client/cmdhficlass.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   3 // Copyright (C) 2011 Gerhard de Koning Gans
   4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // High frequency iClass commands
  11 //-----------------------------------------------------------------------------
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <string.h>
  16 #include <sys/stat.h>
  17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
  18 #include "data.h"
  19 #include "proxmark3.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhficlass.h"
  23 #include "common.h"
  24 #include "util.h"
  25 #include "cmdmain.h"
  26 #include "loclass/des.h"
  27 #include "loclass/cipherutils.h"
  28 #include "loclass/cipher.h"
  29 #include "loclass/ikeys.h"
  30 #include "loclass/elite_crack.h"
  31 #include "loclass/fileutils.h"
  32 #include "protocols.h"
  33 #include "usb_cmd.h"
  34
  35 static int CmdHelp(const char *Cmd);
  36
  37 int xorbits_8(uint8_t val)
  38 {
  39         uint8_t res = val ^ (val >> 1); //1st pass
  40         res = res ^ (res >> 1);                 // 2nd pass
  41         res = res ^ (res >> 2);                 // 3rd pass
  42         res = res ^ (res >> 4);                         // 4th pass
  43         return res & 1;
  44 }
  45
  46 int CmdHFiClassList(const char *Cmd)
  47 {
  48         PrintAndLog("Deprecated command, use 'hf list iclass' instead");
  49         return 0;
  50 }
  51
  52 int CmdHFiClassSnoop(const char *Cmd)
  53 {
  54         UsbCommand c = {CMD_SNOOP_ICLASS};
  55         SendCommand(&c);
  56         return 0;
  57 }
  58 int usage_hf_iclass_sim()
  59 {
  60         PrintAndLog("Usage:  hf iclass sim <option> [CSN]");
  61         PrintAndLog("        options");
  62         PrintAndLog("                0 <CSN> simulate the given CSN");
  63         PrintAndLog("                1       simulate default CSN");
  64         PrintAndLog("                2       Reader-attack, gather reader responses to extract elite key");
  65         PrintAndLog("                3       Full simulation using emulator memory (see 'hf iclass eload')");
  66         PrintAndLog("        example: hf iclass sim 0 031FEC8AF7FF12E0");
  67         PrintAndLog("        example: hf iclass sim 2");
  68         PrintAndLog("        example: hf iclass eload 'tagdump.bin'");
  69         PrintAndLog("                 hf iclass sim 3");
  70         return 0;
  71 }
  72
  73 #define NUM_CSNS 15
  74 int CmdHFiClassSim(const char *Cmd)
  75 {
  76         uint8_t simType = 0;
  77         uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
  78
  79         if (strlen(Cmd)<1) {
  80                 return usage_hf_iclass_sim();
  81         }
  82         simType = param_get8ex(Cmd, 0, 0, 10);
  83
  84         if(simType == 0)
  85         {
  86                 if (param_gethex(Cmd, 1, CSN, 16)) {
  87                         PrintAndLog("A CSN should consist of 16 HEX symbols");
  88                         return usage_hf_iclass_sim();
  89                 }
  90
  91                 PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
  92         }
  93         if(simType > 3)
  94         {
  95                 PrintAndLog("Undefined simptype %d", simType);
  96                 return usage_hf_iclass_sim();
  97         }
  98
  99         uint8_t numberOfCSNs=0;
 100         if(simType == 2)
 101         {
 102                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,NUM_CSNS}};
 103                 UsbCommand resp = {0};
 104
 105                 uint8_t csns[8*NUM_CSNS] = {
 106                         0x00, 0x0B, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
 107                         0x00, 0x04, 0x0E, 0x08, 0xF7, 0xFF, 0x12, 0xE0,
 108                         0x00, 0x09, 0x0D, 0x05, 0xF7, 0xFF, 0x12, 0xE0,
 109                         0x00, 0x0A, 0x0C, 0x06, 0xF7, 0xFF, 0x12, 0xE0,
 110                         0x00, 0x0F, 0x0B, 0x03, 0xF7, 0xFF, 0x12, 0xE0,
 111                         0x00, 0x08, 0x0A, 0x0C, 0xF7, 0xFF, 0x12, 0xE0,
 112                         0x00, 0x0D, 0x09, 0x09, 0xF7, 0xFF, 0x12, 0xE0,
 113                         0x00, 0x0E, 0x08, 0x0A, 0xF7, 0xFF, 0x12, 0xE0,
 114                         0x00, 0x03, 0x07, 0x17, 0xF7, 0xFF, 0x12, 0xE0,
 115                         0x00, 0x3C, 0x06, 0xE0, 0xF7, 0xFF, 0x12, 0xE0,
 116                         0x00, 0x01, 0x05, 0x1D, 0xF7, 0xFF, 0x12, 0xE0,
 117                         0x00, 0x02, 0x04, 0x1E, 0xF7, 0xFF, 0x12, 0xE0,
 118                         0x00, 0x07, 0x03, 0x1B, 0xF7, 0xFF, 0x12, 0xE0,
 119                         0x00, 0x00, 0x02, 0x24, 0xF7, 0xFF, 0x12, 0xE0,
 120                         0x00, 0x05, 0x01, 0x21, 0xF7, 0xFF, 0x12, 0xE0 };
 121
 122                 memcpy(c.d.asBytes, csns, 8*NUM_CSNS);
