mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-14 02:27:26 -07:00
Add hf 15 sub-commands for EAS, AFI, privacy mode, and passwords on SLIX tags
This commit is contained in:
Matthew Jackson
parent
e7f28a6b50
commit
9041627ae5
7 changed files with 993 additions and 135 deletions
|
|
@ -698,7 +698,7 @@ static int NxpCheckSig(uint8_t *uid) {
|
|||
PacketResponseNG resp;
|
||||
uint16_t reqlen = 0;
|
||||
uint8_t req[PM3_CMD_DATA_SIZE] = {0};
|
||||
|
||||
|
||||
// Check if we can also read the signature
|
||||
req[reqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
|
||||
req[reqlen++] = ISO15693_READ_SIGNATURE;
|
||||
|
|
@ -736,7 +736,7 @@ static int NxpCheckSig(uint8_t *uid) {
|
|||
memcpy(signature, recv + 1, 32);
|
||||
|
||||
nxp_15693_print_signature(uid, signature);
|
||||
|
||||
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
|
|
@ -1352,94 +1352,83 @@ static int CmdHF15WriteAfi(const char *Cmd) {
|
|||
CLIParserInit(&ctx, "hf 15 writeafi",
|
||||
"Write AFI on card",
|
||||
"hf 15 writeafi -* --afi 12\n"
|
||||
"hf 15 writeafi -u E011223344556677 --afi 12"
|
||||
"hf 15 writeafi -u E011223344556677 --afi 12 -p 0F0F0F0F"
|
||||
);
|
||||
|
||||
void *argtable[6 + 2] = {};
|
||||
uint8_t arglen = arg_add_default(argtable);
|
||||
argtable[arglen++] = arg_int1(NULL, "afi", "<dec>", "AFI number (0-255)");
|
||||
argtable[arglen++] = arg_param_end;
|
||||
void *argtable[5] = {};
|
||||
argtable[0] = arg_param_begin;
|
||||
argtable[1] = arg_str0("u", "uid", "<hex>", "full UID, 8 bytes");
|
||||
argtable[2] = arg_int1(NULL, "afi", "<dec>", "AFI number (0-255)");
|
||||
argtable[3] = arg_str0("p", "pwd", "<hex>", "optional AFI/EAS password");
|
||||
argtable[4] = arg_param_end;
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
struct {
|
||||
uint8_t pwd[4];
|
||||
bool use_pwd;
|
||||
uint8_t uid[8];
|
||||
bool use_uid;
|
||||
uint8_t afi;
|
||||
} PACKED payload;
|
||||
|
||||
uint8_t uid[8];
|
||||
int uidlen = 0;
|
||||
CLIGetHexWithReturn(ctx, 1, uid, &uidlen);
|
||||
bool unaddressed = arg_get_lit(ctx, 2);
|
||||
bool scan = arg_get_lit(ctx, 3);
|
||||
int fast = (arg_get_lit(ctx, 4) == false);
|
||||
bool add_option = arg_get_lit(ctx, 5);
|
||||
CLIGetHexWithReturn(ctx, 1, payload.uid, &uidlen);
|
||||
|
||||
int afi = arg_get_int_def(ctx, 6, 0);
|
||||
payload.afi = arg_get_int_def(ctx, 2, 0);
|
||||
|
||||
int pwdlen;
|
||||
|
||||
CLIGetHexWithReturn(ctx, 3, payload.pwd, &pwdlen);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if(pwdlen == 4)
|
||||
{
|
||||
payload.use_pwd = true;
|
||||
}
|
||||
|
||||
if(uidlen == 8)
|
||||
{
|
||||
payload.use_uid = true;
|
||||
}
|
||||
|
||||
// sanity checks
|
||||
if ((scan + unaddressed + uidlen) > 1) {
|
||||
PrintAndLogEx(WARNING, "Select only one option /scan/unaddress/uid");
|
||||
if (uidlen != 0 && uidlen != 8) {
|
||||
PrintAndLogEx(WARNING, "uid must be 8 hex bytes if provided");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
// request to be sent to device/card
|
||||
uint16_t flags = arg_get_raw_flag(uidlen, unaddressed, scan, add_option);
|
||||
uint8_t req[16] = {flags, ISO15693_WRITE_AFI};
|
||||
uint16_t reqlen = 2;
|
||||
|
||||
if (unaddressed == false) {
|
||||
if (scan) {
|
||||
if (getUID(false, uid) != PM3_SUCCESS) {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
uidlen = 8;
|
||||
}
|
||||
|
||||
if (uidlen == 8) {
|
||||
// add UID (scan, uid)
|
||||
memcpy(req + reqlen, uid, sizeof(uid));
|
||||
reqlen += sizeof(uid);
|
||||
}
|
||||
PrintAndLogEx(SUCCESS, "Using UID... " _GREEN_("%s"), iso15693_sprintUID(NULL, uid));
|
||||
|
||||
if(pwdlen > 0 && pwdlen != 4)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "password must be 4 hex bytes if provided");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
// enforce, since we are writing
|
||||
req[0] |= ISO15_REQ_OPTION;
|
||||
|
||||
req[reqlen++] = (uint8_t)afi;
|
||||
|
||||
AddCrc15(req, reqlen);
|
||||
reqlen += 2;
|
||||
|
||||
// arg: len, speed, recv?
