RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-02-02 13:28:14 +08:00
Code Issues Projects Releases Packages Wiki Activity

Iceman1001 s MFU clean up

Browse source 
cleaned up MF UL_C auth code device side.
This commit is contained in:
marshmellow42 2015-05-17 20:49:25 -04:00
parent cceabb79e6
commit 8258f40969
6 changed files with 211 additions and 346 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
armsrc/appmain.c
View file

@ -826,11 +826,8 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_MIFAREU_READBL:
MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
break;
case CMD_MIFAREUC_AUTH1:
MifareUC_Auth1(c->arg[0],c->d.asBytes);
break;
case CMD_MIFAREUC_AUTH2:
MifareUC_Auth2(c->arg[0],c->d.asBytes);
case CMD_MIFAREUC_AUTH:
MifareUC_Auth(c->arg[0],c->d.asBytes);
break;
case CMD_MIFAREU_READCARD:
case CMD_MIFAREUC_READCARD:

3
armsrc/apps.h
View file

@ -166,8 +166,7 @@ void ReaderMifare(bool first_try);
int32_t dist_nt(uint32_t nt1, uint32_t nt2);
void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
void MifareUC_Auth1(uint8_t arg0, uint8_t *datain);
void MifareUC_Auth2(uint8_t arg0, uint8_t *datain);
void MifareUC_Auth(uint8_t arg0, uint8_t *datain);
void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain);
void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);

