rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

renamed readtagfile to view\nrenamed clone to restore\nrefactored reader, info, dump, rdbl, wrbl to be on device side. Commands now also seamless works with NON_SECURE_MPAGE

Browse Source
This commit is contained in:
iceman1001
2020-07-29 11:02:30 +02:00
parent acb598756c
commit e147bdc71b
8 changed files with 953 additions and 574 deletions
Download Patch File Download Diff File Expand all files Collapse all files
armsrc/Standalone/hf_iceclass.c
+92 -67
View File
@@ -13,10 +13,14 @@
#include "BigBuf.h"
#include "fpgaloader.h"
#include "util.h"
#include "ticks.h"
#include "dbprint.h"
#include "spiffs.h"
#include "iclass.h"
#include "iso15693.h"
#include "optimized_cipher.h"
#include "pm3_cmd.h"
#include "protocols.h"
#define NUM_CSNS 9
#define MAC_RESPONSES_SIZE (16 * NUM_CSNS)
@@ -36,15 +40,8 @@ char* cc_files[] = { HF_ICLASS_CC_A, HF_ICLASS_CC_B };
#define ICE_STATE_READER 3
#define ICE_STATE_CONFIGCARD 4
typedef struct {
uint8_t app_limit; //[8]
uint8_t otp[2]; //[9-10]
uint8_t block_writelock;//[11]
uint8_t chip_config; //[12]
uint8_t mem_config; //[13]
uint8_t eas; //[14]
uint8_t fuses; //[15]
} picopass_conf_block_t;
// times in ssp_clk_cycles @ 3,3625MHz when acting as reader
#define DELAY_ICLASS_VICC_TO_VCD_READER DELAY_ISO15693_VICC_TO_VCD_READER
// iclass card descriptors
char * card_types[] = {
@@ -70,9 +67,12 @@ uint8_t card_app2_limit[] = {
};
static uint8_t aa2_key[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
static uint8_t legacy_aa1_key[] = {0xAE, 0xA6, 0x84, 0xA6, 0xDA, 0xB2, 0x32, 0x78};
static uint8_t get_pagemap(const picopass_hdr *hdr) {
return (hdr->conf.fuses & (FUSE_CRYPT0 | FUSE_CRYPT1)) >> 3;
}
static uint8_t csns[8 * NUM_CSNS] = {
0x01, 0x0A, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0,
0x0C, 0x06, 0x0C, 0xFE, 0xF7, 0xFF, 0x12, 0xE0,
@@ -224,16 +224,10 @@ static int reader_attack_mode(void) {
static int reader_dump_mode(void) {
BigBuf_free();
uint8_t *card_data = BigBuf_malloc(0xFF * 8);
memset(card_data, 0xFF, sizeof(card_data));
struct p {
uint8_t key[8];
bool use_raw;
bool use_elite;
bool use_credit_key;
} PACKED;
for (;;) {
if (BUTTON_PRESS()) {
@@ -241,65 +235,104 @@ static int reader_dump_mode(void) {
break;
}
// AA1
struct p payload = {
// setup authenticate AA1
iclass_auth_req_t auth = {
.use_raw = false,
.use_elite = false,
.use_credit_key = false,
.do_auth = true,
.send_reply = false,
};
memcpy(payload.key, legacy_aa1_key, sizeof(payload.key));
memcpy(auth.key, legacy_aa1_key, sizeof(auth.key));
bool isOK = iclass_auth((uint8_t*)&payload, false, card_data);
if (isOK == false) {
Iso15693InitReader();
// select tag.
