Merge branch 'master' into fido2

This commit is contained in:
Oleg Moiseenko 2018-11-27 19:37:08 +02:00 committed by GitHub
commit 4e89ef7c24
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
18 changed files with 1264 additions and 546 deletions

View file

@ -83,7 +83,10 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
- Added `hf fido` commands that work with FIDO U2F authenticators (@merlokk)
- Added mbedtls instead of old polarssl (@merlokk)
- Added jansson (@merlokk)
- Added `hf emv scan` - save card's data to json file (@merlokk)
- Added `hf emv` `gpo`, `readrec`, `genac`, `challenge`, `intauth` - separate commands from `hf emc exec` (@merlokk)
- Added `hf fido` `assert` and `make` commands from fido2 protocol (authenticatorMakeCredential and authenticatorGetAssertion) (@merlokk)
### Fixed
- Changed driver file proxmark3.inf to support both old and new Product/Vendor IDs (piwi)
- Changed start sequence in Qt mode (fix: short commands hangs main Qt thread) (Merlok)

View file

@ -628,7 +628,7 @@ void ListenReaderField(int limit) {
void UsbPacketReceived(uint8_t *packet, int len) {
UsbCommand *c = (UsbCommand *)packet;
//Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d",len,c->cmd,c->arg[0],c->arg[1],c->arg[2]);
//Dbprintf("received %d bytes, with command: 0x%04x and args: %d %d %d", len, c->cmd, c->arg[0], c->arg[1], c->arg[2]);
switch(c->cmd) {
#ifdef WITH_LF
@ -1075,45 +1075,70 @@ void UsbPacketReceived(uint8_t *packet, int len) {
#ifdef WITH_FPC
case CMD_FPC_SEND: {
char dest[USB_CMD_DATA_SIZE] = { '\0' };
static const char* welcome = "Proxmark3 Serial interface ready\n";
strncat(dest, welcome, sizeof(dest) - strlen(dest) - 1);
sprintf(dest + strlen(dest) - 1, "Arg0 | 0x%" PRIx64 " \n", c->arg[0]);
sprintf(dest + strlen(dest) - 1, "Arg1 | 0x%" PRIx64 " \n", c->arg[1]);
sprintf(dest + strlen(dest) - 1, "Arg2 | 0x%" PRIx64 " \n", c->arg[2]);
sprintf(dest + strlen(dest) - 1, "bytes | 0x%02x 0x%02x 0x%02x 0x%02x \n"
,c->d.asBytes[0], c->d.asBytes[1], c->d.asBytes[2], c->d.asBytes[3]);
/*
UsbCommand txcmd;
for (size_t i=0; i < sizeof(UsbCommand); i++)
((uint8_t*)&txcmd)[i] = 0x00;
// Compose the outgoing command frame
txcmd.cmd = CMD_DEBUG_PRINT_STRING;
txcmd.arg[0] = len;
txcmd.arg[1] = 0;
txcmd.arg[2] = 0;
memcpy(txcmd.d.asBytes, dest, USB_CMD_DATA_SIZE);
usart_writebuffer((uint8_t*)&txcmd, sizeof(UsbCommand));
*/
DbpString("Starting to listen");
LED_A_ON();
StartTicks();
DbpString("Mutual USB/FPC sending from device to client");
/*
uint8_t rx[sizeof(UsbCommand)];
char at[11] = {'\0'};
static const char* s_at = "AT+BAUD8\0D\0A";
strncat(at, s_at, sizeof(at) - strlen(at) - 1);
DbpString("Try AT baud rate setting");
usart_init();
int16_t res = usart_writebuffer((uint8_t*)&at, sizeof(at));
WaitMS(1);
Dbprintf("SEND %d | %c%c%c%c%c%c%c%c%c%c%c", res, at[0], at[1], at[2], at[3], at[4], at[5], at[6], at[7], at[8], at[9], at[10]);
uint8_t my_rx[20];
memset(my_rx, 0, sizeof(my_rx));
res = usart_readbuffer(my_rx, sizeof(my_rx));
WaitMS(1);
Dbprintf("GOT %d | %c%c%c%c%c%c%c%c", res, my_rx[0], my_rx[1], my_rx[2], my_rx[3], my_rx[4], my_rx[5], my_rx[6], my_rx[7]);
*/
char dest[USB_CMD_DATA_SIZE] = { '\0' };
static const char* welcome = "Proxmark3 Serial interface via FPC ready\n";
strncat(dest, welcome, sizeof(dest) - strlen(dest) - 1);
sprintf(dest + strlen(dest) - 1, "| bytes 0x%02x 0x%02x 0x%02x 0x%02x \n"
, c->d.asBytes[0]
, c->d.asBytes[1]
, c->d.asBytes[2]
, c->d.asBytes[3]
);
UsbCommand txcmd = { CMD_DEBUG_PRINT_STRING, { strlen(dest), 0, 0 } };
memcpy(txcmd.d.asBytes, dest, sizeof(dest));
LED_A_ON();
usart_init();
usart_writebuffer((uint8_t*)&txcmd, sizeof(UsbCommand));
//usb
cmd_send(CMD_DEBUG_PRINT_STRING, strlen(dest), 0, 0, dest, strlen(dest));
LED_A_OFF();
/*
uint8_t my_rx[sizeof(UsbCommand)];
while (!BUTTON_PRESS() && !usb_poll_validate_length()) {
WaitMS(1);
if (usart_readbuffer(rx, sizeof(rx)) )
DbpString("got 544");
LED_B_INV();
if (usart_readbuffer(my_rx, sizeof(UsbCommand)) ) {
//UsbPacketReceived(my_rx, sizeof(my_rx));
UsbCommand *my = (UsbCommand *)my_rx;
if (mc->cmd > 0 ) {
Dbprintf("received command: 0x%04x and args: %d %d %d", my->cmd, my->arg[0], my->arg[1], my->arg[2]);
}
}
}
*/
cmd_send(CMD_DEBUG_PRINT_STRING, strlen(dest), 0, 0, dest, strlen(dest));
//DbpString("finished");
LED_A_OFF();
//cmd_send(CMD_DEBUG_PRINT_STRING, strlen(dest), 0, 0, dest, strlen(dest));
cmd_send(CMD_ACK,0,0,0,0,0);
StopTicks();
break;
}
#endif
@ -1196,7 +1221,6 @@ void UsbPacketReceived(uint8_t *packet, int len) {
// arg0 = startindex
// arg1 = length bytes to transfer
// arg2 = RFU
//Dbprintf("transfer to client parameters: %" PRIu32 " | %" PRIu32 " | %" PRIu32, startidx, numofbytes, c->arg[2]);
for (size_t i = 0; i < numofbytes; i += USB_CMD_DATA_SIZE) {
len = MIN((numofbytes - i), USB_CMD_DATA_SIZE);
@ -1231,7 +1255,6 @@ void UsbPacketReceived(uint8_t *packet, int len) {
if (!FlashInit()) {
break;
}
//Flash_CheckBusy(BUSY_TIMEOUT);
for(size_t i = 0; i < len; i += size) {
len = MIN((len - i), size);

