardhelper");
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int load_config_cards(void) {
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(INFO, "detecting cardhelper...");
|
|
|
|
if (IsCardHelperPresent(false) == false) {
|
|
|
|
PrintAndLogEx(FAILED, "failed to detect cardhelper");
|
2021-04-04 23:01:43 +08:00
|
|
|
return PM3_ENODATA;
|
2021-04-08 15:34:11 +08:00
|
|
|
}
|
2021-04-04 23:01:43 +08:00
|
|
|
|
|
|
|
for (int i = 0; i < ARRAYLEN(iclass_config_types); ++i) {
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(INPLACE, "loading setting %i", i);
|
2021-04-04 23:01:43 +08:00
|
|
|
iclass_config_card_item_t *ret = &iclass_config_types[i];
|
|
|
|
|
|
|
|
uint8_t desc[70] = {0};
|
|
|
|
if (GetConfigCardStrByIdx(i, desc) == PM3_SUCCESS) {
|
|
|
|
memcpy(ret->desc, desc, sizeof(desc));
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t blocks[16] = {0};
|
|
|
|
if (GetConfigCardByIdx(i, blocks) == PM3_SUCCESS) {
|
2021-04-08 15:34:11 +08:00
|
|
|
memcpy(ret->data, blocks, sizeof(blocks));
|
2021-04-04 23:01:43 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass configcard -p") "` to list all");
|
|
|
|
return PM3_SUCCESS;
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static const iclass_config_card_item_t *get_config_card_item(int idx) {
|
|
|
|
if (idx < 0 && idx > 13) {
|
|
|
|
idx = 13;
|
|
|
|
}
|
|
|
|
return &iclass_config_types[idx];
|
2021-04-04 23:01:43 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static void print_config_cards(void) {
|
|
|
|
if (check_config_card(&iclass_config_types[0])) {
|
|
|
|
PrintAndLogEx(INFO, "---- " _CYAN_("Config cards available") " ------------");
|
|
|
|
for (int i = 0; i < ARRAYLEN(iclass_config_types); ++i) {
|
|
|
|
PrintAndLogEx(INFO, "%2d, %s", i, iclass_config_types[i].desc);
|
|
|
|
}
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void print_config_card(const iclass_config_card_item_t *o) {
|
|
|
|
if (check_config_card(o)) {
|
|
|
|
PrintAndLogEx(INFO, "description... %s", o->desc);
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(INFO, "data....... " _YELLOW_("%s"), sprint_hex_inrow(o->data, sizeof(o->data)));
|
2021-04-04 23:01:43 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static int generate_config_card(const iclass_config_card_item_t *o, uint8_t *key, bool got_kr) {
|
|
|
|
if (check_config_card(o) == false) {
|
|
|
|
return PM3_EINVARG;
|
2021-04-04 23:01:43 +08:00
|
|
|
}
|
2021-04-08 15:34:11 +08:00
|
|
|
// get header from card
|
|
|
|
//bool have = memcmp(iclass_last_known_card.csn, "\x00\x00\x00\x00\x00\x00\x00\x00", 8);
|
|
|
|
PrintAndLogEx(INFO, "trying to read a card..");
|
|
|
|
int res = read_iclass_csn(false, false);
|
|
|
|
if (res != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(FAILED, "Put a card on antenna and try again...");
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
|
|
|
// generate dump file
|
|
|
|
uint8_t app1_limit = iclass_last_known_card.conf.app_limit;
|
|
|
|
uint8_t old_limit = app1_limit;
|
|
|
|
uint8_t tot_bytes = (app1_limit + 1) * 8;
|
|
|
|
|
|
|
|
// normal size
|
|
|
|
uint8_t *data = calloc(1, tot_bytes);
|
|
|
|
if (data == NULL) {
|
|
|
|
PrintAndLogEx(FAILED, "failed to allocate memory");
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
|
|
|
memset(data, 0xFF, tot_bytes);
|
|
|
|
|
|
|
|
// Keyrolling configuration cards are special.
|
|
|
|
if (strstr(o->desc, "Keyroll") != NULL) {
|
|
|
|
|
|
|
|
if (got_kr == false) {
|
|
|
|
PrintAndLogEx(ERR, "please specifiy KEYROLL key!");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (app1_limit < 0x16) {
|
|
|
|
// if card wasn't large enough before, adapt to new size
|
|
|
|
PrintAndLogEx(WARNING, "Adapting applimit1 for KEY rolling..");
|
|
|
|
|
|
|
|
app1_limit = 0x16;
|
|
|
|
iclass_last_known_card.conf.app_limit = 0x16;
|
|
|
|
tot_bytes = (app1_limit + 1) * 8;
|
|
|
|
|
|
|
|
uint8_t *p;
|
|
|
|
p = realloc(data, tot_bytes);
|
|
|
|
if (p == NULL) {
|
|
|
|
PrintAndLogEx(FAILED, "failed to allocate memory");
|
|
|
|
free(data);
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
|
|
|
data = p;
|
|
|
|
memset(data, 0xFF, tot_bytes);
|
|
|
|
}
|
|
|
|
|
|
|
|
// need to encrypt
|
|
|
|
PrintAndLogEx(INFO, "Detecting cardhelper...");
|
|
|
|
if (IsCardHelperPresent(false) == false) {
|
|
|
|
PrintAndLogEx(FAILED, "failed to detect cardhelper");
|
|
|
|
return PM3_ENODATA;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t ffs[8] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
|
|
|
|
if (Encrypt(ffs, ffs) == false) {
|
|
|
|
PrintAndLogEx(WARNING, "failed to encrypt FF");
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t enckey1[8];
|
|
|
|
if (Encrypt(key, enckey1) == false) {
|
|
|
|
PrintAndLogEx(WARNING, "failed to encrypt key1");
|
|
|
|
}
|
|
|
|
|
|
|
|
memcpy(data, &iclass_last_known_card, sizeof(picopass_hdr_t));
|
|
|
|
memcpy(data + (6 * 8), o->data, sizeof(o->data));
|
|
|
|
|
|
|
|
// encrypted keyroll key 0D
|
|
|
|
memcpy(data + (0xD * 8), enckey1, sizeof(enckey1));
|
|
|
|
// encrypted 0xFF
|
|
|
|
for (uint8_t i = 0xe; i < 0x14; i++) {
|
|
|
|
memcpy(data + (i*8), ffs, sizeof(ffs));
|
|
|
|
}
|
|
|
|
|
|
|
|
// encrypted partial keyroll key 14
|
|
|
|
uint8_t foo[8] = {0x15};
|
|
|
|
memcpy(foo + 1, key, 7);
|
|
|
|
uint8_t enckey2[8];
|
|
|
|
if (Encrypt(foo, enckey2) == false) {
|
|
|
|
PrintAndLogEx(WARNING, "failed to encrypt partial 1");
|
|
|
|
}
|
|
|
|
memcpy(data + (0x14 * 8), enckey2, sizeof(enckey2));
|
|
|
|
|
|
|
|
// encrypted partial keyroll key 15
|
|
|
|
memset(foo, 0xFF, sizeof(foo));
|
|
|
|
foo[0] = key[7];
|
|
|
|
if (Encrypt(foo, enckey2) == false) {
|
|
|
|
PrintAndLogEx(WARNING, "failed to encrypt partial 2");
|
|
|
|
}
|
|
|
|
memcpy(data + (0x15 * 8), enckey2, sizeof(enckey2));
|
|
|
|
|
|
|
|
// encrypted 0xFF
|
|
|
|
for (uint8_t i = 0x16; i <= app1_limit; i++) {
|
|
|
|
memcpy(data + (i * 8), ffs, sizeof(ffs));
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// revert potential modified app1_limit
|
|
|
|
iclass_last_known_card.conf.app_limit = old_limit;
|
|
|
|
|
|
|
|
} else {
|
|
|
|
memcpy(data, &iclass_last_known_card, sizeof(picopass_hdr_t));
|
|
|
|
memcpy(data + (6*8), o->data, sizeof(o->data));
|
|
|
|
}
|
|
|
|
|
|
|
|
// create filename
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
char *fptr = filename;
|
|
|
|
fptr += snprintf(fptr, sizeof(filename), "hf-iclass-");
|
|
|
|
FillFileNameByUID(fptr, data, "-dump", 8);
|
|
|
|
|
|
|
|
// save dump file
|
|
|
|
saveFile(filename, ".bin", data, tot_bytes);
|
|
|
|
saveFileEML(filename, data, tot_bytes, 8);
|
|
|
|
saveFileJSON(filename, jsfIclass, data, tot_bytes, NULL);
|
|
|
|
|
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass view -f %s.bin") "` to view dump file", filename);
|
|
|
|
return PM3_SUCCESS;
|
2021-04-04 23:01:43 +08:00
|
|
|
}
|
|
|
|
|
2019-08-08 22:57:33 +08:00
|
|
|
static uint8_t isset(uint8_t val, uint8_t mask) {
|
|
|
|
return (val & mask);
|
|
|
|
}
|
|
|
|
|
|
|
|
static uint8_t notset(uint8_t val, uint8_t mask) {
|
|
|
|
return !(val & mask);
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
uint8_t get_pagemap(const picopass_hdr_t *hdr) {
|
2020-07-29 17:02:30 +08:00
|
|
|
return (hdr->conf.fuses & (FUSE_CRYPT0 | FUSE_CRYPT1)) >> 3;
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static void fuse_config(const picopass_hdr_t *hdr) {
|
2020-10-18 17:50:20 +08:00
|
|
|
|
|
|
|
uint16_t otp = (hdr->conf.otp[1] << 8 | hdr->conf.otp[0]);
|
|
|
|
|
2020-10-20 07:00:23 +08:00
|
|
|
PrintAndLogEx(INFO, " Raw: " _YELLOW_("%s"), sprint_hex((uint8_t *)&hdr->conf, 8));
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " " _YELLOW_("%02X") "..................... app limit", hdr->conf.app_limit);
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, " " _YELLOW_("%04X") " ( %5u )...... OTP", otp, otp);
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " " _YELLOW_("%02X") "............ block write lock", hdr->conf.block_writelock);
|
|
|
|
PrintAndLogEx(INFO, " " _YELLOW_("%02X") "......... chip", hdr->conf.chip_config);
|
|
|
|
PrintAndLogEx(INFO, " " _YELLOW_("%02X") "...... mem", hdr->conf.mem_config);
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, " " _YELLOW_("%02X") "... EAS", hdr->conf.eas);
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " " _YELLOW_("%02X") " fuses", hdr->conf.fuses);
|
2020-10-18 17:50:20 +08:00
|
|
|
|
2019-08-08 22:57:33 +08:00
|
|
|
uint8_t fuses = hdr->conf.fuses;
|
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, " Fuses:");
|
2019-08-08 22:57:33 +08:00
|
|
|
if (isset(fuses, FUSE_FPERS))
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " mode......... " _GREEN_("Personalization (programmable)"));
|
2019-08-08 22:57:33 +08:00
|
|
|
else
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " mode......... " _YELLOW_("Application (locked)"));
|
2019-08-08 22:57:33 +08:00
|
|
|
|
|
|
|
if (isset(fuses, FUSE_CODING1)) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " coding...... RFU");
|
2019-08-08 22:57:33 +08:00
|
|
|
} else {
|
|
|
|
if (isset(fuses, FUSE_CODING0))
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " coding....... " _YELLOW_("ISO 14443-2 B / 15693"));
|
2019-08-08 22:57:33 +08:00
|
|
|
else
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " coding....... " _YELLOW_("ISO 14443-B only"));
|
2019-08-08 22:57:33 +08:00
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint8_t pagemap = get_pagemap(hdr);
|
|
|
|
switch (pagemap) {
|
|
|
|
case 0x0:
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " crypt........ No auth possible. Read only if RA is enabled");
|
2020-07-29 17:02:30 +08:00
|
|
|
break;
|
|
|
|
case 0x1:
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " crypt........ Non secured page");
|
2020-07-29 17:02:30 +08:00
|
|
|
break;
|
|
|
|
case 0x2:
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " crypt........ Secured page, keys locked");
|
2020-07-29 17:02:30 +08:00
|
|
|
break;
|
|
|
|
case 0x03:
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " crypt........ Secured page, " _GREEN_("keys not locked"));
|
2020-07-29 17:02:30 +08:00
|
|
|
break;
|
|
|
|
}
|
2019-08-08 22:57:33 +08:00
|
|
|
|
|
|
|
if (isset(fuses, FUSE_RA))
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " RA........... Read access enabled (non-secure mode)");
|
2019-08-08 22:57:33 +08:00
|
|
|
else
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " RA........... Read access not enabled");
|
2019-08-08 22:57:33 +08:00
|
|
|
}
|
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
static void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *app_areas, uint8_t *kb) {
|
2020-08-13 18:25:04 +08:00
|
|
|
// How to determine chip type
|
2020-08-06 14:14:40 +08:00
|
|
|
|
2020-08-13 18:25:04 +08:00
|
|
|
// mem-bit 7 = 16K
|
2020-08-06 14:14:40 +08:00
|
|
|
// mem-bit 5 = Book
|
|
|
|
// mem-bit 4 = 2K
|
|
|
|
// chip-bit 4 = Multi App
|
|
|
|
|
2019-08-08 22:57:33 +08:00
|
|
|
uint8_t k16 = isset(mem_cfg, 0x80);
|
2020-08-06 14:14:40 +08:00
|
|
|
//uint8_t k2 = isset(mem_cfg, 0x10);
|
2019-08-08 22:57:33 +08:00
|
|
|
uint8_t book = isset(mem_cfg, 0x20);
|
|
|
|
|
|
|
|
if (isset(chip_cfg, 0x10) && !k16 && !book) {
|
|
|
|
*kb = 2;
|
|
|
|
*app_areas = 2;
|
|
|
|
} else if (isset(chip_cfg, 0x10) && k16 && !book) {
|
|
|
|
*kb = 16;
|
|
|
|
*app_areas = 2;
|
|
|
|
} else if (notset(chip_cfg, 0x10) && !k16 && !book) {
|
|
|
|
*kb = 16;
|
|
|
|
*app_areas = 16;
|
|
|
|
} else if (isset(chip_cfg, 0x10) && k16 && book) {
|
|
|
|
*kb = 32;
|
|
|
|
*app_areas = 3;
|
|
|
|
} else if (notset(chip_cfg, 0x10) && !k16 && book) {
|
|
|
|
*kb = 32;
|
|
|
|
*app_areas = 17;
|
|
|
|
} else {
|
|
|
|
*kb = 32;
|
|
|
|
*app_areas = 2;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static uint8_t get_mem_config(const picopass_hdr_t *hdr) {
|
2020-07-20 02:45:47 +08:00
|
|
|
// three configuration bits that decides sizes
|
2020-08-06 14:14:40 +08:00
|
|
|
uint8_t type = (hdr->conf.chip_config & 0x10) >> 2;
|
|
|
|
// 16K bit 0 == 1==
|
|
|
|
type |= (hdr->conf.mem_config & 0x80) >> 6;
|
|
|
|
// BOOK bit 0 == 1==
|
|
|
|
type |= (hdr->conf.mem_config & 0x20) >> 5;
|
|
|
|
// 2K
|
|
|
|
//type |= (hdr->conf.mem_config & 0x10) >> 5;
|
2020-07-20 02:45:47 +08:00
|
|
|
return type;
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static void mem_app_config(const picopass_hdr_t *hdr) {
|
2019-08-08 22:57:33 +08:00
|
|
|
uint8_t mem = hdr->conf.mem_config;
|
|
|
|
uint8_t chip = hdr->conf.chip_config;
|
|
|
|
uint8_t kb = 2;
|
|
|
|
uint8_t app_areas = 2;
|
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
getMemConfig(mem, chip, &app_areas, &kb);
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint8_t type = get_mem_config(hdr);
|
2020-07-20 02:45:47 +08:00
|
|
|
uint8_t app1_limit = hdr->conf.app_limit - 5; // minus header blocks
|
|
|
|
uint8_t app2_limit = card_app2_limit[type];
|
2020-07-29 17:02:30 +08:00
|
|
|
uint8_t pagemap = get_pagemap(hdr);
|
2019-08-08 22:57:33 +08:00
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, "-------------------------- " _CYAN_("Memory") " --------------------------");
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, " %u KBits ( " _YELLOW_("%u") " bytes )", kb, app2_limit * 8);
|
2020-07-29 17:02:30 +08:00
|
|
|
PrintAndLogEx(INFO, " Tag has not App Areas");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, " %u KBits/%u App Areas ( " _YELLOW_("%u") " bytes )", kb, app_areas, (app2_limit + 1) * 8);
|
2020-08-13 18:25:04 +08:00
|
|
|
PrintAndLogEx(INFO, " AA1 blocks %u { 0x06 - 0x%02X (06 - %02d) }", app1_limit, app1_limit + 5, app1_limit + 5);
|
2020-07-29 17:02:30 +08:00
|
|
|
PrintAndLogEx(INFO, " AA2 blocks %u { 0x%02X - 0x%02X (%02d - %02d) }", app2_limit - app1_limit, app1_limit + 5 + 1, app2_limit, app1_limit + 5 + 1, app2_limit);
|
2020-06-27 04:20:32 +08:00
|
|
|
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, "------------------------- " _CYAN_("KeyAccess") " ------------------------");
|
|
|
|
PrintAndLogEx(INFO, " * Kd, Debit key, AA1 Kc, Credit key, AA2 *");
|
2019-08-08 22:57:33 +08:00
|
|
|
uint8_t book = isset(mem, 0x20);
|
|
|
|
if (book) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " Read A....... debit");
|
|
|
|
PrintAndLogEx(INFO, " Read B....... credit");
|
|
|
|
PrintAndLogEx(INFO, " Write A...... debit");
|
|
|
|
PrintAndLogEx(INFO, " Write B...... credit");
|
|
|
|
PrintAndLogEx(INFO, " Debit........ debit or credit");
|
|
|
|
PrintAndLogEx(INFO, " Credit....... credit");
|
2019-08-08 22:57:33 +08:00
|
|
|
} else {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, " Read A....... debit or credit");
|
|
|
|
PrintAndLogEx(INFO, " Read B....... debit or credit");
|
|
|
|
PrintAndLogEx(INFO, " Write A...... credit");
|
|
|
|
PrintAndLogEx(INFO, " Write B...... credit");
|
|
|
|
PrintAndLogEx(INFO, " Debit........ debit or credit");
|
2020-10-23 07:24:54 +08:00
|
|
|
PrintAndLogEx(INFO, " Credit....... credit");
|
2019-08-08 22:57:33 +08:00
|
|
|
}
|
|
|
|
}
|
2020-02-27 23:35:17 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static void print_picopass_info(const picopass_hdr_t *hdr) {
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, "-------------------- " _CYAN_("card configuration") " --------------------");
|
2019-08-08 22:57:33 +08:00
|
|
|
fuse_config(hdr);
|
|
|
|
mem_app_config(hdr);
|
|
|
|
}
|
2020-11-28 20:46:16 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
static void print_picopass_header(const picopass_hdr_t *hdr) {
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, "--------------------------- " _CYAN_("card") " ---------------------------");
|
|
|
|
PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s") " uid", sprint_hex(hdr->csn, sizeof(hdr->csn)));
|
|
|
|
PrintAndLogEx(SUCCESS, " Config: %s Card configuration", sprint_hex((uint8_t *)&hdr->conf, sizeof(hdr->conf)));
|
|
|
|
PrintAndLogEx(SUCCESS, "E-purse: %s Card challenge, CC", sprint_hex(hdr->epurse, sizeof(hdr->epurse)));
|
|
|
|
PrintAndLogEx(SUCCESS, " Kd: %s Debit key, hidden", sprint_hex(hdr->key_d, sizeof(hdr->key_d)));
|
|
|
|
PrintAndLogEx(SUCCESS, " Kc: %s Credit key, hidden", sprint_hex(hdr->key_c, sizeof(hdr->key_c)));
|
|
|
|
PrintAndLogEx(SUCCESS, " AIA: %s Application Issuer area", sprint_hex(hdr->app_issuer_area, sizeof(hdr->app_issuer_area)));
|
2019-08-08 22:57:33 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassList(const char *Cmd) {
|
2020-10-10 02:46:48 +08:00
|
|
|
char args[128] = {0};
|
2020-10-10 02:19:36 +08:00
|
|
|
if (strlen(Cmd) == 0) {
|
|
|
|
snprintf(args, sizeof(args), "-t iclass");
|
2020-10-10 02:46:48 +08:00
|
|
|
} else {
|
|
|
|
strncpy(args, Cmd, sizeof(args) - 1);
|
2020-10-10 02:19:36 +08:00
|
|
|
}
|
|
|
|
return CmdTraceList(args);
|
2014-04-24 20:13:33 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassSniff(const char *Cmd) {
|
2020-07-09 06:21:26 +08:00
|
|
|
|
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass sniff",
|
|
|
|
"Sniff the communication reader and tag",
|
2020-09-30 14:39:08 +08:00
|
|
|
"hf iclass sniff\n"
|
|
|
|
"hf iclass sniff -j -> jam e-purse updates\n"
|
2020-08-13 18:25:04 +08:00
|
|
|
);
|
|
|
|
|
|
|
|
void *argtable[] = {
|
2020-07-09 06:21:26 +08:00
|
|
|
arg_param_begin,
|
|
|
|
arg_lit0("j", "jam", "Jam (prevent) e-purse updates"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
2020-07-14 21:25:56 +08:00
|
|
|
|
2020-08-13 18:25:04 +08:00
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
2020-07-09 06:21:26 +08:00
|
|
|
bool jam_epurse_update = arg_get_lit(ctx, 1);
|
2020-07-14 21:25:56 +08:00
|
|
|
CLIParserFree(ctx);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-09 06:21:26 +08:00
|
|
|
const uint8_t update_epurse_sequence[2] = {0x87, 0x02};
|
|
|
|
|
|
|
|
struct {
|
|
|
|
uint8_t jam_search_len;
|
|
|
|
uint8_t jam_search_string[2];
|
|
|
|
} PACKED payload;
|
|
|
|
|
2020-08-13 18:25:04 +08:00
|
|
|
if (jam_epurse_update) {
|
2020-07-09 06:21:26 +08:00
|
|
|
payload.jam_search_len = sizeof(update_epurse_sequence);
|
|
|
|
memcpy(payload.jam_search_string, update_epurse_sequence, sizeof(payload.jam_search_string));
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
PacketResponseNG resp;
|
|
|
|
clearCommandBuffer();
|
2020-07-09 06:21:26 +08:00
|
|
|
SendCommandNG(CMD_HF_ICLASS_SNIFF, (uint8_t *)&payload, sizeof(payload));
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
WaitForResponse(CMD_HF_ICLASS_SNIFF, &resp);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-08-14 20:55:07 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass list") "` to view captured tracelog");
|
2020-12-05 20:27:39 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("trace save -f hf_iclass_mytrace") "` to save tracelog for later analysing");
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2011-05-18 20:33:32 +08:00
|
|
|
}
|
2015-10-08 05:00:46 +08:00
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassSim(const char *Cmd) {
|
2020-11-28 10:22:23 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass sim",
|
|
|
|
"Simulate a iCLASS legacy/standard tag",
|
|
|
|
"hf iclass sim -t 0 --csn 031FEC8AF7FF12E0 -> simulate with specficied CSN\n"
|
|
|
|
"hf iclass sim -t 1 -> simulate with default CSN\n"
|
|
|
|
"hf iclass sim -t 2 -> execute loclass attack online part\n"
|
|
|
|
"hf iclass eload -f hf-iclass-AA162D30F8FF12F1-dump.bin -> simulate full iCLASS 2k tag\n"
|
|
|
|
"hf iclass sim -t 3 -> simulate full iCLASS 2k tag\n"
|
|
|
|
"hf iclass sim -t 4 -> Reader-attack, adapted for KeyRoll mode, gather reader responses to extract elite key");
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_int1("t", "type", "<0-4> ", "Simulation type to use"),
|
|
|
|
arg_str0(NULL, "csn", "<hex>", "Specify CSN as 8 hex bytes to use with sim type 0"),
|
2020-11-28 10:22:23 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
2015-02-15 04:17:08 +08:00
|
|
|
|
2020-11-28 10:22:23 +08:00
|
|
|
int sim_type = arg_get_int(ctx, 1);
|
2016-01-20 02:31:34 +08:00
|
|
|
|
2020-11-28 10:22:23 +08:00
|
|
|
int csn_len = 0;
|
|
|
|
uint8_t csn[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 2, csn, &csn_len);
|
2017-08-19 15:49:41 +08:00
|
|
|
|
2020-11-28 10:22:23 +08:00
|
|
|
if (sim_type == 0 && csn_len > 0) {
|
|
|
|
if (csn_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "CSN is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-11-28 10:22:23 +08:00
|
|
|
PrintAndLogEx(INFO, " simtype: %02x CSN: %s", sim_type, sprint_hex(csn, 8));
|
|
|
|
} else if (sim_type == 0 && csn_len == 0) {
|
|
|
|
PrintAndLogEx(ERR, "Simtype 0 requires CSN argument (--csn)");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2016-01-20 02:31:34 +08:00
|
|
|
|
2020-11-28 10:22:23 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
2020-07-04 03:33:17 +08:00
|
|
|
if (sim_type > 4) {
|
|
|
|
PrintAndLogEx(ERR, "Undefined simtype %d", sim_type);
|
2020-11-28 10:22:23 +08:00
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2012-06-28 21:38:40 +08:00
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
// remember to change the define NUM_CSNS to match.
