lf hitag reader - now uses cliparser

This commit is contained in:
iceman1001 2021-04-12 13:18:25 +02:00
commit 8bee66c32a
2 changed files with 111 additions and 66 deletions

View file

@ -49,9 +49,7 @@ static const char *getHitagTypeStr(uint32_t uid) {
static size_t nbytes(size_t nbits) { static size_t nbytes(size_t nbits) {
return (nbits / 8) + ((nbits % 8) > 0); return (nbits / 8) + ((nbits % 8) > 0);
} }
*/
/*
static int usage_hitag_dump(void) { static int usage_hitag_dump(void) {
PrintAndLogEx(NORMAL, "Usage: lf hitag dump [h] p <pwd> f <name>"); PrintAndLogEx(NORMAL, "Usage: lf hitag dump [h] p <pwd> f <name>");
PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, "Options:");
@ -65,24 +63,6 @@ static int usage_hitag_dump(void) {
return PM3_SUCCESS; return PM3_SUCCESS;
} }
*/ */
static int usage_hitag_reader(void) {
PrintAndLogEx(NORMAL, "Hitag reader functions");
PrintAndLogEx(NORMAL, "Usage: lf hitag reader [h] <reader function #>");
PrintAndLogEx(NORMAL, "Options:");
PrintAndLogEx(NORMAL, " h This help");
PrintAndLogEx(NORMAL, " HitagS (0*)");
PrintAndLogEx(NORMAL, " 01 <nr> <ar> Read all pages, challenge mode");
PrintAndLogEx(NORMAL, " 02 <key> Read all pages, crypto mode. Set key=0 for no auth");
PrintAndLogEx(NORMAL, " Hitag1 (1*)");
PrintAndLogEx(NORMAL, " Not implemented");
PrintAndLogEx(NORMAL, " Hitag2 (2*)");
PrintAndLogEx(NORMAL, " 21 <password> Read all pages, password mode. Default: " _YELLOW_("4D494B52") " (\"MIKR\")");
PrintAndLogEx(NORMAL, " 22 <nr> <ar> Read all pages, challenge mode");
PrintAndLogEx(NORMAL, " 23 <key> Read all pages, crypto mode. Key format: ISK high + ISK low. Default: " _YELLOW_("4F4E4D494B52") " (\"ONMIKR\")");
PrintAndLogEx(NORMAL, " 25 Test recorded authentications");
PrintAndLogEx(NORMAL, " 26 Just read UID");
return PM3_SUCCESS;
}
static int usage_hitag_writer(void) { static int usage_hitag_writer(void) {
PrintAndLogEx(NORMAL, "Hitag writer functions"); PrintAndLogEx(NORMAL, "Hitag writer functions");
PrintAndLogEx(NORMAL, "Usage: lf hitag write [h] <reader function #>"); PrintAndLogEx(NORMAL, "Usage: lf hitag write [h] <reader function #>");
@ -558,57 +538,123 @@ static int CmdLFHitagInfo(const char *Cmd) {
// //
static int CmdLFHitagReader(const char *Cmd) { static int CmdLFHitagReader(const char *Cmd) {
uint16_t cmd = CMD_LF_HITAG_READER; CLIParserContext *ctx;
hitag_data htd; CLIParserInit(&ctx, "lf hitag reader",
hitag_function htf = param_get32ex(Cmd, 0, 0, 10); "Act like a Hitag Reader",
"Hitag S\n"
" lf hitag reader --01 --nr 01020304 --ar 11223344\n"
" lf hitag reader --02 -k 4F4E4D494B52\n"
"Hitag 2\n"
" lf hitag reader --21 -k 4D494B52\n"
" lf hitag reader --22 --nr 01020304 --ar 11223344\n"
" lf hitag reader --23 -k 4F4E4D494B52\n"
" lf hitag reader --26\n"
);
switch (htf) { void *argtable[] = {
case RHTSF_CHALLENGE: { arg_param_begin,
arg_lit0(NULL, "01", "HitagS, read all pages, challenge mode"),
arg_lit0(NULL, "02", "HitagS, read all pages, crypto mode. Set key=0 for no auth"),
arg_lit0(NULL, "21", "Hitag2, read all pages, password mode. def 4D494B52 (MIKR)"),
arg_lit0(NULL, "22", "Hitag2, read all pages, challenge mode"),
arg_lit0(NULL, "23", "Hitag2, read all pages, crypto mode. Key format: ISK high + ISK low. def 4F4E4D494B52 (ONMIKR)"),
arg_lit0(NULL, "25", "Hitag2, test recorded authentications (replay?)"),
arg_lit0(NULL, "26", "Hitag2, read UID"),
arg_str0("k","key", "<hex>", "4 or 6 hex bytes"),
arg_str0(NULL,"nr", "<hex>", "nonce reader, 4 hex bytes"),
arg_str0(NULL,"ar", "<hex>", "answer reader, 4 hex bytes"),