View file

@ -575,10 +575,13 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
// this may destroy the bigbuf so be sure this is called before calling SimulateTagLowFrequencyEx
void SimulateTagLowFrequencyEx(int period, int gap, int ledcontrol, int numcycles) {
// start us timer
StartTicks();
//FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE );
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
SpinDelay(20);
WaitMS(20);
int i = 0, x = 0;
uint8_t *buf = BigBuf_get_addr();
@ -617,7 +620,7 @@ void SimulateTagLowFrequencyEx(int period, int gap, int ledcontrol, int numcycle
goto OUT;
}
if(buf[i])
if (buf[i])
OPEN_COIL();
else
SHORT_COIL();
@ -631,17 +634,18 @@ void SimulateTagLowFrequencyEx(int period, int gap, int ledcontrol, int numcycle
}
i++;
if(i == period) {
if (i == period) {
i = 0;
if (gap) {
SHORT_COIL();
SpinDelayUs(gap);
WaitUS(gap);
}
}
if (ledcontrol) LED_D_OFF();
}
OUT:
StopTicks();
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
}
@ -665,44 +669,44 @@ static void fc(int c, int *n)
int idx;
// for when we want an fc8 pattern every 4 logical bits
if(c==0) {
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
if (c == 0) {
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
}
// an fc/8 encoded bit is a bit pattern of 11110000 x6 = 48 samples
if(c==8) {
for (idx=0; idx<6; idx++) {
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
if (c == 8) {
for (idx=0; idx < 6; idx++) {
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
}
}
// an fc/10 encoded bit is a bit pattern of 1111100000 x5 = 50 samples
if(c==10) {
for (idx=0; idx<5; idx++) {
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=1;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
dest[((*n)++)]=0;
if (c == 10) {
for (idx = 0; idx < 5; idx++) {
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 1;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
dest[((*n)++)] = 0;
}
}
}
@ -720,7 +724,7 @@ static void fcSTT(int *n) {
static void fcAll(uint8_t fc, int *n, uint8_t clock, uint16_t *modCnt)
{
uint8_t *dest = BigBuf_get_addr();
uint8_t halfFC = fc/2;
uint8_t halfFC = fc >> 1;
uint8_t wavesPerClock = clock/fc;
uint8_t mod = clock % fc; //modifier
uint8_t modAdj = fc/mod; //how often to apply modifier
@ -729,21 +733,22 @@ static void fcAll(uint8_t fc, int *n, uint8_t clock, uint16_t *modCnt)
// loop through clock - step field clock
for (uint8_t idx=0; idx < wavesPerClock; idx++){
// put 1/2 FC length 1's and 1/2 0's per field clock wave (to create the wave)
memset(dest+(*n), 0, fc-halfFC); //in case of odd number use extra here
memset(dest+(*n)+(fc-halfFC), 1, halfFC);
memset(dest + (*n), 0, fc - halfFC); //in case of odd number use extra here
memset(dest + (*n) + (fc - halfFC), 1, halfFC);
*n += fc;
}
if (mod>0) (*modCnt)++;
if ((mod>0) && modAdjOk){ //fsk2
if (mod > 0) (*modCnt)++;
if ((mod > 0) && modAdjOk){ //fsk2
if ((*modCnt % modAdj) == 0){ //if 4th 8 length wave in a rf/50 add extra 8 length wave
memset(dest+(*n), 0, fc-halfFC);
memset(dest+(*n)+(fc-halfFC), 1, halfFC);
memset(dest + (*n), 0, fc - halfFC);
memset(dest + (*n) + ( fc - halfFC), 1, halfFC);
*n += fc;
}
}
if (mod>0 && !modAdjOk){ //fsk1
memset(dest+(*n), 0, mod-(mod/2));
memset(dest+(*n)+(mod-(mod/2)), 1, mod/2);
if (mod > 0 && !modAdjOk){ //fsk1
memset(dest + (*n), 0, mod - (mod >> 1));
memset(dest + (*n) + (mod - (mod >> 1)), 1, mod >> 1);
*n += mod;
}
}
@ -781,11 +786,11 @@ void CmdHIDsimTAGEx( uint32_t hi, uint32_t lo, int ledcontrol, int numcycles) {
fcSTT(&n);
// manchester encode bits 43 to 32
for (i=11; i>=0; i--) {
for (i = 11; i >= 0; i--) {
if ((i%4)==3) fc(0, &n);
if ((i % 4) == 3) fc(0, &n);
if ((hi>>i) & 1) {
if ((hi >> i) & 1) {
fc(10, &n); fc(8, &n); // low-high transition
} else {
fc(8, &n); fc(10, &n); // high-low transition
@ -793,11 +798,11 @@ void CmdHIDsimTAGEx( uint32_t hi, uint32_t lo, int ledcontrol, int numcycles) {
}
// manchester encode bits 31 to 0
for (i=31; i>=0; i--) {
for (i = 31; i >= 0; i--) {
if ((i%4)==3) fc(0, &n);
if ((i % 4) == 3) fc(0, &n);
if ((lo>>i) & 1) {
if (( lo >> i ) & 1) {
fc(10, &n); fc(8, &n); // low-high transition
} else {
fc(8, &n); fc(10, &n); // high-low transition