230
armsrc/mifarecmd.c
View file

@ -17,7 +17,6 @@
#include "apps.h"
#include "util.h"
#include "des.h"
#include "crc.h"
// the block number for the ISO14443-4 PCB
@ -93,53 +92,28 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
LEDsoff();
}
void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
byte_t dataoutbuf[16] = {0x00};
uint8_t uid[10] = {0x00};
uint32_t cuid = 0x00;
bool turnOffField = (arg0 == 1);
LED_A_ON(); LED_B_OFF(); LED_C_OFF();
clear_trace();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
if(!iso14443a_select_card(uid, NULL, &cuid)) {
if(!iso14443a_select_card(NULL, NULL, NULL)) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
OnError(0);
return;
};
if(mifare_ultra_auth1(dataoutbuf)){
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
if(mifare_ultra_auth(keybytes) == 1){
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
OnError(1);
return;
}
cmd_send(CMD_ACK,1,0,0,0,0);
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
LEDsoff();
}
void MifareUC_Auth2(uint8_t arg0, uint8_t *datain){
uint8_t key[16] = {0x00};
byte_t dataoutbuf[16] = {0x00};
memcpy(key, datain, 16);
LED_A_ON(); LED_B_OFF(); LED_C_OFF();
if(mifare_ultra_auth2(key, dataoutbuf)){
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
OnError(1);
return;
}
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
if (arg0) {
if (turnOffField) {
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
}
@ -152,125 +126,56 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
{
uint8_t blockNo = arg0;
byte_t dataout[16] = {0x00};
uint8_t uid[10] = {0x00};
uint8_t key[16] = {0x00};
bool usePwd = (arg1 == 1);
bool useKey = (arg1 == 1); //UL_C
bool usePwd = (arg1 == 2); //UL_EV1/NTAG
LEDsoff();
LED_A_ON();
clear_trace();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
int len = iso14443a_select_card(uid, NULL, NULL);
int len = iso14443a_select_card(NULL, NULL, NULL);
if(!len) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
OnError(1);
return;
}
// authenticate here.
if ( usePwd ) {
// UL-C authentication
if ( useKey ) {
uint8_t key[16] = {0x00};
memcpy(key, datain, sizeof(key) );
memcpy(key, datain, 16);
// Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );
// Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );
uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
uint8_t random_b[8] = {0x00};
uint8_t enc_random_b[8] = {0x00};
uint8_t rnd_ab[16] = {0x00};
uint8_t IV[8] = {0x00};
uint16_t len;
uint8_t receivedAnswer[MAX_FRAME_SIZE];
uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
if (len != 11) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
if ( mifare_ultra_auth(key) == 1 ) {
OnError(1);
return;
}
// tag nonce.
memcpy(enc_random_b,receivedAnswer+1,8);
// decrypt nonce.
tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
rol(random_b,8);
memcpy(rnd_ab ,random_a,8);
memcpy(rnd_ab+8,random_b,8);
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],
enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",
random_b[0],random_b[1],random_b[2],random_b[3],
random_b[4],random_b[5],random_b[6],random_b[7]);
Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
}
// encrypt out, in, length, key, iv
tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
if (len != 11) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
OnError(1);
return;
}
uint8_t enc_resp[8] = { 0 };
uint8_t resp_random_a[8] = { 0 };
memcpy(enc_resp, receivedAnswer+1, 8);
// decrypt out, in, length, key, iv
tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
if ( memcmp(resp_random_a, random_a, 8) != 0 )
Dbprintf("failed authentication");
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
random_a[0],random_a[1],random_a[2],random_a[3],
random_a[4],random_a[5],random_a[6],random_a[7]);
Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
}
}
// UL-EV1 / NTAG authentication
if ( usePwd ) {
uint8_t pwd[4] = {0x00};
memcpy(pwd, datain, 4);
uint8_t pack[4] = {0,0,0,0};
if (mifare_ul_ev1_auth(pwd, pack) == 1) {
OnError(1);
return;
}
}
if( mifare_ultra_readblock(blockNo, dataout) ) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
OnError(2);
return;
}
if( mifare_ultra_halt() ) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
OnError(3);
return;
}
cmd_send(CMD_ACK,1,0,0,dataout,16);
cmd_send(CMD_ACK,1,0,0,dataout,16);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
}
@ -365,64 +270,25 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
return;
}
// authenticate
// UL-C authentication
if ( useKey ) {
uint8_t key[16] = {0x00};
memcpy(key, datain, 16);
memcpy(key, datain, sizeof(key) );
uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
uint8_t random_b[8] = {0x00};
uint8_t enc_random_b[8] = {0x00};
uint8_t rnd_ab[16] = {0x00};
uint8_t IV[8] = {0x00};
uint16_t len2;
uint8_t receivedAnswer[MAX_FRAME_SIZE];
uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
len2 = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
if (len2 != 11) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
if ( mifare_ultra_auth(key) == 1 ) {
OnError(1);
return;
}
// tag nonce.
memcpy(enc_random_b,receivedAnswer+1,8);
// decrypt nonce.
tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
rol(random_b,8);
memcpy(rnd_ab ,random_a,8);
memcpy(rnd_ab+8,random_b,8);
// encrypt out, in, length, key, iv
tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
len2 = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
if (len2 != 11) {
OnError(1);
return;
}
uint8_t enc_resp[8] = { 0 };
uint8_t resp_random_a[8] = { 0 };
memcpy(enc_resp, receivedAnswer+1, 8);
// decrypt out, in, length, key, iv
tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
if ( memcmp(resp_random_a, random_a, 8) != 0 )
Dbprintf("failed authentication");
}
if (usePwd) { //ev1 or ntag auth
uint8_t Pwd[4] = {0x00};
memcpy(Pwd, datain, 4);
// UL-EV1 / NTAG authentication
if (usePwd) {
uint8_t pwd[4] = {0x00};
memcpy(pwd, datain, sizeof(pwd));
uint8_t pack[4] = {0,0,0,0};
if (mifare_ul_ev1_auth(Pwd, pack)){
if (mifare_ul_ev1_auth(pwd, pack) == 1){
OnError(1);
Dbprintf("failed authentication");
return;
}
}
@ -569,16 +435,15 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
{
uint8_t blockNo = arg0;
byte_t blockdata[4] = {0x00};
memcpy(blockdata, datain,4);
uint8_t uid[10] = {0x00};
memcpy(blockdata, datain,4);
LED_A_ON(); LED_B_OFF(); LED_C_OFF();
LEDsoff();
LED_A_ON();
clear_trace();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
if(!iso14443a_select_card(uid, NULL, NULL)) {
if(!iso14443a_select_card(NULL, NULL, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
OnError(0);
return;
@ -1320,21 +1185,18 @@ void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
int len = iso14443a_select_card(uid, NULL, &cuid);
if(!len) {
if (MF_DBGLEVEL >= MF_DBG_ERROR)
Dbprintf("Can't select card");
//OnError(1);
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
OnError(1);
return;
};
if(mifare_desfire_des_auth1(cuid, dataout)){
if (MF_DBGLEVEL >= MF_DBG_ERROR)
Dbprintf("Authentication part1: Fail.");
//OnError(4);
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
OnError(4);
return;
}
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
}