|
||||
// arg0 (datalen, cmd len? .arg0 == crc?)
|
||||
// arg1 (speed == 0 == 1 of 256, == 1 == 1 of 4 )
|
||||
// arg2 (recv == 1 == expect a response)
|
||||
uint8_t read_response = 1;
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandMIX(CMD_HF_ISO15693_COMMAND, reqlen, fast, read_response, req, reqlen);
|
||||
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_COMMAND, &resp, 2000) == false) {
|
||||
PrintAndLogEx(ERR, "iso15693 timeout");
|
||||
SendCommandNG(CMD_HF_ISO15693_WRITE_AFI, (uint8_t *)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_WRITE_AFI, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
DropField();
|
||||
|
||||
if (resp.status == PM3_ETEAROFF) {
|
||||
return resp.status;
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
uint8_t *data = resp.data.asBytes;
|
||||
|
||||
if ((data[0] & ISO15_RES_ERROR) == ISO15_RES_ERROR) {
|
||||
PrintAndLogEx(ERR, "iso15693 card returned error %i: %s", data[0], TagErrorStr(data[0]));
|
||||
return PM3_EWRONGANSWER;
|
||||
switch (resp.status) {
|
||||
case PM3_ETIMEOUT: {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
break;
|
||||
}
|
||||
case PM3_EWRONGANSWER: {
|
||||
PrintAndLogEx(WARNING, "error writing AFI");
|
||||
break;
|
||||
}
|
||||
case PM3_SUCCESS: {
|
||||
PrintAndLogEx(SUCCESS, "Wrote AFI 0x%02X", payload.afi);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(SUCCESS, "Wrote AFI 0x%02X", afi);
|
||||
return PM3_SUCCESS;
|
||||
return resp.status;
|
||||
}
|
||||
|
||||
// Writes the DSFID (Data Storage Format Identifier) of a card
|
||||
|
|
@ -2378,10 +2367,164 @@ static int CmdHF15CSetUID(const char *Cmd) {
|
|||
}
|
||||
}
|
||||
|
||||
static int CmdHF15SlixEASEnable(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 15 slixeasenable",
|
||||
"Enable EAS mode on SLIX ISO-15693 tag",
|
||||
"hf 15 slixeasenable -p 0F0F0F0F");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str0("p", "pwd", "<hex>", "optional password, 8 hex bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
struct {
|
||||
uint8_t pwd[4];
|
||||
bool usepwd;
|
||||
} PACKED payload;
|
||||
int pwdlen = 0;
|
||||
|
||||
int ret_pwdparse = CLIParamHexToBuf(arg_get_str(ctx, 1), payload.pwd, 4, &pwdlen);
|
||||
if((pwdlen > 0 && pwdlen != 4) || ret_pwdparse != 0)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "password must be 4 hex bytes if provided");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
//CLIGetHexWithReturn(ctx, 1, payload.pwd, &pwdlen);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
if(pwdlen > 0 )
|
||||
{
|
||||
PrintAndLogEx(INFO, "Trying to enable EAS mode using password " _GREEN_("%s")
|
||||
, sprint_hex_inrow(payload.pwd, sizeof(payload.pwd))
|
||||
);
|
||||
payload.usepwd = true;
|
||||
}
|
||||
else
|
||||
{
|
||||
PrintAndLogEx(INFO, "Trying to enable EAS mode without using a password");
|
||||
payload.usepwd = false;
|
||||
}
|
||||
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_ENABLE_EAS, (uint8_t *)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_ENABLE_EAS, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
switch (resp.status) {
|
||||
case PM3_ETIMEOUT: {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
break;
|
||||
}
|
||||
case PM3_EWRONGANSWER: {
|
||||
if(pwdlen > 0 )
|
||||
{
|
||||