View file

@ -171,13 +171,6 @@ int usage_hf_14a_info(void){
PrintAndLogEx(NORMAL, " n test for nack bug");
return 0;
}
int usage_hf_14a_apdu(void) {
PrintAndLogEx(NORMAL, "Usage: hf 14a apdu [-s] [-k] [-t] <APDU (hex)>");
PrintAndLogEx(NORMAL, " -s activate field and select card");
PrintAndLogEx(NORMAL, " -k leave the signal field ON after receive response");
PrintAndLogEx(NORMAL, " -t executes TLV decoder if it possible. TODO!!!!");
return 0;
}
int usage_hf_14a_antifuzz(void) {
PrintAndLogEx(NORMAL, "Usage: hf 14a antifuzz [4|7|10]");
PrintAndLogEx(NORMAL, " <len> determine which anticollision phase the command will target.");
@ -190,6 +183,45 @@ int CmdHF14AList(const char *Cmd) {
return 0;
}
int Hf14443_4aGetCardData(iso14a_card_select_t * card) {
UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
SendCommand(&c);
UsbCommand resp;
WaitForResponse(CMD_ACK,&resp);
memcpy(card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
uint64_t select_status = resp.arg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
if(select_status == 0) {
PrintAndLog("E->iso14443a card select failed");
return 1;
}
if(select_status == 2) {
PrintAndLog("E->Card doesn't support iso14443-4 mode");
return 1;
}
if(select_status == 3) {
PrintAndLog("E->Card doesn't support standard iso14443-3 anticollision");
PrintAndLog("\tATQA : %02x %02x", card->atqa[1], card->atqa[0]);
return 1;
}
PrintAndLog(" UID: %s", sprint_hex(card->uid, card->uidlen));
PrintAndLog("ATQA: %02x %02x", card->atqa[1], card->atqa[0]);
PrintAndLog(" SAK: %02x [%" PRIu64 "]", card->sak, resp.arg[0]);
if(card->ats_len < 3) { // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
PrintAndLog("E-> Error ATS length(%d) : %s", card->ats_len, sprint_hex(card->ats, card->ats_len));
return 1;
}
PrintAndLog(" ATS: %s", sprint_hex(card->ats, card->ats_len));
return 0;
}
int CmdHF14AReader(const char *Cmd) {
uint32_t cm = ISO14A_CONNECT;
@ -875,57 +907,35 @@ int ExchangeAPDU14a(uint8_t *datain, int datainlen, bool activateField, bool lea
return 0;
}
// ISO14443-4. 7. Half-duplex block transmission protocol
int CmdHF14AAPDU(const char *cmd) {
uint8_t data[USB_CMD_DATA_SIZE];
int datalen = 0;
bool activateField = false;
bool leaveSignalON = false;
bool decodeTLV = false;
if (strlen(cmd) < 2) return usage_hf_14a_apdu();
int cmdp = 0;
while(param_getchar(cmd, cmdp) != 0x00) {
char c = param_getchar(cmd, cmdp);
if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
switch (tolower(param_getchar_indx(cmd, 1, cmdp))) {
case 'h':
return usage_hf_14a_apdu();
case 's':
activateField = true;
break;
case 'k':
leaveSignalON = true;
break;
case 't':
decodeTLV = true;
break;
default:
PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
return 1;
}
CLIParserInit("hf 14a apdu",
"Sends an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol (T=CL)",
"Sample:\n\thf 14a apdu -st 00A404000E325041592E5359532E444446303100\n");
void* argtable[] = {
arg_param_begin,
arg_lit0("sS", "select", "activate field and select card"),
arg_lit0("kK", "keep", "leave the signal field ON after receive response"),
arg_lit0("tT", "tlv", "executes TLV decoder if it possible"),
arg_strx1(NULL, NULL, "<APDU (hex)>", NULL),
arg_param_end
};
CLIExecWithReturn(cmd, argtable, false);
if (isxdigit(c)) {
activateField = arg_get_lit(1);
leaveSignalON = arg_get_lit(2);
decodeTLV = arg_get_lit(3);
// len = data + PCB(1b) + CRC(2b)
switch(param_gethex_to_eol(cmd, cmdp, data, sizeof(data) - 1 - 2, &datalen)) {
case 1:
PrintAndLogEx(WARNING, "invalid HEX value.");
return 1;
case 2:
PrintAndLogEx(WARNING, "APDU too large.");
return 1;
case 3:
PrintAndLogEx(WARNING, "hex must have even number of digits.");
return 1;
}
// we get all the hex to end of line with spaces
break;
}
cmdp++;
}
CLIGetHexBLessWithReturn(4, data, &datalen, 1 + 2);
CLIParserFree();
PrintAndLogEx(NORMAL, ">>>>[%s%s%s] %s", activateField ? "sel ": "", leaveSignalON ? "keep ": "", decodeTLV ? "TLV": "", sprint_hex(data, datalen));
int res = ExchangeAPDU14a(data, datalen, activateField, leaveSignalON, data, USB_CMD_DATA_SIZE, &datalen);

View file

@ -50,6 +50,7 @@ extern int CmdHF14ACUIDs(const char *Cmd);
extern int CmdHF14AAntiFuzz(const char *cmd);
extern char* getTagInfo(uint8_t uid);
extern int Hf14443_4aGetCardData(iso14a_card_select_t * card);
extern int ExchangeAPDU14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);
extern int ExchangeRAW14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);

View file

@ -2290,7 +2290,6 @@ int CmdHFiClassLookUp(const char *Cmd) {
t1 = msclock() - t1;
PrintAndLogEx(NORMAL, "\nTime in iclass : %.0f seconds\n", (float)t1/1000.0);
DropField();
free(prekey);
free(keyBlock);
PrintAndLogEx(NORMAL, "");
@ -2527,7 +2526,7 @@ static command_t CommandTable[] = {
{"encryptblk", CmdHFiClassEncryptBlk, 1, "<BlockData> Encrypt given block data"},
{"list", CmdHFiClassList, 0, " (Deprecated) List iClass history"},
{"loclass", CmdHFiClass_loclass, 1, "[options..] Use loclass to perform bruteforce of reader attack dump"},
{"lookup", CmdHFiClassLookUp, 0, "[options..] Uses authentication trace to check for key in dictionary file"},
{"lookup", CmdHFiClassLookUp, 1, "[options..] Uses authentication trace to check for key in dictionary file"},
{"managekeys", CmdHFiClassManageKeys, 1, "[options..] Manage the keys to use with iClass"},
{"permutekey", CmdHFiClassPermuteKey, 0, " Permute function from 'heart of darkness' paper"},
{"readblk", CmdHFiClass_ReadBlock, 0, "[options..] Authenticate and Read iClass block"},

View file

@ -344,7 +344,7 @@ int CmdSmartUpgrade(const char *Cmd) {
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
return 1;
}
if ( (resp.arg[0] && 0xFF ) )
if ( (resp.arg[0] & 0xFF ) )
PrintAndLogEx(SUCCESS, "Smartcard socket firmware upgraded successful");
else
PrintAndLogEx(FAILED, "Smartcard socket firmware updating failed");

