rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

CHG: finalized the merge between peter filmoores 14atagfuzz branch (emv). I seriously doubt anything works.

Browse Source
This commit is contained in:
iceman1001
2017-03-01 21:51:23 +01:00
parent a9eeb57698
commit 99136c6eef
12 changed files with 678 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
armsrc/appmain.c
-3
View File
@@ -1233,9 +1233,6 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_EMV_READ_RECORD:
EMVReadRecord(c->arg[0], c->arg[1], NULL);
break;
case CMD_EMV_TRANSACTION:
EMVTransaction();
break;
case CMD_EMV_CLONE:
EMVClone(c->arg[0], c->arg[1]);
break;
armsrc/apps.h
+12 -8
View File
@@ -29,6 +29,8 @@ extern "C" {
#include "pcf7931.h"
#include "desfire.h"
#include "iso14443b.h"
//#include "iso14443a.h"
#include "emvcard.h"
extern int rsamples; // = 0;
extern int tracing; // = TRUE;
@@ -118,6 +120,9 @@ void ReaderIso14443a(UsbCommand * c);
//bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t len, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
void GetParity(const uint8_t *pbtCmd, uint16_t len, uint8_t *parity);
void iso14a_set_trigger(bool enable);
// also used in emv
bool prepare_allocated_tag_modulation(tag_response_info_t * response_info);
int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len);
// epa.h
void EPA_PACE_Collect_Nonce(UsbCommand * c);
@@ -220,23 +225,22 @@ bool cmd_send(uint32_t cmd, uint32_t arg0, uint32_t arg1, uint32_t arg2, void* d
// util.h
void HfSnoop(int , int);
//EMV functions emvcmd.h
//EMV functions
// emvcmd.h
void EMVTransaction(void);
void EMVgetUDOL(void);
void EMVloadvalue(uint32_t tag, uint8_t* datain);
void EMVdumpcard(void);
/*
//void EMVSelect(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
void EMVFuzz_RATS(uint8_t len, uint8_t* RATS);
void EMVFuzz_RATS(uint8_t ratslen, uint8_t* RATS);
void EMVReadRecord(uint8_t arg0, uint8_t arg1,emvcard* inputcard);
void EMVSelectPPSE();
void EMVSelectAID(uint8_t *AID, uint8_t AIDlen, emvcard* inputcard);
void EMVTransaction(); //perform an EMV transaction
void EMVClone(uint8_t maxsfi, uint8_t maxrecord); //clone an EMV card.
void EMVTransaction();
void EMVClone(uint8_t maxsfi, uint8_t maxrecord);
void EMVSim();
void EMVTest(); //test function for emv stuff.
*/
void EMVTest();
void SimulateEMVcard();
#ifdef __cplusplus
}
armsrc/emvcard.h
+1 -1
View File
@@ -240,6 +240,6 @@ typedef struct {
uint8_t tag_BF0C[222]; //File Control Information (FCI) Issuer Discretionary Data
uint8_t tag_DFName[16];
uint8_t tag_DFName_len;
} emvtags;
} emvcard;
#endif //__EMVCARD_H
armsrc/emvcmd.c
+547 -160
View File
File diff suppressed because it is too large Load Diff
armsrc/emvcmd.h
+1 -1
View File
@@ -18,7 +18,6 @@
#include "string.h"
#include "iso14443crc.h"
#include "iso14443a.h"
#include "mifare.h"
#include "emvcmd.h"
#include "emvutil.h"
#include "emvdataels.h"
@@ -31,4 +30,5 @@
#define MASTERCARD_MSR 0
#define MASTERCARD_MCHIP 1
#endif
armsrc/emvutil.c
+83 -16
View File
@@ -16,7 +16,7 @@