 123
 124                 SendCommand(&c);
 125                 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
 126                         PrintAndLog("Command timed out");
 127                         return 0;
 128                 }
 129
 130                 uint8_t num_mac_responses  = resp.arg[1];
 131                 PrintAndLog("Mac responses: %d MACs obtained (should be %d)", num_mac_responses,NUM_CSNS);
 132
 133                 size_t datalen = NUM_CSNS*24;
 134                 /*
 135                  * Now, time to dump to file. We'll use this format:
 136                  * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
 137                  * So, it should wind up as
 138                  * 8 * 24 bytes.
 139                  *
 140                  * The returndata from the pm3 is on the following format
 141                  * <4 byte NR><4 byte MAC>
 142                  * CC are all zeroes, CSN is the same as was sent in
 143                  **/
 144                 void* dump = malloc(datalen);
 145                 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
 146                 uint8_t i = 0;
 147                 for(i = 0 ; i < NUM_CSNS ; i++)
 148                 {
 149                         memcpy(dump+i*24, csns+i*8,8); //CSN
 150                         //8 zero bytes here...
 151                         //Then comes NR_MAC (eight bytes from the response)
 152                         memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
 153
 154                 }
 155                 /** Now, save to dumpfile **/
 156                 saveFile("iclass_mac_attack", "bin", dump,datalen);
 157                 free(dump);
 158         }else
 159         {
 160                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
 161                 memcpy(c.d.asBytes, CSN, 8);
 162                 SendCommand(&c);
 163         }
 164
 165         return 0;
 166 }
 167
 168 int HFiClassReader(const char *Cmd, bool loop, bool verbose)
 169 {
 170         bool tagFound = false;
 171         UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
 172                                         FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
 173         if (!loop) c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
 174         SendCommand(&c);
 175         UsbCommand resp;
 176         while(!ukbhit()){
 177                 if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
 178                         uint8_t readStatus = resp.arg[0] & 0xff;
 179                         uint8_t *data = resp.d.asBytes;
 180
 181                         if (verbose)
 182                                 PrintAndLog("Readstatus:%02x", readStatus);
 183                         if( readStatus == 0){
 184                                 //Aborted
 185                                 if (verbose) PrintAndLog("Quitting...");
 186                                 return 0;
 187                         }
 188                         if( readStatus & FLAG_ICLASS_READER_CSN){
 189                                 PrintAndLog("CSN: %s",sprint_hex(data,8));
 190                                 tagFound = true;
 191                         }
 192                         if( readStatus & FLAG_ICLASS_READER_CC)  PrintAndLog("CC: %s",sprint_hex(data+16,8));
 193                         if( readStatus & FLAG_ICLASS_READER_CONF){
 194                                 printIclassDumpInfo(data);
 195                         }
 196                         if (tagFound && !loop) return 1;
 197                 } else {
 198                         if (verbose) PrintAndLog("Command execute timeout");
 199                 }
 200                 if (!loop) break;
 201         }
 202         return 0;
 203
 204 }
 205
 206 int CmdHFiClassReader(const char *Cmd)
 207 {
 208         return HFiClassReader(Cmd, true, true);
 209 }
 210
 211 int CmdHFiClassReader_Replay(const char *Cmd)
 212 {
 213         uint8_t readerType = 0;
 214         uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
 215
 216         if (strlen(Cmd)<1) {
 217                 PrintAndLog("Usage:  hf iclass replay <MAC>");
 218                 PrintAndLog("        sample: hf iclass replay 00112233");
 219                 return 0;
 220         }
 221
 222         if (param_gethex(Cmd, 0, MAC, 8)) {
 223                 PrintAndLog("MAC must include 8 HEX symbols");
 224                 return 1;
 225         }
 226
 227         UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
 228         memcpy(c.d.asBytes, MAC, 4);
 229         SendCommand(&c);
 230
 231         return 0;
 232 }
 233
 234 int CmdHFiClassReader_Dump(const char *Cmd)
 235 {
 236         uint8_t readerType = 0;