View file

@ -146,7 +146,7 @@ static int getCommand(UsbCommand* response) {
// that we weren't necessarily expecting, for example a debug print.
//-----------------------------------------------------------------------------
static void UsbCommandReceived(UsbCommand* c) {
switch(c->cmd) {
// First check if we are handling a debug message
case CMD_DEBUG_PRINT_STRING: {
@ -237,7 +237,7 @@ __attribute__((force_align_arg_pointer))
#endif
*uart_communication(void *targ) {
communication_arg_t *conn = (communication_arg_t*)targ;
size_t rxlen;
size_t rxlen, totallen = 0;
UsbCommand rx;
UsbCommand *prx = &rx;
@ -247,22 +247,29 @@ __attribute__((force_align_arg_pointer))
disableAppNap("Proxmark3 polling UART");
#endif
while (conn->run) {
rxlen = 0;
bool ACK_received = false;
if (uart_receive(sp, (uint8_t *)prx, sizeof(UsbCommand) - (prx - &rx), &rxlen) && rxlen) {
prx += rxlen;
totallen += rxlen;
if (prx - &rx < sizeof(UsbCommand)) {
PrintAndLogEx(NORMAL, "Foo %d | %d (will loop)", prx - &rx, rxlen);
if ( totallen < sizeof(UsbCommand)) {
// iceman: this looping is no working as expected at all. The reassemble of package is nonfunctional.
// solved so far with increasing the timeouts of the serial port configuration.
PrintAndLogEx(NORMAL, "Foo %d | %d (loop)", prx - &rx, rxlen);
continue;
}
totallen = 0;
UsbCommandReceived(&rx);
if (rx.cmd == CMD_ACK) {
ACK_received = true;
}
}
prx = &rx;
pthread_mutex_lock(&txBufferMutex);
@ -297,7 +304,6 @@ __attribute__((force_align_arg_pointer))
#if defined(__MACH__) && defined(__APPLE__)
enableAppNap();
#endif
pthread_exit(NULL);
return NULL;

File diff suppressed because it is too large Load diff

View file

@ -27,6 +27,11 @@
#include <string.h>
#include <stdarg.h>
static bool strictExecution = true;
void PKISetStrictExecution(bool se) {
strictExecution = se;
}
static const unsigned char empty_tlv_value[] = {};
static const struct tlv empty_tlv = {.tag = 0x0, .len = 0, .value = empty_tlv_value};
@ -108,9 +113,12 @@ static unsigned char *emv_pki_decode_message(const struct emv_pk *enc_pk,
printf("ERROR: Calculated wrong hash\n");
printf("decoded: %s\n",sprint_hex(data + data_len - 1 - hash_len, hash_len));
printf("calculated: %s\n",sprint_hex(crypto_hash_read(ch), hash_len));
crypto_hash_close(ch);
free(data);
return NULL;
if (strictExecution) {
crypto_hash_close(ch);
free(data);
return NULL;
}
}
crypto_hash_close(ch);

View file

@ -21,6 +21,8 @@
#include <stddef.h>
extern void PKISetStrictExecution(bool se);
struct emv_pk *emv_pki_recover_issuer_cert(const struct emv_pk *pk, struct tlvdb *db);
struct emv_pk *emv_pki_recover_icc_cert(const struct emv_pk *pk, struct tlvdb *db, const struct tlv *sda_tlv);
struct emv_pk *emv_pki_recover_icc_pe_cert(const struct emv_pk *pk, struct tlvdb *db);