157
armsrc/mifareutil.c
View file

@ -18,6 +18,7 @@
#include "iso14443a.h"
#include "crapto1.h"
#include "mifareutil.h"
#include "des.h"
int MF_DBGLEVEL = MF_DBG_ALL;
@ -110,6 +111,27 @@ int mifare_sendcmd_short_mfucauth(struct Crypto1State *pcs, uint8_t crypted, uin
return len;
}
int mifare_sendcmd_short_mfuev1auth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)
{
uint8_t dcmd[7];
int len;
dcmd[0] = cmd;
memcpy(dcmd+1,data,4);
AppendCrc14443a(dcmd, 5);
ReaderTransmit(dcmd, sizeof(dcmd), timing);
len = ReaderReceive(answer, answer_parity);
if(!len) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed. Card timeout.");
len = ReaderReceive(answer,answer_parity);
}
if(len==1) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("NAK - Authentication failed.");
return 1;
}
return len;
}
int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)
{
uint8_t dcmd[4], ecmd[4];
@ -288,67 +310,114 @@ int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blo
}
// mifare ultralight commands
int mifare_ul_ev1_auth(uint8_t *key, uint8_t *pack){
int mifare_ul_ev1_auth(uint8_t *keybytes, uint8_t *pack){
uint16_t len;
uint8_t receivedAnswer[MAX_FRAME_SIZE];
uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
len = mifare_sendcmd_short_mfucauth(NULL, 0, 0x1B, key, receivedAnswer, receivedAnswerPar, NULL);
uint8_t resp[4];
uint8_t respPar[1];
uint8_t key[4] = {0x00};
memcpy(key, keybytes, 4);
Dbprintf("EV1 Auth : %02x%02x%02x%02x", key[0], key[1], key[2], key[3]);
len = mifare_sendcmd_short_mfuev1auth(NULL, 0, 0x1B, key, resp, respPar, NULL);
if (len != 4) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", receivedAnswer[0], len);
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", resp[0], len);
OnError(1);
return 1;
}
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
Dbprintf("Auth Resp: %02x%02x%02x%02x",
receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3]);
}
memcpy(pack, receivedAnswer, 4);
if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
Dbprintf("Auth Resp: %02x%02x%02x%02x", resp[0],resp[1],resp[2],resp[3]);
memcpy(pack, resp, 4);
return 0;
}
int mifare_ultra_auth1(uint8_t *blockData){
int mifare_ultra_auth(uint8_t *keybytes){
/// 3des2k
uint8_t random_a[8] = {1,1,1,1,1,1,1,1};
uint8_t random_b[8] = {0x00};
uint8_t enc_random_b[8] = {0x00};
uint8_t rnd_ab[16] = {0x00};
uint8_t IV[8] = {0x00};
uint8_t key[16] = {0x00};
memcpy(key, keybytes, 16);
uint16_t len;
uint8_t receivedAnswer[MAX_FRAME_SIZE];
uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
uint8_t resp[19] = {0x00};
uint8_t respPar[3] = {0,0,0};
// REQUEST AUTHENTICATION
len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, resp, respPar ,NULL);
if (len != 11) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);
OnError(1);
return 1;
}
// tag nonce.
memcpy(enc_random_b,resp+1,8);
// decrypt nonce.
tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
rol(random_b,8);
memcpy(rnd_ab ,random_a,8);
memcpy(rnd_ab+8,random_b,8);
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",
random_b[0],random_b[1],random_b[2],random_b[3],random_b[4],random_b[5],random_b[6],random_b[7]);
Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
}
// encrypt out, in, length, key, iv
tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, resp, respPar, NULL);
if (len != 11) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);
OnError(1);
return 1;
}
uint8_t enc_resp[8] = { 0,0,0,0,0,0,0,0 };
uint8_t resp_random_a[8] = { 0,0,0,0,0,0,0,0 };
memcpy(enc_resp, resp+1, 8);
// decrypt out, in, length, key, iv
tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
if ( memcmp(resp_random_a, random_a, 8) != 0 ) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("failed authentication");
return 1;
}
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
Dbprintf("Auth1 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],
receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],
receivedAnswer[10]);
}
memcpy(blockData, receivedAnswer, 11);
return 0;
}
Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
int mifare_ultra_auth2(uint8_t *key, uint8_t *blockData){
Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
uint16_t len;
uint8_t receivedAnswer[MAX_FRAME_SIZE];
uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, key, receivedAnswer, receivedAnswerPar, NULL);
if (len != 11) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
return 1;
Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
random_a[0],random_a[1],random_a[2],random_a[3],
random_a[4],random_a[5],random_a[6],random_a[7]);
Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
}
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
Dbprintf("Auth2 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],
receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],
receivedAnswer[10]);
}
memcpy(blockData, receivedAnswer, 11);
return 0;
}
@ -380,8 +449,6 @@ int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData)
return 0;
}
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData)
{
// variables