PrintAndLogEx(WARNING, "the password provided was not accepted");
|
||||
}
|
||||
else
|
||||
{
|
||||
PrintAndLogEx(WARNING, "either a password is required or EAS mode is locked");
|
||||
}
|
||||
break;
|
||||
}
|
||||
case PM3_SUCCESS: {
|
||||
PrintAndLogEx(SUCCESS, "EAS mode is now enabled ( " _GREEN_("ok") " ) ");
|
||||
break;
|
||||
}
|
||||
}
|
||||
return resp.status;
|
||||
}
|
||||
|
||||
static int CmdHF15SlixEASDisable(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 15 slixeasdisable",
|
||||
"Disable EAS mode on SLIX ISO-15693 tag",
|
||||
"hf 15 slixeasdisable -p 0F0F0F0F");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str0("p", "pwd", "<hex>", "optional password, 8 hex bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
struct {
|
||||
uint8_t pwd[4];
|
||||
bool usepwd;
|
||||
|
||||
} PACKED payload;
|
||||
int pwdlen = 0;
|
||||
|
||||
int ret_pwdparse = CLIParamHexToBuf(arg_get_str(ctx, 1), payload.pwd, 4, &pwdlen);
|
||||
if((pwdlen > 0 && pwdlen != 4) || ret_pwdparse != 0)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "password must be 4 hex bytes if provided");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
//CLIGetHexWithReturn(ctx, 1, payload.pwd, &pwdlen);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
if(pwdlen > 0 )
|
||||
{
|
||||
PrintAndLogEx(INFO, "Trying to disable EAS mode using password " _GREEN_("%s")
|
||||
, sprint_hex_inrow(payload.pwd, sizeof(payload.pwd))
|
||||
);
|
||||
payload.usepwd = true;
|
||||
}
|
||||
else
|
||||
{
|
||||
PrintAndLogEx(INFO, "Trying to enable EAS mode without using a password");
|
||||
payload.usepwd = false;
|
||||
}
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_DISABLE_EAS, (uint8_t *)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_DISABLE_EAS, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
switch (resp.status) {
|
||||
case PM3_ETIMEOUT: {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
break;
|
||||
}
|
||||
case PM3_EWRONGANSWER: {
|
||||
if(pwdlen > 0 )
|
||||
{
|
||||
PrintAndLogEx(WARNING, "the password provided was not accepted");
|
||||
}
|
||||
else
|
||||
{
|
||||
PrintAndLogEx(WARNING, "either a password is required or EAS mode is locked");
|
||||
}
|
||||
break;
|
||||
}
|
||||
case PM3_SUCCESS: {
|
||||
PrintAndLogEx(SUCCESS, "EAS mode is now disabled ( " _GREEN_("ok") " ) ");
|
||||
break;
|
||||
}
|
||||
}
|
||||
return resp.status;
|
||||
}
|
||||
|
||||
static int CmdHF15SlixDisable(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 15 slixdisable",
|
||||
CLIParserInit(&ctx, "hf 15 slixprivacydisable",
|
||||
"Disable privacy mode on SLIX ISO-15693 tag",
|
||||
"hf 15 slixdisable -p 0F0F0F0F");
|
||||
|
||||
|
|
@ -2404,8 +2547,8 @@ static int CmdHF15SlixDisable(const char *Cmd) {
|
|||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_L_DISABLE_PRIVACY, (uint8_t *)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_L_DISABLE_PRIVACY, &resp, 2000) == false) {
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_DISABLE_PRIVACY, (uint8_t *)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_DISABLE_PRIVACY, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ESOFT;
|
||||
|
|
@ -2428,32 +2571,330 @@ static int CmdHF15SlixDisable(const char *Cmd) {
|
|||
return resp.status;
|
||||
}
|
||||
|
||||
static int CmdHF15SlixEnable(const char* Cmd) {