View file

@ -9,6 +9,8 @@
//-----------------------------------------------------------------------------
#include "emvcore.h"
#include "emvjson.h"
#include "util_posix.h"
// Got from here. Thanks)
// https://eftlab.co.uk/index.php/site-map/knowledge-base/211-emv-aid-rid-pix
@ -18,6 +20,13 @@ static const char *PSElist [] = {
};
//static const size_t PSElistLen = sizeof(PSElist)/sizeof(char*);
char *TransactionTypeStr[] = {
"MSD",
"VSDC",
"qVCDCMCHIP",
"CDA"
};
typedef struct {
enum CardPSVendor vendor;
const char* aid;
@ -257,9 +266,14 @@ int EMVExchangeEx(bool ActivateField, bool LeaveFieldON, sAPDU apdu, bool Includ
*sw = isw;
if (isw != 0x9000) {
if (APDULogging)
PrintAndLogEx(WARNING, "APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
return 5;
if (APDULogging) {
if (*sw >> 8 == 0x61) {
PrintAndLogEx(ERR, "APDU chaining len:%02x -->", *sw & 0xff);
} else {
PrintAndLogEx(ERR, "APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
return 5;
}
}
}
// add to tlv tree
@ -527,7 +541,7 @@ int trSDA(struct tlvdb *tlv) {
if (!sda_tlv || sda_tlv->len < 1) {
emv_pk_free(issuer_pk);
emv_pk_free(pk);
PrintAndLogEx(WARNING, "Error: Can't find input list for Offline Data Authentication. Exit.");
PrintAndLogEx(WARNING, "Can't find input list for Offline Data Authentication. Exit.");
return 3;
}
@ -539,7 +553,7 @@ int trSDA(struct tlvdb *tlv) {
} else {
emv_pk_free(issuer_pk);
emv_pk_free(pk);
PrintAndLogEx(WARNING, "Error: SSAD verify error");
PrintAndLogEx(WARNING, "SSAD verify error");
return 4;
}
@ -851,3 +865,63 @@ int trCDA(struct tlvdb *tlv, struct tlvdb *ac_tlv, struct tlv *pdol_data_tlv, st
emv_pk_free(icc_pk);
return 0;
}
int RecoveryCertificates(struct tlvdb *tlvRoot, json_t *root) {
struct emv_pk *pk = get_ca_pk(tlvRoot);
if (!pk) {
PrintAndLog("ERROR: Key not found. Exit.");
return 1;
}
struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlvRoot);
if (!issuer_pk) {
emv_pk_free(pk);
PrintAndLog("WARNING: Issuer certificate not found. Exit.");
return 2;
}
PrintAndLog("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx",
issuer_pk->rid[0],
issuer_pk->rid[1],
issuer_pk->rid[2],
issuer_pk->rid[3],
issuer_pk->rid[4],
issuer_pk->index,
issuer_pk->serial[0],
issuer_pk->serial[1],
issuer_pk->serial[2]
);
JsonSaveBufAsHex(root, "$.ApplicationData.RID", issuer_pk->rid, 5);
char *issuer_pk_c = emv_pk_dump_pk(issuer_pk);
JsonSaveStr(root, "$.ApplicationData.IssuerPublicKeyDec", issuer_pk_c);
JsonSaveBufAsHex(root, "$.ApplicationData.IssuerPublicKeyModulus", issuer_pk->modulus, issuer_pk->mlen);
free(issuer_pk_c);
struct emv_pk *icc_pk = emv_pki_recover_icc_cert(issuer_pk, tlvRoot, NULL);
if (!icc_pk) {
emv_pk_free(pk);
emv_pk_free(issuer_pk);
PrintAndLog("WARNING: ICC certificate not found. Exit.");
return 2;
}
printf("ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
icc_pk->rid[0],
icc_pk->rid[1],
icc_pk->rid[2],
icc_pk->rid[3],
icc_pk->rid[4],
icc_pk->index,
icc_pk->serial[0],
icc_pk->serial[1],
icc_pk->serial[2]
);
char *icc_pk_c = emv_pk_dump_pk(icc_pk);
JsonSaveStr(root, "$.ApplicationData.ICCPublicKeyDec", icc_pk_c);
JsonSaveBufAsHex(root, "$.ApplicationData.ICCPublicKeyModulus", icc_pk->modulus, icc_pk->mlen);
free(issuer_pk_c);
return 0;
}

View file

@ -16,6 +16,7 @@
#include <stdlib.h>
#include <inttypes.h>
#include <string.h>
#include <jansson.h>
#include "util.h"
#include "common.h"
#include "ui.h"
@ -37,6 +38,7 @@ enum TransactionType {
TT_QVSDCMCHIP,
TT_CDA,
};
extern char *TransactionTypeStr[];
typedef struct {
uint8_t CLA;
@ -93,6 +95,8 @@ extern int trSDA(struct tlvdb *tlv);
extern int trDDA(bool decodeTLV, struct tlvdb *tlv);
extern int trCDA(struct tlvdb *tlv, struct tlvdb *ac_tlv, struct tlv *pdol_data_tlv, struct tlv *ac_data_tlv);
extern int RecoveryCertificates(struct tlvdb *tlvRoot, json_t *root);
#endif

View file

@ -56,8 +56,8 @@ uint8_t cmd_send(uint64_t cmd, uint64_t arg0, uint64_t arg1, uint64_t arg2, void
sendlen = usb_write( (uint8_t*)&txcmd, sizeof(UsbCommand) );
#ifdef WITH_FPC
usart_init();
usart_writebuffer( (uint8_t*)&txcmd, sizeof(UsbCommand) );
// usart_init();
// usart_writebuffer( (uint8_t*)&txcmd, sizeof(UsbCommand) );
#endif
return sendlen;