 237         uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 238         uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 239         uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 240         uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 241         //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 242         uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 243         uint8_t keytable[128] = {0};
 244         int elite = 0;
 245         uint8_t *used_key;
 246         int i;
 247         if (strlen(Cmd)<1)
 248         {
 249                 PrintAndLog("Usage:  hf iclass dump <Key> [e]");
 250                 PrintAndLog("        Key    - A 16 byte master key");
 251                 PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
 252                 PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
 253                 PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
 254                 PrintAndLog("        sample: hf iclass dump 0011223344556677");
 255
 256
 257                 return 0;
 258         }
 259
 260         if (param_gethex(Cmd, 0, KEY, 16))
 261         {
 262                 PrintAndLog("KEY must include 16 HEX symbols");
 263                 return 1;
 264         }
 265
 266         if (param_getchar(Cmd, 1) == 'e')
 267         {
 268                 PrintAndLog("Elite switch on");
 269                 elite = 1;
 270
 271                 //calc h2
 272                 hash2(KEY, keytable);
 273                 printarr_human_readable("keytable", keytable, 128);
 274
 275         }
 276
 277         UsbCommand resp;
 278         uint8_t key_sel[8] = {0};
 279         uint8_t key_sel_p[8] = { 0 };
 280
 281         UsbCommand c = {CMD_READER_ICLASS, {0}};
 282         c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE| FLAG_ICLASS_READER_CC;
 283         SendCommand(&c);
 284
 285
 286
 287         if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
 288         {
 289                 PrintAndLog("Command execute timeout");
 290                 return 0;
 291         }
 292
 293         uint8_t isOK    = resp.arg[0] & 0xff;
 294         uint8_t * data  = resp.d.asBytes;
 295
 296         memcpy(CSN,data,8);
 297         memcpy(CCNR,data+16,8);
 298
 299         PrintAndLog("isOk:%02x", isOK);
 300
 301         if(isOK > 0)
 302         {
 303                 PrintAndLog("CSN: %s",sprint_hex(CSN,8));
 304         }
 305         if(isOK <= 1){
 306                 PrintAndLog("Failed to obtain CC! Aborting");
 307                 return 0;
 308         }
 309         //Status 2 or higher
 310
 311         if(elite)
 312         {
 313                 //Get the key index (hash1)
 314                 uint8_t key_index[8] = {0};
 315
 316                 hash1(CSN, key_index);
 317                 printvar("hash1", key_index,8);
 318                 for(i = 0; i < 8 ; i++)
 319                         key_sel[i] = keytable[key_index[i]] & 0xFF;
 320                 PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");
 321                 printvar("k_sel", key_sel,8);
 322                 //Permute from iclass format to standard format
 323                 permutekey_rev(key_sel,key_sel_p);
 324                 used_key = key_sel_p;
 325         }else{
 326                 used_key = KEY;
 327         }
 328
 329         PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");
 330         printvar("Used key",used_key,8);
 331         diversifyKey(CSN,used_key, div_key);
 332         PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");
 333         printvar("Div key", div_key, 8);
 334         printvar("CC_NR:",CCNR,12);
 335         doMAC(CCNR,div_key, MAC);
 336         printvar("MAC", MAC, 4);
 337
 338         uint8_t iclass_data[32000] = {0};
 339         uint32_t iclass_datalen = 0;
 340         uint32_t iclass_blocksFailed = 0;//Set to 1 if dump was incomplete
 341
 342         UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
 343         memcpy(d.d.asBytes, MAC, 4);
 344         clearCommandBuffer();
 345         SendCommand(&d);
 346         PrintAndLog("Waiting for device to dump data. Press button on device and key on keyboard to abort...");
 347         while (true) {
 348                 printf(".");
 349                 if (ukbhit()) {
 350                         getchar();
 351                         printf("\naborted via keyboard!\n");
 352                         break;
 353                 }
 354                 if(WaitForResponseTimeout(CMD_ACK,&resp,4500))
 355                 {
 356                         uint32_t dataLength = resp.arg[0];
 357                         iclass_blocksFailed |= resp.arg[1];
 358                         if(dataLength > 0)
 359                         {
 360                                 PrintAndLog("Got %d bytes data (total so far %d)" ,dataLength,iclass_datalen);