4
armsrc/mifareutil.h
View file

@ -57,14 +57,14 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
int mifare_sendcmd_short_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
int mifare_sendcmd_short_mfucauth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
int mifare_sendcmd_short_mfuev1auth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested);
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing);
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
int mifare_ul_ev1_auth(uint8_t *key, uint8_t *pack);
int mifare_ultra_auth1(uint8_t *blockData);
int mifare_ultra_auth2(uint8_t *key, uint8_t *blockData);
int mifare_ultra_auth(uint8_t *key);
int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData);
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData);

156
client/cmdhfmfu.c
View file

@ -34,12 +34,16 @@ uint8_t default_3des_keys[KEYS_3DES_COUNT][16] = {
{ 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF } // 11 22 33
};
#define KEYS_PWD_COUNT 8
#define KEYS_PWD_COUNT 10
uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = {
{0xFF,0xFF,0xFF,0xFF}, // PACK 0x00,0x00 -- factory default
{0x4A,0xF8,0x4B,0x19}, // PACK 0xE5,0xBE -- italian bus (sniffed)
{0x33,0x6B,0xA1,0x19}, // PACK 0x9c,0x2d -- italian bus (sniffed)
{0xFF,0x90,0x6C,0xB2}, // PACK 0x12,0x9e -- italian bus (sniffed)
{0x46,0x1c,0xA3,0x19}, // PACK 0xE9,0x5A -- italian bus (sniffed)
{0x35,0x1C,0xD0,0x19}, // PACK 0x9A,0x5a -- italian bus (sniffed)
{0x05,0x22,0xE6,0xB4}, // PACK 0x80,0x80 -- Amiiboo (sniffed) pikachu-b UID:
{0x7E,0x22,0xE6,0xB4}, // PACK 0x80,0x80 -- AMiiboo (sniffed)
{0x02,0xE1,0xEE,0x36}, // PACK 0x80,0x80 -- AMiiboo (sniffed) sonic UID: 04d257 7ae33e8027
@ -56,20 +60,20 @@ uint8_t UL_MEMORY_ARRAY[MAX_UL_TYPES] = {MAX_UL_BLOCKS, MAX_UL_BLOCKS, MAX_ULC_B
static int CmdHelp(const char *Cmd);
char* getProductTypeStr( uint8_t id){
char *getProductTypeStr( uint8_t id){
static char buf[20];
char *retStr = buf;
switch(id) {
case 3:
sprintf(retStr, "0x%02X %s", id, "(Ultralight)");
sprintf(retStr, "%02X %s", id, "(Ultralight)");
break;
case 4:
sprintf(retStr, "0x%02X %s", id, "(NTAG)");
sprintf(retStr, "%02X %s", id, "(NTAG)");
break;
default:
sprintf(retStr, "0x%02X %s", id, "(unknown)");
sprintf(retStr, "%02X %s", id, "(unknown)");
break;
}
return buf;
@ -80,7 +84,7 @@ char* getProductTypeStr( uint8_t id){
the LSBit is set to '0' if the size is exactly 2^n
and set to '1' if the storage size is between 2^n and 2^(n+1).
*/
char* getUlev1CardSizeStr( uint8_t fsize ){
char *getUlev1CardSizeStr( uint8_t fsize ){
static char buf[40];
char *retStr = buf;
@ -153,8 +157,6 @@ static int ul_read( uint8_t page, uint8_t *response, uint16_t responseLength ){
uint8_t cmd[] = {ISO14443A_CMD_READBLOCK, page};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
if ( len == -1 )
ul_switch_off_field();
return len;
}
@ -169,9 +171,7 @@ static int ul_comp_write( uint8_t page, uint8_t *data, uint8_t datalen ){
memcpy(cmd+2, data, datalen);
uint8_t response[1] = {0xff};
int len = ul_send_cmd_raw(cmd, 2+datalen, response, sizeof(response));
if ( len == -1 )
ul_switch_off_field();
ul_send_cmd_raw(cmd, 2+datalen, response, sizeof(response));
// ACK
if ( response[0] == 0x0a ) return 0;