|
|
|
|
|
|
|
|
// pre-defined 9 CSN by iceman
|
2019-03-10 07:00:59 +08:00
|
|
|
uint8_t csns[8 * NUM_CSNS] = {
|
|
|
|
0x01, 0x0A, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0x0C, 0x06, 0x0C, 0xFE, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0x10, 0x97, 0x83, 0x7B, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0x13, 0x97, 0x82, 0x7A, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0x07, 0x0E, 0x0D, 0xF9, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0x14, 0x96, 0x84, 0x76, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0x17, 0x96, 0x85, 0x71, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0xCE, 0xC5, 0x0F, 0x77, 0xF7, 0xFF, 0x12, 0xE0,
|
|
|
|
0xD2, 0x5A, 0x82, 0xF8, 0xF7, 0xFF, 0x12, 0xE0
|
|
|
|
//0x04, 0x08, 0x9F, 0x78, 0x6E, 0xFF, 0x12, 0xE0
|
|
|
|
};
|
|
|
|
|
|
|
|
/* DUMPFILE FORMAT:
|
|
|
|
*
|
|
|
|
* <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
|
|
|
|
* So, it should wind up as
|
|
|
|
* 8 * 24 bytes.
|
|
|
|
*
|
|
|
|
* The returndata from the pm3 is on the following format
|
|
|
|
* <4 byte NR><4 byte MAC>
|
|
|
|
* CC are all zeroes, CSN is the same as was sent in
|
|
|
|
**/
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t tries = 0;
|
|
|
|
|
2020-07-04 03:33:17 +08:00
|
|
|
switch (sim_type) {
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-04 03:33:17 +08:00
|
|
|
case ICLASS_SIM_MODE_READER_ATTACK: {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(INFO, "Starting iCLASS sim 2 attack (elite mode)");
|
2020-07-04 03:33:17 +08:00
|
|
|
PrintAndLogEx(INFO, "press " _YELLOW_("`enter`") " to cancel");
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2020-07-20 06:52:46 +08:00
|
|
|
SendCommandMIX(CMD_HF_ICLASS_SIMULATE, sim_type, NUM_CSNS, 1, csns, 8 * NUM_CSNS);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-20 06:52:46 +08:00
|
|
|
while (WaitForResponseTimeout(CMD_ACK, &resp, 2000) == false) {
|
2019-03-10 06:35:06 +08:00
|
|
|
tries++;
|
2019-07-11 19:01:34 +08:00
|
|
|
if (kbd_enter_pressed()) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "\naborted via keyboard.");
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_EOPABORTED;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-03-10 07:00:59 +08:00
|
|
|
if (tries > 20) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.");
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
2019-04-18 05:44:48 +08:00
|
|
|
uint8_t num_mac = resp.oldarg[1];
|
2019-03-10 07:00:59 +08:00
|
|
|
bool success = (NUM_CSNS == num_mac);
|
2020-04-16 15:01:14 +08:00
|
|
|
PrintAndLogEx((success) ? SUCCESS : WARNING, "[%c] %d out of %d MAC obtained [%s]", (success) ? '+' : '!', num_mac, NUM_CSNS, (success) ? "OK" : "FAIL");
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (num_mac == 0)
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
|
|
|
|
size_t datalen = NUM_CSNS * 24;
|
2019-04-05 06:08:36 +08:00
|
|
|
uint8_t *dump = calloc(datalen, sizeof(uint8_t));
|
2019-03-10 07:00:59 +08:00
|
|
|
if (!dump) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "Failed to allocate memory");
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_EMALLOC;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-10-23 07:24:54 +08:00
|
|
|
memset(dump, 0, datalen);//<-- Need zeroes for the EPURSE - field (official)
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
uint8_t i = 0;
|
|
|
|
for (i = 0 ; i < NUM_CSNS ; i++) {
|
|
|
|
//copy CSN
|
2019-03-10 07:00:59 +08:00
|
|
|
memcpy(dump + i * 24, csns + i * 8, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
//copy epurse
|
2019-04-18 05:44:48 +08:00
|
|
|
memcpy(dump + i * 24 + 8, resp.data.asBytes + i * 16, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
// NR_MAC (eight bytes from the response) ( 8b csn + 8b epurse == 16)
|
2019-04-18 05:44:48 +08:00
|
|
|
memcpy(dump + i * 24 + 16, resp.data.asBytes + i * 16 + 8, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
/** Now, save to dumpfile **/
|
2019-04-29 02:42:57 +08:00
|
|
|
saveFile("iclass_mac_attack", ".bin", dump, datalen);
|
2019-03-10 06:35:06 +08:00
|
|
|
free(dump);
|
2020-07-21 20:09:05 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass loclass -f iclass_mac_attack.bin") "` to recover elite key");
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
2020-07-04 03:33:17 +08:00
|
|
|
case ICLASS_SIM_MODE_READER_ATTACK_KEYROLL: {
|
2019-03-10 06:35:06 +08:00
|
|
|
// reader in key roll mode, when it has two keys it alternates when trying to verify.
|
|
|
|
PrintAndLogEx(INFO, "Starting iCLASS sim 4 attack (elite mode, reader in key roll mode)");
|
2019-07-11 19:01:34 +08:00
|
|
|
PrintAndLogEx(INFO, "press Enter to cancel");
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2020-07-20 06:52:46 +08:00
|
|
|
SendCommandMIX(CMD_HF_ICLASS_SIMULATE, sim_type, NUM_CSNS, 1, csns, 8 * NUM_CSNS);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-20 06:52:46 +08:00
|
|
|
while (WaitForResponseTimeout(CMD_ACK, &resp, 2000) == false) {
|
2019-03-10 06:35:06 +08:00
|
|
|
tries++;
|
2019-07-11 19:01:34 +08:00
|
|
|
if (kbd_enter_pressed()) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "\naborted via keyboard.");
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_EOPABORTED;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-03-10 07:00:59 +08:00
|
|
|
if (tries > 20) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.");
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
2019-04-18 05:44:48 +08:00
|
|
|
uint8_t num_mac = resp.oldarg[1];
|
2019-03-10 07:00:59 +08:00
|
|
|
bool success = ((NUM_CSNS * 2) == num_mac);
|
2020-04-03 13:22:54 +08:00
|
|
|
PrintAndLogEx((success) ? SUCCESS : WARNING, "[%c] %d out of %d MAC obtained [%s]", (success) ? '+' : '!', num_mac, NUM_CSNS * 2, (success) ? "OK" : "FAIL");
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (num_mac == 0)
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
|
|
|
|
size_t datalen = NUM_CSNS * 24;
|
2019-04-05 06:08:36 +08:00
|
|
|
uint8_t *dump = calloc(datalen, sizeof(uint8_t));
|
2019-03-10 07:00:59 +08:00
|
|
|
if (!dump) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "Failed to allocate memory");
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_EMALLOC;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
#define MAC_ITEM_SIZE 24
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
//KEYROLL 1
|
|
|
|
//Need zeroes for the CC-field
|
|
|
|
memset(dump, 0, datalen);
|
|
|
|
for (uint8_t i = 0; i < NUM_CSNS ; i++) {
|
|
|
|
// copy CSN
|
2019-03-10 07:00:59 +08:00
|
|
|
memcpy(dump + i * MAC_ITEM_SIZE, csns + i * 8, 8); //CSN
|
2019-03-10 06:35:06 +08:00
|
|
|
// copy EPURSE
|
2019-04-18 05:44:48 +08:00
|
|
|
memcpy(dump + i * MAC_ITEM_SIZE + 8, resp.data.asBytes + i * 16, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
// copy NR_MAC (eight bytes from the response) ( 8b csn + 8b epurse == 16)
|
2019-04-18 05:44:48 +08:00
|
|
|
memcpy(dump + i * MAC_ITEM_SIZE + 16, resp.data.asBytes + i * 16 + 8, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-04-29 02:42:57 +08:00
|
|
|
saveFile("iclass_mac_attack_keyroll_A", ".bin", dump, datalen);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
//KEYROLL 2
|
|
|
|
memset(dump, 0, datalen);
|
|
|
|
for (uint8_t i = 0; i < NUM_CSNS; i++) {
|
2019-06-08 00:41:39 +08:00
|
|
|
uint8_t resp_index = (i + NUM_CSNS) * 16;
|
2019-03-10 06:35:06 +08:00
|
|
|
// Copy CSN
|
2019-03-10 07:00:59 +08:00
|
|
|
memcpy(dump + i * MAC_ITEM_SIZE, csns + i * 8, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
// copy EPURSE
|
2019-04-18 05:44:48 +08:00
|
|
|
memcpy(dump + i * MAC_ITEM_SIZE + 8, resp.data.asBytes + resp_index, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
// copy NR_MAC (eight bytes from the response) ( 8b csn + 8 epurse == 16)
|
2019-04-18 05:44:48 +08:00
|
|
|
memcpy(dump + i * MAC_ITEM_SIZE + 16, resp.data.asBytes + resp_index + 8, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
resp_index++;
|
|
|
|
}
|
2019-04-29 02:42:57 +08:00
|
|
|
saveFile("iclass_mac_attack_keyroll_B", ".bin", dump, datalen);
|
2019-03-10 06:35:06 +08:00
|
|
|
free(dump);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass loclass -f iclass_mac_attack_keyroll_A.bin") "` to recover elite key");
|
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass loclass -f iclass_mac_attack_keyroll_B.bin") "` to recover elite key");
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
2020-07-04 03:33:17 +08:00
|
|
|
case ICLASS_SIM_MODE_CSN:
|
|
|
|
case ICLASS_SIM_MODE_CSN_DEFAULT:
|
|
|
|
case ICLASS_SIM_MODE_FULL:
|
2019-03-10 06:35:06 +08:00
|
|
|
default: {
|
2020-10-17 22:36:58 +08:00
|
|
|
PrintAndLogEx(INFO, "Starting iCLASS simulation");
|
2020-11-28 10:22:23 +08:00
|
|
|
PrintAndLogEx(INFO, "press " _YELLOW_("`button`") " to cancel");
|
2019-06-08 00:41:39 +08:00
|
|
|
uint8_t numberOfCSNs = 0;
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2020-11-28 10:22:23 +08:00
|
|
|
SendCommandMIX(CMD_HF_ICLASS_SIMULATE, sim_type, numberOfCSNs, 1, csn, 8);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-21 20:09:05 +08:00
|
|
|
if (sim_type == ICLASS_SIM_MODE_FULL)
|
2020-11-23 08:33:11 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass esave -h") "` to save the emulator memory to file");
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2012-06-28 21:38:40 +08:00
|
|
|
}
|
|
|
|
|
2019-09-08 23:37:14 +08:00
|
|
|
static int CmdHFiClassInfo(const char *Cmd) {
|
2020-12-02 05:03:09 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass info",
|
|
|
|
"Act as a iCLASS reader. Reads / fingerprints a iCLASS tag.",
|
|
|
|
"hf iclass info");
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
|
|
|
CLIParserFree(ctx);
|
2020-07-29 17:02:30 +08:00
|
|
|
return info_iclass();
|
|
|
|
}
|
|
|
|
|
|
|
|
int read_iclass_csn(bool loop, bool verbose) {
|
|
|
|
|
|
|
|
uint32_t flags = (FLAG_ICLASS_READER_INIT | FLAG_ICLASS_READER_CLEARTRACE);
|
|
|
|
int res = PM3_SUCCESS;
|
|
|
|
|
2020-12-02 22:24:11 +08:00
|
|
|
do {
|
2020-07-29 17:02:30 +08:00
|
|
|
clearCommandBuffer();
|
|
|
|
SendCommandMIX(CMD_HF_ICLASS_READER, flags, 0, 0, NULL, 0);
|
|
|
|
PacketResponseNG resp;
|
|
|
|
if (WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
|
|
|
|
|
|
|
|
uint8_t status = resp.oldarg[0] & 0xff;
|
|
|
|
|
2020-12-02 22:24:11 +08:00
|
|
|
if (loop) {
|
|
|
|
if (status == 0xFF) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (status == 0 || status == 0xFF) {
|
|
|
|
if (verbose) PrintAndLogEx(WARNING, "iCLASS / ISO15693 card select failed");
|
|
|
|
res = PM3_EOPABORTED;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
picopass_hdr_t *card = calloc(1, sizeof(picopass_hdr_t));
|
|
|
|
if (card) {
|
|
|
|
memcpy(card, (picopass_hdr_t *)resp.data.asBytes, sizeof(picopass_hdr_t));
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(SUCCESS, "iCLASS / Picopass CSN: " _GREEN_("%s"), sprint_hex(card->csn, sizeof(card->csn)));
|
|
|
|
iclass_set_last_known_card(card);
|
|
|
|
free(card);
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(FAILED, "failed to allocate memory");
|
|
|
|
}
|
2020-07-29 17:02:30 +08:00
|
|
|
}
|
2020-12-02 22:24:11 +08:00
|
|
|
} while (loop && kbd_enter_pressed() == false);
|
2020-07-29 17:02:30 +08:00
|
|
|
|
2020-08-13 18:25:04 +08:00
|
|
|
DropField();
|
2020-07-29 17:02:30 +08:00
|
|
|
return res;
|
2019-09-08 23:37:14 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassReader(const char *Cmd) {
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-10-18 06:15:09 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass reader",
|
2020-12-02 22:24:11 +08:00
|
|
|
"Act as a iCLASS reader. Look for iCLASS tags until Enter or the pm3 button is pressed",
|
|
|
|
"hf iclass reader -@ -> continuous reader mode"
|
2020-12-12 21:46:40 +08:00
|
|
|
);
|
2020-10-18 06:15:09 +08:00
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-12-02 22:24:11 +08:00
|
|
|
arg_lit0("@", NULL, "optional - continuous reader mode"),
|
2020-10-18 06:15:09 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
2020-12-02 22:24:11 +08:00
|
|
|
bool cm = arg_get_lit(ctx, 1);
|
2020-10-18 06:15:09 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
2020-12-02 22:24:11 +08:00
|
|
|
if (cm) {
|
|
|
|
PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
|
|
|
|
}
|
|
|
|
|
|
|
|
return read_iclass_csn(cm, true);
|
2014-04-15 18:47:01 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassELoad(const char *Cmd) {
|
2020-11-02 09:10:13 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass eload",
|
|
|
|
"Loads iCLASS tag dump into emulator memory on device",
|
|
|
|
"hf iclass eload -f hf-iclass-AA162D30F8FF12F1-dump.bin\n");
|
2015-02-15 04:15:53 +08:00
|
|
|
|
2020-11-02 09:10:13 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str1("f", "file", "<filename>", "filename of dump"),
|
2020-11-02 09:15:32 +08:00
|
|
|
arg_lit0(NULL, "json", "load JSON type dump"),
|
|
|
|
arg_lit0(NULL, "eml", "load EML type dump"),
|
2020-11-02 09:10:13 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
2019-08-29 13:47:17 +08:00
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
2020-11-02 09:10:13 +08:00
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
2020-11-03 00:25:09 +08:00
|
|
|
if (strlen(filename) == 0) {
|
|
|
|
PrintAndLogEx(ERR, "Error: Please specify a filename");
|
2020-11-03 01:28:15 +08:00
|
|
|
CLIParserFree(ctx);
|
2020-11-03 00:25:09 +08:00
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-03 00:25:09 +08:00
|
|
|
DumpFileType_t dftype = BIN;
|
2020-11-07 08:32:43 +08:00
|
|
|
|
2020-11-03 00:25:09 +08:00
|
|
|
bool use_json = arg_get_lit(ctx, 2);
|
|
|
|
bool use_eml = arg_get_lit(ctx, 3);
|
|
|
|
CLIParserFree(ctx);
|
2020-11-07 08:32:43 +08:00
|
|
|
|
2020-11-03 00:25:09 +08:00
|
|
|
if (use_json && use_eml) {
|
|
|
|
PrintAndLogEx(ERR, "Error: can't specify both JSON & EML");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2020-11-07 08:32:43 +08:00
|
|
|
|
2020-11-03 00:25:09 +08:00
|
|
|
if (use_json) {
|
2020-11-02 09:10:13 +08:00
|
|
|
dftype = JSON;
|
2020-11-03 00:25:09 +08:00
|
|
|
} else if (use_eml) {
|
2020-11-02 09:10:13 +08:00
|
|
|
dftype = EML;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-11-03 00:25:09 +08:00
|
|
|
size_t bytes_read = 2048;
|
2019-08-29 13:47:17 +08:00
|
|
|
uint8_t *dump = calloc(2048, sizeof(uint8_t));
|
2019-03-10 06:35:06 +08:00
|
|
|
if (!dump) {
|
2019-08-08 22:57:33 +08:00
|
|
|
PrintAndLogEx(ERR, "error, cannot allocate memory ");
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_EMALLOC;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2019-08-29 13:47:17 +08:00
|
|
|
int res = 0;
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-08-30 16:45:52 +08:00
|
|
|
switch (dftype) {
|
2019-08-29 13:47:17 +08:00
|
|
|
case BIN: {
|
2019-08-31 21:25:36 +08:00
|
|
|
res = loadFile_safe(filename, ".bin", (void **)&dump, &bytes_read);
|
2019-08-29 13:47:17 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
case EML: {
|
2020-06-10 07:17:49 +08:00
|
|
|
res = loadFileEML_safe(filename, (void **)&dump, &bytes_read);
|
2019-08-29 13:47:17 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
case JSON: {
|
2020-06-02 05:44:41 +08:00
|
|
|
res = loadFileJSON(filename, dump, 2048, &bytes_read, NULL);
|
2019-08-29 13:47:17 +08:00
|
|
|
break;
|
|
|
|
}
|
2020-11-03 00:25:09 +08:00
|
|
|
case DICTIONARY: {
|
|
|
|
PrintAndLogEx(ERR, "Error: Only BIN/JSON/EML formats allowed");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2019-08-29 13:47:17 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-08-30 16:45:52 +08:00
|
|
|
if (res != PM3_SUCCESS) {
|
2019-03-10 06:35:06 +08:00
|
|
|
free(dump);
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_EFILE;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t *newdump = realloc(dump, bytes_read);
|
|
|
|
if (newdump == NULL) {
|
|
|
|
free(dump);
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
} else {
|
|
|
|
dump = newdump;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-04-30 18:14:46 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
print_picopass_header((picopass_hdr_t *) dump);
|
|
|
|
print_picopass_info((picopass_hdr_t *) dump);
|
2019-08-29 13:47:17 +08:00
|
|
|
|
2019-04-30 18:14:46 +08:00
|
|
|
// fast push mode
|
2019-04-30 20:19:26 +08:00
|
|
|
conn.block_after_ACK = true;
|
2019-05-01 07:38:52 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
//Send to device
|
|
|
|
uint32_t bytes_sent = 0;
|
|
|
|
uint32_t bytes_remaining = bytes_read;
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
while (bytes_remaining > 0) {
|
2019-05-01 03:10:11 +08:00
|
|
|
uint32_t bytes_in_packet = MIN(PM3_CMD_DATA_SIZE, bytes_remaining);
|
2019-05-09 01:16:37 +08:00
|
|
|
if (bytes_in_packet == bytes_remaining) {
|
|
|
|
// Disable fast mode on last packet
|
|
|
|
conn.block_after_ACK = false;
|
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2019-08-04 01:17:00 +08:00
|
|
|
SendCommandOLD(CMD_HF_ICLASS_EML_MEMSET, bytes_sent, bytes_in_packet, 0, dump + bytes_sent, bytes_in_packet);
|
2019-03-10 06:35:06 +08:00
|
|
|
bytes_remaining -= bytes_in_packet;
|
|
|
|
bytes_sent += bytes_in_packet;
|
|
|
|
}
|
|
|
|
free(dump);
|
2019-04-30 18:14:46 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "sent %d bytes of data to device emulator memory", bytes_sent);
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-02-15 04:15:53 +08:00
|
|
|
}
|
2020-11-28 20:46:16 +08:00
|
|
|
|
2020-07-21 20:09:05 +08:00
|
|
|
static int CmdHFiClassESave(const char *Cmd) {
|
2020-11-23 08:33:11 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass esave",
|
|
|
|
"Save emulator memory to file.\n"
|
|
|
|
"if filename is not supplied, CSN will be used.",
|
|
|
|
"hf iclass esave\n"
|
|
|
|
"hf iclass esave -f hf-iclass-dump\n"
|
|
|
|
"hf iclass esave -s 2048 -f hf-iclass-dump");
|
2020-07-21 20:09:05 +08:00
|
|
|
|
2020-11-23 08:33:11 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str0("f", "file", "<filename>", "filename of dumpfile"),
|
|
|
|
arg_int0("s", "size", "<256|2048>", "number of bytes to save (default 256)"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
2020-07-21 20:09:05 +08:00
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
2020-11-23 08:33:11 +08:00
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
2020-07-21 20:09:05 +08:00
|
|
|
char *fnameptr = filename;
|
|
|
|
|
2020-11-23 08:33:11 +08:00
|
|
|
uint16_t bytes = arg_get_int_def(ctx, 2, 256);
|
|
|
|
|
|
|
|
if (bytes > 4096) {
|
|
|
|
PrintAndLogEx(WARNING, "Emulator memory is max 4096bytes. Truncating %u to 4096", bytes);
|
|
|
|
bytes = 4096;
|
2020-07-21 20:09:05 +08:00
|
|
|
}
|
|
|
|
|
2020-11-23 08:33:11 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
2020-07-21 20:09:05 +08:00
|
|
|
uint8_t *dump = calloc(bytes, sizeof(uint8_t));
|
2020-08-30 15:55:57 +08:00
|
|
|
if (dump == NULL) {
|
2020-07-21 20:09:05 +08:00
|
|
|
PrintAndLogEx(WARNING, "Fail, cannot allocate memory");
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
|
|
|
|
|
|
|
PrintAndLogEx(INFO, "downloading from emulator memory");
|
|
|
|
if (!GetFromDevice(BIG_BUF_EML, dump, bytes, 0, NULL, 0, NULL, 2500, false)) {
|
|
|
|
PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
|
|
|
|
free(dump);
|
|
|
|
return PM3_ETIMEOUT;
|
|
|
|
}
|
|
|
|
|
|
|
|
// user supplied filename?