View file

@ -1,6 +1,6 @@
//-----------------------------------------------------------------------------
// Iceman, July 2018
// edists by - Anticat, August 2018
// edits by - Anticat, August 2018
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
@ -14,7 +14,7 @@
#define AT91_BAUD_RATE 115200
volatile AT91PS_USART pUS1 = AT91C_BASE_US1;
volatile AT91PS_PIO pPIOA = AT91C_BASE_PIOA;
volatile AT91PS_PIO pPIO = AT91C_BASE_PIOA;
volatile AT91PS_PDC pPDC = AT91C_BASE_PDC_US1;
/*
@ -39,90 +39,53 @@ void usart_close(void) {
}
*/
static uint8_t outbuf[sizeof(UsbCommand)];
//static uint8_t inbuf[sizeof(UsbCommand)];
static uint8_t us_outbuf[sizeof(UsbCommand)];
/// Reads data from an USART peripheral
/// \param data Pointer to the buffer where the received data will be stored.
/// \param len Size of the data buffer (in bytes).
inline int usart_readbuffer(uint8_t *data, size_t len) {
inline int16_t usart_readbuffer(uint8_t *data, size_t len) {
pUS1->US_PTSR = AT91C_PDC_TXTEN;
pUS1->US_PTCR = AT91C_PDC_TXTEN;
// Check if the first PDC bank is free
if (!(pUS1->US_RCR)) {
pUS1->US_RPR = (uint32_t)data;
pUS1->US_RCR = len;
pUS1->US_PTCR = AT91C_PDC_RXTEN | AT91C_PDC_TXTDIS;
return 2;
}
// Check if the second PDC bank is free
else if (!(pUS1->US_RNCR)) {
pUS1->US_RNPR = (uint32_t)data;
pUS1->US_RNCR = len;
pUS1->US_PTCR = AT91C_PDC_RXTEN | AT91C_PDC_TXTDIS;
return 1;
} else {
return 0;
}
/*
pPDC->PDC_PTSR = AT91C_PDC_RXTEN;
pPDC->PDC_PTCR = AT91C_PDC_RXTEN;
//check if data is available
if (pPDC->PDC_RCR != 0) return -1;
memcpy(data, inbuf, len);
//start next transfer
pPDC->PDC_RNPR = (uint32_t)inbuf;
pPDC->PDC_RNCR = sizeof(inbuf);
return sizeof(inbuf);
*/
}
/*
int16_t usart_writebuffer(uint8_t *data, size_t len) {
// pUS1->US_PTSR = AT91C_PDC_TXTEN;
pUS1->US_PTCR = AT91C_PDC_TXTEN;
// if buffer is sent
if (pUS1->US_TCR != 0) return -1;
memcpy(outbuf, data, len);
//start next transfer
pUS1->US_TNPR = (uint32_t)outbuf;
pUS1->US_TNCR = sizeof(outbuf);
return sizeof(outbuf);
}
*/
// works.
// transfer to client
// transfer from device to client
inline int16_t usart_writebuffer(uint8_t *data, size_t len) {
pUS1->US_PTSR = AT91C_PDC_TXTEN;
pUS1->US_PTCR = AT91C_PDC_TXTEN;
// Check if the first PDC bank is free
if (!(pUS1->US_TCR)) {
memcpy(outbuf, data, len);
pUS1->US_TPR = (uint32_t)outbuf;
pUS1->US_TCR = sizeof(outbuf);
memcpy(us_outbuf, data, len);
pUS1->US_TPR = (uint32_t)us_outbuf;
pUS1->US_TCR = sizeof(us_outbuf);
pUS1->US_PTCR = AT91C_PDC_TXTEN | AT91C_PDC_RXTDIS;
return 2;
}
// Check if the second PDC bank is free