|
||||
|
||||
CLIParserContext* ctx;
|
||||
CLIParserInit(&ctx, "hf 15 slixprivacyenable",
|
||||
"Enable privacy mode on SLIX ISO-15693 tag",
|
||||
"hf 15 slixenable -p 0F0F0F0F");
|
||||
|
||||
void* argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str1("p", "pwd", "<hex>", "password, 8 hex bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
struct {
|
||||
uint8_t pwd[4];
|
||||
} PACKED payload;
|
||||
int pwdlen = 0;
|
||||
CLIGetHexWithReturn(ctx, 1, payload.pwd, &pwdlen);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
PrintAndLogEx(INFO, "Trying to enable privacy mode using password " _GREEN_("%s")
|
||||
, sprint_hex_inrow(payload.pwd, sizeof(payload.pwd))
|
||||
);
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_ENABLE_PRIVACY, (uint8_t*)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_ENABLE_PRIVACY, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
switch (resp.status) {
|
||||
case PM3_ETIMEOUT: {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
break;
|
||||
}
|
||||
case PM3_EWRONGANSWER: {
|
||||
PrintAndLogEx(WARNING, "password was not accepted");
|
||||
break;
|
||||
}
|
||||
case PM3_SUCCESS: {
|
||||
PrintAndLogEx(SUCCESS, "privacy mode is now enabled ( " _GREEN_("ok") " ) ");
|
||||
break;
|
||||
}
|
||||
}
|
||||
return resp.status;
|
||||
}
|
||||
|
||||
static int CmdHF15SlixWritePassword(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 15 slixwritepwd",
|
||||
"Write a password on a SLIX family ISO-15693 tag",
|
||||
"hf 15 slixwritepwd -t READ -o 00000000 -n 12131415");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str1("t", "type", "<read|write|privacy|destroy|easafi>", "which password field to write to (some tags do not support all password types)"),
|
||||
arg_str0("o", "old", "<hex>", "old password (if present), 8 hex bytes"),
|
||||
arg_str1("n", "new", "<hex>", "new password, 8 hex bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
||||
struct {
|
||||
uint8_t old_pwd[4];
|
||||
uint8_t new_pwd[4];
|
||||
uint8_t pwd_id;
|
||||
} PACKED payload;
|
||||
int pwdlen = 0;
|
||||
|
||||
|
||||
|
||||
CLIGetHexWithReturn(ctx, 2, payload.old_pwd, &pwdlen);
|
||||
|
||||
if(pwdlen > 0 && pwdlen != 4)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "old password must be 4 hex bytes if provided");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
CLIGetHexWithReturn(ctx, 3, payload.new_pwd, &pwdlen);
|
||||
|
||||
if(pwdlen != 4)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "new password must be 4 hex bytes");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int vlen = 0;
|
||||
char value[10];
|
||||
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)value, sizeof(value), &vlen);
|
||||
|
||||
if (vlen > 0) {
|
||||
if (strcmp(value, "read") == 0)
|
||||
{
|
||||
PrintAndLogEx(SUCCESS, "Selected read pass");
|
||||
payload.pwd_id = 0x01;
|
||||
}
|
||||
else if (strcmp(value, "write") == 0)
|
||||
{
|
||||
PrintAndLogEx(SUCCESS, "Selected write pass");
|
||||
payload.pwd_id = 0x02;
|
||||
}
|
||||
else if (strcmp(value, "privacy") == 0)
|
||||
{
|
||||
PrintAndLogEx(SUCCESS, "Selected privacy pass");
|
||||
payload.pwd_id = 0x04;
|
||||
}
|
||||
else if (strcmp(value, "destroy") == 0)
|
||||
{
|
||||
PrintAndLogEx(SUCCESS, "Selected destroy pass");
|
||||