|
2020-11-23 08:33:11 +08:00
|
|
|
if (fnlen < 1) {
|
2020-08-29 21:22:26 +08:00
|
|
|
fnameptr += snprintf(fnameptr, sizeof(filename), "hf-iclass-");
|
2020-07-21 20:09:05 +08:00
|
|
|
FillFileNameByUID(fnameptr, dump, "-dump", 8);
|
|
|
|
}
|
|
|
|
|
|
|
|
saveFile(filename, ".bin", dump, bytes);
|
2020-07-29 17:02:30 +08:00
|
|
|
saveFileEML(filename, dump, bytes, 8);
|
2020-07-21 20:09:05 +08:00
|
|
|
saveFileJSON(filename, jsfIclass, dump, bytes, NULL);
|
|
|
|
free(dump);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass view -f %s.bin") "` to view dump file", filename);
|
2020-08-13 18:25:04 +08:00
|
|
|
return PM3_SUCCESS;
|
2020-07-21 20:09:05 +08:00
|
|
|
}
|
|
|
|
|
2020-08-30 15:55:57 +08:00
|
|
|
static int CmdHFiClassEView(const char *Cmd) {
|
2020-11-23 08:33:11 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass eview",
|
|
|
|
"Display emulator memory.\n"
|
|
|
|
"Number of bytes to download defaults to 256. Other value is 2048.",
|
|
|
|
"hf iclass eview\n"
|
|
|
|
"hf iclass eview -s 2048\n"
|
|
|
|
"hf iclass eview -s 2048 -v");
|
2020-08-30 15:55:57 +08:00
|
|
|
|
2020-11-23 08:33:11 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_int0("s", "size", "<256|2048>", "number of bytes to save (default 256)"),
|
2020-11-24 03:46:07 +08:00
|
|
|
arg_lit0("v", "verbose", "verbose output"),
|
2020-11-23 08:33:11 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
2020-08-30 15:55:57 +08:00
|
|
|
|
2020-11-23 08:33:11 +08:00
|
|
|
uint16_t blocks = 32;
|
|
|
|
uint16_t bytes = arg_get_int_def(ctx, 1, 256);
|
|
|
|
bool verbose = arg_get_lit(ctx, 2);
|
|
|
|
blocks = bytes / 8;
|
2020-08-30 15:55:57 +08:00
|
|
|
|
2020-11-23 08:33:11 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
|
|
|
if (bytes > 4096) {
|
|
|
|
PrintAndLogEx(WARNING, "Emulator memory is max 4096bytes. Truncating %u to 4096", bytes);
|
|
|
|
bytes = 4096;
|
2020-08-30 15:55:57 +08:00
|
|
|
}
|
|
|
|
|
2020-11-23 08:33:11 +08:00
|
|
|
if (bytes % 8 != 0) {
|
|
|
|
bytes &= 0xFFF8;
|
|
|
|
PrintAndLogEx(WARNING, "Number not divided by 8, truncating to %u", bytes);
|
2020-08-30 15:55:57 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t *dump = calloc(bytes, sizeof(uint8_t));
|
|
|
|
if (dump == NULL) {
|
|
|
|
PrintAndLogEx(WARNING, "Fail, cannot allocate memory");
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
|
|
|
memset(dump, 0, bytes);
|
|
|
|
|
|
|
|
PrintAndLogEx(INFO, "downloading from emulator memory");
|
|
|
|
if (!GetFromDevice(BIG_BUF_EML, dump, bytes, 0, NULL, 0, NULL, 2500, false)) {
|
|
|
|
PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
|
|
|
|
free(dump);
|
|
|
|
return PM3_ETIMEOUT;
|
|
|
|
}
|
2020-09-07 16:35:09 +08:00
|
|
|
|
2020-08-30 15:55:57 +08:00
|
|
|
if (verbose) {
|
2021-04-08 15:34:11 +08:00
|
|
|
print_picopass_header((picopass_hdr_t *) dump);
|
|
|
|
print_picopass_info((picopass_hdr_t *) dump);
|
2020-08-30 15:55:57 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
printIclassDumpContents(dump, 1, blocks, bytes);
|
|
|
|
free(dump);
|
|
|
|
return PM3_SUCCESS;
|
|
|
|
}
|
2020-11-28 20:46:16 +08:00
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassDecrypt(const char *Cmd) {
|
2020-11-24 03:46:07 +08:00
|
|
|
CLIParserContext *clictx;
|
|
|
|
CLIParserInit(&clictx, "hf iclass decrypt",
|
|
|
|
"3DES decrypt data\n"
|
2020-11-24 05:07:03 +08:00
|
|
|
"This is a naive implementation, it tries to decrypt every block after block 6.\n"
|
2020-11-24 03:46:07 +08:00
|
|
|
"Correct behaviour would be to decrypt only the application areas where the key is valid,\n"
|
|
|
|
"which is defined by the configuration block.\n"
|
|
|
|
"OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside\n"
|
|
|
|
"in the resources directory. The file should be 16 bytes binary data",
|
|
|
|
"hf iclass decrypt -f hf-iclass-AA162D30F8FF12F1-dump.bin\n"
|
2020-11-24 05:07:03 +08:00
|
|
|
"hf iclass decrypt -f hf-iclass-AA162D30F8FF12F1-dump.bin -k 000102030405060708090a0b0c0d0e0f\n"
|
|
|
|
"hf iclass decrypt -d 1122334455667788 -k 000102030405060708090a0b0c0d0e0f");
|
2019-08-30 16:45:52 +08:00
|
|
|
|
2020-11-24 03:46:07 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str0("f", "file", "<filename>", "filename of dumpfile"),
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_str0("d", "data", "<hex>", "3DES encrypted data"),
|
|
|
|
arg_str0("k", "key", "<hex>", "3DES transport key"),
|
2020-11-24 03:46:07 +08:00
|
|
|
arg_lit0("v", "verbose", "verbose output"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(clictx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
CLIParamStrToBuf(arg_get_str(clictx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
|
|
|
size_t decryptedlen = 0;
|
|
|
|
uint8_t *decrypted = NULL;
|
2019-09-06 04:39:30 +08:00
|
|
|
bool have_file = false;
|
2019-08-30 16:45:52 +08:00
|
|
|
|
2020-11-24 03:46:07 +08:00
|
|
|
if (fnlen > 0) {
|
|
|
|
if (loadFile_safe(filename, "", (void **)&decrypted, &decryptedlen) != PM3_SUCCESS) {
|
|
|
|
CLIParserFree(clictx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
have_file = true;
|
|
|
|
}
|
|
|
|
|
|
|
|
int enc_data_len = 0;
|
2019-09-06 04:39:30 +08:00
|
|
|
uint8_t enc_data[8] = {0};
|
2020-11-24 03:46:07 +08:00
|
|
|
bool have_data = false;
|
2019-09-13 22:31:17 +08:00
|
|
|
|
2020-11-24 03:46:07 +08:00
|
|
|
CLIGetHexWithReturn(clictx, 2, enc_data, &enc_data_len);
|
|
|
|
|
|
|
|
if (enc_data_len > 0) {
|
|
|
|
if (enc_data_len != 8) {
|
2020-12-05 20:27:39 +08:00
|
|
|
PrintAndLogEx(ERR, "Data must be 8 hex bytes (16 HEX symbols)");
|
2020-11-24 03:46:07 +08:00
|
|
|
CLIParserFree(clictx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
have_data = true;
|
|
|
|
}
|
|
|
|
|
|
|
|
int key_len = 0;
|
2020-11-24 04:42:32 +08:00
|
|
|
uint8_t key[16] = {0};
|
2019-08-29 20:17:39 +08:00
|
|
|
uint8_t *keyptr = NULL;
|
2020-11-24 03:46:07 +08:00
|
|
|
bool have_key = false;
|
2019-08-30 16:45:52 +08:00
|
|
|
|
2020-11-24 03:46:07 +08:00
|
|
|
CLIGetHexWithReturn(clictx, 3, key, &key_len);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-24 03:46:07 +08:00
|
|
|
if (key_len > 0) {
|
|
|
|
if (key_len != 16) {
|
2020-12-05 20:27:39 +08:00
|
|
|
PrintAndLogEx(ERR, "Transport key must be 16 hex bytes (32 HEX characters)");
|
2020-11-24 03:46:07 +08:00
|
|
|
CLIParserFree(clictx);
|
|
|
|
return PM3_EINVARG;
|
2019-08-29 20:17:39 +08:00
|
|
|
}
|
2020-11-24 03:46:07 +08:00
|
|
|
have_key = true;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-11-24 03:46:07 +08:00
|
|
|
bool verbose = arg_get_lit(clictx, 4);
|
|
|
|
CLIParserFree(clictx);
|
|
|
|
|
|
|
|
uint8_t dec_data[8] = {0};
|
2021-02-21 18:04:15 +08:00
|
|
|
bool use_sc = false;
|
|
|
|
if (have_key == false) {
|
2021-04-04 23:01:43 +08:00
|
|
|
use_sc = IsCardHelperPresent(verbose);
|
2021-02-21 18:04:15 +08:00
|
|
|
if (use_sc == false) {
|
|
|
|
size_t keylen = 0;
|
|
|
|
int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&keyptr, &keylen);
|
|
|
|
if (res != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(INFO, "Couldn't find any decryption methods");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (keylen != 16) {
|
|
|
|
PrintAndLogEx(ERR, "Failed to load transport key from file");
|
2021-02-24 01:23:53 +08:00
|
|
|
free(keyptr);
|
2021-02-21 18:04:15 +08:00
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
memcpy(key, keyptr, sizeof(key));
|
|
|
|
free(keyptr);
|
2020-02-27 23:35:17 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// tripledes
|
|
|
|
mbedtls_des3_context ctx;
|
2019-03-10 07:00:59 +08:00
|
|
|
mbedtls_des3_set2key_dec(&ctx, key);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-09-13 22:31:17 +08:00
|
|
|
if (have_data) {
|
2020-02-27 23:35:17 +08:00
|
|
|
|
|
|
|
if (use_sc) {
|
|
|
|
Decrypt(enc_data, dec_data);
|
|
|
|
} else {
|
|
|
|
mbedtls_des3_crypt_ecb(&ctx, enc_data, dec_data);
|
|
|
|
}
|
2019-09-06 04:39:30 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Data: %s", sprint_hex(dec_data, sizeof(dec_data)));
|
2019-09-06 15:00:01 +08:00
|
|
|
}
|
2019-09-06 04:39:30 +08:00
|
|
|
|
2019-09-13 22:31:17 +08:00
|
|
|
if (have_file) {
|
2020-07-20 02:45:47 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
picopass_hdr_t *hdr = (picopass_hdr_t *)decrypted;
|
2019-09-06 04:39:30 +08:00
|
|
|
|
|
|
|
uint8_t mem = hdr->conf.mem_config;
|
|
|
|
uint8_t chip = hdr->conf.chip_config;
|
|
|
|
uint8_t applimit = hdr->conf.app_limit;
|
|
|
|
uint8_t kb = 2;
|
|
|
|
uint8_t app_areas = 2;
|
2020-07-20 02:45:47 +08:00
|
|
|
getMemConfig(mem, chip, &app_areas, &kb);
|
2020-03-11 00:10:05 +08:00
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
BLOCK79ENCRYPTION aa1_encryption = (decrypted[(6 * 8) + 7] & 0x03);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-03-12 00:08:03 +08:00
|
|
|
uint32_t limit = MIN(applimit, decryptedlen / 8);
|
|
|
|
|
|
|
|
if (decryptedlen / 8 != applimit) {
|
2020-04-22 08:22:55 +08:00
|
|
|
PrintAndLogEx(WARNING, "Actual file len " _YELLOW_("%zu") " vs HID app-limit len " _YELLOW_("%u"), decryptedlen, applimit * 8);
|
2020-03-12 00:08:03 +08:00
|
|
|
PrintAndLogEx(INFO, "Setting limit to " _GREEN_("%u"), limit * 8);
|
|
|
|
}
|
2020-07-20 02:45:47 +08:00
|
|
|
|
|
|
|
//uint8_t numblocks4userid = GetNumberBlocksForUserId(decrypted + (6 * 8));
|
2020-03-12 00:08:03 +08:00
|
|
|
|
|
|
|
for (uint16_t blocknum = 0; blocknum < limit; ++blocknum) {
|
2019-09-06 04:39:30 +08:00
|
|
|
|
|
|
|
uint8_t idx = blocknum * 8;
|
|
|
|
memcpy(enc_data, decrypted + idx, 8);
|
|
|
|
|
2020-03-12 04:00:19 +08:00
|
|
|
if (aa1_encryption == RFU || aa1_encryption == None)
|
|
|
|
continue;
|
2020-04-16 15:01:14 +08:00
|
|
|
|
2020-03-12 04:00:19 +08:00
|
|
|
// Decrypted block 7,8,9 if configured.
|
2020-07-20 02:45:47 +08:00
|
|
|
if (blocknum > 6 && blocknum <= 9 && memcmp(enc_data, empty, 8) != 0) {
|
2020-02-27 23:35:17 +08:00
|
|
|
if (use_sc) {
|
|
|
|
Decrypt(enc_data, decrypted + idx);
|
|
|
|
} else {
|
|
|
|
mbedtls_des3_crypt_ecb(&ctx, enc_data, decrypted + idx);
|
|
|
|
}
|
2019-09-06 04:39:30 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
// use the first block (CSN) for filename
|
2020-03-12 00:08:03 +08:00
|
|
|
char *fptr = calloc(50, sizeof(uint8_t));
|
2020-07-20 02:45:47 +08:00
|
|
|
if (fptr == false) {
|
2020-03-12 00:08:03 +08:00
|
|
|
PrintAndLogEx(WARNING, "Failed to allocate memory");
|
|
|
|
free(decrypted);
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
2020-07-20 02:45:47 +08:00
|
|
|
|
2019-09-06 04:39:30 +08:00
|
|
|
strcat(fptr, "hf-iclass-");
|
2020-03-22 03:58:20 +08:00
|
|
|
FillFileNameByUID(fptr, hdr->csn, "-dump-decrypted", sizeof(hdr->csn));
|
2019-08-30 16:45:52 +08:00
|
|
|
|
2019-09-06 04:39:30 +08:00
|
|
|
saveFile(fptr, ".bin", decrypted, decryptedlen);
|
|
|
|
saveFileEML(fptr, decrypted, decryptedlen, 8);
|
2020-06-02 05:44:41 +08:00
|
|
|
saveFileJSON(fptr, jsfIclass, decrypted, decryptedlen, NULL);
|
2019-08-29 20:17:39 +08:00
|
|
|
|
2019-09-06 04:39:30 +08:00
|
|
|
printIclassDumpContents(decrypted, 1, (decryptedlen / 8), decryptedlen);
|
2020-03-11 00:10:05 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
// decode block 6
|
2020-03-11 00:10:05 +08:00
|
|
|
if (memcmp(decrypted + (8 * 6), empty, 8) != 0) {
|
2020-02-27 23:35:17 +08:00
|
|
|
if (use_sc) {
|
2020-03-11 00:10:05 +08:00
|
|
|
DecodeBlock6(decrypted + (8 * 6));
|
2020-02-27 23:35:17 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-03-11 00:10:05 +08:00
|
|
|
// decode block 7-8-9
|
|
|
|
if (memcmp(decrypted + (8 * 7), empty, 8) != 0) {
|
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
//todo: remove preamble/sentinal
|
|
|
|
|
|
|
|
uint32_t top = 0, mid, bot;
|
2020-03-11 00:10:05 +08:00
|
|
|
mid = bytes_to_num(decrypted + (8 * 7), 4);
|
|
|
|
bot = bytes_to_num(decrypted + (8 * 7) + 4, 4);
|
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
PrintAndLogEx(INFO, "Block 7 decoder");
|
2020-02-27 23:35:17 +08:00
|
|
|
|
2021-04-04 23:01:43 +08:00
|
|
|
char hexstr[16 + 1] = {0};
|
2020-03-11 00:10:05 +08:00
|
|
|
hex_to_buffer((uint8_t *)hexstr, decrypted + (8 * 7), 8, sizeof(hexstr) - 1, 0, 0, true);
|
2020-02-27 23:35:17 +08:00
|
|
|
|
2020-03-11 00:10:05 +08:00
|
|
|
char binstr[8 * 8 + 1] = {0};
|
2020-02-27 23:35:17 +08:00
|
|
|
hextobinstring(binstr, hexstr);
|
2020-03-11 00:10:05 +08:00
|
|
|
uint8_t i = 0;
|
|
|
|
while (i < strlen(binstr) && binstr[i++] == '0');
|
2020-02-27 23:35:17 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Binary..................... " _GREEN_("%s"), binstr + i);
|
2020-03-11 00:10:05 +08:00
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
PrintAndLogEx(INFO, "Wiegand decode");
|
|
|
|
wiegand_message_t packed = initialize_message_object(top, mid, bot);
|
|
|
|
HIDTryUnpack(&packed, true);
|
2020-07-20 02:45:47 +08:00
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
} else {
|
|
|
|
PrintAndLogEx(INFO, "No credential found.");
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
// decode block 9
|
|
|
|
if (memcmp(decrypted + (8 * 9), empty, 8) != 0) {
|
|
|
|
|
|
|
|
uint8_t usr_blk_len = GetNumberBlocksForUserId(decrypted + (8 * 6));
|
|
|
|
if (usr_blk_len < 3) {
|
|
|
|
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(INFO, "Block 9 decoder");
|
|
|
|
if (use_sc) {
|
2021-01-28 21:18:44 +08:00
|
|
|
uint8_t pinsize = GetPinSize(decrypted + (8 * 6));
|
2020-07-20 05:09:21 +08:00
|
|
|
if (pinsize > 0) {
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-20 05:09:21 +08:00
|
|
|
uint64_t pin = bytes_to_num(decrypted + (8 * 9), 5);
|
|
|
|
char tmp[17] = {0};
|
2020-08-29 21:22:26 +08:00
|
|
|
snprintf(tmp, sizeof(tmp), "%."PRIu64, BCD2DEC(pin));
|
2020-07-20 05:09:21 +08:00
|
|
|
PrintAndLogEx(INFO, "PIN........................ " _GREEN_("%.*s"), pinsize, tmp);
|
|
|
|
}
|
2020-07-20 02:45:47 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
PrintAndLogEx(INFO, "-----------------------------------------------------------------");
|
2020-03-11 00:10:05 +08:00
|
|
|
|
2019-09-06 04:39:30 +08:00
|
|
|
free(decrypted);
|
|
|
|
free(fptr);
|
|
|
|
}
|
2019-09-06 15:00:01 +08:00
|
|
|
|
|
|
|
mbedtls_des3_free(&ctx);
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2020-07-15 05:12:54 +08:00
|
|
|
static void iclass_encrypt_block_data(uint8_t *blk_data, uint8_t *key) {
|
2019-08-29 13:47:17 +08:00
|
|
|
uint8_t encrypted_data[16];
|
|
|
|
uint8_t *encrypted = encrypted_data;
|
2019-03-10 06:35:06 +08:00
|
|
|
mbedtls_des3_context ctx;
|
2019-03-10 07:00:59 +08:00
|
|
|
mbedtls_des3_set2key_enc(&ctx, key);
|
2019-08-29 13:47:17 +08:00
|
|
|
mbedtls_des3_crypt_ecb(&ctx, blk_data, encrypted);
|
|
|
|
memcpy(blk_data, encrypted, 8);
|
2019-09-06 15:00:01 +08:00
|
|
|
mbedtls_des3_free(&ctx);
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
2015-02-15 04:17:08 +08:00
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassEncryptBlk(const char *Cmd) {
|
2020-11-24 04:42:32 +08:00
|
|
|
CLIParserContext *clictx;
|
|
|
|
CLIParserInit(&clictx, "hf iclass encrypt",
|
|
|
|
"3DES encrypt data\n"
|
|
|
|
"OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside\n"
|
2020-12-05 20:27:39 +08:00
|
|
|
"in the resources directory. The file should be 16 hex bytes of binary data",
|
2020-11-24 04:42:32 +08:00
|
|
|
"hf iclass encrypt -d 0102030405060708\n"
|
2020-11-24 05:07:03 +08:00
|
|
|
"hf iclass encrypt -d 0102030405060708 -k 00112233445566778899AABBCCDDEEFF");
|
2020-11-24 04:42:32 +08:00
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_str1("d", "data", "<hex>", "data to encrypt"),
|
|
|
|
arg_str0("k", "key", "<hex>", "3DES transport key"),
|
2020-11-24 04:42:32 +08:00
|
|
|
arg_lit0("v", "verbose", "verbose output"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(clictx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int blk_data_len = 0;
|
2019-08-29 13:47:17 +08:00
|
|
|
uint8_t blk_data[8] = {0};
|
2020-11-24 04:42:32 +08:00
|
|
|
|
|
|
|
CLIGetHexWithReturn(clictx, 1, blk_data, &blk_data_len);
|
|
|
|
|
|
|
|
if (blk_data_len != 8) {
|
2020-12-05 20:27:39 +08:00
|
|
|
PrintAndLogEx(ERR, "Block data must be 8 hex bytes (16 HEX symbols)");
|
2020-11-24 04:42:32 +08:00
|
|
|
CLIParserFree(clictx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
int key_len = 0;
|
2019-08-29 13:47:17 +08:00
|
|
|
uint8_t key[16] = {0};
|
2019-08-29 20:17:39 +08:00
|
|
|
uint8_t *keyptr = NULL;
|
2020-11-24 04:42:32 +08:00
|
|
|
bool have_key = false;
|
|
|
|
|
|
|
|
CLIGetHexWithReturn(clictx, 2, key, &key_len);
|
|
|
|
|
|
|
|
if (key_len > 0) {
|
|
|
|
if (key_len != 16) {
|
2020-12-11 07:42:55 +08:00
|
|
|
PrintAndLogEx(ERR, "Transport key must be 16 hex bytes (32 HEX characters)");
|
2020-11-24 04:42:32 +08:00
|
|
|
CLIParserFree(clictx);
|
|
|
|
return PM3_EINVARG;
|
2019-08-29 13:47:17 +08:00
|
|
|
}
|
2020-11-24 04:42:32 +08:00
|
|
|
have_key = true;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2015-02-15 04:17:08 +08:00
|
|
|
|
2020-11-24 04:42:32 +08:00
|
|
|
bool verbose = arg_get_lit(clictx, 3);
|
|
|
|
|
|
|
|
CLIParserFree(clictx);
|
2019-08-29 13:47:17 +08:00
|
|
|
|
2021-02-21 18:04:15 +08:00
|
|
|
bool use_sc = false;
|
|
|
|
if (have_key == false) {
|
2021-04-04 23:01:43 +08:00
|
|
|
use_sc = IsCardHelperPresent(verbose);
|
2021-02-21 18:04:15 +08:00
|
|
|
if (use_sc == false) {
|
|
|
|
size_t keylen = 0;
|
|
|
|
int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&keyptr, &keylen);
|
|
|
|
if (res != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(ERR, "Failed to find any encryption methods");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2020-02-27 23:35:17 +08:00
|
|
|
|
2021-02-21 18:04:15 +08:00
|
|
|
if (keylen != 16) {
|
|
|
|
PrintAndLogEx(ERR, "Failed to load transport key from file");
|
2021-02-24 01:23:53 +08:00
|
|
|
free(keyptr);
|
2021-02-21 18:04:15 +08:00
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
memcpy(key, keyptr, sizeof(key));
|
|
|
|
free(keyptr);
|
2020-12-11 07:42:55 +08:00
|
|
|
}
|
2019-08-29 13:47:17 +08:00
|
|
|
}
|
|
|
|
|
2020-02-27 23:35:17 +08:00
|
|
|
if (use_sc) {
|
|
|
|
Encrypt(blk_data, blk_data);
|
|
|
|
} else {
|
2020-07-15 05:12:54 +08:00
|
|
|
iclass_encrypt_block_data(blk_data, key);
|
2020-02-27 23:35:17 +08:00
|
|
|
}
|
2020-05-14 23:17:47 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "encrypted block %s", sprint_hex(blk_data, 8));
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool verbose) {
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2020-07-13 18:29:31 +08:00
|
|
|
uint8_t flags = (FLAG_ICLASS_READER_INIT | FLAG_ICLASS_READER_CLEARTRACE);
|
2015-10-08 05:00:46 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2020-07-13 18:29:31 +08:00
|
|
|
PacketResponseNG resp;
|
2019-08-04 01:17:00 +08:00
|
|
|
SendCommandMIX(CMD_HF_ICLASS_READER, flags, 0, 0, NULL, 0);
|
2020-07-10 01:42:34 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_ACK, &resp, 2000) == false) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "command execute timeout");
|
|
|
|
return false;
|
|
|
|
}
|
2015-02-15 04:17:08 +08:00
|
|
|
|
2020-07-13 18:29:31 +08:00
|
|
|
uint8_t isok = resp.oldarg[0] & 0xff;
|
2015-10-08 05:00:46 +08:00
|
|
|
|
2020-07-13 18:29:31 +08:00
|
|
|
// no tag found or button pressed
|
|
|
|
if ((isok == 0) || isok == 0xFF) {
|
2020-07-10 01:42:34 +08:00
|
|
|
if (verbose) {
|
2020-07-13 18:29:31 +08:00
|
|
|
PrintAndLogEx(FAILED, "failed tag-select, aborting... (%d)", isok);
|
2020-07-10 01:42:34 +08:00
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
picopass_hdr_t *hdr = (picopass_hdr_t *)resp.data.asBytes;
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2020-07-10 01:42:34 +08:00
|
|
|
if (CSN != NULL)
|
|
|
|
memcpy(CSN, hdr->csn, 8);
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2020-07-10 01:42:34 +08:00
|
|
|
if (CCNR != NULL)
|
|
|
|
memcpy(CCNR, hdr->epurse, 8);
|
2019-09-11 22:56:08 +08:00
|
|
|
|
2020-07-10 01:42:34 +08:00
|
|
|
if (verbose) {
|
|
|
|
PrintAndLogEx(SUCCESS, "CSN %s", sprint_hex(CSN, 8));
|
|
|
|
PrintAndLogEx(SUCCESS, "epurse %s", sprint_hex(CCNR, 8));
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
return true;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2020-07-13 18:29:31 +08:00
|
|
|
static int CmdHFiClassDump(const char *Cmd) {
|
2020-11-26 03:02:52 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass dump",
|
|
|
|
"Dump all memory from a iCLASS tag",
|
|
|
|
"hf iclass dump -k 001122334455667B\n"
|
|
|
|
"hf iclass dump -k AAAAAAAAAAAAAAAA --credit 001122334455667B\n"
|
|
|
|
"hf iclass dump -k AAAAAAAAAAAAAAAA --elite\n"
|
|
|
|
"hf iclass dump --ki 0\n"
|
|
|
|
"hf iclass dump --ki 0 --ci 2");
|
2015-10-08 05:00:46 +08:00
|
|
|
|
2020-11-26 03:02:52 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str0("f", "file", "<filename>", "filename to save dump to"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0("k", "key", "<hex>", "debit key or NR/MAC for replay as 8 hex bytes"),
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_int0(NULL, "ki", "<dec>", "debit key index to select key from memory 'hf iclass managekeys'"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0(NULL, "credit", "<hex>", "credit key as 8 hex bytes"),
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_int0(NULL, "ci", "<dec>", "credit key index to select key from memory 'hf iclass managekeys'"),
|
2020-11-26 03:02:52 +08:00
|
|
|
arg_lit0(NULL, "elite", "elite computations applied to key"),
|
|
|
|
arg_lit0(NULL, "raw", "raw, the key is interpreted as raw block 3/4"),
|
|
|
|
arg_lit0(NULL, "nr", "replay of NR/MAC"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
2019-03-10 06:35:06 +08:00
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
2020-11-26 03:02:52 +08:00
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
|
|
|
int key_len = 0;
|
|
|
|
uint8_t key[8] = {0};
|
2020-11-26 07:42:22 +08:00
|
|
|
bool auth = false;
|
2020-11-26 03:02:52 +08:00
|
|
|
|
|
|
|
CLIGetHexWithReturn(ctx, 2, key, &key_len);
|
|
|
|
|
|
|
|
int deb_key_nr = arg_get_int_def(ctx, 3, -1);
|
|
|
|
|
|
|
|
if (key_len > 0 && deb_key_nr >= 0) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify debit key or index, not both");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (key_len > 0) {
|
2020-11-26 07:42:22 +08:00
|
|
|
auth = true;
|
2020-11-26 03:02:52 +08:00
|
|
|
if (key_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "Debit key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (deb_key_nr >= 0) {
|
|
|
|
if (deb_key_nr < ICLASS_KEYS_MAX) {
|
2020-11-26 07:42:22 +08:00
|
|
|
auth = true;
|
2020-11-26 03:02:52 +08:00
|
|
|
memcpy(key, iClass_Key_Table[deb_key_nr], 8);
|
2020-11-26 10:16:08 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Using AA1 (debit) key[%d] " _GREEN_("%s"), deb_key_nr, sprint_hex(iClass_Key_Table[deb_key_nr], 8));
|
2020-11-26 03:02:52 +08:00
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int credit_key_len = 0;
|
|
|
|
uint8_t credit_key[8] = {0};
|
2019-03-10 06:35:06 +08:00
|
|
|
bool have_credit_key = false;
|
2020-11-26 03:02:52 +08:00
|
|
|
|
|
|
|
CLIGetHexWithReturn(ctx, 4, credit_key, &credit_key_len);
|
|
|
|
|
|
|
|
int credit_key_nr = arg_get_int_def(ctx, 5, -1);
|
|
|
|
|
|
|
|
if (credit_key_len > 0 && credit_key_nr >= 0) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify credit key or index, not both");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (credit_key_len > 0) {
|
2020-11-26 07:42:22 +08:00
|
|
|
auth = true;
|
2020-11-26 03:02:52 +08:00
|
|
|
have_credit_key = true;
|
2020-11-28 10:23:28 +08:00
|
|
|
if (credit_key_len != 8) {
|
2020-11-26 03:02:52 +08:00
|
|
|
PrintAndLogEx(ERR, "Credit key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
2020-10-13 17:54:38 +08:00
|
|
|
|
2020-11-26 03:02:52 +08:00
|
|
|
if (credit_key_nr >= 0) {
|
|
|
|
if (credit_key_nr < ICLASS_KEYS_MAX) {
|
2020-11-26 07:42:22 +08:00
|
|
|
auth = true;
|
2020-11-26 03:02:52 +08:00
|
|
|
have_credit_key = true;
|
|
|
|
memcpy(key, iClass_Key_Table[credit_key_nr], 8);
|
2020-11-26 10:16:08 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Using AA2 (credit) key[%d] " _GREEN_("%s"), credit_key_nr, sprint_hex(iClass_Key_Table[credit_key_nr], 8));
|
2020-11-26 03:02:52 +08:00
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
bool elite = arg_get_lit(ctx, 6);
|
|
|
|
bool rawkey = arg_get_lit(ctx, 7);
|
|
|
|
bool use_replay = arg_get_lit(ctx, 8);
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
2020-10-18 05:09:34 +08:00
|
|
|
if ((use_replay + rawkey + elite) > 1) {
|
2021-03-27 17:20:54 +08:00
|
|
|
PrintAndLogEx(ERR, "Can not use a combo of 'elite', 'raw', 'nr'");
|
2020-11-26 03:02:52 +08:00
|
|
|
return PM3_EINVARG;
|
2020-10-13 17:54:38 +08:00
|
|
|
}
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-11-26 03:02:52 +08:00
|
|
|
uint8_t app_limit1 = 0, app_limit2 = 0;
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint32_t flags = (FLAG_ICLASS_READER_INIT | FLAG_ICLASS_READER_CLEARTRACE);
|
|
|
|
|
|
|
|
//get CSN and config
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2020-08-08 17:46:22 +08:00
|
|
|
uint8_t tag_data[0x100 * 8];
|
2020-08-03 23:42:05 +08:00
|
|
|
memset(tag_data, 0xFF, sizeof(tag_data));
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
clearCommandBuffer();
|
2019-08-04 01:17:00 +08:00
|
|
|
SendCommandMIX(CMD_HF_ICLASS_READER, flags, 0, 0, NULL, 0);
|
2020-07-13 18:29:31 +08:00
|
|
|
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "command execute timeout");
|
|
|
|
DropField();
|
2019-09-09 05:19:06 +08:00
|
|
|
return PM3_ESOFT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
DropField();
|
|
|
|
|
2019-04-18 05:44:48 +08:00
|
|
|
uint8_t readStatus = resp.oldarg[0] & 0xff;
|
2021-04-08 15:34:11 +08:00
|
|
|
picopass_hdr_t *hdr = (picopass_hdr_t *)resp.data.asBytes;