uint32_t eof_time = 0;
bool res = select_iclass_tag(card_data, auth.use_credit_key, &eof_time);
if (res == false) {
switch_off();
continue;
}
picopass_conf_block_t *conf = (picopass_conf_block_t*)(card_data + 8);
uint32_t start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
picopass_hdr *hdr = (picopass_hdr *)card_data;
// get 3 config bits
uint8_t type = (conf->chip_config & 0x10) >> 2;
type |= (conf->mem_config & 0x80) >> 6;
type |= (conf->mem_config & 0x20) >> 5;
uint8_t type = (hdr->conf.chip_config & 0x10) >> 2;
type |= (hdr->conf.mem_config & 0x80) >> 6;
type |= (hdr->conf.mem_config & 0x20) >> 5;
uint8_t app1_limit = conf->app_limit - 5; // minus header blocks
uint8_t app2_limit = card_app2_limit[type];
uint16_t dumped = 0;
uint8_t block;
for (block = 5; block < app1_limit; block++) {
isOK = iclass_readblock(block, card_data + (8 * block));
if (isOK) {
dumped++;
uint8_t pagemap = get_pagemap(hdr);
uint8_t app1_limit, app2_limit, start_block;
// tags configured for NON SECURE PAGE, acts different
if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
app1_limit = card_app2_limit[type];
app2_limit = 0;
start_block = 3;
} else {
app1_limit = hdr->conf.app_limit;
app2_limit = card_app2_limit[type];
start_block = 6;
res = authenticate_iclass_tag(&auth, hdr, &start_time, &eof_time, NULL);
if (res == false) {
switch_off();
DbpString("failed AA1 auth");
continue;
}
start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
}
// AA2
payload.use_credit_key = true;
memcpy(payload.key, aa2_key, sizeof(payload.key));
uint16_t dumped = 0;
isOK = iclass_auth((uint8_t*)&payload, false, card_data);
if (isOK) {
for (; block < app2_limit; block++) {
isOK = iclass_readblock(block, card_data + (8 * block));
if (isOK) {
dumped++;
// main read loop
for (uint8_t i = start_block; i <= app1_limit; i++) {
res = iclass_read_block(i, card_data + (8 * i));
if (res) {
dumped++;
}
start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
}
if (pagemap != PICOPASS_NON_SECURE_PAGEMODE) {
// authenticate AA2
auth.use_credit_key = true;
memcpy(auth.key, aa2_key, sizeof(auth.key));
res = select_iclass_tag(card_data, auth.use_credit_key, &eof_time);
if (res) {
res = authenticate_iclass_tag(&auth, hdr, &start_time, &eof_time, NULL);
if (res) {
start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
for (uint8_t i = app1_limit + 1; i <= app2_limit; i++) {
res = iclass_read_block(i, card_data + (8 * i));
if (res) {
dumped++;
}
start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
}
} else {
DbpString("failed AA2 auth");
}
}
}
Dbprintf("Found %s", card_types[type]);
/*
Dbprintf("APP1 Blocks: %d", app1_limit);
Dbprintf("APP2 Blocks: %d", app2_limit - app1_limit - 5); // minus app1 and header
Dbprintf("Got %d blocks (saving %u, %u bytes )", dumped, dumped + 5, ((dumped+5)*8) );
*/
if (5 + dumped > app1_limit) {
save_to_flash(card_data, (5 + dumped) * 8 );
}
switch_off();
save_to_flash(card_data, (start_block + dumped) * 8 );
SpinDelay(250);
Dbprintf("Found a %s", card_types[type]);
}
Dbprintf("exit read & dump mode");
Dbprintf("-=[ exiting `read & dump` mode");
return PM3_SUCCESS;
}
@@ -336,7 +369,7 @@ void RunMod(void) {
StandAloneMode();
Dbprintf(_YELLOW_("HF iCLASS mode a.k.a iceCLASS started"));
uint8_t mode = ICE_STATE_FULLSIM;
uint8_t mode = ICE_STATE_READER;
for (;;) {
@@ -344,14 +377,6 @@ void RunMod(void) {
if (mode == ICE_STATE_NONE) break;
if (data_available()) break;
/*
// Was our button held down or pressed?
int button_pressed = BUTTON_HELD(1000);
if (button_pressed != BUTTON_NO_CLICK) {
break;
}
*/
int res;
switch (mode) {
@@ -387,7 +412,7 @@ void RunMod(void) {
break;
}
case ICE_STATE_READER: {
Dbprintf("enter read & dump mode");
Dbprintf("enter read & dump mode, continuous scanning");
res = reader_dump_mode();
if (res == PM3_SUCCESS)
download_instructions(mode);
armsrc/appmain.c
+7 -30
View File
@@ -1407,36 +1407,14 @@ static void PacketReceived(PacketCommandNG *packet) {
break;
}
case CMD_HF_ICLASS_WRITEBL: {
struct p {
uint8_t blockno;
uint8_t data[12];
} PACKED;
struct p *payload = (struct p *)packet->data.asBytes;
iClass_WriteBlock(payload->blockno, payload->data);
break;
}
// iceman2019, unused?