else if (!(pUS1->US_TNCR)) {
memcpy(outbuf, data, len);
pUS1->US_TNPR = (uint32_t)outbuf;
pUS1->US_TNCR = sizeof(outbuf);
memcpy(us_outbuf, data, len);
pUS1->US_TNPR = (uint32_t)us_outbuf;
pUS1->US_TNCR = sizeof(us_outbuf);
pUS1->US_PTCR = AT91C_PDC_TXTEN | AT91C_PDC_RXTDIS;
return 1;
} else {
return 0;
@ -132,19 +95,20 @@ inline int16_t usart_writebuffer(uint8_t *data, size_t len) {
void usart_init(void) {
// disable & reset receiver / transmitter for configuration
pUS1->US_CR = (AT91C_US_RSTRX | AT91C_US_RSTTX);
pUS1->US_CR = (AT91C_US_RSTRX | AT91C_US_RSTTX | AT91C_US_RXDIS | AT91C_US_TXDIS);
//enable the USART1 Peripheral clock
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_US1);
// disable PIO control of receive / transmit pins
pPIOA->PIO_PDR |= (AT91C_PA21_RXD1 | AT91C_PA22_TXD1);
pPIO->PIO_PDR |= (AT91C_PA21_RXD1 | AT91C_PA22_TXD1);
// enable peripheral mode A on receive / transmit pins
pPIOA->PIO_ASR |= (AT91C_PA21_RXD1 | AT91C_PA22_TXD1);
pPIO->PIO_ASR |= (AT91C_PA21_RXD1 | AT91C_PA22_TXD1);
pPIO->PIO_BSR = 0;
// enable pull-up on receive / transmit pins (see 31.5.1 I/O Lines)
pPIOA->PIO_PPUER |= (AT91C_PA21_RXD1 | AT91C_PA22_TXD1);
pPIO->PIO_PPUER |= (AT91C_PA21_RXD1 | AT91C_PA22_TXD1);
// set mode
pUS1->US_MR = AT91C_US_USMODE_NORMAL | // normal mode
@ -154,8 +118,19 @@ void usart_init(void) {
AT91C_US_NBSTOP_1_BIT | // 1 stop bit
AT91C_US_CHMODE_NORMAL; // channel mode: normal
// all interrupts disabled
pUS1->US_IDR = 0xFFFF;
// iceman, setting 115200 doesn't work. Only speed I got to work is 9600.
// something fishy with the AT91SAM7S512 USART.. Or I missed something
// For a nice detailed sample, interrupt driven but still relevant.
// See https://www.sparkfun.com/datasheets/DevTools/SAM7/at91sam7%20serial%20communications.pdf
// set baudrate to 115200
pUS1->US_BRGR = (48UL*1000*1000) / (115200*16);
// 115200 * 16 == 1843200
//
//pUS1->US_BRGR = (48UL*1000*1000) / (9600*16);
pUS1->US_BRGR = 48054841 / (9600 << 4);
// Write the Timeguard Register
pUS1->US_TTGR = 0;
@ -163,23 +138,6 @@ void usart_init(void) {
pUS1->US_FIDI = 0;
pUS1->US_IF = 0;
/*
//Empty PDC
pUS1->US_RNPR = (uint32_t)(char *)0;
pUS1->US_RNCR = 0;
pUS1->US_RPR = (uint32_t)(char *)0;
pUS1->US_RCR = 0;
pUS1->US_TNPR = (uint32_t)(char *)0;
pUS1->US_TNCR = 0;
pUS1->US_TPR = (uint32_t)(char *)0;
pUS1->US_TCR = 0;
*/
//pUS1->US_PTCR = (AT91C_PDC_RXTEN | AT91C_PDC_TXTEN);
//pUS1->US_PTSR = (AT91C_PDC_RXTEN | AT91C_PDC_TXTEN);
// re-enable receiver / transmitter
pUS1->US_CR = (AT91C_US_RXEN | AT91C_US_TXEN);
}