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (readStatus == 0) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(FAILED, "no tag found");
|
2019-09-09 05:19:06 +08:00
|
|
|
DropField();
|
|
|
|
return PM3_ESOFT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint8_t pagemap = get_pagemap(hdr);
|
|
|
|
|
|
|
|
if (readStatus & (FLAG_ICLASS_CSN | FLAG_ICLASS_CONF | FLAG_ICLASS_CC)) {
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
memcpy(tag_data, hdr, 24);
|
2020-07-20 02:45:47 +08:00
|
|
|
|
|
|
|
uint8_t type = get_mem_config(hdr);
|
2020-07-29 17:02:30 +08:00
|
|
|
|
|
|
|
// tags configured for NON SECURE PAGE, acts different
|
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
|
|
|
|
|
|
|
PrintAndLogEx(INFO, "Card in non-secure page mode detected");
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
app_limit1 = card_app2_limit[type];
|
|
|
|
app_limit2 = 0;
|
|
|
|
} else {
|
|
|
|
app_limit1 = hdr->conf.app_limit;
|
|
|
|
app_limit2 = card_app2_limit[type];
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
} else {
|
|
|
|
PrintAndLogEx(FAILED, "failed to read block 0,1,2");
|
|
|
|
DropField();
|
2020-08-13 18:25:04 +08:00
|
|
|
return PM3_ESOFT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
2020-08-13 18:25:04 +08:00
|
|
|
PrintAndLogEx(INFO, "Dumping all available memory, block 3 - %u (0x%02x)", app_limit1, app_limit1);
|
2020-11-26 07:42:22 +08:00
|
|
|
if (auth) {
|
2020-07-29 17:02:30 +08:00
|
|
|
PrintAndLogEx(INFO, "No keys needed, ignoring user supplied key");
|
|
|
|
}
|
|
|
|
} else {
|
2020-11-26 07:42:22 +08:00
|
|
|
if (auth == false) {
|
2020-07-29 17:02:30 +08:00
|
|
|
PrintAndLogEx(FAILED, "Run command with keys");
|
|
|
|
return PM3_ESOFT;
|
|
|
|
}
|
|
|
|
PrintAndLogEx(INFO, "Card has atleast 2 application areas. AA1 limit %u (0x%02X) AA2 limit %u (0x%02X)", app_limit1, app_limit1, app_limit2, app_limit2);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
iclass_dump_req_t payload = {
|
|
|
|
.req.use_raw = rawkey,
|
|
|
|
.req.use_elite = elite,
|
|
|
|
.req.use_credit_key = false,
|
2020-10-13 17:54:38 +08:00
|
|
|
.req.use_replay = use_replay,
|
2020-07-29 17:02:30 +08:00
|
|
|
.req.send_reply = true,
|
2020-11-26 07:42:22 +08:00
|
|
|
.req.do_auth = auth,
|
2020-07-29 17:02:30 +08:00
|
|
|
.end_block = app_limit1,
|
|
|
|
};
|
2020-11-26 03:02:52 +08:00
|
|
|
memcpy(payload.req.key, key, 8);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// tags configured for NON SECURE PAGE, acts different
|
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
|
|
|
payload.start_block = 3;
|
|
|
|
payload.req.do_auth = false;
|
|
|
|
} else {
|
|
|
|
payload.start_block = 6;
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2020-08-13 18:25:04 +08:00
|
|
|
SendCommandNG(CMD_HF_ICLASS_DUMP, (uint8_t *)&payload, sizeof(payload));
|
2020-07-13 18:29:31 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
while (true) {
|
2020-08-29 21:22:26 +08:00
|
|
|
|
|
|
|
PrintAndLogEx(NORMAL, "." NOLF);
|
2019-07-11 19:01:34 +08:00
|
|
|
if (kbd_enter_pressed()) {
|
2020-08-29 21:22:26 +08:00
|
|
|
PrintAndLogEx(WARNING, "\naborted via keyboard!\n");
|
2019-03-10 06:35:06 +08:00
|
|
|
DropField();
|
2020-03-12 01:38:07 +08:00
|
|
|
return PM3_EOPABORTED;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-07-13 18:29:31 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_HF_ICLASS_DUMP, &resp, 2000))
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
2020-07-13 18:29:31 +08:00
|
|
|
|
2020-08-29 21:22:26 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-07-13 18:29:31 +08:00
|
|
|
if (resp.status != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(ERR, "failed to communicate with card");
|
|
|
|
return resp.status;
|
|
|
|
}
|
|
|
|
|
|
|
|
struct p_resp {
|
|
|
|
bool isOK;
|
2020-08-06 14:14:40 +08:00
|
|
|
uint16_t block_cnt;
|
2020-07-13 18:29:31 +08:00
|
|
|
uint32_t bb_offset;
|
|
|
|
} PACKED;
|
|
|
|
struct p_resp *packet = (struct p_resp *)resp.data.asBytes;
|
|
|
|
|
|
|
|
if (packet->isOK == false) {
|
2020-07-20 06:52:46 +08:00
|
|
|
PrintAndLogEx(WARNING, "read AA1 blocks failed");
|
2019-09-09 05:23:06 +08:00
|
|
|
return PM3_ESOFT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint32_t startindex = packet->bb_offset;
|
2020-07-20 05:09:21 +08:00
|
|
|
uint32_t blocks_read = packet->block_cnt;
|
2020-07-29 17:02:30 +08:00
|
|
|
|
2020-08-08 17:46:22 +08:00
|
|
|
uint8_t tempbuf[0x100 * 8];
|
2020-07-20 05:09:21 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
// response ok - now get bigbuf content of the dump
|
2020-07-29 17:02:30 +08:00
|
|
|
if (!GetFromDevice(BIG_BUF, tempbuf, sizeof(tempbuf), startindex, NULL, 0, NULL, 2500, false)) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "command execution time out");
|
2019-09-09 05:19:06 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-08-13 18:25:04 +08:00
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
2020-07-29 17:02:30 +08:00
|
|
|
// all memory available
|
2020-08-13 18:25:04 +08:00
|
|
|
memcpy(tag_data + (8 * 3), tempbuf + (8 * 3), (blocks_read * 8));
|
2020-07-29 17:02:30 +08:00
|
|
|
} else {
|
|
|
|
// div key KD
|
|
|
|
memcpy(tag_data + (8 * 3), tempbuf + (8 * 3), 8);
|
2020-08-03 23:42:05 +08:00
|
|
|
// AIA data
|
|
|
|
memcpy(tag_data + (8 * 5), tempbuf + (8 * 5), 8);
|
2020-07-29 17:02:30 +08:00
|
|
|
// AA1 data
|
2020-08-13 18:25:04 +08:00
|
|
|
memcpy(tag_data + (8 * 6), tempbuf + (8 * 6), (blocks_read * 8));
|
2020-07-29 17:02:30 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint16_t bytes_got = (app_limit1 + 1) * 8;
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-13 18:29:31 +08:00
|
|
|
// try AA2 Kc, Credit
|
2020-07-29 17:02:30 +08:00
|
|
|
bool aa2_success = false;
|
2019-09-09 05:19:06 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (have_credit_key && pagemap != 0x01) {
|
2019-09-09 05:19:06 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// AA2 authenticate credit key
|
2020-11-26 03:02:52 +08:00
|
|
|
memcpy(payload.req.key, credit_key, 8);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
payload.req.use_credit_key = true;
|
|
|
|
payload.start_block = app_limit1 + 1;
|
|
|
|
payload.end_block = app_limit2;
|
|
|
|
payload.req.do_auth = true;
|
2020-07-13 18:29:31 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
clearCommandBuffer();
|
2020-08-13 18:25:04 +08:00
|
|
|
SendCommandNG(CMD_HF_ICLASS_DUMP, (uint8_t *)&payload, sizeof(payload));
|
2020-07-13 18:29:31 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
while (true) {
|
2020-08-29 21:22:26 +08:00
|
|
|
PrintAndLogEx(NORMAL, "." NOLF);
|
2020-07-29 17:02:30 +08:00
|
|
|
if (kbd_enter_pressed()) {
|
2020-08-29 21:22:26 +08:00
|
|
|
PrintAndLogEx(WARNING, "\naborted via keyboard!\n");
|
2020-07-29 17:02:30 +08:00
|
|
|
DropField();
|
|
|
|
return PM3_EOPABORTED;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (WaitForResponseTimeout(CMD_HF_ICLASS_DUMP, &resp, 2000))
|
|
|
|
break;
|
2020-07-20 02:45:47 +08:00
|
|
|
}
|
2020-08-29 21:22:26 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-07-20 02:45:47 +08:00
|
|
|
if (resp.status != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(ERR, "failed to communicate with card");
|
2020-07-29 17:02:30 +08:00
|
|
|
goto write_dump;
|
2020-07-20 02:45:47 +08:00
|
|
|
}
|
2020-07-13 18:29:31 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
packet = (struct p_resp *)resp.data.asBytes;
|
|
|
|
if (packet->isOK == false) {
|
2020-07-29 17:02:30 +08:00
|
|
|
PrintAndLogEx(WARNING, "failed read block using credit key");
|
|
|
|
goto write_dump;
|
2020-07-20 02:45:47 +08:00
|
|
|
}
|
2020-07-29 17:02:30 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
blocks_read = packet->block_cnt;
|
|
|
|
startindex = packet->bb_offset;
|
2020-07-20 05:09:21 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (blocks_read * 8 > sizeof(tag_data) - bytes_got) {
|
|
|
|
PrintAndLogEx(WARNING, "data exceeded buffer size! ");
|
|
|
|
blocks_read = (sizeof(tag_data) - bytes_got) / 8;
|
2020-07-20 02:45:47 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
// get dumped data from bigbuf
|
2020-07-29 17:02:30 +08:00
|
|
|
if (!GetFromDevice(BIG_BUF, tempbuf, sizeof(tempbuf), startindex, NULL, 0, NULL, 2500, false)) {
|
2020-07-20 02:45:47 +08:00
|
|
|
PrintAndLogEx(WARNING, "command execution time out");
|
2020-07-29 17:02:30 +08:00
|
|
|
goto write_dump;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// div key KC
|
|
|
|
memcpy(tag_data + (8 * 4), tempbuf + (8 * 4), 8);
|
2020-07-20 02:45:47 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// AA2 data
|
2020-08-13 18:25:04 +08:00
|
|
|
memcpy(tag_data + (8 * (app_limit1 + 1)), tempbuf + (8 * (app_limit1 + 1)), (blocks_read * 8));
|
2019-09-13 22:31:17 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
bytes_got = (blocks_read * 8);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
aa2_success = true;
|
|
|
|
}
|
2019-09-09 05:19:06 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
write_dump:
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (have_credit_key && pagemap != 0x01 && aa2_success == false)
|
|
|
|
PrintAndLogEx(INFO, "Reading AA2 failed. dumping AA1 data to file");
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
// print the dump
|
2020-07-29 17:02:30 +08:00
|
|
|
printIclassDumpContents(tag_data, 1, (bytes_got / 8), bytes_got);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// use CSN as filename
|
2019-03-10 07:00:59 +08:00
|
|
|
if (filename[0] == 0) {
|
2019-08-29 20:33:09 +08:00
|
|
|
strcat(filename, "hf-iclass-");
|
2020-03-22 03:58:20 +08:00
|
|
|
FillFileNameByUID(filename, tag_data, "-dump", 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// save the dump to .bin file
|
2020-08-13 20:04:09 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "saving dump file - %u blocks read", bytes_got / 8);
|
2020-07-29 17:02:30 +08:00
|
|
|
saveFile(filename, ".bin", tag_data, bytes_got);
|
|
|
|
saveFileEML(filename, tag_data, bytes_got, 8);
|
|
|
|
saveFileJSON(filename, jsfIclass, tag_data, bytes_got, NULL);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass decrypt -f %s.bin") "` to decrypt dump file", filename);
|
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass view -f %s.bin") "` to view dump file", filename);
|
2020-07-29 21:28:42 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2019-08-29 20:33:09 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
2015-02-15 04:17:08 +08:00
|
|
|
|
2020-11-09 16:58:30 +08:00
|
|
|
static int iclass_write_block(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool replay, bool verbose, bool use_secure_pagemode) {
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-08-13 18:25:04 +08:00
|
|
|
iclass_writeblock_req_t payload = {
|
2020-07-29 17:02:30 +08:00
|
|
|
.req.use_raw = rawkey,
|
|
|
|
.req.use_elite = elite,
|
|
|
|
.req.use_credit_key = use_credit_key,
|
2020-10-13 17:54:38 +08:00
|
|
|
.req.use_replay = replay,
|
2020-07-29 17:02:30 +08:00
|
|
|
.req.blockno = blockno,
|
|
|
|
.req.send_reply = true,
|
2020-11-09 16:58:30 +08:00
|
|
|
.req.do_auth = use_secure_pagemode,
|
2020-07-29 17:02:30 +08:00
|
|
|
};
|
|
|
|
memcpy(payload.req.key, KEY, 8);
|
|
|
|
memcpy(payload.data, bldata, sizeof(payload.data));
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-14 02:13:25 +08:00
|
|
|
clearCommandBuffer();
|
|
|
|
SendCommandNG(CMD_HF_ICLASS_WRITEBL, (uint8_t *)&payload, sizeof(payload));
|
|
|
|
PacketResponseNG resp;
|
2019-09-09 03:21:30 +08:00
|
|
|
|
2020-07-14 02:13:25 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_HF_ICLASS_WRITEBL, &resp, 2000) == 0) {
|
|
|
|
if (verbose) PrintAndLogEx(WARNING, "Command execute timeout");
|
|
|
|
return PM3_ETIMEOUT;
|
|
|
|
}
|
2019-09-09 03:21:30 +08:00
|
|
|
|
2020-07-14 02:13:25 +08:00
|
|
|
if (resp.status != PM3_SUCCESS) {
|
|
|
|
if (verbose) PrintAndLogEx(ERR, "failed to communicate with card");
|
2020-10-14 04:43:28 +08:00
|
|
|
return resp.status;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-07-14 02:13:25 +08:00
|
|
|
return (resp.data.asBytes[0] == 1) ? PM3_SUCCESS : PM3_ESOFT;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClass_WriteBlock(const char *Cmd) {
|
2020-11-26 13:11:54 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass wrbl",
|
|
|
|
"Write data to an iCLASS tag",
|
|
|
|
"hf iclass wrbl -b 10 -d AAAAAAAAAAAAAAAA -k 001122334455667B\n"
|
2020-12-05 20:27:39 +08:00
|
|
|
"hf iclass wrbl -b 10 -d AAAAAAAAAAAAAAAA -k 001122334455667B --credit\n"
|
|
|
|
"hf iclass wrbl -b 10 -d AAAAAAAAAAAAAAAA --ki 0");
|
2020-11-26 13:11:54 +08:00
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0("k", "key", "<hex>", "Access key as 8 hex bytes"),
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_int0(NULL, "ki", "<dec>", "Key index to select key from memory 'hf iclass managekeys'"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_int1("b", "block", "<dec>", "The block number to read"),
|
|
|
|
arg_str1("d", "data", "<hex>", "data to write as 8 hex bytes"),
|
2020-11-26 13:11:54 +08:00
|
|
|
arg_lit0(NULL, "credit", "key is assumed to be the credit key"),
|
|
|
|
arg_lit0(NULL, "elite", "elite computations applied to key"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_lit0(NULL, "raw", "no computations applied to key"),
|
2020-11-26 13:11:54 +08:00
|
|
|
arg_lit0(NULL, "nr", "replay of NR/MAC"),
|
|
|
|
arg_lit0("v", "verbose", "verbose output"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int key_len = 0;
|
|
|
|
uint8_t key[8] = {0};
|
|
|
|
|
|
|
|
CLIGetHexWithReturn(ctx, 1, key, &key_len);
|
|
|
|
|
|
|
|
int key_nr = arg_get_int_def(ctx, 2, -1);
|
|
|
|
|
|
|
|
if (key_len > 0 && key_nr >= 0) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify key or index, not both");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool auth = false;
|
|
|
|
|
|
|
|
if (key_len > 0) {
|
|
|
|
auth = true;
|
|
|
|
if (key_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "Key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
} else if (key_nr >= 0) {
|
|
|
|
if (key_nr < ICLASS_KEYS_MAX) {
|
|
|
|
auth = true;
|
|
|
|
memcpy(key, iClass_Key_Table[key_nr], 8);
|
|
|
|
PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), key_nr, sprint_hex(iClass_Key_Table[key_nr], 8));
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
2019-09-13 22:31:17 +08:00
|
|
|
|
2020-11-26 13:11:54 +08:00
|
|
|
int blockno = arg_get_int_def(ctx, 3, 0);
|
|
|
|
|
|
|
|
int data_len = 0;
|
|
|
|
uint8_t data[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 4, data, &data_len);
|
|
|
|
|
|
|
|
if (data_len != 8) {
|
2020-12-05 20:27:39 +08:00
|
|
|
PrintAndLogEx(ERR, "Data must be 8 hex bytes (16 hex symbols)");
|
2020-11-26 13:11:54 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2020-10-13 17:54:38 +08:00
|
|
|
}
|
|
|
|
|
2020-11-26 13:11:54 +08:00
|
|
|
bool use_credit_key = arg_get_lit(ctx, 5);
|
|
|
|
bool elite = arg_get_lit(ctx, 6);
|
|
|
|
bool rawkey = arg_get_lit(ctx, 7);
|
|
|
|
bool use_replay = arg_get_lit(ctx, 8);
|
|
|
|
bool verbose = arg_get_lit(ctx, 9);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-26 13:11:54 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
|
|
|
if ((use_replay + rawkey + elite) > 1) {
|
|
|
|
PrintAndLogEx(ERR, "Can not use a combo of 'elite', 'raw', 'nr'");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
int isok = iclass_write_block(blockno, data, key, use_credit_key, elite, rawkey, use_replay, verbose, auth);
|
2020-10-20 07:00:23 +08:00
|
|
|
switch (isok) {
|
2020-10-14 04:43:28 +08:00
|
|
|
case PM3_SUCCESS:
|
2020-11-26 13:11:54 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Wrote block %3d/0x%02X successful", blockno, blockno);
|
2020-10-14 04:43:28 +08:00
|
|
|
break;
|
|
|
|
case PM3_ETEAROFF:
|
|
|
|
if (verbose)
|
|
|
|
PrintAndLogEx(INFO, "Writing tear off triggered");
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
PrintAndLogEx(FAILED, "Writing failed");
|
|
|
|
break;
|
|
|
|
}
|
2020-07-14 02:13:25 +08:00
|
|
|
return isok;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
static int CmdHFiClassRestore(const char *Cmd) {
|
2020-11-26 07:00:32 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass restore",
|
|
|
|
"Restore data from dumpfile onto a iCLASS tag",
|
2020-12-05 20:27:39 +08:00
|
|
|
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0\n"
|
2020-12-08 22:35:30 +08:00
|
|
|
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0 --elite\n"
|
2020-12-05 20:27:39 +08:00
|
|
|
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 -k 1122334455667788 --elite\n"
|
2020-12-12 21:46:40 +08:00
|
|
|
);
|
2020-06-09 22:25:56 +08:00
|
|
|
|
2020-11-26 07:00:32 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str1("f", "file", "<filename>", "specify a filename to restore"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0("k", "key", "<hex>", "Access key as 8 hex bytes"),
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_int0(NULL, "ki", "<dec>", "Key index to select key from memory 'hf iclass managekeys'"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_int1(NULL, "first", "<dec>", "The first block number to restore"),
|
|
|
|
arg_int1(NULL, "last", "<dec>", "The last block number to restore"),
|
2020-11-26 07:00:32 +08:00
|
|
|
arg_lit0(NULL, "credit", "key is assumed to be the credit key"),
|
|
|
|
arg_lit0(NULL, "elite", "elite computations applied to key"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_lit0(NULL, "raw", "no computations applied to key"),
|
2020-11-26 07:00:32 +08:00
|
|
|
arg_lit0("v", "verbose", "verbose output"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
|
|
|
int key_len = 0;
|
|
|
|
uint8_t key[8] = {0};
|
|
|
|
|
|
|
|
CLIGetHexWithReturn(ctx, 2, key, &key_len);
|
|
|
|
|
|
|
|
int key_nr = arg_get_int_def(ctx, 3, -1);
|
|
|
|
|
|
|
|
if (key_len > 0 && key_nr >= 0) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify key or index, not both");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (key_len > 0) {
|
|
|
|
if (key_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "Key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-11-26 07:00:32 +08:00
|
|
|
} else if (key_nr >= 0) {
|
|
|
|
if (key_nr < ICLASS_KEYS_MAX) {
|
|
|
|
memcpy(key, iClass_Key_Table[key_nr], 8);
|
|
|
|
PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), key_nr, sprint_hex(iClass_Key_Table[key_nr], 8));
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Please specify a key or key index");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-11-26 07:00:32 +08:00
|
|
|
int startblock = arg_get_int_def(ctx, 4, 0);
|
|
|
|
int endblock = arg_get_int_def(ctx, 5, 0);
|
|
|
|
|
|
|
|
bool use_credit_key = arg_get_lit(ctx, 6);
|
|
|
|
bool elite = arg_get_lit(ctx, 7);
|
|
|
|
bool rawkey = arg_get_lit(ctx, 8);
|
|
|
|
bool verbose = arg_get_lit(ctx, 9);
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
if (rawkey + elite > 1) {
|
|
|
|
PrintAndLogEx(FAILED, "Can not use both 'e', 'r'");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
2019-09-09 05:19:06 +08:00
|
|
|
if (startblock < 5) {
|
|
|
|
PrintAndLogEx(WARNING, "you cannot write key blocks this way. yet... make your start block > 4");
|
2020-09-07 16:35:09 +08:00
|
|
|
return PM3_EINVARG;
|
2019-09-09 05:19:06 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
uint32_t payload_size = sizeof(iclass_restore_req_t) + (sizeof(iclass_restore_item_t) * (endblock - startblock + 1));
|
2019-09-13 22:31:17 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
if (payload_size > PM3_CMD_DATA_SIZE) {
|
2019-05-01 03:10:11 +08:00
|
|
|
PrintAndLogEx(NORMAL, "Trying to write too many blocks at once. Max: %d", PM3_CMD_DATA_SIZE / 8);
|
2019-09-09 05:19:06 +08:00
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-09-09 05:19:06 +08:00
|
|
|
|
2020-06-09 22:25:56 +08:00
|
|
|
uint8_t *dump = NULL;
|
|
|
|
size_t bytes_read = 0;
|
2020-06-10 07:17:49 +08:00
|
|
|
if (loadFile_safe(filename, "", (void **)&dump, &bytes_read) != PM3_SUCCESS) {
|
2019-05-15 16:24:06 +08:00
|
|
|
PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", filename);
|
|
|
|
return PM3_EFILE;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-06-09 22:25:56 +08:00
|
|
|
if (bytes_read == 0) {
|
|
|
|
PrintAndLogEx(ERR, "file reading error");
|
2020-06-09 23:01:31 +08:00
|
|
|
free(dump);
|
2020-06-09 22:25:56 +08:00
|
|
|
return PM3_EFILE;
|
|
|
|
}
|
2020-06-09 23:01:31 +08:00
|
|
|
|
2020-10-20 07:00:23 +08:00
|
|
|
if (bytes_read < ((endblock - startblock + 1) * 8)) {
|
2020-10-14 23:41:34 +08:00
|
|
|
PrintAndLogEx(ERR, "file is smaller than your suggested block range ( " _RED_("0x%02x..0x%02x")" )",
|
2020-10-20 07:00:23 +08:00
|
|
|
startblock, endblock
|
|
|
|
);
|
2020-06-09 23:01:31 +08:00
|
|
|
free(dump);
|
2020-06-09 22:25:56 +08:00
|
|
|
return PM3_EFILE;
|
|
|
|
}
|
2019-09-09 05:19:06 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
iclass_restore_req_t *payload = calloc(1, payload_size);
|
2020-10-20 07:06:07 +08:00
|
|
|
payload->req.use_raw = rawkey;
|
|
|
|
payload->req.use_elite = elite;
|
|
|
|
payload->req.use_credit_key = use_credit_key;
|
|
|
|
payload->req.use_replay = false;
|
|
|
|
payload->req.blockno = startblock;
|
|
|
|
payload->req.send_reply = true;
|
|
|
|
payload->req.do_auth = true;
|
2020-11-26 07:00:32 +08:00
|
|
|
memcpy(payload->req.key, key, 8);
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
payload->item_cnt = (endblock - startblock + 1);
|
|
|
|
|
2019-09-09 05:19:06 +08:00
|
|
|
// read data from file from block 6 --- 19
|
|
|
|
// we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
|
|
|
|
// then copy to usbcommand->asbytes;
|
|
|
|
// max is 32 - 6 = 28 block. 28 x 12 bytes gives 336 bytes
|
2020-06-10 07:17:49 +08:00
|
|
|
|
2020-10-20 07:00:23 +08:00
|
|
|
for (uint8_t i = 0; i < payload->item_cnt; i++) {
|
2020-10-14 23:41:34 +08:00
|
|
|
payload->blocks[i].blockno = startblock + i;
|
2020-10-20 07:00:23 +08:00
|
|
|
memcpy(payload->blocks[i].data, dump + (startblock * 8) + (i * 8), sizeof(payload->blocks[i].data));
|
2019-03-14 17:01:07 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
free(dump);
|
2019-09-09 05:19:06 +08:00
|
|
|
|
2019-09-13 22:31:17 +08:00
|
|
|
if (verbose) {
|
2020-11-26 07:00:32 +08:00
|
|
|
PrintAndLogEx(INFO, "Preparing to restore block range %02d..%02d", startblock, endblock);
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-11-26 07:42:22 +08:00
|
|
|
PrintAndLogEx(INFO, "---------+----------------------");
|
|
|
|
PrintAndLogEx(INFO, " block# | data");
|
|
|
|
PrintAndLogEx(INFO, "---------+----------------------");
|
2020-10-14 23:41:34 +08:00
|
|
|
|
2020-10-20 07:00:23 +08:00
|
|
|
for (uint8_t i = 0; i < payload->item_cnt; i++) {
|
2020-10-14 23:41:34 +08:00
|
|
|
iclass_restore_item_t item = payload->blocks[i];
|
2020-11-26 07:42:22 +08:00
|
|
|
PrintAndLogEx(INFO, "%3d/0x%02X | %s", item.blockno, item.blockno, sprint_hex_inrow(item.data, sizeof(item.data)));
|
2019-09-09 05:19:06 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-03-14 19:30:32 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
PrintAndLogEx(INFO, "restore started...");
|
2019-09-13 22:31:17 +08:00
|
|
|
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2020-10-14 23:41:34 +08:00
|
|
|
SendCommandNG(CMD_HF_ICLASS_RESTORE, (uint8_t *)payload, payload_size);
|
2019-09-09 05:19:06 +08:00
|
|
|
|
2020-10-14 23:41:34 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_HF_ICLASS_RESTORE, &resp, 2500) == 0) {
|
2019-03-14 19:30:32 +08:00
|
|
|
PrintAndLogEx(WARNING, "command execute timeout");
|
2019-09-09 05:19:06 +08:00
|
|
|
DropField();
|
2020-10-16 22:07:39 +08:00
|
|
|
free(payload);
|
2019-09-09 05:19:06 +08:00
|
|
|
return PM3_ETIMEOUT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-09-13 22:31:17 +08:00
|
|
|
|
|
|
|
if (resp.status == PM3_SUCCESS) {
|
2020-10-14 23:41:34 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "iCLASS restore " _GREEN_("successful"));
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass rdbl") "` to verify data on card");
|
2020-10-14 23:41:34 +08:00
|
|
|
} else {
|
|
|
|
PrintAndLogEx(WARNING, "iCLASS restore " _RED_("failed"));
|
2019-09-09 05:19:06 +08:00
|
|
|
}
|
2020-10-16 22:07:39 +08:00
|
|
|
|
|
|
|
free(payload);
|
2019-09-09 05:19:06 +08:00
|
|
|
return resp.status;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2020-10-13 17:54:38 +08:00
|
|
|
static int iclass_read_block(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool replay, bool verbose, bool auth, uint8_t *out) {
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
iclass_auth_req_t payload = {
|
|
|
|
.use_raw = rawkey,
|
|
|
|
.use_elite = elite,
|
|
|
|
.use_credit_key = (keyType == 0x18),
|
2020-10-13 17:54:38 +08:00
|
|
|
.use_replay = replay,
|
2020-07-29 17:02:30 +08:00
|
|
|
.blockno = blockno,
|
|
|
|
.send_reply = true,
|
2020-08-13 18:25:04 +08:00
|
|
|
.do_auth = auth,
|
2020-07-29 17:02:30 +08:00
|
|
|
};
|
|
|
|
memcpy(payload.key, KEY, 8);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-14 02:58:24 +08:00
|
|
|
PacketResponseNG resp;
|
2020-08-13 18:25:04 +08:00
|
|
|
clearCommandBuffer();
|
|
|
|
SendCommandNG(CMD_HF_ICLASS_READBL, (uint8_t *)&payload, sizeof(payload));
|
2019-09-08 23:37:14 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_HF_ICLASS_READBL, &resp, 2000) == false) {
|
2020-07-14 02:58:24 +08:00
|
|
|
if (verbose) PrintAndLogEx(WARNING, "Command execute timeout");
|
|
|
|
return PM3_ETIMEOUT;
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-14 02:58:24 +08:00
|
|
|
if (resp.status != PM3_SUCCESS) {
|
|
|
|
if (verbose) PrintAndLogEx(ERR, "failed to communicate with card");
|
|
|
|
return PM3_EWRONGANSWER;
|
|
|
|
}
|
2019-09-09 03:21:30 +08:00
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
// return data.