 361                                 memcpy(iclass_data+iclass_datalen, resp.d.asBytes,dataLength);
 362                                 iclass_datalen += dataLength;
 363                         }else
 364                         {//Last transfer, datalength 0 means the dump is finished
 365                                 PrintAndLog("Dumped %d bytes of data from tag. ", iclass_datalen);
 366                                 if(iclass_blocksFailed)
 367                                 {
 368                                         PrintAndLog("OBS! Some blocks failed to be dumped correctly!");
 369                                 }
 370                                 if(iclass_datalen > 0)
 371                                 {
 372                                         char filename[100] = {0};
 373                                         //create a preferred filename
 374                                         snprintf(filename, 100,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
 375                                                          CSN[0],CSN[1],CSN[2],CSN[3],
 376                                                         CSN[4],CSN[5],CSN[6],CSN[7]);
 377                                         //Place the div_key in block 3
 378                                         memcpy(iclass_data+(3*8), div_key, 8);
 379                                         saveFile(filename,"bin",iclass_data, iclass_datalen );
 380                                 }
 381                                 //Aaaand we're finished
 382                                 return 0;
 383                         }
 384                 }
 385         }
 386
 387
 388         return 0;
 389 }
 390
 391 int hf_iclass_eload_usage()
 392 {
 393         PrintAndLog("Loads iclass tag-dump into emulator memory on device");
 394         PrintAndLog("Usage:  hf iclass eload f <filename>");
 395         PrintAndLog("");
 396         PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
 397         return 0;
 398
 399 }
 400
 401 int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
 402         UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
 403         memcpy(c.d.asBytes, data, blocksCount * 16);
 404         SendCommand(&c);
 405         return 0;
 406 }
 407 int CmdHFiClassELoad(const char *Cmd)
 408 {
 409
 410         char opt = param_getchar(Cmd, 0);
 411         if (strlen(Cmd)<1 || opt == 'h')
 412                 return hf_iclass_eload_usage();
 413
 414         //File handling and reading
 415         FILE *f;
 416         char filename[FILE_PATH_SIZE];
 417         if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
 418         {
 419                 f = fopen(filename, "rb");
 420         }else{
 421                 return hf_iclass_eload_usage();
 422         }
 423
 424         if(!f) {
 425                 PrintAndLog("Failed to read from file '%s'", filename);
 426                 return 1;
 427         }
 428
 429         fseek(f, 0, SEEK_END);
 430         long fsize = ftell(f);
 431         fseek(f, 0, SEEK_SET);
 432
 433         uint8_t *dump = malloc(fsize);
 434
 435
 436         size_t bytes_read = fread(dump, 1, fsize, f);
 437         fclose(f);
 438
 439         printIclassDumpInfo(dump);
 440         //Validate
 441
 442         if (bytes_read < fsize)
 443         {
 444                 prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
 445                 free(dump);
 446                 return 1;
 447         }
 448         //Send to device
 449         uint32_t bytes_sent = 0;
 450         uint32_t bytes_remaining  = bytes_read;
 451
 452         while(bytes_remaining > 0){
 453                 uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
 454                 UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
 455                 memcpy(c.d.asBytes, dump, bytes_in_packet);
 456                 SendCommand(&c);
 457                 bytes_remaining -= bytes_in_packet;
 458                 bytes_sent += bytes_in_packet;
 459         }
 460         free(dump);
 461         PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
 462         return 0;
 463 }
 464
 465 int usage_hf_iclass_decrypt()
 466 {
 467         PrintAndLog("Usage: hf iclass decrypt f <tagdump> o ");
 468         PrintAndLog("");
 469         PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
 470         PrintAndLog("in the working directory. The file should be 16 bytes binary data");
 471         PrintAndLog("");
 472         PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
 473         PrintAndLog("");
 474         PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
 475         PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