//util functions
//print detected tag name over the serial link
int emv_printtag(uint8_t* selected_tag, emvtags* inputcard, uint8_t* outputstring, uint8_t* outputlen)
int emv_printtag(uint8_t* selected_tag, emvcard* inputcard, uint8_t* outputstring, uint8_t* outputlen)
{
//search tag list and print the match
//get the value of the tag
@@ -36,8 +36,8 @@ int emv_printtag(uint8_t* selected_tag, emvtags* inputcard, uint8_t* outputstrin
return 0;
}
//returns the value of the emv tag in the supplied emvtags structure
int emv_lookuptag(uint8_t* tag, emvtags *currentcard, uint8_t* outputval, uint8_t* outputvallen)
//returns the value of the emv tag in the supplied emvcard structure
int emv_lookuptag(uint8_t* tag, emvcard *currentcard, uint8_t* outputval, uint8_t* outputvallen)
{
//loop through tag and return the appropriate value
uint8_t returnedtag[255];
@@ -367,7 +367,7 @@ exitfunction: //goto label to exit search quickly once found
}
//function to
int emv_settag(uint32_t tag, uint8_t *datain, emvtags *currentcard){
int emv_settag(uint32_t tag, uint8_t *datain, emvcard *currentcard){
char binarydata[255] = {0};
/*
@@ -807,13 +807,13 @@ int emv_settag(uint32_t tag, uint8_t *datain, emvtags *currentcard){
}
/* generates an emv template based off tag values supplied */
int emv_generatetemplate(uint8_t* templateval,emvtags* currentcard, uint8_t* returnedval, uint8_t* returnedlen,uint8_t numtags, ...)
int emv_generatetemplate(uint8_t* templateval,emvcard* currentcard, uint8_t* returnedval, uint8_t* returnedlen,uint8_t numtags, ...)
{
va_list arguments;
uint8_t* currenttag; //value of the current tag
uint8_t tagval[255]; //buffer to hold the extracted tag value
uint8_t tagval[256]; //buffer to hold the extracted tag value
uint8_t taglen = 0; //extracted tag length
uint8_t bufferval[255];
uint8_t bufferval[256];
uint8_t counter = 0;
uint32_t encodedlen = 0;
va_start(arguments, numtags);
@@ -830,7 +830,7 @@ int emv_generatetemplate(uint8_t* templateval,emvtags* currentcard, uint8_t* ret
}
//generate a valid pdol list
int emv_generateDOL(uint8_t* DOL, uint8_t DOLlen,emvtags* currentcard,uint8_t* DOLoutput, uint8_t* DOLoutputlen)
int emv_generateDOL(uint8_t* DOL, uint8_t DOLlen,emvcard* currentcard,uint8_t* DOLoutput, uint8_t* DOLoutputlen)
{
if(!DOL || !currentcard || !DOLoutput) // null pointer checks
return 1;
@@ -866,7 +866,7 @@ int emv_generateDOL(uint8_t* DOL, uint8_t DOLlen,emvtags* currentcard,uint8_t* D
//decode the tag inputted and fill in the supplied structure. clean up the cleanup_passpass function
int emv_emvtags_decode_tag(tlvtag* inputtag, emvtags* currentcard)
int emv_emvtags_decode_tag(tlvtag* inputtag, emvcard* currentcard)
{
if(!inputtag || !currentcard) {
return 1;
@@ -1324,7 +1324,7 @@ else
return 0;
}
int emv_decode_field(uint8_t* inputfield,uint16_t inputlength, emvtags *result)
int emv_decode_field(uint8_t* inputfield,uint16_t inputlength, emvcard *result)
{
uint16_t lengthcounter=0;
tlvtag newtag;
@@ -1337,7 +1337,7 @@ int emv_decode_field(uint8_t* inputfield,uint16_t inputlength, emvtags *result)