|
2020-07-29 17:02:30 +08:00
|
|
|
iclass_readblock_resp_t *packet = (iclass_readblock_resp_t *)resp.data.asBytes;
|
2020-07-14 02:58:24 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (packet->isOK == false) {
|
|
|
|
if (verbose) PrintAndLogEx(FAILED, "authentication error");
|
2020-07-20 02:45:47 +08:00
|
|
|
return PM3_ESOFT;
|
|
|
|
}
|
2019-09-12 04:51:13 +08:00
|
|
|
|
2020-07-21 19:00:52 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-11-26 13:11:54 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " block %3d/0x%02X : " _GREEN_("%s"), blockno, blockno, sprint_hex(packet->data, sizeof(packet->data)));
|
2020-07-21 19:00:52 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-07-14 06:16:25 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (out)
|
|
|
|
memcpy(out, packet->data, sizeof(packet->data));
|
2020-07-14 02:13:25 +08:00
|
|
|
|
2019-09-08 23:37:14 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClass_ReadBlock(const char *Cmd) {
|
2020-11-26 10:16:08 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass rdbl",
|
|
|
|
"Read a iCLASS block from tag",
|
|
|
|
"hf iclass rdbl -b 6 -k 0011223344556677\n"
|
|
|
|
"hf iclass rdbl -b 27 -k 0011223344556677 --credit\n"
|
|
|
|
"hf iclass rdbl -b 10 --ki 0");
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0("k", "key", "<hex>", "Access key as 8 hex bytes"),
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_int0(NULL, "ki", "<dec>", "Key index to select key from memory 'hf iclass managekeys'"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_int1("b", "block", "<dec>", "The block number to read"),
|
2020-11-26 10:16:08 +08:00
|
|
|
arg_lit0(NULL, "credit", "key is assumed to be the credit key"),
|
|
|
|
arg_lit0(NULL, "elite", "elite computations applied to key"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_lit0(NULL, "raw", "no computations applied to key"),
|
2020-11-26 10:16:08 +08:00
|
|
|
arg_lit0(NULL, "nr", "replay of NR/MAC"),
|
|
|
|
arg_lit0("v", "verbose", "verbose output"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int key_len = 0;
|
|
|
|
uint8_t key[8] = {0};
|
|
|
|
|
|
|
|
CLIGetHexWithReturn(ctx, 1, key, &key_len);
|
|
|
|
|
|
|
|
int key_nr = arg_get_int_def(ctx, 2, -1);
|
|
|
|
|
|
|
|
if (key_len > 0 && key_nr >= 0) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify key or index, not both");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
bool auth = false;
|
2020-07-20 02:45:47 +08:00
|
|
|
|
2020-11-26 10:16:08 +08:00
|
|
|
if (key_len > 0) {
|
|
|
|
auth = true;
|
|
|
|
if (key_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "Key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-11-26 10:16:08 +08:00
|
|
|
} else if (key_nr >= 0) {
|
|
|
|
if (key_nr < ICLASS_KEYS_MAX) {
|
|
|
|
auth = true;
|
|
|
|
memcpy(key, iClass_Key_Table[key_nr], 8);
|
|
|
|
PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), key_nr, sprint_hex(iClass_Key_Table[key_nr], 8));
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-11-26 10:16:08 +08:00
|
|
|
int blockno = arg_get_int_def(ctx, 3, 0);
|
|
|
|
|
|
|
|
uint8_t keyType = 0x88; //debit key
|
|
|
|
if (arg_get_lit(ctx, 4)) {
|
|
|
|
PrintAndLogEx(SUCCESS, "Using " _YELLOW_("credit") " key");
|
|
|
|
keyType = 0x18; //credit key
|
2020-10-13 17:54:38 +08:00
|
|
|
}
|
2019-09-13 22:31:17 +08:00
|
|
|
|
2020-11-26 10:16:08 +08:00
|
|
|
bool elite = arg_get_lit(ctx, 5);
|
|
|
|
bool rawkey = arg_get_lit(ctx, 6);
|
|
|
|
bool use_replay = arg_get_lit(ctx, 7);
|
|
|
|
bool verbose = arg_get_lit(ctx, 8);
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
|
|
|
if ((use_replay + rawkey + elite) > 1) {
|
2021-03-27 17:20:54 +08:00
|
|
|
PrintAndLogEx(ERR, "Can not use a combo of 'elite', 'raw', 'nr'");
|
2020-11-26 10:16:08 +08:00
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-21 19:00:52 +08:00
|
|
|
if (verbose) {
|
2020-11-26 10:16:08 +08:00
|
|
|
if (key_len > 0)
|
|
|
|
PrintAndLogEx(SUCCESS, "Using key %s", sprint_hex(key, 8));
|
2020-07-21 19:00:52 +08:00
|
|
|
}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (auth == false && verbose) {
|
2020-10-23 07:24:54 +08:00
|
|
|
PrintAndLogEx(WARNING, "warning: no authentication used with read. Typical for cards configured into `non-secure page`");
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t data[8] = {0};
|
2020-11-26 10:16:08 +08:00
|
|
|
int res = iclass_read_block(key, blockno, keyType, elite, rawkey, use_replay, verbose, auth, data);
|
2020-07-29 17:02:30 +08:00
|
|
|
if (res != PM3_SUCCESS)
|
|
|
|
return res;
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (blockno < 6 || blockno > 7)
|
|
|
|
return PM3_SUCCESS;
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (memcmp(data, empty, 8) == 0)
|
|
|
|
return PM3_SUCCESS;
|
|
|
|
|
2021-04-04 23:01:43 +08:00
|
|
|
bool use_sc = IsCardHelperPresent(verbose);
|
2020-08-13 18:25:04 +08:00
|
|
|
if (use_sc == false)
|
2020-07-29 17:02:30 +08:00
|
|
|
return PM3_SUCCESS;
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// crypto helper available.
|
|
|
|
PrintAndLogEx(INFO, "----------------------------- " _CYAN_("cardhelper") " -----------------------------");
|
|
|
|
|
|
|
|
switch (blockno) {
|
|
|
|
case 6: {
|
|
|
|
DecodeBlock6(data);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 7: {
|
|
|
|
|
|
|
|
uint8_t dec_data[8];
|
|
|
|
|
|
|
|
uint64_t a = bytes_to_num(data, 8);
|
|
|
|
bool starts = (leadingzeros(a) < 12);
|
2021-03-08 06:48:48 +08:00
|
|
|
bool ones = (bitcount64(a) > 16 && bitcount64(a) < 48);
|
2020-07-29 17:02:30 +08:00
|
|
|
|
|
|
|
if (starts && ones) {
|
|
|
|
PrintAndLogEx(INFO, "data looks encrypted, False Positives " _YELLOW_("ARE") " possible");
|
|
|
|
Decrypt(data, dec_data);
|
|
|
|
PrintAndLogEx(SUCCESS, "decrypted : " _GREEN_("%s"), sprint_hex(dec_data, sizeof(dec_data)));
|
|
|
|
} else {
|
|
|
|
memcpy(dec_data, data, sizeof(dec_data));
|
|
|
|
PrintAndLogEx(INFO, "data looks unencrypted, trying to decode");
|
|
|
|
}
|
|
|
|
|
|
|
|
if (memcmp(dec_data, empty, 8) != 0) {
|
|
|
|
|
|
|
|
//todo: remove preamble/sentinal
|
|
|
|
|
|
|
|
uint32_t top = 0, mid, bot;
|
|
|
|
mid = bytes_to_num(dec_data, 4);
|
|
|
|
bot = bytes_to_num(dec_data + 4, 4);
|
2020-07-21 19:00:52 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
char hexstr[16 + 1] = {0};
|
|
|
|
hex_to_buffer((uint8_t *)hexstr, dec_data, 8, sizeof(hexstr) - 1, 0, 0, true);
|
|
|
|
char binstr[64 + 1] = {0};
|
|
|
|
hextobinstring(binstr, hexstr);
|
|
|
|
uint8_t i = 0;
|
|
|
|
while (i < strlen(binstr) && binstr[i++] == '0');
|
2019-08-24 11:08:03 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
i &= 0x3C;
|
|
|
|
PrintAndLogEx(SUCCESS, " bin : %s", binstr + i);
|
2020-08-13 18:25:04 +08:00
|
|
|
PrintAndLogEx(INFO, "");
|
2020-07-29 17:02:30 +08:00
|
|
|
PrintAndLogEx(INFO, "------------------------------ " _CYAN_("wiegand") " -------------------------------");
|
|
|
|
wiegand_message_t packed = initialize_message_object(top, mid, bot);
|
|
|
|
HIDTryUnpack(&packed, true);
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(INFO, "no credential found");
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
PrintAndLogEx(INFO, "----------------------------------------------------------------------");
|
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClass_loclass(const char *Cmd) {
|
2020-11-02 09:58:14 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass loclass",
|
|
|
|
"Execute the offline part of loclass attack\n"
|
|
|
|
" An iclass dumpfile is assumed to consist of an arbitrary number of\n"
|
|
|
|
" malicious CSNs, and their protocol responses\n"
|
|
|
|
" The binary format of the file is expected to be as follows: \n"
|
|
|
|
" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>\n"
|
|
|
|
" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>\n"
|
|
|
|
" <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>\n"
|
|
|
|
" ... totalling N*24 bytes",
|
2021-01-29 04:41:57 +08:00
|
|
|
"hf iclass loclass -f iclass_dump.bin\n"
|
2020-11-02 09:58:14 +08:00
|
|
|
"hf iclass loclass --test");
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str0("f", "file", "<filename>", "filename of Bruteforce iclass dumpfile"),
|
|
|
|
arg_lit0(NULL, "test", "Perform self-test"),
|
|
|
|
arg_lit0(NULL, "long", "Perform self-test, including long ones"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-02 09:58:14 +08:00
|
|
|
bool test = arg_get_lit(ctx, 2);
|
2020-11-07 08:32:43 +08:00
|
|
|
bool longtest = arg_get_lit(ctx, 3);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-02 09:58:14 +08:00
|
|
|
CLIParserFree(ctx);
|
2020-05-15 23:03:28 +08:00
|
|
|
|
2020-11-02 09:58:14 +08:00
|
|
|
if (test || longtest) {
|
2019-03-10 06:35:06 +08:00
|
|
|
int errors = testCipherUtils();
|
|
|
|
errors += testMAC();
|
2020-05-15 23:03:28 +08:00
|
|
|
errors += doKeyTests();
|
2020-11-02 09:58:14 +08:00
|
|
|
errors += testElite(longtest);
|
2020-05-15 23:03:28 +08:00
|
|
|
|
|
|
|
if (errors != PM3_SUCCESS)
|
|
|
|
PrintAndLogEx(ERR, "There were errors!!!");
|
|
|
|
|
2019-08-29 21:55:52 +08:00
|
|
|
return PM3_ESOFT;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-07-15 17:35:03 +08:00
|
|
|
|
2020-11-02 09:58:14 +08:00
|
|
|
return bruteforceFileNoKeys(filename);
|
2015-01-05 16:16:06 +08:00
|
|
|
}
|
2014-04-15 18:47:01 +08:00
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
picopass_hdr_t *hdr = (picopass_hdr_t *)iclass_dump;
|
|
|
|
// picopass_ns_hdr_t *ns_hdr = (picopass_ns_hdr_t *)iclass_dump;
|
2020-08-06 14:14:40 +08:00
|
|
|
// uint8_t pagemap = get_pagemap(hdr);
|
2020-08-13 18:25:04 +08:00
|
|
|
// if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) { }
|
|
|
|
|
2020-08-06 14:14:40 +08:00
|
|
|
uint8_t lock = hdr->conf.block_writelock;
|
|
|
|
|
|
|
|
// is chip in ReadOnly (RO)
|
|
|
|
bool ro = ((lock & 0x80) == 0);
|
|
|
|
|
2020-04-03 14:36:55 +08:00
|
|
|
uint8_t maxmemcount;
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t filemaxblock = filesize / 8;
|
2020-04-03 14:36:55 +08:00
|
|
|
uint8_t mem_config = iclass_dump[13];
|
2016-01-20 02:31:34 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
if (mem_config & 0x80)
|
|
|
|
maxmemcount = 255;
|
|
|
|
else
|
|
|
|
maxmemcount = 31;
|
2015-10-08 05:00:46 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
if (startblock == 0)
|
|
|
|
startblock = 6;
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
if ((endblock > maxmemcount) || (endblock == 0))
|
|
|
|
endblock = maxmemcount;
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
// remember endblock needs to relate to zero-index arrays.