payload.pwd_id = 0x08;
|
||||
}
|
||||
else if (strcmp(value, "easafi") == 0)
|
||||
{
|
||||
PrintAndLogEx(SUCCESS, "Selected easafi pass");
|
||||
payload.pwd_id = 0x10;
|
||||
}
|
||||
else
|
||||
{
|
||||
PrintAndLogEx(ERR, "t argument must be 'read', 'write', 'privacy', 'destroy', or 'easafi'");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
}
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
PrintAndLogEx(INFO, "Trying to write " _YELLOW_("%s") " as " _YELLOW_("%s") " password"
|
||||
, sprint_hex_inrow(payload.new_pwd, sizeof(payload.new_pwd)), value);
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_WRITE_PWD, (uint8_t *)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_WRITE_PWD, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
switch (resp.status) {
|
||||
case PM3_ETIMEOUT: {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
break;
|
||||
}
|
||||
case PM3_EWRONGANSWER: {
|
||||
PrintAndLogEx(WARNING, "password was not accepted");
|
||||
break;
|
||||
}
|
||||
case PM3_SUCCESS: {
|
||||
PrintAndLogEx(SUCCESS, "password written ( " _GREEN_("ok") " ) ");
|
||||
break;
|
||||
}
|
||||
}
|
||||
return resp.status;
|
||||
}
|
||||
|
||||
static int CmdHF15AFIPassProtect(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 15 passprotectafi",
|
||||
"Password protect AFI. Cannot be undone.",
|
||||
"hf 15 passprotectafi -p 00000000 -c");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str1("p", "password", "<hex>", "EAS/AFI password, 8 hex bytes"),
|
||||
arg_lit0("c", "confirm", "confirm the execution of this irreversible command"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
struct {
|
||||
uint8_t pwd[4];
|
||||
} PACKED payload;
|
||||
int pwdlen = 0;
|
||||
|
||||
CLIGetHexWithReturn(ctx, 1, payload.pwd, &pwdlen);
|
||||
|
||||
bool confirmation = arg_get_lit(ctx, 2);
|
||||
|
||||
if(pwdlen != 4)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "password must be 4 hex bytes");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
if(confirmation == 0)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "This irreversible command must be confirmed with the -c flag");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
|
||||
PrintAndLogEx(INFO, "Trying to enable AFI password protection");
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_PASS_PROTECT_AFI, (uint8_t*)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_PASS_PROTECT_AFI, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
switch (resp.status) {
|
||||
case PM3_ETIMEOUT: {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
break;
|
||||
}
|
||||
case PM3_EWRONGANSWER: {
|
||||
PrintAndLogEx(WARNING, "error enabling AFI password protection");
|
||||
break;
|
||||
}
|
||||
case PM3_SUCCESS: {
|
||||
PrintAndLogEx(SUCCESS, "AFI password protected ( " _GREEN_("ok") " ) ");
|
||||
break;
|
||||
}
|
||||
}
|
||||
return resp.status;
|
||||
|
||||
}
|
||||
|
||||
static int CmdHF15EASPassProtect(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 15 passprotecteas",
|
||||
"Password protect EAS. Cannot be undone.",
|
||||
"hf 15 passprotecteas -p 00000000 -c");
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str1("p", "password", "<hex>", "EAS/AFI password, 8 hex bytes"),
|
||||
arg_lit0("c", "confirm", "confirm the execution of this irreversible command"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