{
//decode the tlv tag
decode_ber_tlv_item((inputfield+lengthcounter),&newtag);
//write the emvtags strucutre
//write the emvcard strucutre
emv_emvtags_decode_tag(&newtag,result);
//move to next value and decode
lengthcounter += newtag.fieldlength-1;
@@ -1503,18 +1503,85 @@ int emv_decodeCVM(uint8_t* CVM, uint8_t CVMlen)
}
return 0;
}
//simulate a emvcard card
//input is a structure containing values to simulate
//clones an EMV card
void emvsnoop() {
//states
int cardSTATE = EMVEMUL_NOFIELD;
int vHf = 0;
int res;
uint16_t len = 0;
uint8_t* receivedCmd = BigBuf_malloc(MAX_MIFARE_FRAME_SIZE);
uint8_t par[MAX_MIFARE_PARITY_SIZE] = {0x00};
uint8_t rATQA[] = {0x04,0x00};
uint8_t rUIDBCC[] = {0x8F,0x2F,0x27,0xE1, 0x66};
uint8_t rSAK[] = {0x28, 0xB4, 0xFC};
iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
bool finished = FALSE;
while (!BUTTON_PRESS() && !finished){
WDT_HIT();
//find reader field
if(cardSTATE == EMVEMUL_NOFIELD){
vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
if(vHf > EMV_MINFIELDV){
cardSTATE_TO_IDLE();
LED_A_ON();
}
}
if(cardSTATE == EMVEMUL_NOFIELD) continue;
//get data
res = EmGetCmd(receivedCmd, &len, par);
if(res == 2) { //field is off
cardSTATE = EMVEMUL_NOFIELD;
LEDsoff();
continue;
}
else if(res==1){
break; // button press
}
if(len==1 && ((receivedCmd[0] == 0x26 && cardSTATE != EMVEMUL_HALTED) || receivedCmd[0] == 0x52)){
EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
cardSTATE = EMVEMUL_SELECT1;
continue;
}
switch(cardSTATE){
case EMVEMUL_NOFIELD:
case EMVEMUL_HALTED:
case EMVEMUL_IDLE:{
break;
}
case EMVEMUL_SELECT1:{
//select all
if(len==2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
EmSendCmd(rUIDBCC, sizeof(rUIDBCC));
break;
}
if(len==2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC, 4) == 0)) {
EmSendCmd(rSAK, sizeof(rSAK));
break;
}
}
}
}
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
}
//ICEMAN: move to client
//dump the current card to the console
void dumpCard(emvtags* currentcard){
void dumpCard(emvcard* currentcard){
DUMP(currentcard->ATQA);
Dbhexdump(sizeof(currentcard->ATQA), currentcard->ATQA, false);
DUMP(currentcard->UID);
Dbhexdump(currentcard->UID_len, currentcard->UID, false);
DUMP(currentcard->SAK1);
Dbhexdump(1, &currentcard->SAK1, false);
DUMP(currentcard->SAK2);
Dbhexdump(1, &currentcard->SAK2, false);
DUMP(currentcard->SAK);
Dbhexdump(1, &currentcard->SAK, false);
DUMP(currentcard->ATS);
Dbhexdump(currentcard->ATS_len, currentcard->ATS, false);
DUMP(currentcard->tag_4F);
armsrc/emvutil.h
+12 -10
View File
@@ -48,8 +48,7 @@
int emv_select(uint8_t* AID, uint8_t AID_len, void* data);
int emv_selectPPSE();
int emv_readrecord(uint8_t recordnumber, uint8_t sfi, void* data);
int emv_getprocessingoptions(uint8_t* pdol, uint8_t pdol_len, void* data
);
int emv_getprocessingoptions(uint8_t* pdol, uint8_t pdol_len, void* data);
int emv_computecryptogram(uint8_t* UDOL, uint8_t UDOL_len, void *data);
//return 8 8byte ICC random number.