 476         PrintAndLog("which is defined by the configuration block.");
 477         return 1;
 478 }
 479
 480 int readKeyfile(const char *filename, size_t len, uint8_t* buffer)
 481 {
 482         FILE *f = fopen(filename, "rb");
 483         if(!f) {
 484                 PrintAndLog("Failed to read from file '%s'", filename);
 485                 return 1;
 486         }
 487         fseek(f, 0, SEEK_END);
 488         long fsize = ftell(f);
 489         fseek(f, 0, SEEK_SET);
 490         size_t bytes_read = fread(buffer, 1, len, f);
 491         fclose(f);
 492         if(fsize != len)
 493         {
 494                 PrintAndLog("Warning, file size is %d, expected %d", fsize, len);
 495                 return 1;
 496         }
 497         if(bytes_read != len)
 498         {
 499                 PrintAndLog("Warning, could only read %d bytes, expected %d" ,bytes_read, len);
 500                 return 1;
 501         }
 502         return 0;
 503 }
 504
 505 int CmdHFiClassDecrypt(const char *Cmd)
 506 {
 507         uint8_t key[16] = { 0 };
 508         if(readKeyfile("iclass_decryptionkey.bin", 16, key))
 509         {
 510                 usage_hf_iclass_decrypt();
 511                 return 1;
 512         }
 513         PrintAndLog("Decryption file found... ");
 514         char opt = param_getchar(Cmd, 0);
 515         if (strlen(Cmd)<1 || opt == 'h')
 516                 return usage_hf_iclass_decrypt();
 517
 518         //Open the tagdump-file
 519         FILE *f;
 520         char filename[FILE_PATH_SIZE];
 521         if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
 522         {
 523                 f = fopen(filename, "rb");
 524         }else{
 525                 return usage_hf_iclass_decrypt();
 526         }
 527
 528         fseek(f, 0, SEEK_END);
 529         long fsize = ftell(f);
 530         fseek(f, 0, SEEK_SET);
 531         uint8_t enc_dump[8] = {0};
 532         uint8_t *decrypted = malloc(fsize);
 533         des3_context ctx = { DES_DECRYPT ,{ 0 } };
 534         des3_set2key_dec( &ctx, key);
 535         size_t bytes_read = fread(enc_dump, 1, 8, f);
 536
 537         //Use the first block (CSN) for filename
 538         char outfilename[FILE_PATH_SIZE] = { 0 };
 539         snprintf(outfilename,FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x-decrypted",
 540                          enc_dump[0],enc_dump[1],enc_dump[2],enc_dump[3],
 541                          enc_dump[4],enc_dump[5],enc_dump[6],enc_dump[7]);
 542
 543         size_t blocknum =0;
 544         while(bytes_read == 8)
 545         {
 546                 if(blocknum < 7)
 547                 {
 548                         memcpy(decrypted+(blocknum*8), enc_dump, 8);
 549                 }else{
 550                         des3_crypt_ecb(&ctx, enc_dump,decrypted +(blocknum*8) );
 551                 }
 552                 printvar("decrypted block", decrypted +(blocknum*8), 8);
 553                 bytes_read = fread(enc_dump, 1, 8, f);
 554                 blocknum++;
 555         }
 556         fclose(f);
 557
 558         saveFile(outfilename,"bin", decrypted, blocknum*8);
 559
 560         return 0;
 561 }
 562
 563 int CmdHFiClass_iso14443A_write(const char *Cmd)
 564 {
 565         uint8_t readerType = 0;
 566         uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 567         uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 568         uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 569         uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 570         uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 571
 572         uint8_t blockNo=0;
 573         uint8_t bldata[8]={0};
 574
 575         if (strlen(Cmd)<3)
 576         {
 577                 PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
 578                 PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
 579                 return 0;
 580         }
 581
 582         if (param_gethex(Cmd, 0, KEY, 16))
 583         {
 584                 PrintAndLog("KEY must include 16 HEX symbols");
 585                 return 1;
 586         }
 587
 588         blockNo = param_get8(Cmd, 1);
 589         if (blockNo>32)
 590         {
 591                 PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
 592                 return 1;
 593         }
 594         if (param_gethex(Cmd, 2, bldata, 8))
 595         {
 596                 PrintAndLog("Block data must include 8 HEX symbols");
 597                 return 1;
 598         }
 599
 600         UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
 601         SendCommand(&c);
 602         UsbCommand resp;
 603
 604         if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 605                 uint8_t isOK    = resp.arg[0] & 0xff;
 606                 uint8_t * data  = resp.d.asBytes;