case CMD_HF_ICLASS_READCHECK: { // auth step 1
iClass_ReadCheck(packet->oldarg[0], packet->oldarg[1]);
iClass_WriteBlock(packet->data.asBytes);
break;
}
case CMD_HF_ICLASS_READBL: {
/*
struct p {
uint8_t blockno;
} PACKED;
struct p *payload = (struct p *)packet->data.asBytes;
*/
iClass_ReadBlk(packet->data.asBytes[0]);
iClass_ReadBlock(packet->data.asBytes);
break;
}
case CMD_HF_ICLASS_AUTH: { //check
/*
struct p {
uint8_t mac[4];
} PACKED;
struct p *payload = (struct p *)packet->data.asBytes;
*/
iClass_Authentication(packet->data.asBytes);
break;
}
@@ -1445,12 +1423,7 @@ static void PacketReceived(PacketCommandNG *packet) {
break;
}
case CMD_HF_ICLASS_DUMP: {
struct p {
uint8_t start_blockno;
uint8_t numblks;
} PACKED;
struct p *payload = (struct p *)packet->data.asBytes;
iClass_Dump(payload->start_blockno, payload->numblks);
iClass_Dump(packet->data.asBytes);
break;
}
case CMD_HF_ICLASS_CLONE: {
@@ -1463,6 +1436,10 @@ static void PacketReceived(PacketCommandNG *packet) {
iClass_Clone(payload->startblock, payload->endblock, payload->data);
break;
}
case CMD_HF_ICLASS_RESTORE: {
iClass_Restore(packet->data.asBytes);
break;
}
#endif
#ifdef WITH_HFSNIFF
armsrc/iclass.c
+354 -135
View File
File diff suppressed because it is too large Load Diff
armsrc/iclass.h
+12 -6
View File
@@ -12,15 +12,17 @@
#define __ICLASS_H
#include "common.h"
#include "pm3_cmd.h"
void SniffIClass(uint8_t jam_search_len, uint8_t *jam_search_string);
void ReaderIClass(uint8_t arg0);
void ReaderIClass_Replay(uint8_t arg0, uint8_t *mac);
void iClass_WriteBlock(uint8_t blockno, uint8_t *data);
void iClass_Dump(uint8_t blockno, uint8_t numblks);
void iClass_WriteBlock(uint8_t *msg);
void iClass_Dump(uint8_t *msg);
void iClass_Restore(uint8_t *msg);
void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data);
void iClass_ReadCheck(uint8_t blockno, uint8_t keytype);
int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf);
void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
@@ -28,8 +30,12 @@ void iclass_simulate(uint8_t sim_type, uint8_t num_csns, bool send_reply, uint8_
void iClass_Authentication_fast(uint64_t arg0, uint64_t arg1, uint8_t *datain);
void iClass_Authentication(uint8_t *bytes);
bool iclass_auth(uint8_t *bytes, bool send_reply, uint8_t *dataout);
bool iclass_auth(iclass_auth_req_t *payload, uint8_t *out);
void iClass_ReadBlock(uint8_t *msg);
bool iclass_read_block(uint8_t blockno, uint8_t *data);
bool select_iclass_tag(uint8_t *card_data, bool use_credit_key, uint32_t *eof_time);
bool authenticate_iclass_tag(iclass_auth_req_t *payload, picopass_hdr *hdr, uint32_t *start_time, uint32_t *eof_time, uint8_t *mac_out);
void iClass_ReadBlk(uint8_t blockno);
bool iclass_readblock(uint8_t blockno, uint8_t *data);
#endif
client/src/cmdhf.c
+3 -3
View File
@@ -130,10 +130,10 @@ int CmdHFSearch(const char *Cmd) {
}
PROMPT_CLEARLINE;
PrintAndLogEx(INPLACE, " Searching for iClass / PicoPass tag...");
PrintAndLogEx(INPLACE, " Searching for iCLASS / PicoPass tag...");
if (IfPm3Iclass()) {
if (readIclass(false, false) == PM3_SUCCESS) {
PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("iClass tag / PicoPass tag") " found\n");
if (read_iclass_csn(false, false) == PM3_SUCCESS) {
PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("iCLASS tag / PicoPass tag") " found\n");
res = PM3_SUCCESS;
}
}
client/src/cmdhficlass.c
+423 -329
View File
File diff suppressed because it is too large Load Diff
client/src/cmdhficlass.h
+2 -1
View File
@@ -29,7 +29,8 @@ typedef struct iclass_prekey {
int CmdHFiClass(const char *Cmd);
int readIclass(bool loop, bool verbose);
int info_iclass(void);
int read_iclass_csn(bool loop, bool verbose);
void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize);
void HFiClassCalcDivKey(uint8_t *CSN, uint8_t *KEY, uint8_t *div_key, bool elite);
include/pm3_cmd.h
+60 -3
View File
@@ -291,19 +291,74 @@ typedef struct {
// iCLASS auth request data structure
// used with read block, dump, write block
typedef struct {
uint8_t key[8];
bool use_raw;
bool use_elite;
bool use_credit_key;
bool send_reply;
bool do_auth;
uint8_t blockno;
} PACKED iclass_auth_req_t;
// iCLASS auth response data structure
// iCLASS read block response data structure
typedef struct {
bool isOK;
uint8_t div_key[8];
uint8_t mac[4];
} PACKED iclass_auth_resp_t;
uint8_t data[8];
} PACKED iclass_readblock_resp_t;
// iCLASS dump data structure
typedef struct {
iclass_auth_req_t req;
uint8_t start_block;
uint8_t end_block;
} PACKED iclass_dump_req_t;
// iCLASS write block request data structure
typedef struct {
iclass_auth_req_t req;
uint8_t data[8];
} PACKED iclass_writeblock_req_t;
// iCLASS dump data structure
typedef struct {
iclass_auth_req_t req;
uint8_t start_block;
uint8_t end_block;
uint8_t data[];
} PACKED iclass_restore_req_t;
// iclass / picopass chip config structures and shared routines
typedef struct {
uint8_t app_limit; //[8]
uint8_t otp[2]; //[9-10]
uint8_t block_writelock;//[11]
uint8_t chip_config; //[12]
uint8_t mem_config; //[13]
uint8_t eas; //[14]
uint8_t fuses; //[15]
} picopass_conf_block_t;
// iCLASS secure mode memory mapping
typedef struct {
uint8_t csn[8];
picopass_conf_block_t conf;
uint8_t epurse[8];
uint8_t key_d[8];
uint8_t key_c[8];
uint8_t app_issuer_area[8];
} picopass_hdr;
// iCLASS non-secure mode memory mapping
typedef struct {
uint8_t csn[8];
picopass_conf_block_t conf;
uint8_t app_issuer_area[8];
} picopass_ns_hdr;
// For the bootloader
@@ -485,6 +540,7 @@ typedef struct {
#define CMD_HF_LEGIC_INFO 0x03BC
#define CMD_HF_LEGIC_ESET 0x03BD
// iCLASS / Picopass
#define CMD_HF_ICLASS_READCHECK 0x038F
#define CMD_HF_ICLASS_CLONE 0x0390
#define CMD_HF_ICLASS_DUMP 0x0391
@@ -497,6 +553,7 @@ typedef struct {
#define CMD_HF_ICLASS_EML_MEMSET 0x0398
#define CMD_HF_ICLASS_AUTH 0x0399
#define CMD_HF_ICLASS_CHKKEYS 0x039A
#define CMD_HF_ICLASS_RESTORE 0x039B
// For ISO1092 / FeliCa
#define CMD_HF_FELICA_SIMULATE 0x03A0
@@ -602,7 +659,7 @@ typedef struct {
#define FLAG_ICLASS_READER_INIT 0x01
#define FLAG_ICLASS_READER_CLEARTRACE 0x02
#define FLAG_ICLASS_READER_ONLY_ONCE 0x04
#define FLAG_ICLASS_READER_CEDITKEY 0x08
#define FLAG_ICLASS_READER_CREDITKEY 0x08
#define FLAG_ICLASS_READER_AIA 0x10
// iCLASS reader status flags