int emv_getchallenge(void *data);
@@ -59,18 +58,21 @@ int emv_decodeAFL(uint8_t* AFL, uint8_t AFLlen);
int emv_decodeAIP(uint8_t* AIP);
int emv_decodeCVM(uint8_t* CVM, uint8_t CVMlen);
//emulator
void EMVsim();
//utils
int emv_printtag(uint8_t* selected_tag,emvtags* inputcard, uint8_t* outputstring, uint8_t* outputlen);
int emv_decode_field(uint8_t* inputfield,uint16_t inputlength, emvtags *result);
int emv_emvtags_decode_tag(tlvtag* inputtag, emvtags* currentcard);
int emv_printtag(uint8_t* selected_tag, emvcard* inputcard, uint8_t* outputstring, uint8_t* outputlen);
int emv_decode_field(uint8_t* inputfield,uint16_t inputlength, emvcard *result);
int emv_emvtags_decode_tag(tlvtag* inputtag, emvcard* currentcard);
//look up a tag in the current structure
int emv_lookuptag(uint8_t* tag, emvtags* currentcard, uint8_t* outputval, uint8_t* outputvallen);
int emv_lookuptag(uint8_t* tag, emvcard* currentcard, uint8_t* outputval, uint8_t* outputvallen);
//set a tag from external impurt
int emv_settag(uint32_t tag, uint8_t *datain, emvtags *currentcard) ;
void dumpCard(emvtags* currentcard);
int emv_settag(uint32_t tag, uint8_t *datain, emvcard *currentcard) ;
void dumpCard(emvcard* currentcard);
//generate a valid PDOL list from the returned card value, used in get processing options
int emv_generateDOL(uint8_t* DOL, uint8_t DOLlen,emvtags* currentcard, uint8_t* DOLoutput, uint8_t* DOLoutputlen);
int emv_generateDOL(uint8_t* DOL, uint8_t DOLlen,emvcard* currentcard, uint8_t* DOLoutput, uint8_t* DOLoutputlen);
int emv_generatetemplate(uint8_t* templateval,emvtags* currentcard, uint8_t* returnedval, uint8_t* returnedlen, uint8_t numtags, ...);
int emv_generatetemplate(uint8_t* templateval,emvcard* currentcard, uint8_t* returnedval, uint8_t* returnedlen, uint8_t numtags, ...);
#endif
armsrc/iso14443a.c
+2 -36
View File
@@ -759,7 +759,7 @@ static void Code4bitAnswerAsTag(uint8_t cmd) {
// Stop when button is pressed
// Or return TRUE when command is captured
//-----------------------------------------------------------------------------
static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len) {
int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len) {
// Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
// only, since we are receiving, not transmitting).
// Signal field is off with the appropriate LED
@@ -1361,40 +1361,6 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data) {
BigBuf_free_keep_EM();
LED_A_OFF();
/*
if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1) {
for ( uint8_t i = 0; i < ATTACK_KEY_COUNT; i++) {
if (ar_nr_collected[i] == 2) {
Dbprintf("Collected two pairs of AR/NR which can be used to extract %s from reader for sector %d:", (i<ATTACK_KEY_COUNT/2) ? "keyA" : "keyB", ar_nr_resp[i].sector);
Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
ar_nr_resp[i].cuid, //UID
ar_nr_resp[i].nonce, //NT
ar_nr_resp[i].nr, //NR1
ar_nr_resp[i].ar, //AR1
ar_nr_resp[i].nr2, //NR2
ar_nr_resp[i].ar2 //AR2
);
}
}
for ( uint8_t i = ATTACK_KEY_COUNT; i < ATTACK_KEY_COUNT*2; i++) {
if (ar_nr_collected[i] == 2) {
Dbprintf("Collected two pairs of AR/NR which can be used to extract %s from reader for sector %d:", (i<ATTACK_KEY_COUNT/2) ? "keyA" : "keyB", ar_nr_resp[i].sector);
Dbprintf("../tools/mfkey/mfkey32v2 %08x %08x %08x %08x %08x %08x %08x",
ar_nr_resp[i].cuid, //UID