struct {
|
||||
uint8_t pwd[4];
|
||||
} PACKED payload;
|
||||
int pwdlen = 0;
|
||||
|
||||
CLIGetHexWithReturn(ctx, 1, payload.pwd, &pwdlen);
|
||||
|
||||
bool confirmation = arg_get_lit(ctx, 2);
|
||||
|
||||
if(pwdlen != 4)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "password must be 4 hex bytes");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
if(confirmation == 0)
|
||||
{
|
||||
PrintAndLogEx(WARNING, "This irreversible command must be confirmed with the -c flag");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
PrintAndLogEx(INFO, "Trying to enable EAS password protection");
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_HF_ISO15693_SLIX_PASS_PROTECT_EAS, (uint8_t*)&payload, sizeof(payload));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO15693_SLIX_PASS_PROTECT_EAS, &resp, 2000) == false) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
DropField();
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
switch (resp.status) {
|
||||
case PM3_ETIMEOUT: {
|
||||
PrintAndLogEx(WARNING, "no tag found");
|
||||
break;
|
||||
}
|
||||
case PM3_EWRONGANSWER: {
|
||||
PrintAndLogEx(WARNING, "error enabling EAS password protection");
|
||||
break;
|
||||
}
|
||||
case PM3_SUCCESS: {
|
||||
PrintAndLogEx(SUCCESS, "EAS password protected ( " _GREEN_("ok") " ) ");
|
||||
break;
|
||||
}
|
||||
}
|
||||
return resp.status;
|
||||
}
|
||||
|
||||
static command_t CommandTable[] = {
|
||||
{"-----------", CmdHF15Help, AlwaysAvailable, "--------------------- " _CYAN_("General") " ---------------------"},
|
||||
{"help", CmdHF15Help, AlwaysAvailable, "This help"},
|
||||
{"list", CmdHF15List, AlwaysAvailable, "List ISO-15693 history"},
|
||||
{"demod", CmdHF15Demod, AlwaysAvailable, "Demodulate ISO-15693 from tag"},
|
||||
{"dump", CmdHF15Dump, IfPm3Iso15693, "Read all memory pages of an ISO-15693 tag, save to file"},
|
||||
{"info", CmdHF15Info, IfPm3Iso15693, "Tag information"},
|
||||
{"sniff", CmdHF15Sniff, IfPm3Iso15693, "Sniff ISO-15693 traffic"},
|
||||
{"raw", CmdHF15Raw, IfPm3Iso15693, "Send raw hex data to tag"},
|
||||
{"rdbl", CmdHF15Readblock, IfPm3Iso15693, "Read a block"},
|
||||
{"rdmulti", CmdHF15Readmulti, IfPm3Iso15693, "Reads multiple blocks"},
|
||||
{"reader", CmdHF15Reader, IfPm3Iso15693, "Act like an ISO-15693 reader"},
|
||||
{"restore", CmdHF15Restore, IfPm3Iso15693, "Restore from file to all memory pages of an ISO-15693 tag"},
|
||||
{"samples", CmdHF15Samples, IfPm3Iso15693, "Acquire samples as reader (enables carrier, sends inquiry)"},
|
||||
{"eload", CmdHF15ELoad, IfPm3Iso15693, "Load image file into emulator to be used by 'sim' command"},
|
||||
{"esave", CmdHF15ESave, IfPm3Iso15693, "Save emulator memory into image file"},
|
||||
{"eview", CmdHF15EView, IfPm3Iso15693, "View emulator memory"},
|
||||
{"sim", CmdHF15Sim, IfPm3Iso15693, "Fake an ISO-15693 tag"},
|
||||
{"slixdisable", CmdHF15SlixDisable, IfPm3Iso15693, "Disable privacy mode on SLIX ISO-15693 tag"},
|
||||
{"wrbl", CmdHF15Write, IfPm3Iso15693, "Write a block"},
|
||||
{"-----------", CmdHF15Help, IfPm3Iso15693, "----------------------- " _CYAN_("afi") " -----------------------"},
|
||||
{"findafi", CmdHF15FindAfi, IfPm3Iso15693, "Brute force AFI of an ISO-15693 tag"},
|
||||