View file

@ -7,6 +7,6 @@
void usart_init(void);
void usart_close(void);
int usart_readbuffer(uint8_t *data, size_t len);
int16_t usart_readbuffer(uint8_t *data, size_t len);
int16_t usart_writebuffer(uint8_t *data, size_t len);
#endif

View file

@ -118,8 +118,12 @@ serial_port uart_open(const char* pcPortName)
tcflush(sp->fd, TCIOFLUSH);
#ifdef WITH_FPC
uart_set_speed(sp, 115200);
if ( uart_set_speed(sp, 115200) ) {
printf("[=] UART Setting serial baudrate 115200 [FPC enabled]\n");
} else {
uart_set_speed(sp, 9600);
printf("[=] UART Setting serial baudrate 9600 [FPC enabled]\n");
}
#else
// set speed, works for UBUNTU 14.04
bool success = uart_set_speed(sp, 460800);

View file

@ -86,12 +86,20 @@ serial_port uart_open(const char* pcPortName) {
}
// all zero's configure: no timeout for read/write used.
// took settings from libnfc/buses/uart.c
#ifdef WITH_FPC
sp->ct.ReadIntervalTimeout = 1000;
sp->ct.ReadTotalTimeoutMultiplier = 0;
sp->ct.ReadTotalTimeoutConstant = 1500;
sp->ct.WriteTotalTimeoutMultiplier = 1000;
sp->ct.WriteTotalTimeoutConstant = 0;
#else
sp->ct.ReadIntervalTimeout = 30;
sp->ct.ReadTotalTimeoutMultiplier = 0;
sp->ct.ReadTotalTimeoutConstant = 30;
sp->ct.WriteTotalTimeoutMultiplier = 30;
sp->ct.WriteTotalTimeoutConstant = 0;
#endif
if (!SetCommTimeouts(sp->hPort, &sp->ct)) {
uart_close(sp);
printf("[!] UART error while setting comm time outs\n");
@ -101,7 +109,12 @@ serial_port uart_open(const char* pcPortName) {
PurgeComm(sp->hPort, PURGE_RXABORT | PURGE_RXCLEAR);
#ifdef WITH_FPC
uart_set_speed(sp, 115200);
if ( uart_set_speed(sp, 115200) ) {
printf("[=] UART Setting serial baudrate 115200 [FPC enabled]\n");
} else {
uart_set_speed(sp, 9600);
printf("[=] UART Setting serial baudrate 9600 [FPC enabled]\n");
}
#else
bool success = uart_set_speed(sp, 460800);
if (success) {