// NACK
@ -182,17 +182,25 @@ static int ulc_requestAuthentication( uint8_t *nonce, uint16_t nonceLength ){
uint8_t cmd[] = {MIFARE_ULC_AUTH_1, 0x00};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), nonce, nonceLength);
if ( len == -1 )
ul_switch_off_field();
return len;
}
static int ulc_authentication( uint8_t *key, bool switch_off_field ){
UsbCommand c = {CMD_MIFAREUC_AUTH, {switch_off_field}};
memcpy(c.d.asBytes, key, 16);
SendCommand(&c);
UsbCommand resp;
if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) return -1;
if ( resp.arg[0] == 1 ) return 0;
return -2;
}
static int ulev1_requestAuthentication( uint8_t *pwd, uint8_t *pack, uint16_t packLength ){
uint8_t cmd[] = {MIFARE_ULEV1_AUTH, pwd[0], pwd[1], pwd[2], pwd[3]};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), pack, packLength);
if ( len == -1)
ul_switch_off_field();
return len;
}
@ -200,8 +208,6 @@ static int ulev1_getVersion( uint8_t *response, uint16_t responseLength ){
uint8_t cmd[] = {MIFARE_ULEV1_VERSION};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
if ( len == -1 )
ul_switch_off_field();
return len;
}
@ -210,7 +216,6 @@ static int ulev1_getVersion( uint8_t *response, uint16_t responseLength ){
// uint8_t cmd[] = {MIFARE_ULEV1_FASTREAD, startblock, endblock};
// if ( !ul_send_cmd_raw(cmd, sizeof(cmd), response)){
// ul_switch_off_field();
// return -1;
// }
// return 0;
@ -220,8 +225,6 @@ static int ulev1_readCounter( uint8_t counter, uint8_t *response, uint16_t respo
uint8_t cmd[] = {MIFARE_ULEV1_READ_CNT, counter};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
if (len == -1)
ul_switch_off_field();
return len;
}
@ -229,8 +232,6 @@ static int ulev1_readTearing( uint8_t counter, uint8_t *response, uint16_t respo
uint8_t cmd[] = {MIFARE_ULEV1_CHECKTEAR, counter};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
if (len == -1)
ul_switch_off_field();
return len;
}
@ -238,15 +239,12 @@ static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){
uint8_t cmd[] = {MIFARE_ULEV1_READSIG, 0x00};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
if (len == -1)
ul_switch_off_field();
return len;
}
static int ul_print_default( uint8_t *data){
uint8_t uid[7];
uid[0] = data[0];
uid[1] = data[1];
uid[2] = data[2];
@ -504,7 +502,7 @@ uint16_t GetHF14AMfU_Type(void){
status = ul_select(&card);
if ( status < 1 ){
PrintAndLog("Error: couldn't select");
PrintAndLog("iso14443a card select failed");
ul_switch_off_field();
return UL_ERROR;
}
@ -518,7 +516,7 @@ uint16_t GetHF14AMfU_Type(void){
if ( card.uid[0] != 0x05) {
len = ulev1_getVersion(version, sizeof(version));
if (len > -1) ul_switch_off_field(); //if -1 it is already off
ul_switch_off_field();
switch (len) {
case 0x0A: {
@ -551,11 +549,11 @@ uint16_t GetHF14AMfU_Type(void){
ul_switch_off_field();
return UL_ERROR;
}
uint8_t nonce1[11] = {0x00};
status = ulc_requestAuthentication(nonce1, sizeof(nonce1));
uint8_t nonce[11] = {0x00};
status = ulc_requestAuthentication(nonce, sizeof(nonce));
tagtype = ( status > 0 ) ? UL_C : UL;
if (status != -1) ul_switch_off_field();
ul_switch_off_field();
}
} else {
// Infinition MY-D tests Exam high nibble
@ -642,9 +640,8 @@ int CmdHF14AMfUInfo(const char *Cmd){
if ( hasAuthKey ) {
if ((tagtype & UL_C)) {