arg_param_end
};
CLIExecWithReturn(ctx, Cmd, argtable, false);
// Hitag S
bool s01 = arg_get_lit(ctx, 1);
bool s02 = arg_get_lit(ctx, 2);
// Hitag 2
bool h21 = arg_get_lit(ctx, 3);
bool h22 = arg_get_lit(ctx, 4);
bool h23 = arg_get_lit(ctx, 5);
bool h25 = arg_get_lit(ctx, 6);
bool h26 = arg_get_lit(ctx, 7);
uint8_t key[6];
int keylen = 0;
CLIParamHexToBuf(arg_get_str(ctx, 8), key, sizeof(key), &keylen);
uint8_t nr[4];
int nlen = 0;
CLIParamHexToBuf(arg_get_str(ctx, 9), nr, sizeof(nr), &nlen);
uint8_t ar[4];
int alen = 0;
CLIParamHexToBuf(arg_get_str(ctx, 10), ar, sizeof(ar), &alen);
CLIParserFree(ctx);
// sanity checks
if (keylen != 0 && keylen != 6) {
PrintAndLogEx(WARNING, "Wrong KEY len expected 0 or 6, got %d", keylen);
return PM3_EINVARG;
}
if (nlen != 0 && nlen != 4) {
PrintAndLogEx(WARNING, "Wrong NR len expected 0 or 4, got %d", nlen);
return PM3_EINVARG;
}
if (alen != 0 && alen != 4) {
PrintAndLogEx(WARNING, "Wrong AR len expected 0 or 4, got %d", alen);
return PM3_EINVARG;
}
uint8_t foo = (s01 + s02 + h21 + h22 + h23 + h25 + h26);
if (foo > 1) {
PrintAndLogEx(WARNING, "Only specify one HITAG reader call");
return PM3_EINVARG;
} else if (foo == 0) {
PrintAndLogEx(WARNING, "Specify one HITAG reader call");
return PM3_EINVARG;
}
hitag_function htf;
hitag_data htd;
uint16_t cmd = CMD_LF_HITAG_READER;
if (s01) {
cmd = CMD_LF_HITAGS_READ; cmd = CMD_LF_HITAGS_READ;
num_to_bytes(param_get32ex(Cmd, 1, 0, 16), 4, htd.auth.NrAr); htf = RHTSF_CHALLENGE;
num_to_bytes(param_get32ex(Cmd, 2, 0, 16), 4, htd.auth.NrAr + 4); memcpy(htd.auth.NrAr, nr, sizeof(nr));
break; memcpy(htd.auth.NrAr + 4, ar, sizeof(ar));
} }
case RHTSF_KEY: { if (s02){
cmd = CMD_LF_HITAGS_READ; cmd = CMD_LF_HITAGS_READ;
num_to_bytes(param_get64ex(Cmd, 1, 0, 16), 6, htd.crypto.key); htf = RHTSF_KEY;
break; memcpy(htd.crypto.key, key, sizeof(key));
} }
case RHT2F_PASSWORD: { if (h21) {
num_to_bytes(param_get32ex(Cmd, 1, 0, 16), 4, htd.pwd.password); htf = RHT2F_PASSWORD;
break; memcpy(htd.pwd.password, key, 4);
} }
case RHT2F_AUTHENTICATE: { if (h22) {
num_to_bytes(param_get32ex(Cmd, 1, 0, 16), 4, htd.auth.NrAr); htf = RHT2F_AUTHENTICATE;
num_to_bytes(param_get32ex(Cmd, 2, 0, 16), 4, htd.auth.NrAr + 4); memcpy(htd.auth.NrAr, nr, sizeof(nr));
break; memcpy(htd.auth.NrAr + 4, ar, sizeof(ar));
} }
case RHT2F_CRYPTO: { if (h23) {
num_to_bytes(param_get64ex(Cmd, 1, 0, 16), 6, htd.crypto.key); htf = RHT2F_CRYPTO;
break; memcpy(htd.crypto.key, key, sizeof(key));
} }
case RHT2F_TEST_AUTH_ATTEMPTS: { if (h25) {
// No additional parameters needed htf = RHT2F_TEST_AUTH_ATTEMPTS;
break;
} }
case RHT2F_UID_ONLY: { if (h26) {
// No additional parameters needed htf = RHT2F_UID_ONLY;
break;
}
default:
case RHT1F_PLAIN:
case RHT1F_AUTHENTICATE:
case WHTSF_CHALLENGE:
case WHTSF_KEY:
case WHT2F_PASSWORD:
case WHT2F_CRYPTO:
return usage_hitag_reader();
} }
clearCommandBuffer(); clearCommandBuffer();
SendCommandMIX(cmd, htf, 0, 0, &htd, sizeof(htd)); SendCommandMIX(cmd, htf, 0, 0, &htd, sizeof(htd));
PacketResponseNG resp; PacketResponseNG resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) { if (WaitForResponseTimeout(CMD_ACK, &resp, 2000) == false) {
PrintAndLogEx(WARNING, "timeout while waiting for reply."); PrintAndLogEx(WARNING, "timeout while waiting for reply.");
return PM3_ETIMEOUT; return PM3_ETIMEOUT;
} }

View file

@ -16,6 +16,5 @@ hf felica auth1
hf felica auth2 hf felica auth2
hf felica rqspecver hf felica rqspecver
hf felica resetmode hf felica resetmode
lf hitag reader
lf hitag writer lf hitag writer
lf hitag dump lf hitag dump