|
2019-03-10 07:00:59 +08:00
|
|
|
if (endblock > filemaxblock - 1)
|
|
|
|
endblock = filemaxblock - 1;
|
2016-12-09 21:38:51 +08:00
|
|
|
|
2020-04-03 14:36:55 +08:00
|
|
|
/*
|
|
|
|
PrintAndLogEx(INFO, "startblock: %u, endblock: %u, filesize: %zu, maxmemcount: %u, filemaxblock: %u"
|
|
|
|
, startblock
|
|
|
|
, endblock
|
|
|
|
, filesize
|
|
|
|
, maxmemcount
|
|
|
|
, filemaxblock
|
|
|
|
);
|
|
|
|
*/
|
2020-10-18 17:50:20 +08:00
|
|
|
uint8_t pagemap = get_pagemap(hdr);
|
|
|
|
|
|
|
|
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
int i = startblock;
|
2020-10-18 17:50:20 +08:00
|
|
|
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-11-26 07:42:22 +08:00
|
|
|
PrintAndLogEx(INFO, " block# | data | ascii |lck| info");
|
|
|
|
PrintAndLogEx(INFO, "---------+-------------------------+----------+---+--------------");
|
|
|
|
PrintAndLogEx(INFO, " 0/0x00 | " _GREEN_("%s") " | | CSN ", sprint_hex_ascii(iclass_dump, 8));
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
if (i != 1)
|
|
|
|
PrintAndLogEx(INFO, "....");
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
while (i <= endblock) {
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t *blk = iclass_dump + (i * 8);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-08-06 14:14:40 +08:00
|
|
|
bool bl_lock = false;
|
2020-08-13 18:25:04 +08:00
|
|
|
if (ro == false) {
|
|
|
|
switch (i) {
|
|
|
|
case 12: {
|
2020-08-06 14:14:40 +08:00
|
|
|
bl_lock = ((lock & 0x40) == 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 11: {
|
|
|
|
bl_lock = ((lock & 0x20) == 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 10: {
|
|
|
|
bl_lock = ((lock & 0x10) == 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 9: {
|
|
|
|
bl_lock = ((lock & 0x08) == 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 8: {
|
|
|
|
bl_lock = ((lock & 0x04) == 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 7: {
|
|
|
|
bl_lock = ((lock & 0x02) == 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 6: {
|
|
|
|
bl_lock = ((lock & 0x01) == 0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
bl_lock = true;
|
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
const char *lockstr = (bl_lock) ? _RED_("x") : " ";
|
|
|
|
|
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
|
|
|
const char *info_nonks[] = {"CSN", "Config", "AIA", "User"};
|
|
|
|
const char *s = info_nonks[3];
|
|
|
|
if (i < 3) {
|
|
|
|
s = info_nonks[i];
|
2020-10-20 07:00:23 +08:00
|
|
|
}
|
|
|
|
|
2020-11-26 07:42:22 +08:00
|
|
|
PrintAndLogEx(INFO, "%3d/0x%02X | %s | %s | %s ", i, i, sprint_hex_ascii(blk, 8), lockstr, s);
|
2020-10-18 17:50:20 +08:00
|
|
|
} else {
|
|
|
|
const char *info_ks[] = {"CSN", "Config", "E-purse", "Debit", "Credit", "AIA", "User"};
|
|
|
|
const char *s = info_ks[6];
|
|
|
|
if (i < 6) {
|
|
|
|
s = info_ks[i];
|
|
|
|
}
|
2020-11-26 07:42:22 +08:00
|
|
|
PrintAndLogEx(INFO, "%3d/0x%02X | %s | %s | %s ", i, i, sprint_hex_ascii(blk, 8), lockstr, s);
|
2020-10-18 17:50:20 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
i++;
|
|
|
|
}
|
2020-11-26 07:42:22 +08:00
|
|
|
PrintAndLogEx(INFO, "---------+-------------------------+----------+---+--------------");
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
static int CmdHFiClassView(const char *Cmd) {
|
2020-10-05 03:23:48 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass view",
|
|
|
|
"Print a iCLASS tag dump file",
|
|
|
|
"hf iclass view -f hf-iclass-AA162D30F8FF12F1-dump.bin\n"
|
2020-12-05 20:27:39 +08:00
|
|
|
"hf iclass view --first 1 -f hf-iclass-AA162D30F8FF12F1-dump.bin\n");
|
2020-10-05 03:23:48 +08:00
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-10-06 21:03:24 +08:00
|
|
|
arg_str1("f", "file", "<filename>", "filename of dump"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_int0(NULL, "first", "<dec>", "Begin printing from this block (default block 6)"),
|
2020-11-26 13:34:30 +08:00
|
|
|
arg_int0(NULL, "last", "<dec>", "End printing at this block (default 0, ALL)"),
|
2020-11-26 07:00:32 +08:00
|
|
|
arg_lit0("v", "verbose", "verbose output"),
|
2020-10-05 03:23:48 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
2019-03-10 06:35:06 +08:00
|
|
|
char filename[FILE_PATH_SIZE];
|
2020-10-07 00:00:00 +08:00
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
2020-10-05 03:23:48 +08:00
|
|
|
|
|
|
|
int startblock = arg_get_int_def(ctx, 2, 0);
|
|
|
|
int endblock = arg_get_int_def(ctx, 3, 0);
|
|
|
|
bool verbose = arg_get_lit(ctx, 4);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-10-07 00:00:00 +08:00
|
|
|
CLIParserFree(ctx);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-06-09 22:25:56 +08:00
|
|
|
uint8_t *dump = NULL;
|
|
|
|
size_t bytes_read = 0;
|
2020-06-10 07:17:49 +08:00
|
|
|
if (loadFile_safe(filename, "", (void **)&dump, &bytes_read) != PM3_SUCCESS) {
|
2019-05-15 16:24:06 +08:00
|
|
|
PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", filename);
|
|
|
|
return PM3_EFILE;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-04-16 15:01:14 +08:00
|
|
|
|
2020-04-03 15:11:12 +08:00
|
|
|
if (verbose) {
|
|
|
|
PrintAndLogEx(INFO, "File: " _YELLOW_("%s"), filename);
|
2020-04-06 13:29:39 +08:00
|
|
|
PrintAndLogEx(INFO, "File size %zu bytes, file blocks %d (0x%x)", bytes_read, (uint16_t)(bytes_read >> 3), (uint16_t)(bytes_read >> 3));
|
2020-11-26 07:00:32 +08:00
|
|
|
PrintAndLogEx(INFO, "Printing blocks from: " _YELLOW_("%02d") " to: " _YELLOW_("%02d"), (startblock == 0) ? 6 : startblock, endblock);
|
2020-04-03 15:11:12 +08:00
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2021-04-08 15:34:11 +08:00
|
|
|
print_picopass_header((picopass_hdr_t *) dump);
|
|
|
|
print_picopass_info((picopass_hdr_t *) dump);
|
2019-03-10 06:35:06 +08:00
|
|
|
printIclassDumpContents(dump, startblock, endblock, bytes_read);
|
|
|
|
free(dump);
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite) {
|
2019-03-10 06:35:06 +08:00
|
|
|
if (elite) {
|
2019-06-08 00:41:39 +08:00
|
|
|
uint8_t keytable[128] = {0};
|
|
|
|
uint8_t key_index[8] = {0};
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t key_sel[8] = { 0 };
|
|
|
|
uint8_t key_sel_p[8] = { 0 };
|
|
|
|
hash2(KEY, keytable);
|
|
|
|
hash1(CSN, key_index);
|
2019-03-10 07:00:59 +08:00
|
|
|
for (uint8_t i = 0; i < 8 ; i++)
|
2020-05-15 23:03:28 +08:00
|
|
|
key_sel[i] = keytable[key_index[i]];
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
//Permute from iclass format to standard format
|
|
|
|
permutekey_rev(key_sel, key_sel_p);
|
|
|
|
diversifyKey(CSN, key_sel_p, div_key);
|
|
|
|
} else {
|
|
|
|
diversifyKey(CSN, KEY, div_key);
|
|
|
|
}
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
|
|
|
|
//calculate and return xor_div_key (ready for a key write command)
|
|
|
|
//print all div_keys if verbose
|
2019-03-10 18:20:22 +08:00
|
|
|
static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose) {
|
2019-03-10 07:00:59 +08:00
|
|
|
uint8_t old_div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
|
uint8_t new_div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
2019-03-10 06:35:06 +08:00
|
|
|
//get old div key
|
|
|
|
HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
|
|
|
|
//get new div key
|
|
|
|
HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
|
|
|
|
|
2019-08-01 06:14:09 +08:00
|
|
|
for (uint8_t i = 0; i < ARRAYLEN(old_div_key); i++) {
|
2019-03-10 06:35:06 +08:00
|
|
|
xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
|
|
|
|
}
|
|
|
|
if (verbose) {
|
2021-03-27 02:32:11 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Old div key......... %s", sprint_hex(old_div_key, 8));
|
|
|
|
PrintAndLogEx(SUCCESS, "New div key......... %s", sprint_hex(new_div_key, 8));
|
|
|
|
PrintAndLogEx(SUCCESS, "Xor div key......... " _YELLOW_("%s") "\n", sprint_hex(xor_div_key, 8));
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassCalcNewKey(const char *Cmd) {
|
2020-11-28 08:51:54 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass calcnewkey",
|
|
|
|
"Calculate new keys for updating (blocks 3 & 4)",
|
|
|
|
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --csn deadbeafdeadbeaf --elite2 -> e key to e key given csn\n"
|
|
|
|
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 --elite -> std key to e key read csn\n"
|
|
|
|
"hf iclass calcnewkey --old 1122334455667788 --new 2233445566778899 -> std to std read csn");
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0(NULL, "old", "<hex>", "Specify key as 8 hex bytes"),
|
2020-11-28 08:51:54 +08:00
|
|
|
arg_int0(NULL, "oki", "<dec>", "Old key index to select key from memory 'hf iclass managekeys'"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0(NULL, "new", "<hex>", "Specify key as 8 hex bytes"),
|
2020-11-28 08:51:54 +08:00
|
|
|
arg_int0(NULL, "nki", "<dec>", "New key index to select key from memory 'hf iclass managekeys'"),
|
|
|
|
arg_str0(NULL, "csn", "<hex>", "Specify a Card Serial Number (CSN) to diversify the key (if omitted will attempt to read a CSN)"),
|
|
|
|
arg_lit0(NULL, "elite", "Elite computations applied to new key"),
|
|
|
|
arg_lit0(NULL, "elite2", "Elite computations applied to both old and new key"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int old_key_len = 0;
|
|
|
|
uint8_t old_key[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 1, old_key, &old_key_len);
|
|
|
|
|
|
|
|
int old_key_nr = arg_get_int_def(ctx, 2, -1);
|
|
|
|
|
|
|
|
if (old_key_len > 0 && old_key_nr >= 0) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify old key or index, not both");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (old_key_len > 0) {
|
|
|
|
if (old_key_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "Old key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
} else if (old_key_nr >= 0) {
|
|
|
|
if (old_key_nr < ICLASS_KEYS_MAX) {
|
|
|
|
memcpy(old_key, iClass_Key_Table[old_key_nr], 8);
|
2021-03-27 02:32:11 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Using old key[%d]... " _GREEN_("%s"), old_key_nr, sprint_hex(iClass_Key_Table[old_key_nr], 8));
|
2020-11-28 08:51:54 +08:00
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Please specify an old key or old key index");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
int new_key_len = 0;
|
|
|
|
uint8_t new_key[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 3, new_key, &new_key_len);
|
|
|
|
|
|
|
|
int new_key_nr = arg_get_int_def(ctx, 4, -1);
|
|
|
|
|
|
|
|
if (new_key_len > 0 && new_key_nr >= 0) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify new key or index, not both");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (new_key_len > 0) {
|
|
|
|
if (new_key_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "New key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
} else if (new_key_nr >= 0) {
|
|
|
|
if (new_key_nr < ICLASS_KEYS_MAX) {
|
|
|
|
memcpy(new_key, iClass_Key_Table[new_key_nr], 8);
|
2021-03-27 02:32:11 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Using new key[%d]... " _GREEN_("%s"), new_key_nr, sprint_hex(iClass_Key_Table[new_key_nr], 8));
|
2020-11-28 08:51:54 +08:00
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Please specify an new key or old key index");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
int csn_len = 0;
|
|
|
|
uint8_t csn[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 5, csn, &csn_len);
|
2019-03-10 06:35:06 +08:00
|
|
|
bool givenCSN = false;
|
2020-11-28 08:51:54 +08:00
|
|
|
|
|
|
|
if (csn_len > 0) {
|
|
|
|
givenCSN = true;
|
|
|
|
if (csn_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "CSN is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
2020-11-28 08:51:54 +08:00
|
|
|
|
|
|
|
bool elite = arg_get_lit(ctx, 6);
|
|
|
|
bool old_elite = false;
|
|
|
|
|
|
|
|
if (arg_get_lit(ctx, 7)) {
|
|
|
|
elite = true;
|
|
|
|
old_elite = true;
|
|
|
|
}
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
|
|
|
uint8_t xor_div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-07-13 18:29:31 +08:00
|
|
|
if (givenCSN == false) {
|
2019-06-08 00:41:39 +08:00
|
|
|
uint8_t CCNR[12] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
2020-11-28 08:51:54 +08:00
|
|
|
if (select_only(csn, CCNR, true) == false) {
|
2019-09-11 22:56:08 +08:00
|
|
|
DropField();
|
2020-04-03 13:22:54 +08:00
|
|
|
return PM3_ESOFT;
|
2019-09-11 22:56:08 +08:00
|
|
|
}
|
2019-06-08 00:41:39 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-28 08:51:54 +08:00
|
|
|
HFiClassCalcNewKey(csn, old_key, new_key, xor_div_key, elite, old_elite, true);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
static int loadKeys(char *filename) {
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-06-09 22:25:56 +08:00
|
|
|
uint8_t *dump = NULL;
|
|
|
|
size_t bytes_read = 0;
|
2020-06-10 07:17:49 +08:00
|
|
|
if (loadFile_safe(filename, "", (void **)&dump, &bytes_read) != PM3_SUCCESS) {
|
2020-06-09 22:25:56 +08:00
|
|
|
PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", filename);
|
2020-04-03 13:22:54 +08:00
|
|
|
return PM3_EFILE;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (bytes_read > ICLASS_KEYS_MAX * 8) {
|
2019-10-06 05:56:19 +08:00
|
|
|
PrintAndLogEx(WARNING, "File is too long to load - bytes: %zu", bytes_read);
|
2019-03-10 06:35:06 +08:00
|
|
|
free(dump);
|
2020-04-03 13:22:54 +08:00
|
|
|
return PM3_EFILE;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
uint8_t i = 0;
|
2019-03-10 07:00:59 +08:00
|
|
|
for (; i < bytes_read / 8; i++)
|
|
|
|
memcpy(iClass_Key_Table[i], dump + (i * 8), 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
free(dump);
|
2020-04-22 08:22:55 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Loaded " _GREEN_("%2d") " keys from %s", i, filename);
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
static int saveKeys(char *filename) {
|
2019-03-10 06:35:06 +08:00
|
|
|
FILE *f;
|
|
|
|
f = fopen(filename, "wb");
|
|
|
|
if (!f) {
|
2019-05-15 16:24:06 +08:00
|
|
|
PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", filename);
|
|
|
|
return PM3_EFILE;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-03-10 07:00:59 +08:00
|
|
|
for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++) {
|
|
|
|
if (fwrite(iClass_Key_Table[i], 8, 1, f) != 1) {
|
2019-05-15 16:24:06 +08:00
|
|
|
PrintAndLogEx(WARNING, "save key failed to write to file:" _YELLOW_("%s"), filename);
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
fclose(f);
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
static int printKeys(void) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, "idx| key");
|
|
|
|
PrintAndLogEx(INFO, "---+------------------------");
|
2019-08-24 11:08:03 +08:00
|
|
|
for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++) {
|
2019-08-30 16:45:52 +08:00
|
|
|
if (memcmp(iClass_Key_Table[i], "\x00\x00\x00\x00\x00\x00\x00\x00", 8) == 0)
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, " %u |", i);
|
2019-08-30 16:45:52 +08:00
|
|
|
else
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, " %u | " _YELLOW_("%s"), i, sprint_hex(iClass_Key_Table[i], 8));
|
2019-08-24 11:08:03 +08:00
|
|
|
}
|
2020-10-18 17:50:20 +08:00
|
|
|
PrintAndLogEx(INFO, "---+------------------------");
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassManageKeys(const char *Cmd) {
|
2020-11-28 07:27:02 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass managekeys",
|
|
|
|
"Manage iCLASS Keys in client memory",
|
2020-12-05 20:27:39 +08:00
|
|
|
"hf iclass managekeys --ki 0 -k 1122334455667788 -> set key 1122334455667788 at index 0\n"
|
2020-11-28 07:27:02 +08:00
|
|
|
"hf iclass managekeys -f mykeys.bin --save -> save key file\n"
|
|
|
|
"hf iclass managekeys -f mykeys.bin --load -> load key file\n"
|
|
|
|
"hf iclass managekeys -p -> print keys");
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str0("f", "file", "<filename>", "Specify a filename to use with load or save operations"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str0("k", "key", "<hex>", "Access key as 8 hex bytes"),
|
2020-11-28 07:27:02 +08:00
|
|
|
arg_int0(NULL, "ki", "<dec>", "Specify key index to set key in memory"),
|
|
|
|
arg_lit0(NULL, "save", "Save keys in memory to file specified by filename"),
|
|
|
|
arg_lit0(NULL, "load", "Load keys to memory from file specified by filename"),
|
|
|
|
arg_lit0("p", "print", "Print keys loaded into memory"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
|
|
|
int key_len = 0;
|
|
|
|
uint8_t key[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 2, key, &key_len);
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t operation = 0;
|
|
|
|
|
2020-11-28 07:27:02 +08:00
|
|
|
if (key_len > 0) {
|
|
|
|
operation += 3;
|
|
|
|
if (key_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "Key is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int key_nr = arg_get_int_def(ctx, 3, -1);
|
|
|
|
|
|
|
|
if (key_nr >= 0) {
|
|
|
|
if (key_nr < ICLASS_KEYS_MAX) {
|
2020-11-28 21:42:02 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Current key[%d] " _YELLOW_("%s"), key_nr, sprint_hex_inrow(iClass_Key_Table[key_nr], 8));
|
2020-11-28 07:27:02 +08:00
|
|
|
} else {
|
2020-11-28 21:42:02 +08:00
|
|
|
PrintAndLogEx(ERR, "Key index is out-of-range");
|
2020-11-28 07:27:02 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
2020-11-28 07:27:02 +08:00
|
|
|
|
|
|
|
if (arg_get_lit(ctx, 4)) { //save
|
|
|
|
operation += 6;
|
|
|
|
}
|
|
|
|
if (arg_get_lit(ctx, 5)) { //load
|
|
|
|
operation += 5;
|
|
|
|
}
|
|
|
|
if (arg_get_lit(ctx, 6)) { //print
|
|
|
|
operation += 4;
|
|
|
|
}
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (operation == 0) {
|
2020-11-28 07:27:02 +08:00
|
|
|
PrintAndLogEx(ERR, "No operation specified (load, save, or print)\n");
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-03-10 07:00:59 +08:00
|
|
|
if (operation > 6) {
|
2020-11-28 07:27:02 +08:00
|
|
|
PrintAndLogEx(ERR, "Too many operations specified\n");
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-11-28 07:27:02 +08:00
|
|
|
if (operation > 4 && fnlen == 0) {
|
|
|
|
PrintAndLogEx(ERR, "You must enter a filename when loading or saving\n");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
if (key_len > 0 && key_nr == -1) {
|
|
|
|
PrintAndLogEx(ERR, "Please specify key index when specifying key");
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
switch (operation) {
|
|
|
|
case 3:
|
2020-11-28 07:27:02 +08:00
|
|
|
memcpy(iClass_Key_Table[key_nr], key, 8);
|
2020-11-28 21:42:02 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " New key[%d] " _GREEN_("%s"), key_nr, sprint_hex_inrow(iClass_Key_Table[key_nr], 8));
|
2019-08-24 11:08:03 +08:00
|
|
|
return PM3_SUCCESS;
|
2019-03-10 07:00:59 +08:00
|
|
|
case 4:
|
|
|
|
return printKeys();
|
|
|
|
case 5:
|
|
|
|
return loadKeys(filename);
|
|
|
|
case 6:
|
|
|
|
return saveKeys(filename);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2015-10-08 05:00:46 +08:00
|
|
|
}
|
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
static void add_key(uint8_t *key) {
|
|
|
|
|
|
|
|
uint8_t i;
|
|
|
|
for (i = 0; i < ICLASS_KEYS_MAX; i++) {
|
|
|
|
|
|
|
|
if (memcmp(iClass_Key_Table[i], key, 8) == 0) {
|
|
|
|
PrintAndLogEx(SUCCESS, "Key already at keyslot " _GREEN_("%d"), i);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (memcmp(iClass_Key_Table[i], "\x00\x00\x00\x00\x00\x00\x00\x00", 8) == 0) {
|
|
|
|
memcpy(iClass_Key_Table[i], key, 8);
|
|
|
|
PrintAndLogEx(SUCCESS, "Added key to keyslot " _GREEN_("%d"), i);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (i == ICLASS_KEYS_MAX) {
|
|
|
|
PrintAndLogEx(INFO, "Couldn't find an empty keyslot");
|
|
|
|
} else {
|
2021-04-08 15:34:11 +08:00
|
|
|
PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass managekeys -p") "` to view keys");
|
2020-08-03 23:42:05 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
|
2020-10-18 05:09:34 +08:00
|
|
|
/*
|
2020-10-18 17:50:20 +08:00
|
|
|
static int iclass_chk_keys(uint8_t *keyBlock, uint32_t keycount) {
|
|
|
|
|
|
|
|
iclass_premac_t *pre = calloc(keycount, sizeof(iclass_premac_t));
|
|
|
|
if (pre == NULL) {
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
|
|
|
|
|
|
|
// max 42 keys inside USB_COMMAND. 512/4 = 103 mac
|
|
|
|
uint32_t chunksize = keycount > (PM3_CMD_DATA_SIZE / 4) ? (PM3_CMD_DATA_SIZE / 4) : keycount;
|
|
|
|
bool lastChunk = false;
|
|
|
|
|
|
|
|
// fast push mode
|
|
|
|
conn.block_after_ACK = true;
|
|
|
|
|
|
|
|
// keep track of position of found key
|
|
|
|
uint8_t found_offset = 0;
|
|
|
|
uint32_t key_offset = 0;
|
|
|
|
// main keychunk loop
|
|
|
|
for (key_offset = 0; key_offset < keycount; key_offset += chunksize) {
|
|
|
|
|
|
|
|
uint64_t t2 = msclock();
|
|
|
|
uint8_t timeout = 0;
|
|
|
|
|
|
|
|
if (kbd_enter_pressed()) {
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(WARNING, "Aborted via keyboard!");
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint32_t keys = ((keycount - key_offset) > chunksize) ? chunksize : keycount - key_offset;
|
|
|
|
|
|
|
|
// last chunk?
|
|
|
|
if (keys == keycount - key_offset) {
|
|
|
|
lastChunk = true;
|
|
|
|
// Disable fast mode on last command
|
|
|
|
conn.block_after_ACK = false;
|
|
|
|
}
|
|
|
|
uint32_t flags = lastChunk << 8;
|
|
|
|
// bit 16
|
|
|
|
// - 1 indicates credit key
|
|
|
|
// - 0 indicates debit key (default)
|
|
|
|
flags |= (use_credit_key << 16);
|
|
|
|
|
|
|
|
clearCommandBuffer();
|
|
|
|
SendCommandOLD(CMD_HF_ICLASS_CHKKEYS, flags, keys, 0, pre + key_offset, 4 * keys);
|
|
|
|
PacketResponseNG resp;
|
|
|
|
|
|
|
|
bool looped = false;
|
|
|
|
while (!WaitForResponseTimeout(CMD_HF_ICLASS_CHKKEYS, &resp, 2000)) {
|
|
|
|
timeout++;
|
|
|
|
PrintAndLogEx(NORMAL, "." NOLF);
|
|
|
|
if (timeout > 120) {
|
|
|
|
PrintAndLogEx(WARNING, "\nNo response from Proxmark3. Aborting...");
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
looped = true;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (looped)
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
|
|
|
|
found_offset = resp.oldarg[1] & 0xFF;
|
|
|
|
uint8_t isOK = resp.oldarg[0] & 0xFF;
|
|
|
|
|
|
|
|
t2 = msclock() - t2;
|
|
|
|
switch (isOK) {
|
|
|
|
case 1: {
|
|
|
|
found_key = true;
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(SUCCESS, "Found valid key " _GREEN_("%s")
|
|
|
|
, sprint_hex(keyBlock + (key_offset + found_offset) * 8, 8)
|
|
|
|
);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 0: {
|
|
|
|
PrintAndLogEx(INPLACE, "Chunk [%d/%d]", key_offset, keycount);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 99: {
|
|
|
|
}
|
|
|
|
default: {
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// both keys found.
|
|
|
|
if (found_key) {
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
2020-10-18 05:09:34 +08:00
|
|
|
return PM3_SUCCESS;
|
|
|
|
}
|
|
|
|
*/
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassCheckKeys(const char *Cmd) {
|
2020-11-28 04:46:06 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass chk",
|
|
|
|
"Checkkeys loads a dictionary text file with 8byte hex keys to test authenticating against a iClass tag",
|
2020-11-28 20:46:16 +08:00
|
|
|
"hf iclass chk -f iclass_default_keys.dic\n"
|
|
|
|
"hf iclass chk -f iclass_default_keys.dic --elite");
|
2017-12-13 17:18:38 +08:00
|
|
|
|
2020-11-28 04:46:06 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str1("f", "file", "<filename>", "Dictionary file with default iclass keys"),
|
|
|
|
arg_lit0(NULL, "credit", "key is assumed to be the credit key"),
|
|
|
|
arg_lit0(NULL, "elite", "elite computations applied to key"),
|
|
|
|
arg_lit0(NULL, "raw", "no computations applied to key (raw)"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int fnlen = 0;
|
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
|
|
|
|
|
|
|
bool use_credit_key = arg_get_lit(ctx, 2);
|
|
|
|
bool use_elite = arg_get_lit(ctx, 3);
|
|
|
|
bool use_raw = arg_get_lit(ctx, 4);
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
uint8_t CSN[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
|
uint8_t CCNR[12] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
bool found_key = false;
|
2019-03-10 06:35:06 +08:00
|
|
|
//bool found_credit = false;
|
|
|
|
bool got_csn = false;
|
|
|
|
|
|
|
|
uint64_t t1 = msclock();
|
|
|
|
|
2020-05-20 14:58:28 +08:00
|
|
|
uint8_t *keyBlock = NULL;
|
|
|
|
uint32_t keycount = 0;
|
|
|
|
|
|
|
|
// load keys
|
|
|
|
int res = loadFileDICTIONARY_safe(filename, (void **)&keyBlock, 8, &keycount);
|
|
|
|
if (res != PM3_SUCCESS || keycount == 0) {
|
|
|
|
free(keyBlock);
|
|
|
|
return res;
|
|
|
|
}
|
2020-10-20 07:00:23 +08:00
|
|
|
|
|
|
|
// Get CSN / UID and CCNR
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Reading tag CSN / CCNR...");
|
|
|
|
for (uint8_t i = 0; i < ICLASS_AUTH_RETRY && !got_csn; i++) {
|
|
|
|
got_csn = select_only(CSN, CCNR, false);
|
|
|
|
if (got_csn == false)
|
|
|
|
PrintAndLogEx(WARNING, "one more try");
|
|
|
|
}
|
|
|
|
|
|
|
|
if (got_csn == false) {
|
|
|
|
PrintAndLogEx(WARNING, "Tried 10 times. Can't select card, aborting...");
|
|
|
|
free(keyBlock);
|
|
|
|
DropField();
|
|
|
|
return PM3_ESOFT;
|
|
|
|
}
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
iclass_premac_t *pre = calloc(keycount, sizeof(iclass_premac_t));
|
|
|
|
if (pre == NULL) {
|
|
|
|
return PM3_EMALLOC;
|
|
|
|
}
|
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
|
|
|
|
PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s"), sprint_hex(CSN, sizeof(CSN)));
|
|
|
|
PrintAndLogEx(SUCCESS, " CCNR: " _GREEN_("%s"), sprint_hex(CCNR, sizeof(CCNR)));
|
|
|
|
|
2020-08-18 17:11:43 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Generating diversified keys %s", (use_elite || use_raw) ? NOLF : "");
|
2019-03-10 06:35:06 +08:00
|
|
|
if (use_elite)
|
2020-08-18 17:11:43 +08:00
|
|
|
PrintAndLogEx(NORMAL, "using " _YELLOW_("elite algo"));
|
2019-03-10 06:35:06 +08:00
|
|
|
if (use_raw)
|
2020-08-18 17:11:43 +08:00
|
|
|
PrintAndLogEx(NORMAL, "using " _YELLOW_("raw mode"));
|
2019-08-29 13:47:17 +08:00
|
|
|
|
|
|
|
GenerateMacFrom(CSN, CCNR, use_raw, use_elite, keyBlock, keycount, pre);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Searching for " _YELLOW_("%s") " key...", (use_credit_key) ? "CREDIT" : "DEBIT");
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-10-18 17:50:20 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
// max 42 keys inside USB_COMMAND. 512/4 = 103 mac
|
2019-08-29 13:47:17 +08:00
|
|
|
uint32_t chunksize = keycount > (PM3_CMD_DATA_SIZE / 4) ? (PM3_CMD_DATA_SIZE / 4) : keycount;
|
2019-03-10 06:35:06 +08:00
|
|
|
bool lastChunk = false;
|
|
|
|
|
2019-04-30 20:19:26 +08:00
|
|
|
// fast push mode
|
|
|
|
conn.block_after_ACK = true;
|
2019-05-01 07:38:52 +08:00
|
|
|
|
2019-08-24 11:08:03 +08:00
|
|
|
// keep track of position of found key
|
|
|
|
uint8_t found_offset = 0;
|
|
|
|
uint32_t key_offset = 0;
|
2019-03-10 06:35:06 +08:00
|
|
|
// main keychunk loop
|
2019-10-20 04:39:28 +08:00
|
|
|
for (key_offset = 0; key_offset < keycount; key_offset += chunksize) {
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
uint64_t t2 = msclock();
|
|
|
|
uint8_t timeout = 0;
|
|
|
|
|
2019-07-11 19:01:34 +08:00
|
|
|
if (kbd_enter_pressed()) {
|
2020-08-18 17:11:43 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(WARNING, "Aborted via keyboard!");
|
2019-03-10 06:35:06 +08:00
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
2019-08-29 13:47:17 +08:00
|
|
|
uint32_t keys = ((keycount - key_offset) > chunksize) ? chunksize : keycount - key_offset;
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
// last chunk?
|
2019-08-29 13:47:17 +08:00
|
|
|
if (keys == keycount - key_offset) {
|
2019-03-10 06:35:06 +08:00
|
|
|
lastChunk = true;
|
2019-05-09 01:16:37 +08:00
|
|
|
// Disable fast mode on last command
|
|
|
|
conn.block_after_ACK = false;
|
|
|
|
}
|
2019-04-19 23:03:39 +08:00
|
|
|
uint32_t flags = lastChunk << 8;
|
2019-03-10 06:35:06 +08:00
|
|
|
// bit 16
|
|
|
|
// - 1 indicates credit key
|
|
|
|
// - 0 indicates debit key (default)
|
2019-04-19 23:03:39 +08:00
|
|
|
flags |= (use_credit_key << 16);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
clearCommandBuffer();
|
2019-08-24 11:08:03 +08:00
|
|
|
SendCommandOLD(CMD_HF_ICLASS_CHKKEYS, flags, keys, 0, pre + key_offset, 4 * keys);
|
2019-04-18 18:43:35 +08:00
|
|
|
PacketResponseNG resp;
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
bool looped = false;
|
2020-07-13 18:29:31 +08:00
|
|
|
while (!WaitForResponseTimeout(CMD_HF_ICLASS_CHKKEYS, &resp, 2000)) {
|
2019-03-10 06:35:06 +08:00
|
|
|
timeout++;
|
2020-08-29 21:22:26 +08:00
|
|
|
PrintAndLogEx(NORMAL, "." NOLF);
|
2019-03-10 06:35:06 +08:00
|
|
|
if (timeout > 120) {
|
2020-08-29 21:22:26 +08:00
|
|
|
PrintAndLogEx(WARNING, "\nNo response from Proxmark3. Aborting...");
|
2019-03-10 06:35:06 +08:00
|
|
|
goto out;
|
|
|
|
}
|
2020-08-03 23:42:05 +08:00
|
|
|
looped = true;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-08-03 23:42:05 +08:00
|
|
|
|
|
|
|
if (looped)
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2019-08-24 11:08:03 +08:00
|
|
|
found_offset = resp.oldarg[1] & 0xFF;
|
2019-04-18 05:44:48 +08:00
|
|
|
uint8_t isOK = resp.oldarg[0] & 0xFF;
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
t2 = msclock() - t2;
|
2019-03-10 07:00:59 +08:00
|
|
|
switch (isOK) {
|
2019-03-10 06:35:06 +08:00
|
|
|
case 1: {
|
2020-08-03 23:42:05 +08:00
|
|
|
found_key = true;
|
2020-08-18 17:11:43 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Found valid key " _GREEN_("%s")
|
2019-08-29 13:47:17 +08:00
|
|
|
, sprint_hex(keyBlock + (key_offset + found_offset) * 8, 8)
|
2019-03-10 07:00:59 +08:00
|
|
|
);
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 0: {
|
2020-08-21 22:47:18 +08:00
|
|
|
PrintAndLogEx(INPLACE, "Chunk [%d/%d]", key_offset, keycount);
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
case 99: {
|
|
|
|
}
|
2020-08-18 17:11:43 +08:00
|
|
|
default: {
|
2019-03-10 07:00:59 +08:00
|
|
|
break;
|
2020-08-18 17:11:43 +08:00
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// both keys found.
|
2020-08-03 23:42:05 +08:00
|
|
|
if (found_key) {
|
2019-03-10 06:35:06 +08:00
|
|
|
break;
|
|
|
|
}
|
2020-10-18 17:50:20 +08:00
|
|
|
}
|
2019-03-09 15:59:13 +08:00
|
|
|
|
|
|
|
out:
|
2019-03-10 06:35:06 +08:00
|
|
|
t1 = msclock() - t1;
|
2017-12-13 17:18:38 +08:00
|
|
|
|
2020-08-18 17:11:43 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-11-28 20:47:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "time in iclass chk " _YELLOW_("%.3f") " seconds", (float)t1 / 1000.0);
|
2019-03-10 06:35:06 +08:00
|
|
|
DropField();
|
2019-08-24 11:08:03 +08:00
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
if (found_key) {
|
|
|
|
uint8_t *key = keyBlock + (key_offset + found_offset) * 8;
|
|
|
|
add_key(key);
|
2019-08-24 11:08:03 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
free(pre);
|
|
|
|
free(keyBlock);
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2017-12-13 17:18:38 +08:00
|
|
|
}
|
2018-01-02 18:17:31 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
|
2020-07-21 20:09:05 +08:00
|
|
|
// this method tries to identify in which configuration mode a iCLASS / iCLASS SE reader is in.
|
2018-01-02 18:17:31 +08:00
|
|
|
// Standard or Elite / HighSecurity mode. It uses a default key dictionary list in order to work.