ul_switch_off_field();
//will select card automatically
if (try3DesAuthentication(authenticationkey, false) != 1) {
if (ulc_authentication(authenticationkey, false) != 0) {
ul_switch_off_field();
PrintAndLog("Error: Authentication Failed UL-C");
return 0;
@ -652,7 +649,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
} else {
len = ulev1_requestAuthentication(authenticationkey, pack, sizeof(pack));
if (len < 1) {
if (!len) ul_switch_off_field();
ul_switch_off_field();
PrintAndLog("Error: Authentication Failed UL-EV1/NTAG");
return 0;
}
@ -663,6 +660,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
// read pages 0,1,2,4 (should read 4pages)
status = ul_read(0, data, sizeof(data));
if ( status == -1 ){
ul_switch_off_field();
PrintAndLog("Error: tag didn't answer to READ");
return status;
}
@ -685,6 +683,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
uint8_t ulc_deskey[16] = {0x00};
status = ul_read(0x2C, ulc_deskey, sizeof(ulc_deskey));
if ( status == -1 ){
ul_switch_off_field();
PrintAndLog("Error: tag didn't answer to READ magic");
return status;
}
@ -695,17 +694,18 @@ int CmdHF14AMfUInfo(const char *Cmd){
if ( hasAuthKey ) return 1;
PrintAndLog("Trying some default 3des keys");
ul_switch_off_field(); //will select again in try3DesAuth...
for (uint8_t i = 0; i < KEYS_3DES_COUNT; ++i ){
key = default_3des_keys[i];
if (try3DesAuthentication(key, true) == 1){
if (ulc_authentication(key, true) == 0){
PrintAndLog("Found default 3des key: "); //%s", sprint_hex(key,16));
uint8_t keySwap[16];
memcpy(keySwap, SwapEndian64(key,16,8), 16);
ulc_print_3deskey(keySwap);
ul_switch_off_field();
return 1;
}
}
ul_switch_off_field();
return 1; //return even if key not found (UL_C is done)
}
}
@ -718,6 +718,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
status = ulev1_readSignature( ulev1_signature, sizeof(ulev1_signature));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to READ SIGNATURE");
ul_switch_off_field();
return status;
}
ulev1_print_signature( ulev1_signature, sizeof(ulev1_signature));
@ -727,6 +728,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
status = ul_read(startconfigblock, ulev1_conf, sizeof(ulev1_conf));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to READ EV1");
ul_switch_off_field();
return status;
}
// save AUTHENTICATION LIMITS for later:
@ -745,12 +747,16 @@ int CmdHF14AMfUInfo(const char *Cmd){
status = ulev1_getVersion(version, sizeof(version));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to GETVERSION");
ul_switch_off_field();
return status;
}
ulev1_print_version(version);
// if we called info with key, just return
if ( hasAuthKey ) return 1;
if ( hasAuthKey ) {
ul_switch_off_field();
return 1;
}
// AUTHLIMIT, (number of failed authentications)
// 0 = limitless.
@ -768,7 +774,6 @@ int CmdHF14AMfUInfo(const char *Cmd){
}
}
}
if (len > -1) ul_switch_off_field();
}
}
@ -985,9 +990,6 @@ int CmdHF14AMfUDump(const char *Cmd){
errors = param_gethex(tempStr, 0, key, dataLen);
else
errors = true;
if (!errors)
memcpy(key, data, dataLen/2);
cmdp += 2;
hasPwd = true;
@ -1087,11 +1089,10 @@ int CmdHF14AMfUDump(const char *Cmd){
}
// add keys
if (hasPwd && dataLen == 32){ //UL_C
memcpy(data + Pages*4, key, 16);