ar_nr_resp[i].nonce, //NT
ar_nr_resp[i].nr, //NR1
ar_nr_resp[i].ar, //AR1
ar_nr_resp[i].nonce2,//NT2
ar_nr_resp[i].nr2, //NR2
ar_nr_resp[i].ar2 //AR2
);
}
}
}
*/
if (MF_DBGLEVEL >= 4){
Dbprintf("-[ Wake ups after halt [%d]", happened);
Dbprintf("-[ Messages after halt [%d]", happened2);
@@ -1567,7 +1533,7 @@ void CodeIso14443aAsReaderPar(const uint8_t *cmd, uint16_t len, const uint8_t *p
// Stop when button is pressed (return 1) or field was gone (return 2)
// Or return 0 when command is captured
//-----------------------------------------------------------------------------
static int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity) {
int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity) {
*len = 0;
uint32_t timer = 0, vtime = 0;
armsrc/iso14443a.h
+1 -7
View File
@@ -82,13 +82,6 @@ typedef struct {
uint8_t *parity;
} tUart;
typedef struct {
uint8_t* response;
size_t response_n;
uint8_t* modulation;
size_t modulation_n;
uint32_t ProxToAirDuration;
} tag_response_info_t;
extern void GetParity(const uint8_t *pbtCmd, uint16_t len, uint8_t *par);
extern void AppendCrc14443a(uint8_t *data, int len);
@@ -109,6 +102,7 @@ int EmSend4bit(uint8_t resp);
int EmSendCmdExPar(uint8_t *resp, uint16_t respLen, bool correctionNeeded, uint8_t *par);
int EmSendCmdEx(uint8_t *resp, uint16_t respLen, bool correctionNeeded);
extern int EmSendCmd(uint8_t *resp, uint16_t respLen);
extern int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity);
int EmSendCmdPar(uint8_t *resp, uint16_t respLen, uint8_t *par);
bool EmLogTrace(uint8_t *reader_data, uint16_t reader_len, uint32_t reader_StartTime, uint32_t reader_EndTime, uint8_t *reader_Parity,
uint8_t *tag_data, uint16_t tag_len, uint32_t tag_StartTime, uint32_t tag_EndTime, uint8_t *tag_Parity);
armsrc/iso14443b.h
-2
View File
@@ -23,10 +23,8 @@ extern "C" {
#include "util.h"
#include "string.h"
#include "iso14443crc.h"
#include "mifare.h"
#include "protocols.h"
//#include "mifareutil.h"
extern void AppendCrc14443b(uint8_t *data, int len);
void SendRawCommand14443B_Ex(UsbCommand *c);
include/common.h
+12 -3
View File
@@ -12,6 +12,10 @@
#ifndef __COMMON_H
#define __COMMON_H
#ifdef __cplusplus
extern "C" {
#endif
#include <stddef.h>
#include <stdint.h>
#include <stdbool.h>
@@ -20,7 +24,7 @@ typedef unsigned char byte_t;
// debug
// 0 - no debug messages 1 - error messages 2 - all messages 4 - extended debug mode
#define MF_DBG_NONE 0
#define MF_DBG_NONE 0
#define MF_DBG_ERROR 1
#define MF_DBG_ALL 2
#define MF_DBG_EXTENDED 4
@@ -29,7 +33,6 @@ extern int MF_DBGLEVEL;
// reader voltage field detector
#define MF_MINFIELDV 4000
#ifndef MIN
# define MIN(a, b) (((a) < (b)) ? (a) : (b))
#endif
@@ -42,4 +45,10 @@ extern int MF_DBGLEVEL;
# define ABS(a) ( ((a)<0) ? -(a) : (a) )
#endif
#define RAMFUNC __attribute((long_call, section(".ramfunc")))
#endif
#ifdef __cplusplus
}
#endif
#endif
include/mifare.h
+7 -1
View File
@@ -37,7 +37,13 @@ typedef enum ISO14A_COMMAND {
ISO14A_TOPAZMODE = (1 << 8)
} iso14a_command_t;
typedef struct {
uint8_t* response;
size_t response_n;
uint8_t* modulation;
size_t modulation_n;
uint32_t ProxToAirDuration;
} tag_response_info_t;
//-----------------------------------------------------------------------------
// ISO 14443B
//-----------------------------------------------------------------------------