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassLookUp(const char *Cmd) {
|
2020-11-28 09:28:23 +08:00
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass lookup",
|
|
|
|
"Lookup keys takes some sniffed trace data and tries to verify what key was used against a dictionary file",
|
2020-11-28 20:46:16 +08:00
|
|
|
"hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic\n"
|
|
|
|
"hf iclass lookup --csn 9655a400f8ff12e0 --epurse f0ffffffffffffff --macs 0000000089cb984b -f iclass_default_keys.dic --elite");
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2020-11-28 09:28:23 +08:00
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str1("f", "file", "<filename>", "Dictionary file with default iclass keys"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_str1(NULL, "csn", "<hex>", "Specify CSN as 8 hex bytes"),
|
|
|
|
arg_str1(NULL, "epurse", "<hex>", "Specify ePurse as 8 hex bytes"),
|
2020-11-28 09:28:23 +08:00
|
|
|
arg_str1(NULL, "macs", "<hex>", "MACs"),
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_lit0(NULL, "raw", "no computations applied to key"),
|
2020-11-28 09:28:23 +08:00
|
|
|
arg_lit0(NULL, "elite", "Elite computations applied to key"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-28 09:28:23 +08:00
|
|
|
int fnlen = 0;
|
2019-03-10 06:35:06 +08:00
|
|
|
char filename[FILE_PATH_SIZE] = {0};
|
2020-11-28 09:28:23 +08:00
|
|
|
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-28 09:28:23 +08:00
|
|
|
int csn_len = 0;
|
|
|
|
uint8_t csn[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 2, csn, &csn_len);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-28 09:28:23 +08:00
|
|
|
if (csn_len > 0) {
|
|
|
|
if (csn_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "CSN is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-11-28 09:28:23 +08:00
|
|
|
int epurse_len = 0;
|
|
|
|
uint8_t epurse[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 3, epurse, &epurse_len);
|
|
|
|
|
|
|
|
if (epurse_len > 0) {
|
|
|
|
if (epurse_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "ePurse is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int macs_len = 0;
|
|
|
|
uint8_t macs[8] = {0};
|
|
|
|
CLIGetHexWithReturn(ctx, 4, macs, &macs_len);
|
|
|
|
|
|
|
|
if (macs_len > 0) {
|
|
|
|
if (macs_len != 8) {
|
|
|
|
PrintAndLogEx(ERR, "MAC is incorrect length");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
bool use_elite = arg_get_lit(ctx, 5);
|
|
|
|
bool use_raw = arg_get_lit(ctx, 6);
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
|
|
|
uint8_t CCNR[12];
|
|
|
|
uint8_t MAC_TAG[4] = { 0, 0, 0, 0 };
|
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
// stupid copy.. CCNR is a combo of epurse and reader nonce
|
2020-11-28 09:28:23 +08:00
|
|
|
memcpy(CCNR, epurse, 8);
|
|
|
|
memcpy(CCNR + 8, macs, 4);
|
2020-11-28 20:46:16 +08:00
|
|
|
memcpy(MAC_TAG, macs + 4, 4);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-28 09:28:23 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s"), sprint_hex(csn, sizeof(csn)));
|
|
|
|
PrintAndLogEx(SUCCESS, " Epurse: %s", sprint_hex(epurse, sizeof(epurse)));
|
|
|
|
PrintAndLogEx(SUCCESS, " MACS: %s", sprint_hex(macs, sizeof(macs)));
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " CCNR: " _GREEN_("%s"), sprint_hex(CCNR, sizeof(CCNR)));
|
|
|
|
PrintAndLogEx(SUCCESS, "TAG MAC: %s", sprint_hex(MAC_TAG, sizeof(MAC_TAG)));
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
// run time
|
|
|
|
uint64_t t1 = msclock();
|
|
|
|
|
2019-08-29 13:47:17 +08:00
|
|
|
uint8_t *keyBlock = NULL;
|
2020-05-20 14:58:28 +08:00
|
|
|
uint32_t keycount = 0;
|
2019-08-29 13:47:17 +08:00
|
|
|
|
|
|
|
// load keys
|
2019-08-30 16:45:52 +08:00
|
|
|
int res = loadFileDICTIONARY_safe(filename, (void **)&keyBlock, 8, &keycount);
|
2019-08-29 13:47:17 +08:00
|
|
|
if (res != PM3_SUCCESS || keycount == 0) {
|
2019-03-10 06:35:06 +08:00
|
|
|
free(keyBlock);
|
2019-08-29 13:47:17 +08:00
|
|
|
return res;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-08-30 16:45:52 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
//iclass_prekey_t
|
2020-11-28 20:46:16 +08:00
|
|
|
iclass_prekey_t *prekey = calloc(keycount, sizeof(iclass_prekey_t));
|
2019-03-10 07:00:59 +08:00
|
|
|
if (!prekey) {
|
2019-03-10 06:35:06 +08:00
|
|
|
free(keyBlock);
|
2019-08-29 13:47:17 +08:00
|
|
|
return PM3_EMALLOC;
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Generating diversified keys...");
|
2020-11-28 09:28:23 +08:00
|
|
|
GenerateMacKeyFrom(csn, CCNR, use_raw, use_elite, keyBlock, keycount, prekey);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
if (use_elite)
|
|
|
|
PrintAndLogEx(SUCCESS, "Using " _YELLOW_("elite algo"));
|
|
|
|
if (use_raw)
|
|
|
|
PrintAndLogEx(SUCCESS, "Using " _YELLOW_("raw mode"));
|
|
|
|
|
|
|
|
PrintAndLogEx(SUCCESS, "Sorting...");
|
2019-03-10 06:35:06 +08:00
|
|
|
|
|
|
|
// sort mac list.
|
2019-08-29 13:47:17 +08:00
|
|
|
qsort(prekey, keycount, sizeof(iclass_prekey_t), cmp_uint32);
|
2019-03-10 06:35:06 +08:00
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Searching for " _YELLOW_("%s") " key...", "DEBIT");
|
2019-03-10 06:35:06 +08:00
|
|
|
iclass_prekey_t *item;
|
|
|
|
iclass_prekey_t lookup;
|
|
|
|
memcpy(lookup.mac, MAC_TAG, 4);
|
|
|
|
|
|
|
|
// binsearch
|
2019-08-29 13:47:17 +08:00
|
|
|
item = (iclass_prekey_t *) bsearch(&lookup, prekey, keycount, sizeof(iclass_prekey_t), cmp_uint32);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2019-08-24 11:08:03 +08:00
|
|
|
if (item != NULL) {
|
2020-08-03 23:42:05 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Found valid key " _GREEN_("%s"), sprint_hex(item->key, 8));
|
|
|
|
add_key(item->key);
|
2019-08-24 11:08:03 +08:00
|
|
|
}
|
2019-08-30 16:45:52 +08:00
|
|
|
|
2020-08-03 23:42:05 +08:00
|
|
|
t1 = msclock() - t1;
|
2020-11-28 20:46:16 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "time in iclass lookup " _YELLOW_("%.3f") " seconds", (float)t1 / 1000.0);
|
2020-08-03 23:42:05 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
free(prekey);
|
|
|
|
free(keyBlock);
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2019-03-09 15:59:13 +08:00
|
|
|
}
|
2017-12-24 17:59:24 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
typedef struct {
|
|
|
|
uint8_t thread_idx;
|
2020-11-29 07:28:56 +08:00
|
|
|
uint8_t use_raw;
|
2020-11-28 20:46:16 +08:00
|
|
|
uint8_t use_elite;
|
|
|
|
uint32_t keycnt;
|
|
|
|
uint8_t csn[8];
|
|
|
|
uint8_t cc_nr[12];
|
|
|
|
uint8_t *keys;
|
|
|
|
union {
|
|
|
|
iclass_premac_t *premac;
|
|
|
|
iclass_prekey_t *prekey;
|
|
|
|
} list;
|
|
|
|
} PACKED iclass_thread_arg_t;
|
|
|
|
|
|
|
|
static size_t iclass_tc = 1;
|
|
|
|
|
2020-11-29 07:28:56 +08:00
|
|
|
static void *bf_generate_mac(void *thread_arg) {
|
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
iclass_thread_arg_t *targ = (iclass_thread_arg_t *)thread_arg;
|
|
|
|
const uint8_t idx = targ->thread_idx;
|
|
|
|
const uint8_t use_raw = targ->use_raw;
|
|
|
|
const uint8_t use_elite = targ->use_elite;
|
|
|
|
const uint32_t keycnt = targ->keycnt;
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
uint8_t *keys = targ->keys;
|
|
|
|
iclass_premac_t *list = targ->list.premac;
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
uint8_t csn[8];
|
|
|
|
uint8_t cc_nr[12];
|
|
|
|
memcpy(csn, targ->csn, sizeof(csn));
|
|
|
|
memcpy(cc_nr, targ->cc_nr, sizeof(cc_nr));
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
uint8_t key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
|
|
|
uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
for (uint32_t i = idx; i < keycnt; i += iclass_tc) {
|
2017-12-24 17:59:24 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
memcpy(key, keys + 8 * i, 8);
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
if (use_raw)
|
|
|
|
memcpy(div_key, key, 8);
|
|
|
|
else
|
2020-11-28 20:46:16 +08:00
|
|
|
HFiClassCalcDivKey(csn, key, div_key, use_elite);
|
2017-12-24 17:59:24 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
doMAC(cc_nr, div_key, list[i].mac);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-11-28 20:46:16 +08:00
|
|
|
return NULL;
|
2018-01-02 18:17:31 +08:00
|
|
|
}
|
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
// precalc diversified keys and their MAC
|
|
|
|
void GenerateMacFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, uint32_t keycnt, iclass_premac_t *list) {
|
2018-01-02 18:17:31 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
iclass_tc = num_CPUs();
|
|
|
|
pthread_t threads[iclass_tc];
|
|
|
|
iclass_thread_arg_t args[iclass_tc];
|
|
|
|
// init thread arguments
|
|
|
|
for (uint8_t i = 0; i < iclass_tc; i++) {
|
|
|
|
args[i].thread_idx = i;
|
2020-11-29 07:28:56 +08:00
|
|
|
args[i].use_raw = use_raw;
|
2020-11-28 20:46:16 +08:00
|
|
|
args[i].use_elite = use_elite;
|
|
|
|
args[i].keycnt = keycnt;
|
|
|
|
args[i].keys = keys;
|
|
|
|
args[i].list.premac = list;
|
2020-11-29 07:28:56 +08:00
|
|
|
|
|
|
|
memcpy(args[i].csn, CSN, sizeof(args[i].csn));
|
|
|
|
memcpy(args[i].cc_nr, CCNR, sizeof(args[i].cc_nr));
|
2020-11-28 20:46:16 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
for (int i = 0; i < iclass_tc; i++) {
|
|
|
|
int res = pthread_create(&threads[i], NULL, bf_generate_mac, (void *)&args[i]);
|
|
|
|
if (res) {
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(WARNING, "Failed to create pthreads. Quitting");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
for (int i = 0; i < iclass_tc; i++)
|
|
|
|
pthread_join(threads[i], NULL);
|
|
|
|
}
|
|
|
|
|
2020-11-29 07:28:56 +08:00
|
|
|
static void *bf_generate_mackey(void *thread_arg) {
|
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
iclass_thread_arg_t *targ = (iclass_thread_arg_t *)thread_arg;
|
|
|
|
const uint8_t idx = targ->thread_idx;
|
|
|
|
const uint8_t use_raw = targ->use_raw;
|
|
|
|
const uint8_t use_elite = targ->use_elite;
|
|
|
|
const uint32_t keycnt = targ->keycnt;
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
uint8_t *keys = targ->keys;
|
|
|
|
iclass_prekey_t *list = targ->list.prekey;
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
uint8_t csn[8];
|
|
|
|
uint8_t cc_nr[12];
|
|
|
|
memcpy(csn, targ->csn, sizeof(csn));
|
|
|
|
memcpy(cc_nr, targ->cc_nr, sizeof(cc_nr));
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
|
2018-01-02 18:17:31 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
for (uint32_t i = idx; i < keycnt; i += iclass_tc) {
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
memcpy(list[i].key, keys + 8 * i, 8);
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
if (use_raw)
|
|
|
|
memcpy(div_key, list[i].key, 8);
|
|
|
|
else
|
2020-11-28 20:46:16 +08:00
|
|
|
HFiClassCalcDivKey(csn, list[i].key, div_key, use_elite);
|
|
|
|
|
|
|
|
doMAC(cc_nr, div_key, list[i].mac);
|
|
|
|
}
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
void GenerateMacKeyFrom(uint8_t *CSN, uint8_t *CCNR, bool use_raw, bool use_elite, uint8_t *keys, uint32_t keycnt, iclass_prekey_t *list) {
|
2018-01-02 18:17:31 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
iclass_tc = num_CPUs();
|
|
|
|
pthread_t threads[iclass_tc];
|
|
|
|
iclass_thread_arg_t args[iclass_tc];
|
|
|
|
// init thread arguments
|
|
|
|
for (uint8_t i = 0; i < iclass_tc; i++) {
|
|
|
|
args[i].thread_idx = i;
|
2020-11-29 07:28:56 +08:00
|
|
|
args[i].use_raw = use_raw;
|
2020-11-28 20:46:16 +08:00
|
|
|
args[i].use_elite = use_elite;
|
|
|
|
args[i].keycnt = keycnt;
|
|
|
|
args[i].keys = keys;
|
|
|
|
args[i].list.prekey = list;
|
2020-11-29 07:28:56 +08:00
|
|
|
|
|
|
|
memcpy(args[i].csn, CSN, sizeof(args[i].csn));
|
|
|
|
memcpy(args[i].cc_nr, CCNR, sizeof(args[i].cc_nr));
|
2020-11-28 20:46:16 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
for (int i = 0; i < iclass_tc; i++) {
|
|
|
|
int res = pthread_create(&threads[i], NULL, bf_generate_mackey, (void *)&args[i]);
|
|
|
|
if (res) {
|
|
|
|
PrintAndLogEx(NORMAL, "");
|
|
|
|
PrintAndLogEx(WARNING, "Failed to create pthreads. Quitting");
|
|
|
|
return;
|
|
|
|
}
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2020-11-28 20:46:16 +08:00
|
|
|
|
|
|
|
for (int i = 0; i < iclass_tc; i++)
|
|
|
|
pthread_join(threads[i], NULL);
|
2020-11-29 07:28:56 +08:00
|
|
|
|
2020-11-28 20:46:16 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2017-12-24 17:59:24 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// print diversified keys
|
2020-05-20 14:58:28 +08:00
|
|
|
void PrintPreCalcMac(uint8_t *keys, uint32_t keycnt, iclass_premac_t *pre_list) {
|
2017-12-24 17:59:24 +08:00
|
|
|
|
2020-05-20 14:58:28 +08:00
|
|
|
iclass_prekey_t *b = calloc(keycnt, sizeof(iclass_prekey_t));
|
2019-03-10 07:00:59 +08:00
|
|
|
if (!b)
|
2019-03-10 06:35:06 +08:00
|
|
|
return;
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2020-05-20 14:58:28 +08:00
|
|
|
for (uint32_t i = 0; i < keycnt; i++) {
|
2019-03-10 07:00:59 +08:00
|
|
|
memcpy(b[i].key, keys + 8 * i, 8);
|
2019-03-10 06:35:06 +08:00
|
|
|
memcpy(b[i].mac, pre_list[i].mac, 4);
|
|
|
|
}
|
|
|
|
PrintPreCalc(b, keycnt);
|
|
|
|
free(b);
|
2018-01-02 18:17:31 +08:00
|
|
|
}
|
|
|
|
|
2020-05-20 14:58:28 +08:00
|
|
|
void PrintPreCalc(iclass_prekey_t *list, uint32_t itemcnt) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(NORMAL, "-----+------------------+---------");
|
|
|
|
PrintAndLogEx(NORMAL, "#key | key | mac");
|
|
|
|
PrintAndLogEx(NORMAL, "-----+------------------+---------");
|
2019-03-10 07:00:59 +08:00
|
|
|
for (int i = 0; i < itemcnt; i++) {
|
2017-12-24 17:59:24 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (i < 10) {
|
2019-10-06 05:56:19 +08:00
|
|
|
PrintAndLogEx(NORMAL, "[%2d] | %016" PRIx64 " | %08" PRIx64, i, bytes_to_num(list[i].key, 8), bytes_to_num(list[i].mac, 4));
|
2019-03-10 07:00:59 +08:00
|
|
|
} else if (i == 10) {
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "... skip printing the rest");
|
|
|
|
}
|
|
|
|
}
|
2017-12-24 17:59:24 +08:00
|
|
|
}
|
2017-12-13 17:18:38 +08:00
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
static void permute(uint8_t *data, uint8_t len, uint8_t *output) {
|
2018-02-05 00:19:08 +08:00
|
|
|
#define KEY_SIZE 8
|
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (len > KEY_SIZE) {
|
|
|
|
for (uint8_t m = 0; m < len; m += KEY_SIZE) {
|
|
|
|
permute(data + m, KEY_SIZE, output + m);
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
|
|
|
return;
|
|
|
|
}
|
2019-03-10 07:00:59 +08:00
|
|
|
if (len != KEY_SIZE) {
|
2020-05-14 22:59:02 +08:00
|
|
|
PrintAndLogEx(WARNING, "wrong key size\n");
|
2019-03-10 06:35:06 +08:00
|
|
|
return;
|
|
|
|
}
|
2019-06-08 00:41:39 +08:00
|
|
|
for (uint8_t i = 0; i < KEY_SIZE; ++i) {
|
|
|
|
uint8_t p = 0;
|
|
|
|
uint8_t mask = 0x80 >> i;
|
|
|
|
for (uint8_t j = 0; j < KEY_SIZE; ++j) {
|
2019-03-10 06:35:06 +08:00
|
|
|
p >>= 1;
|
|
|
|
if (data[j] & mask)
|
|
|
|
p |= 0x80;
|
|
|
|
}
|
|
|
|
output[i] = p;
|
|
|
|
}
|
2018-02-05 00:19:08 +08:00
|
|
|
}
|
2019-03-10 18:20:22 +08:00
|
|
|
static void permute_rev(uint8_t *data, uint8_t len, uint8_t *output) {
|
2019-03-10 06:35:06 +08:00
|
|
|
permute(data, len, output);
|
|
|
|
permute(output, len, data);
|
|
|
|
permute(data, len, output);
|
2018-02-05 00:19:08 +08:00
|
|
|
}
|
2019-03-10 18:20:22 +08:00
|
|
|
static void simple_crc(uint8_t *data, uint8_t len, uint8_t *output) {
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t crc = 0;
|
2019-03-10 07:00:59 +08:00
|
|
|
for (uint8_t i = 0; i < len; ++i) {
|
2019-03-10 06:35:06 +08:00
|
|
|
// seventh byte contains the crc.
|
2019-03-10 07:00:59 +08:00
|
|
|
if ((i & 0x7) == 0x7) {
|
2019-03-10 06:35:06 +08:00
|
|
|
output[i] = crc ^ 0xFF;
|
|
|
|
crc = 0;
|
|
|
|
} else {
|
|
|
|
output[i] = data[i];
|
|
|
|
crc ^= data[i];
|
|
|
|
}
|
|
|
|
}
|
2018-02-05 00:19:08 +08:00
|
|
|
}
|
|
|
|
// DES doesn't use the MSB.