if (hasPwd){ //UL_C
memcpy(data + Pages*4, key, dataLen/2);
Pages += 4;
}
//TODO add key MEM location for other tags
for (i = 0; i < Pages; ++i) {
if ( i < 3 ) {
@ -1165,6 +1166,7 @@ int CmdHF14AMfUDump(const char *Cmd){
return 0;
}
/*
// Needed to Authenticate to Ultralight C tags
void rol (uint8_t *data, const size_t len){
uint8_t first = data[0];
@ -1173,6 +1175,7 @@ void rol (uint8_t *data, const size_t len){
}
data[len-1] = first;
}
*/
//-------------------------------------------------------------------------------
// Ultralight C Methods
@ -1191,7 +1194,7 @@ int CmdHF14AMfucAuth(const char *Cmd){
//Change key to user defined one
if (cmdp == 'k' || cmdp == 'K'){
keyNo = param_get8(Cmd, 1);
if(keyNo > 6)
if(keyNo > KEYS_3DES_COUNT)
errors = true;
}
@ -1213,7 +1216,7 @@ int CmdHF14AMfucAuth(const char *Cmd){
}
uint8_t *key = default_3des_keys[keyNo];
if (try3DesAuthentication(key, true) > 0)
if (ulc_authentication(key, true) == 0)
PrintAndLog("Authentication successful. 3des key: %s",sprint_hex(key, 16));
else
PrintAndLog("Authentication failed");
@ -1221,68 +1224,6 @@ int CmdHF14AMfucAuth(const char *Cmd){
return 0;
}
int try3DesAuthentication( uint8_t *key, bool switch_off_field ){
//uint32_t cuid = 0;
des3_context ctx = { 0 };
uint8_t random_a[8] = { 1,1,1,1,1,1,1,1 };
uint8_t random_b[8] = { 0 };
uint8_t enc_random_b[8] = { 0 };
uint8_t rnd_ab[16] = { 0 };
uint8_t iv[8] = { 0 };
UsbCommand c = {CMD_MIFAREUC_AUTH1, {0x00}};
SendCommand(&c);
UsbCommand resp;
if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) return -1;
if ( !(resp.arg[0] & 0xff) ) return -2;
//cuid = resp.arg[1];
memcpy(enc_random_b,resp.d.asBytes+1,8);
des3_set2key_dec(&ctx, key);
// context, mode, length, IV, input, output
des3_crypt_cbc( &ctx, DES_DECRYPT, sizeof(random_b), iv , enc_random_b , random_b);
rol(random_b,8);
memcpy(rnd_ab ,random_a,8);
memcpy(rnd_ab+8,random_b,8);
des3_set2key_enc(&ctx, key);
// context, mode, length, IV, input, output
des3_crypt_cbc(&ctx, DES_ENCRYPT, sizeof(rnd_ab), enc_random_b, rnd_ab, rnd_ab);
//Auth2
c.cmd = CMD_MIFAREUC_AUTH2;
c.arg[0] = switch_off_field;
memcpy(c.d.asBytes, rnd_ab, 16);
SendCommand(&c);
if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500)) return -1;
if ( !(resp.arg[0] & 0xff)) return -2;
uint8_t enc_resp[8] = { 0 };
uint8_t resp_random_a[8] = { 0 };
memcpy(enc_resp, resp.d.asBytes+1, 8);
des3_set2key_dec(&ctx, key);
// context, mode, length, IV, input, output
des3_crypt_cbc( &ctx, DES_DECRYPT, 8, enc_random_b, enc_resp, resp_random_a);
if ( !memcmp(resp_random_a, random_a, 8))
return 1;
return 0;
//PrintAndLog(" RndA :%s", sprint_hex(random_a, 8));
//PrintAndLog(" enc(RndB) :%s", sprint_hex(enc_random_b, 8));
//PrintAndLog(" RndB :%s", sprint_hex(random_b, 8));
//PrintAndLog(" A+B :%s", sprint_hex(random_a_and_b, 16));
//PrintAndLog(" enc(A+B) :%s", sprint_hex(random_a_and_b, 16));
//PrintAndLog(" enc(RndA') :%s", sprint_hex(data2+1, 8));
}
/**
A test function to validate that the polarssl-function works the same
was as the openssl-implementation.
@ -1419,7 +1360,6 @@ int CmdHF14AMfUCRdBl(const char *Cmd)
hasPwd = TRUE;
}
}
//uint8_t *key2 = SwapEndian64(key, 16, 8);
//Read Block
UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};