This commit is contained in:
iceman1001 2025-06-07 11:50:03 +02:00
commit 6fbb13ba41
3 changed files with 25 additions and 23 deletions

View file

@ -607,13 +607,13 @@ int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf) {
trace_data = ff_data; trace_data = ff_data;
trace_data_size = sizeof(ff_data); trace_data_size = sizeof(ff_data);
} else { // use data from emulator memory } else { // use data from emulator memory
if (simulationMode == ICLASS_SIM_MODE_FULL_GLITCH){ if (simulationMode == ICLASS_SIM_MODE_FULL_GLITCH) {
//Jam the read based on the last SIO block //Jam the read based on the last SIO block
if (memcmp(emulator + (current_page * page_size) + (5 * 8), ff_data, PICOPASS_BLOCK_SIZE) == 0){ //SR card if (memcmp(emulator + (current_page * page_size) + (5 * 8), ff_data, PICOPASS_BLOCK_SIZE) == 0) { //SR card
if (block == 16){ //SR cards use a standard legth SIO if (block == 16) { //SR cards use a standard legth SIO
goto send; goto send;
} }
}else{ //For SE cards we have to account for different SIO lengths depending if a standard or custom key is used } else { //For SE cards we have to account for different SIO lengths depending if a standard or custom key is used
uint8_t *sio = emulator + (current_page * page_size) + (6 * 8); uint8_t *sio = emulator + (current_page * page_size) + (6 * 8);
if (block == (5 + ((sio[1] + 12) / 8))) { if (block == (5 + ((sio[1] + 12) / 8))) {
goto send; goto send;
@ -730,7 +730,7 @@ int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf) {
chip_state = HALTED; chip_state = HALTED;
goto send; goto send;
} else if ((simulationMode == ICLASS_SIM_MODE_FULL || simulationMode == ICLASS_SIM_MODE_FULL_GLITCH)&& cmd == ICLASS_CMD_READ4 && len == 4) { // 0x06 } else if ((simulationMode == ICLASS_SIM_MODE_FULL || simulationMode == ICLASS_SIM_MODE_FULL_GLITCH) && cmd == ICLASS_CMD_READ4 && len == 4) { // 0x06
if (chip_state != SELECTED) { if (chip_state != SELECTED) {
goto send; goto send;
@ -803,16 +803,16 @@ int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf) {
memcpy(emulator + (current_page * page_size) + (8 * block), receivedCmd + 2, 8); memcpy(emulator + (current_page * page_size) + (8 * block), receivedCmd + 2, 8);
} }
if (simulationMode == ICLASS_SIM_MODE_FULL_GLITCH){ if (simulationMode == ICLASS_SIM_MODE_FULL_GLITCH) {
//Jam the read based on the last SIO block //Jam the read based on the last SIO block
uint8_t *sr_or_sio = emulator + (current_page * page_size) + (6 * 8); uint8_t *sr_or_sio = emulator + (current_page * page_size) + (6 * 8);
if (memcmp(emulator + (current_page * page_size) + (5 * 8), ff_data, PICOPASS_BLOCK_SIZE) == 0){ //SR card if (memcmp(emulator + (current_page * page_size) + (5 * 8), ff_data, PICOPASS_BLOCK_SIZE) == 0) { //SR card
if (block == 16){ //SR cards use a standard legth SIO if (block == 16) { //SR cards use a standard legth SIO
//update block 6 byte 1 from 03 to A3 //update block 6 byte 1 from 03 to A3
sr_or_sio[0] |= 0xA0; sr_or_sio[0] |= 0xA0;
goto send; goto send;
} }
}else{ //For SE cards we have to account for different SIO lengths depending if a standard or custom key is used } else { //For SE cards we have to account for different SIO lengths depending if a standard or custom key is used
if (block == (5 + ((sr_or_sio[1] + 12) / 8))) { if (block == (5 + ((sr_or_sio[1] + 12) / 8))) {
goto send; goto send;
} }
@ -838,7 +838,7 @@ int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf) {
goto send; goto send;
} }
if ((simulationMode == ICLASS_SIM_MODE_FULL || simulationMode == ICLASS_SIM_MODE_FULL_GLITCH)&& max_page > 0) { if ((simulationMode == ICLASS_SIM_MODE_FULL || simulationMode == ICLASS_SIM_MODE_FULL_GLITCH) && max_page > 0) {
// if on 2k, always ignore 3msb, & 0x1F) // if on 2k, always ignore 3msb, & 0x1F)
uint8_t page = receivedCmd[1] & 0x1F; uint8_t page = receivedCmd[1] & 0x1F;

View file

@ -125,17 +125,18 @@ static uint8_t detect_current_lang(void) {
static const char *get_quote(void) { static const char *get_quote(void) {
const char *quotes_en[] = { const char *quotes_en[] = {
"E Pluribus Unum", "too many secrets",
"Carpe Diem", "Its not that simple",
"Ad astra per aspera", "I have received a coded signal",
"Fortes fortuna adiuvat", "I await your instructions",
"Non ducor, duco", "And so I watch, I wait",
"Veni, vidi, vici", "Listen to the Domain",
"Audentes fortuna iuvat", "ghost.713",
"Virtus in actione consistit", "Local node X.XX.713",
"Dum spiro, spero", "Beggar after knowledge",
"Non scholae, sed vitae discimus", "343 Gulity Spark: offline",
"Faber est suae quisque fortunae" "I serve the Builders!",
"This is rather distressing"
}; };
const char *quotes_fr[] = { const char *quotes_fr[] = {

View file

@ -3694,7 +3694,8 @@
"hf iclass sim -t 1 -> simulate with default CSN", "hf iclass sim -t 1 -> simulate with default CSN",
"hf iclass sim -t 2 -> execute loclass attack online part", "hf iclass sim -t 2 -> execute loclass attack online part",
"hf iclass sim -t 3 -> simulate full iCLASS 2k tag", "hf iclass sim -t 3 -> simulate full iCLASS 2k tag",
"hf iclass sim -t 4 -> Reader-attack, adapted for KeyRoll mode, gather reader responses to extract elite key" "hf iclass sim -t 4 -> Reader-attack, adapted for KeyRoll mode, gather reader responses to extract elite key",
"hf iclass sim -t 6 -> simulate full iCLASS 2k tag that doesn't respond to r/w requests to the last SIO block"
], ],
"offline": false, "offline": false,
"options": [ "options": [
@ -13374,6 +13375,6 @@
"metadata": { "metadata": {
"commands_extracted": 768, "commands_extracted": 768,
"extracted_by": "PM3Help2JSON v1.00", "extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2025-06-06T16:58:34" "extracted_on": "2025-06-07T09:11:06"
} }
} }