 607
 608                 memcpy(CSN,data,8);
 609                 memcpy(CCNR,data+8,8);
 610                 PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
 611                 PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
 612                 PrintAndLog("isOk:%02x", isOK);
 613         } else {
 614                 PrintAndLog("Command execute timeout");
 615         }
 616
 617         diversifyKey(CSN,KEY, div_key);
 618
 619         PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
 620         doMAC(CCNR, div_key, MAC);
 621
 622         UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
 623         memcpy(c2.d.asBytes, bldata, 8);
 624         memcpy(c2.d.asBytes+8, MAC, 4);
 625         SendCommand(&c2);
 626
 627         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 628                 uint8_t isOK    = resp.arg[0] & 0xff;
 629                 uint8_t * data  = resp.d.asBytes;
 630
 631                 if (isOK)
 632                         PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
 633                 else
 634                         PrintAndLog("isOk:%02x", isOK);
 635         } else {
 636                 PrintAndLog("Command execute timeout");
 637         }
 638         return 0;
 639 }
 640 int CmdHFiClass_loclass(const char *Cmd)
 641 {
 642         char opt = param_getchar(Cmd, 0);
 643
 644         if (strlen(Cmd)<1 || opt == 'h') {
 645                 PrintAndLog("Usage: hf iclass loclass [options]");
 646                 PrintAndLog("Options:");
 647                 PrintAndLog("h             Show this help");
 648                 PrintAndLog("t             Perform self-test");
 649                 PrintAndLog("f <filename>  Bruteforce iclass dumpfile");
 650                 PrintAndLog("                   An iclass dumpfile is assumed to consist of an arbitrary number of");
 651                 PrintAndLog("                   malicious CSNs, and their protocol responses");
 652                 PrintAndLog("                   The the binary format of the file is expected to be as follows: ");
 653                 PrintAndLog("                   <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
 654                 PrintAndLog("                   <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
 655                 PrintAndLog("                   <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>");
 656                 PrintAndLog("                  ... totalling N*24 bytes");
 657                 return 0;
 658         }
 659         char fileName[255] = {0};
 660         if(opt == 'f')
 661         {
 662                 if(param_getstr(Cmd, 1, fileName) > 0)
 663                 {
 664                         return bruteforceFileNoKeys(fileName);
 665                 }else
 666                 {
 667                         PrintAndLog("You must specify a filename");
 668                 }
 669         }
 670         else if(opt == 't')
 671         {
 672                 int errors = testCipherUtils();
 673                 errors += testMAC();
 674                 errors += doKeyTests(0);
 675                 errors += testElite();
 676                 if(errors)
 677                 {
 678                         prnlog("OBS! There were errors!!!");
 679                 }
 680                 return errors;
 681         }
 682
 683         return 0;
 684 }
 685
 686 static command_t CommandTable[] =
 687 {
 688         {"help",        CmdHelp,                        1,      "This help"},
 689         {"list",        CmdHFiClassList,        0,      "[Deprecated] List iClass history"},
 690         {"snoop",       CmdHFiClassSnoop,       0,      "Eavesdrop iClass communication"},
 691         {"sim", CmdHFiClassSim,         0,      "Simulate iClass tag"},
 692         {"reader",CmdHFiClassReader,    0,      "Read an iClass tag"},
 693         {"replay",CmdHFiClassReader_Replay,     0,      "Read an iClass tag via Reply Attack"},
 694         {"dump",        CmdHFiClassReader_Dump, 0,              "Authenticate and Dump iClass tag"},
 695 //      {"write",       CmdHFiClass_iso14443A_write,    0,      "Authenticate and Write iClass block"},
 696         {"loclass",     CmdHFiClass_loclass,    1,      "Use loclass to perform bruteforce of reader attack dump"},
 697         {"eload",   CmdHFiClassELoad,    0,     "[experimental] Load data into iclass emulator memory"},
 698         {"decrypt", CmdHFiClassDecrypt,  1,     "Decrypt tagdump" },
 699         {NULL, NULL, 0, NULL}
 700 };
 701
 702 int CmdHFiClass(const char *Cmd)
 703 {
 704         CmdsParse(CommandTable, Cmd);
 705         return 0;
 706 }
 707
 708 int CmdHelp(const char *Cmd)
 709 {
 710         CmdsHelp(CommandTable);
 711         return 0;
 712 }