|
2019-03-10 18:20:22 +08:00
|
|
|
static void shave(uint8_t *data, uint8_t len) {
|
2019-03-10 07:00:59 +08:00
|
|
|
for (uint8_t i = 0; i < len; ++i)
|
2019-03-10 06:35:06 +08:00
|
|
|
data[i] &= 0xFE;
|
2018-02-05 00:19:08 +08:00
|
|
|
}
|
2019-03-10 18:20:22 +08:00
|
|
|
static void generate_rev(uint8_t *data, uint8_t len) {
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t *key = calloc(len, sizeof(uint8_t));
|
|
|
|
PrintAndLogEx(SUCCESS, "input permuted key | %s \n", sprint_hex(data, len));
|
|
|
|
permute_rev(data, len, key);
|
|
|
|
PrintAndLogEx(SUCCESS, " unpermuted key | %s \n", sprint_hex(key, len));
|
|
|
|
shave(key, len);
|
|
|
|
PrintAndLogEx(SUCCESS, " key | %s \n", sprint_hex(key, len));
|
|
|
|
free(key);
|
2018-02-05 00:19:08 +08:00
|
|
|
}
|
2019-03-10 18:20:22 +08:00
|
|
|
static void generate(uint8_t *data, uint8_t len) {
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t *key = calloc(len, sizeof(uint8_t));
|
|
|
|
uint8_t *pkey = calloc(len, sizeof(uint8_t));
|
|
|
|
PrintAndLogEx(SUCCESS, " input key | %s \n", sprint_hex(data, len));
|
|
|
|
permute(data, len, pkey);
|
|
|
|
PrintAndLogEx(SUCCESS, "permuted key | %s \n", sprint_hex(pkey, len));
|
2019-03-10 07:00:59 +08:00
|
|
|
simple_crc(pkey, len, key);
|
2019-03-10 06:35:06 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " CRC'ed key | %s \n", sprint_hex(key, len));
|
|
|
|
free(key);
|
|
|
|
free(pkey);
|
2018-02-05 00:19:08 +08:00
|
|
|
}
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHFiClassPermuteKey(const char *Cmd) {
|
2018-02-05 00:19:08 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
uint8_t key[8] = {0};
|
|
|
|
uint8_t data[16] = {0};
|
|
|
|
int len = 0;
|
2019-03-09 15:59:13 +08:00
|
|
|
|
2020-10-05 02:52:59 +08:00
|
|
|
CLIParserContext *ctx;
|
2020-12-02 05:09:07 +08:00
|
|
|
CLIParserInit(&ctx, "hf iclass permutekey",
|
2020-10-05 02:52:59 +08:00
|
|
|
"Permute function from 'heart of darkness' paper.",
|
2020-12-02 05:09:07 +08:00
|
|
|
"hf iclass permutekey --reverse --key 0123456789abcdef\n"
|
|
|
|
"hf iclass permutekey --key ff55330f0055330f\n");
|
2020-10-05 02:52:59 +08:00
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2020-12-05 20:27:39 +08:00
|
|
|
arg_lit0("r", "reverse", "reverse permuted key"),
|
|
|
|
arg_str1(NULL, "key", "<hex>", "input key, 8 hex bytes"),
|
2020-10-05 02:52:59 +08:00
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
2020-10-18 05:09:34 +08:00
|
|
|
bool isReverse = arg_get_lit(ctx, 1);
|
2020-10-05 02:52:59 +08:00
|
|
|
CLIGetHexWithReturn(ctx, 2, data, &len);
|
2020-10-07 00:00:00 +08:00
|
|
|
CLIParserFree(ctx);
|
2018-02-05 00:19:08 +08:00
|
|
|
|
2019-03-10 06:35:06 +08:00
|
|
|
memcpy(key, data, 8);
|
2018-02-05 00:19:08 +08:00
|
|
|
|
2019-03-10 07:00:59 +08:00
|
|
|
if (isReverse) {
|
2019-03-10 06:35:06 +08:00
|
|
|
generate_rev(data, len);
|
2019-06-08 00:41:39 +08:00
|
|
|
uint8_t key_std_format[8] = {0};
|
2019-03-10 06:35:06 +08:00
|
|
|
permutekey_rev(key, key_std_format);
|
2020-07-09 06:21:26 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Standard NIST format key " _YELLOW_("%s") " \n", sprint_hex(key_std_format, 8));
|
2019-03-10 07:00:59 +08:00
|
|
|
} else {
|
2019-03-10 06:35:06 +08:00
|
|
|
generate(data, len);
|
2019-06-08 00:41:39 +08:00
|
|
|
uint8_t key_iclass_format[8] = {0};
|
2019-03-10 06:35:06 +08:00
|
|
|
permutekey(key, key_iclass_format);
|
2020-07-09 06:21:26 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "HID permuted iCLASS format: %s \n", sprint_hex(key_iclass_format, 8));
|
2019-03-10 06:35:06 +08:00
|
|
|
}
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2018-02-05 00:19:08 +08:00
|
|
|
}
|
|
|
|
|
2020-12-11 07:42:55 +08:00
|
|
|
static int CmdHFiClassEncode(const char *Cmd) {
|
|
|
|
|
2020-12-12 21:46:40 +08:00
|
|
|
CLIParserContext *ctx;
|
2020-12-11 07:42:55 +08:00
|
|
|
CLIParserInit(&ctx, "hf iclass encode",
|
|
|
|
"Encode binary wiegand to block 7",
|
|
|
|
"hf iclass encode --bin 10001111100000001010100011 --ki 0 -> FC 31 CN 337\n"
|
|
|
|
"hf iclass encode --bin 10001111100000001010100011 --ki 0 --elite -> FC 31 CN 337, writing w elite key"
|
2020-12-12 21:46:40 +08:00
|
|
|
);
|
2020-12-11 07:42:55 +08:00
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_str1(NULL, "bin", "<bin>", "Binary string i.e 0001001001"),
|
|
|
|
arg_int1(NULL, "ki", "<dec>", "Key index to select key from memory 'hf iclass managekeys'"),
|
|
|
|
arg_lit0(NULL, "credit", "key is assumed to be the credit key"),
|
|
|
|
arg_lit0(NULL, "elite", "elite computations applied to key"),
|
|
|
|
arg_lit0(NULL, "raw", "no computations applied to key"),
|
|
|
|
arg_str0(NULL, "enckey", "<hex>", "3DES transport key, 16 hex bytes"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
|
|
|
int bin_len = 63;
|
|
|
|
uint8_t bin[70] = {0};
|
|
|
|
CLIGetStrWithReturn(ctx, 1, bin, &bin_len);
|
|
|
|
|
|
|
|
int key_nr = arg_get_int_def(ctx, 2, -1);
|
|
|
|
bool auth = false;
|
|
|
|
|
|
|
|
uint8_t key[8] = {0};
|
|
|
|
if (key_nr >= 0) {
|
|
|
|
if (key_nr < ICLASS_KEYS_MAX) {
|
|
|
|
auth = true;
|
|
|
|
memcpy(key, iClass_Key_Table[key_nr], 8);
|
|
|
|
PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), key_nr, sprint_hex(iClass_Key_Table[key_nr], 8));
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "Key number is invalid");
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
bool use_credit_key = arg_get_lit(ctx, 3);
|
|
|
|
bool elite = arg_get_lit(ctx, 4);
|
|
|
|
bool rawkey = arg_get_lit(ctx, 5);
|
|
|
|
|
|
|
|
int enc_key_len = 0;
|
|
|
|
uint8_t enc_key[16] = {0};
|
|
|
|
uint8_t *enckeyptr = NULL;
|
|
|
|
bool have_enc_key = false;
|
2020-12-11 08:02:36 +08:00
|
|
|
bool use_sc = false;
|
2020-12-11 07:42:55 +08:00
|
|
|
CLIGetHexWithReturn(ctx, 6, enc_key, &enc_key_len);
|
|
|
|
|
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
|
|
|
if ((rawkey + elite) > 1) {
|
|
|
|
PrintAndLogEx(ERR, "Can not use a combo of 'elite', 'raw'");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (enc_key_len > 0) {
|
|
|
|
if (enc_key_len != 16) {
|
|
|
|
PrintAndLogEx(ERR, "Transport key must be 16 hex bytes (32 HEX characters)");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
have_enc_key = true;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (bin_len > 127) {
|
|
|
|
PrintAndLogEx(ERR, "Binary wiegand string must be less than 128 bits");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
|
2020-12-11 08:02:36 +08:00
|
|
|
if (have_enc_key == false) {
|
2021-04-04 23:01:43 +08:00
|
|
|
use_sc = IsCardHelperPresent(false);
|
2020-12-11 08:02:36 +08:00
|
|
|
if (use_sc == false) {
|
|
|
|
size_t keylen = 0;
|
|
|
|
int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&enckeyptr, &keylen);
|
|
|
|
if (res != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(ERR, "Failed to find the transport key");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
if (keylen != 16) {
|
|
|
|
PrintAndLogEx(ERR, "Failed to load transport key from file");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
memcpy(enc_key, enckeyptr, sizeof(enc_key));
|
|
|
|
free(enckeyptr);
|
2020-12-11 07:42:55 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-11 08:02:36 +08:00
|
|
|
uint8_t credential[] = {
|
|
|
|
0x03, 0x03, 0x03, 0x03, 0x00, 0x03, 0xE0, 0x17,
|
|
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
|
};
|
|
|
|
|
2020-12-11 07:42:55 +08:00
|
|
|
uint8_t data[8];
|
|
|
|
memset(data, 0, sizeof(data));
|
|
|
|
BitstreamOut bout = {data, 0, 0 };
|
|
|
|
|
|
|
|
for (int i = 0; i < 64 - bin_len - 1; i++) {
|
|
|
|
pushBit(&bout, 0);
|
|
|
|
}
|
|
|
|
// add binary sentinel bit.
|
|
|
|
pushBit(&bout, 1);
|
2020-12-12 21:46:40 +08:00
|
|
|
|
2020-12-11 07:42:55 +08:00
|
|
|
// convert binary string to hex bytes
|
|
|
|
for (int i = 0; i < bin_len; i++) {
|
|
|
|
char c = bin[i];
|
|
|
|
if (c == '1')
|
|
|
|
pushBit(&bout, 1);
|
|
|
|
else if (c == '0')
|
|
|
|
pushBit(&bout, 0);
|
|
|
|
else {
|
|
|
|
PrintAndLogEx(WARNING, "Ignoring '%c'", c);
|
|
|
|
}
|
|
|
|
}
|
2020-12-11 08:02:36 +08:00
|
|
|
memcpy(credential + 8, data, sizeof(data));
|
2020-12-11 07:42:55 +08:00
|
|
|
|
|
|
|
// encrypt with transport key
|
|
|
|
if (use_sc) {
|
2020-12-11 08:02:36 +08:00
|
|
|
Encrypt(credential + 8, credential + 8);
|
|
|
|
Encrypt(credential + 16, credential + 16);
|
|
|
|
Encrypt(credential + 24, credential + 24);
|
2020-12-11 07:42:55 +08:00
|
|
|
} else {
|
2020-12-11 08:02:36 +08:00
|
|
|
iclass_encrypt_block_data(credential + 8, enc_key);
|
|
|
|
iclass_encrypt_block_data(credential + 16, enc_key);
|
|
|
|
iclass_encrypt_block_data(credential + 24, enc_key);
|
|
|
|
}
|
|
|
|
|
|
|
|
int isok = PM3_SUCCESS;
|
|
|
|
// write
|
2020-12-12 21:46:40 +08:00
|
|
|
for (uint8_t i = 0; i < 4; i++) {
|
|
|
|
isok = iclass_write_block(6 + i, credential + (i * 8), key, use_credit_key, elite, rawkey, false, false, auth);
|
2020-12-11 08:02:36 +08:00
|
|
|
switch (isok) {
|
|
|
|
case PM3_SUCCESS:
|
2020-12-12 21:46:40 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " ) --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i * 8), 8));
|
2020-12-11 08:02:36 +08:00
|
|
|
break;
|
|
|
|
default:
|
|
|
|
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _RED_("fail") " )", 6 + i, 6 + i);
|
|
|
|
break;
|
|
|
|
}
|
2020-12-11 07:49:18 +08:00
|
|
|
}
|
2020-12-11 07:42:55 +08:00
|
|
|
return isok;
|
|
|
|
}
|
|
|
|
|
2020-11-21 02:07:51 +08:00
|
|
|
/*
|
2020-10-18 05:09:34 +08:00
|
|
|
static int CmdHFiClassAutopwn(const char *Cmd) {
|
|
|
|
|
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass autopwn",
|
|
|
|
"Tries to check keys, if found, dump card and save file",
|
|
|
|
"hf iclass autopwn\n");
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
|
|
|
CLIParserFree(ctx);
|
2020-10-20 07:00:23 +08:00
|
|
|
|
2020-10-18 05:09:34 +08:00
|
|
|
// Check keys.
|
|
|
|
|
|
|
|
// dump
|
|
|
|
|
|
|
|
PrintAndLogEx(INFO, "to be implemented");
|
|
|
|
return PM3_SUCCESS;
|
|
|
|
}
|
2020-11-21 02:07:51 +08:00
|
|
|
*/
|
2020-10-18 05:09:34 +08:00
|
|
|
|
2021-04-04 23:01:43 +08:00
|
|
|
static int CmdHFiClassConfigCard(const char * Cmd) {
|
|
|
|
|
|
|
|
CLIParserContext *ctx;
|
|
|
|
CLIParserInit(&ctx, "hf iclass configcard",
|
|
|
|
"Manage reader configuration card via Cardhelper",
|
2021-04-08 15:34:11 +08:00
|
|
|
"hf iclass configcard -l --> download config cards\n"
|
|
|
|
"hf iclass configcard -p --> print config card\n"
|
|
|
|
"hf iclass configcard --ci 1 --> use config card in slot 1\n"
|
|
|
|
"hf iclass configcard -g --ci 0 --> generate config file from slot 0"
|
|
|
|
|
2021-04-04 23:01:43 +08:00
|
|
|
);
|
|
|
|
|
|
|
|
void *argtable[] = {
|
|
|
|
arg_param_begin,
|
2021-04-08 15:34:11 +08:00
|
|
|
arg_int0(NULL, "ci", "<dec>", "use config slot at index"),
|
|
|
|
arg_int0(NULL, "ki", "<dec>", "Key index to select key from memory 'hf iclass managekeys'"),
|
2021-04-04 23:01:43 +08:00
|
|
|
arg_lit0("g", NULL, "generate card dump file"),
|
|
|
|
arg_lit0("l", NULL, "load available cards"),
|
|
|
|
arg_lit0("p", NULL, "print available cards"),
|
|
|
|
arg_param_end
|
|
|
|
};
|
|
|
|
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
int ccidx = arg_get_int_def(ctx, 1, -1);
|
|
|
|
int kidx = arg_get_int_def(ctx, 2, -1);
|
|
|
|
bool generate = arg_get_lit(ctx, 3);
|
|
|
|
bool load = arg_get_lit(ctx, 4);
|
|
|
|
bool print = arg_get_lit(ctx, 5);
|
2021-04-04 23:01:43 +08:00
|
|
|
CLIParserFree(ctx);
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
bool got_kr = false;
|
|
|
|
uint8_t key[8] = {0};
|
|
|
|
if (kidx >= 0) {
|
|
|
|
if (kidx < ICLASS_KEYS_MAX) {
|
|
|
|
got_kr = true;
|
|
|
|
memcpy(key, iClass_Key_Table[kidx], 8);
|
|
|
|
PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), kidx, sprint_hex(iClass_Key_Table[kidx], 8));
|
|
|
|
} else {
|
|
|
|
PrintAndLogEx(ERR, "--ki number is invalid");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-04 23:01:43 +08:00
|
|
|
if (load) {
|
|
|
|
if (load_config_cards() != PM3_SUCCESS) {
|
|
|
|
PrintAndLogEx(INFO, "failed to load, check your cardhelper");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (print) {
|
|
|
|
print_config_cards();
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
if (ccidx > -1 && ccidx < 14) {
|
|
|
|
const iclass_config_card_item_t *item = get_config_card_item(ccidx);
|
2021-04-04 23:01:43 +08:00
|
|
|
print_config_card(item);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (generate) {
|
2021-04-08 15:34:11 +08:00
|
|
|
const iclass_config_card_item_t *item = get_config_card_item(ccidx);
|
|
|
|
if (strstr(item->desc, "Keyroll") != NULL) {
|
|
|
|
if (got_kr == false) {
|
|
|
|
PrintAndLogEx(ERR, "please specifiy KEYROLL key!");
|
|
|
|
return PM3_EINVARG;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
generate_config_card(item, key, got_kr);
|
2021-04-04 23:01:43 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
return PM3_SUCCESS;
|
|
|
|
}
|
|
|
|
|
2016-01-20 02:31:34 +08:00
|
|
|
static command_t CommandTable[] = {
|
2020-08-03 23:42:05 +08:00
|
|
|
{"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("operations") " ---------------------"},
|
2021-01-05 06:06:06 +08:00
|
|
|
{"help", CmdHelp, AlwaysAvailable, "This help"},
|
|
|
|
// {"clone", CmdHFiClassClone, IfPm3Iclass, "Create a HID credential to Picopass / iCLASS tag"},
|
|
|
|
{"dump", CmdHFiClassDump, IfPm3Iclass, "Dump Picopass / iCLASS tag to file"},
|
|
|
|
{"info", CmdHFiClassInfo, AlwaysAvailable, "Tag information"},
|
|
|
|
{"list", CmdHFiClassList, AlwaysAvailable, "List iclass history"},
|
|
|
|
{"rdbl", CmdHFiClass_ReadBlock, IfPm3Iclass, "Read Picopass / iCLASS block"},
|
|
|
|
{"reader", CmdHFiClassReader, IfPm3Iclass, "Act like an Picopass / iCLASS reader"},
|
|
|
|
{"restore", CmdHFiClassRestore, IfPm3Iclass, "Restore a dump file onto a Picopass / iCLASS tag"},
|
|
|
|
{"sniff", CmdHFiClassSniff, IfPm3Iclass, "Eavesdrop Picopass / iCLASS communication"},
|
|
|
|
{"wrbl", CmdHFiClass_WriteBlock, IfPm3Iclass, "Write Picopass / iCLASS block"},
|
2020-08-03 23:42:05 +08:00
|
|
|
|
|
|
|
{"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("recovery") " ---------------------"},
|
2021-01-05 06:06:06 +08:00
|
|
|
// {"autopwn", CmdHFiClassAutopwn, IfPm3Iclass, "Automatic key recovery tool for iCLASS"},
|
|
|
|
{"chk", CmdHFiClassCheckKeys, IfPm3Iclass, "Check keys"},
|
|
|
|
{"loclass", CmdHFiClass_loclass, AlwaysAvailable, "Use loclass to perform bruteforce reader attack"},
|
|
|
|
{"lookup", CmdHFiClassLookUp, AlwaysAvailable, "Uses authentication trace to check for key in dictionary file"},
|
2020-08-03 23:42:05 +08:00
|
|
|
{"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("simulation") " ---------------------"},
|
2021-01-05 06:06:06 +08:00
|
|
|
{"sim", CmdHFiClassSim, IfPm3Iclass, "Simulate iCLASS tag"},
|
|
|
|
{"eload", CmdHFiClassELoad, IfPm3Iclass, "Load Picopass / iCLASS dump file into emulator memory"},
|
|
|
|
{"esave", CmdHFiClassESave, IfPm3Iclass, "Save emulator memory to file"},
|
|
|
|
{"eview", CmdHFiClassEView, IfPm3Iclass, "View emulator memory"},
|
2020-08-03 23:42:05 +08:00
|
|
|
|
2020-08-13 18:25:04 +08:00
|
|
|
{"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("utils") " ---------------------"},
|
2021-04-04 23:01:43 +08:00
|
|
|
{"configcard", CmdHFiClassConfigCard, AlwaysAvailable, "Reader configuration card"},
|
2021-01-05 06:06:06 +08:00
|
|
|
{"calcnewkey", CmdHFiClassCalcNewKey, AlwaysAvailable, "Calc diversified keys (blocks 3 & 4) to write new keys"},
|
|
|
|
{"encode", CmdHFiClassEncode, AlwaysAvailable, "Encode binary wiegand to block 7"},
|
|
|
|
{"encrypt", CmdHFiClassEncryptBlk, AlwaysAvailable, "Encrypt given block data"},
|
|
|
|
{"decrypt", CmdHFiClassDecrypt, AlwaysAvailable, "Decrypt given block data or tag dump file" },
|
|
|
|
{"managekeys", CmdHFiClassManageKeys, AlwaysAvailable, "Manage keys to use with iclass commands"},
|
|
|
|
{"permutekey", CmdHFiClassPermuteKey, IfPm3Iclass, "Permute function from 'heart of darkness' paper"},
|
|
|
|
{"view", CmdHFiClassView, AlwaysAvailable, "Display content from tag dump file"},
|
2019-05-02 02:48:15 +08:00
|
|
|
{NULL, NULL, NULL, NULL}
|
2011-05-18 20:33:32 +08:00
|
|
|
};
|
|
|
|
|
2019-04-13 00:41:14 +08:00
|
|
|
static int CmdHelp(const char *Cmd) {
|
|
|
|
(void)Cmd; // Cmd is not used so far
|
|
|
|
CmdsHelp(CommandTable);
|
2019-05-15 16:24:06 +08:00
|
|
|
return PM3_SUCCESS;
|
2019-04-13 00:41:14 +08:00
|
|
|
}
|
|
|
|
|
2019-03-10 18:20:22 +08:00
|
|
|
int CmdHFiClass(const char *Cmd) {
|
2019-03-10 06:35:06 +08:00
|
|
|
clearCommandBuffer();
|
2019-04-19 06:47:51 +08:00
|
|
|
return CmdsParse(CommandTable, Cmd);
|
2011-05-18 20:33:32 +08:00
|
|
|
}
|
|
|
|
|
2020-07-20 02:45:47 +08:00
|
|
|
//static void test_credential_type(void) {
|
2020-08-13 18:25:04 +08:00
|
|
|
// need AA1 key
|
|
|
|
// Block 5 -> tells if its a legacy or SIO, also tells which key to use.
|
|
|
|
|
|
|
|
// tech | blocks used | desc | num of payloads
|
|
|
|
// -------+-----------------------+-----------------------------------+------
|
|
|
|
// legacy | 6,7,8,9 | AA!, Access control payload | 1
|
|
|
|
// SE | 6,7,8,9,10,11,12 | AA1, Secure identity object (SIO) | 1
|
|
|
|
// SR | 6,7,8,9, | AA1, Access control payload | 2
|
|
|
|
// | 10,11,12,13,14,15,16 | AA1, Secure identity object (SIO) |
|
|
|
|
// SEOS | | |
|
2020-07-20 02:45:47 +08:00
|
|
|
//}
|
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
int info_iclass(void) {
|
2019-04-13 00:41:14 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint32_t flags = (FLAG_ICLASS_READER_INIT | FLAG_ICLASS_READER_CLEARTRACE);
|
2019-04-13 00:41:14 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
clearCommandBuffer();
|
|
|
|
SendCommandMIX(CMD_HF_ICLASS_READER, flags, 0, 0, NULL, 0);
|
|
|
|
PacketResponseNG resp;
|
2019-10-19 21:38:53 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
|
2019-10-19 21:38:53 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint8_t readStatus = resp.oldarg[0] & 0xff;
|
2019-09-11 22:36:41 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// no tag found or button pressed
|
|
|
|
if (readStatus == 0 || readStatus == 0xFF) {
|
|
|
|
DropField();
|
|
|
|
return PM3_EOPABORTED;
|
|
|
|
}
|
2020-06-29 01:13:01 +08:00
|
|
|
|
2021-04-08 15:34:11 +08:00
|
|
|
picopass_hdr_t *hdr = (picopass_hdr_t *)resp.data.asBytes;
|
|
|
|
picopass_ns_hdr_t *ns_hdr = (picopass_ns_hdr_t *)resp.data.asBytes;
|
2020-06-29 01:13:01 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
PrintAndLogEx(NORMAL, "");
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, "--------------------- " _CYAN_("Tag Information") " ----------------------");
|
2019-09-11 22:36:41 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (readStatus & FLAG_ICLASS_CSN) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s") " uid", sprint_hex(hdr->csn, sizeof(hdr->csn)));
|
2020-07-29 17:02:30 +08:00
|
|
|
}
|
2019-09-11 22:36:41 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (readStatus & FLAG_ICLASS_CONF) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " Config: %s card configuration", sprint_hex((uint8_t *)&hdr->conf, sizeof(hdr->conf)));
|
2020-07-29 17:02:30 +08:00
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// page mapping. If fuse0|1 == 0x01, card is in non-secure mode, with CSN, CONF, AIA as top 3 blocks.
|
|
|
|
// page9 in http://www.proxmark.org/files/Documents/13.56%20MHz%20-%20iClass/DS%20Picopass%202KS%20V1-0.pdf
|
|
|
|
uint8_t pagemap = get_pagemap(hdr);
|
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " AIA: %s application issuer area", sprint_hex(ns_hdr->app_issuer_area, sizeof(ns_hdr->app_issuer_area)));
|
2020-08-13 18:25:04 +08:00
|
|
|
} else {
|
2020-06-29 01:13:01 +08:00
|
|
|
|
2020-07-06 21:16:00 +08:00
|
|
|
if (readStatus & FLAG_ICLASS_CC) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, "E-purse: %s Card challenge, CC", sprint_hex(hdr->epurse, sizeof(hdr->epurse)));
|
2019-04-13 00:41:14 +08:00
|
|
|
}
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " Kd: %s debit key, hidden", sprint_hex(hdr->key_d, sizeof(hdr->key_d)));
|
|
|
|
PrintAndLogEx(SUCCESS, " Kc: %s credit key, hidden", sprint_hex(hdr->key_c, sizeof(hdr->key_c)));
|
2019-09-11 22:36:41 +08:00
|
|
|
|
2020-07-06 21:16:00 +08:00
|
|
|
if (readStatus & FLAG_ICLASS_AIA) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " AIA: %s application issuer area", sprint_hex(hdr->app_issuer_area, sizeof(hdr->app_issuer_area)));
|
2020-08-13 18:25:04 +08:00
|
|
|
}
|
2020-07-29 17:02:30 +08:00
|
|
|
}
|
2019-04-13 00:41:14 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (readStatus & FLAG_ICLASS_CONF) {
|
2020-08-13 18:25:04 +08:00
|
|
|
print_picopass_info(hdr);
|
2020-07-29 17:02:30 +08:00
|
|
|
}
|
2019-10-19 21:38:53 +08:00
|
|
|
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(INFO, "------------------------ " _CYAN_("Fingerprint") " -----------------------");
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
uint8_t aia[8];
|
2020-11-09 16:58:30 +08:00
|
|
|
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
|
2020-07-29 17:02:30 +08:00
|
|
|
memcpy(aia, ns_hdr->app_issuer_area, sizeof(aia));
|
2020-11-09 16:58:30 +08:00
|
|
|
} else {
|
2020-07-29 17:02:30 +08:00
|
|
|
memcpy(aia, hdr->app_issuer_area, sizeof(aia));
|
2020-11-09 16:58:30 +08:00
|
|
|
}
|
2019-10-19 21:38:53 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
// if CSN ends with FF12E0, it's inside HID CSN range.
|
|
|
|
bool isHidRange = (memcmp(hdr->csn + 5, "\xFF\x12\xE0", 3) == 0);
|
2019-04-13 00:41:14 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
bool legacy = (memcmp(aia, "\xff\xff\xff\xff\xff\xff\xff\xff", 8) == 0);
|
|
|
|
bool se_enabled = (memcmp(aia, "\xff\xff\xff\x00\x06\xff\xff\xff", 8) == 0);
|
2020-08-13 18:25:04 +08:00
|
|
|
|
2020-07-29 17:02:30 +08:00
|
|
|
if (isHidRange) {
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " CSN.......... " _YELLOW_("HID range"));
|
2020-07-29 17:02:30 +08:00
|
|
|
if (legacy)
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " Credential... " _GREEN_("iCLASS legacy"));
|
2020-07-29 17:02:30 +08:00
|
|
|
if (se_enabled)
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " Credential... " _GREEN_("iCLASS SE"));
|
2019-04-13 00:41:14 +08:00
|
|
|
} else {
|
2020-11-09 16:58:30 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " CSN.......... " _YELLOW_("outside HID range"));
|
2019-04-13 00:41:14 +08:00
|
|
|
}
|
2020-07-29 17:02:30 +08:00
|
|
|
|
|
|
|
uint8_t cardtype = get_mem_config(hdr);
|
2020-10-19 16:33:45 +08:00
|
|
|
PrintAndLogEx(SUCCESS, " Card type.... " _GREEN_("%s"), card_types[cardtype]);
|
2019-04-13 00:41:14 +08:00
|
|
|
}
|
|
|
|
DropField();
|
2020-07-29 17:02:30 +08:00
|
|
|
return PM3_SUCCESS;
|
2011-05-18 20:33:32 +08:00
|
|
|
}
|
2019-04-13 00:41:14 +08:00
|
|
|
|