{"writeafi", CmdHF15WriteAfi, IfPm3Iso15693, "Writes the AFI on an ISO-15693 tag"},
|
||||
{"writedsfid", CmdHF15WriteDsfid, IfPm3Iso15693, "Writes the DSFID on an ISO-15693 tag"},
|
||||
{"-----------", CmdHF15Help, IfPm3Iso15693, "----------------------- " _CYAN_("magic") " -----------------------"},
|
||||
{"csetuid", CmdHF15CSetUID, IfPm3Iso15693, "Set UID for magic card"},
|
||||
{"-----------", CmdHF15Help, AlwaysAvailable, "--------------------- " _CYAN_("General") " ---------------------"},
|
||||
{"help", CmdHF15Help, AlwaysAvailable, "This help"},
|
||||
{"list", CmdHF15List, AlwaysAvailable, "List ISO-15693 history"},
|
||||
{"demod", CmdHF15Demod, AlwaysAvailable, "Demodulate ISO-15693 from tag"},
|
||||
{"dump", CmdHF15Dump, IfPm3Iso15693, "Read all memory pages of an ISO-15693 tag, save to file"},
|
||||
{"info", CmdHF15Info, IfPm3Iso15693, "Tag information"},
|
||||
{"sniff", CmdHF15Sniff, IfPm3Iso15693, "Sniff ISO-15693 traffic"},
|
||||
{"raw", CmdHF15Raw, IfPm3Iso15693, "Send raw hex data to tag"},
|
||||
{"rdbl", CmdHF15Readblock, IfPm3Iso15693, "Read a block"},
|
||||
{"rdmulti", CmdHF15Readmulti, IfPm3Iso15693, "Reads multiple blocks"},
|
||||
{"reader", CmdHF15Reader, IfPm3Iso15693, "Act like an ISO-15693 reader"},
|
||||
{"restore", CmdHF15Restore, IfPm3Iso15693, "Restore from file to all memory pages of an ISO-15693 tag"},
|
||||
{"samples", CmdHF15Samples, IfPm3Iso15693, "Acquire samples as reader (enables carrier, sends inquiry)"},
|
||||
{"eload", CmdHF15ELoad, IfPm3Iso15693, "Load image file into emulator to be used by 'sim' command"},
|
||||
{"esave", CmdHF15ESave, IfPm3Iso15693, "Save emulator memory into image file"},
|
||||
{"eview", CmdHF15EView, IfPm3Iso15693, "View emulator memory"},
|
||||
{"sim", CmdHF15Sim, IfPm3Iso15693, "Fake an ISO-15693 tag"},
|
||||
{"slixwritepwd", CmdHF15SlixWritePassword, IfPm3Iso15693, "Writes a password on a SLIX ISO-15693 tag"},
|
||||
{"slixeasdisable", CmdHF15SlixEASDisable, IfPm3Iso15693, "Disable EAS mode on SLIX ISO-15693 tag"},
|
||||
{"slixeasenable", CmdHF15SlixEASEnable, IfPm3Iso15693, "Enable EAS mode on SLIX ISO-15693 tag"},
|
||||
{"slixprivacydisable", CmdHF15SlixDisable, IfPm3Iso15693, "Disable privacy mode on SLIX ISO-15693 tag"},
|
||||
{"slixprivacyenable", CmdHF15SlixEnable, IfPm3Iso15693, "Enable privacy mode on SLIX ISO-15693 tag"},
|
||||
{"passprotectafi", CmdHF15AFIPassProtect, IfPm3Iso15693, "Password protect AFI - Cannot be undone"},
|
||||
{"passprotecteas", CmdHF15EASPassProtect, IfPm3Iso15693, "Password protect EAS - Cannot be undone"},
|
||||
{"wrbl", CmdHF15Write, IfPm3Iso15693, "Write a block"},
|
||||
{"-----------", CmdHF15Help, IfPm3Iso15693, "----------------------- " _CYAN_("afi") " -----------------------"},
|
||||
{"findafi", CmdHF15FindAfi, IfPm3Iso15693, "Brute force AFI of an ISO-15693 tag"},
|
||||
{"writeafi", CmdHF15WriteAfi, IfPm3Iso15693, "Writes the AFI on an ISO-15693 tag"},
|
||||
{"writedsfid", CmdHF15WriteDsfid, IfPm3Iso15693, "Writes the DSFID on an ISO-15693 tag"},
|
||||
{"-----------", CmdHF15Help, IfPm3Iso15693, "----------------------- " _CYAN_("magic") " -----------------------"},
|
||||
{"csetuid", CmdHF15CSetUID, IfPm3Iso15693, "Set UID for magic card"},
|
||||
{NULL, NULL, NULL, NULL}
|
||||
};
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue