mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-20 05:13:46 -07:00
Merge branch 'master' into 4x50_eview
update 201217
This commit is contained in:
tharexde
commit
c37b74a721
49 changed files with 2732 additions and 671 deletions
|
|
@ -7,6 +7,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
|
|||
- Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)
|
||||
- Changed `recoverpk.py` - now tests more ECDSA curves (@doegox)
|
||||
- Added `hf 14a apdufuzz`- a naive apdu cla/ins/p1p2/len fuzzer (@iceman1001)
|
||||
- Improved `hf 14a apdufuzz/apdufind` to find hidden APDUs (@ikarus23)
|
||||
- Fix mixed up INC/DEC in MIFARE protocol defs (@vortixdev)
|
||||
- Added `lf em 4x70 info` - new support for ID48 transponders (@cmolson)
|
||||
- Fix multiple coverity scan issues (@iceman1001)
|
||||
|
|
|
|||
|
|
@ -111,7 +111,7 @@ Next place to visit is the [Proxmark Forum](http://www.proxmark.org/forum/index.
|
|||
- [Proxmark3 IRC channel](http://webchat.freenode.net/?channels=#proxmark3)
|
||||
- [Proxmark3 sub reddit](https://www.reddit.com/r/proxmark3/)
|
||||
- [Twitter](https://twitter.com/proxmark3/)
|
||||
- [Proxmark3 community discord server](https://discord.gg/zjxc8ZB)
|
||||
- [Proxmark3 community discord server](https://discord.gg/QfPvGFRQxH)
|
||||
|
||||
_no slack channel_
|
||||
|
||||
|
|
|
|||
|
|
@ -1170,6 +1170,26 @@ static void PacketReceived(PacketCommandNG *packet) {
|
|||
em4x70_info((em4x70_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X70_WRITE: {
|
||||
em4x70_write((em4x70_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X70_UNLOCK: {
|
||||
em4x70_unlock((em4x70_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X70_AUTH: {
|
||||
em4x70_auth((em4x70_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X70_WRITEPIN: {
|
||||
em4x70_write_pin((em4x70_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
case CMD_LF_EM4X70_WRITEKEY: {
|
||||
em4x70_write_key((em4x70_data_t *)packet->data.asBytes);
|
||||
break;
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef WITH_ISO15693
|
||||
|
|
|
|||
|
|
@ -37,11 +37,11 @@
|
|||
#define EM4X50_T_TAG_WAITING_FOR_SIGNAL 75
|
||||
#define EM4X50_T_WAITING_FOR_DBLLIW 1550
|
||||
#define EM4X50_T_WAITING_FOR_SNGLLIW 140 // this value seems to be
|
||||
// critical;
|
||||
// if it's too low
|
||||
// (e.g. < 120) some cards
|
||||
// are no longer readable
|
||||
// although they're ok
|
||||
// critical;
|
||||
// if it's too low
|
||||
// (e.g. < 120) some cards
|
||||
// are no longer readable
|
||||
// although they're ok
|
||||
|
||||
#define EM4X50_TAG_TOLERANCE 8
|
||||
#define EM4X50_TAG_WORD 45
|
||||
|
|
|
|||
721
armsrc/em4x70.c
721
armsrc/em4x70.c
|
|
@ -21,28 +21,35 @@ static em4x70_tag_t tag = { 0 };
|
|||
// EM4170 requires a parity bit on commands, other variants do not.
|
||||
static bool command_parity = true;
|
||||
|
||||
#define EM4X70_T_TAG_QUARTER_PERIOD 8
|
||||
#define EM4X70_T_TAG_HALF_PERIOD 16
|
||||
#define EM4X70_T_TAG_THREE_QUARTER_PERIOD 24
|
||||
#define EM4X70_T_TAG_FULL_PERIOD 32
|
||||
#define EM4X70_T_TAG_TWA 128 // Write Access Time
|
||||
#define EM4X70_T_TAG_DIV 224 // Divergency Time
|
||||
#define EM4X70_T_TAG_AUTH 4224 // Authentication Time
|
||||
#define EM4X70_T_TAG_WEE 3072 // EEPROM write Time
|
||||
#define EM4X70_T_TAG_TWALB 128 // Write Access Time of Lock Bits
|
||||
// Conversion from Ticks to RF periods
|
||||
// 1 us = 1.5 ticks
|
||||
// 1RF Period = 8us = 12 Ticks
|
||||
#define TICKS_PER_FC 12
|
||||
|
||||
#define EM4X70_T_WAITING_FOR_SNGLLIW 160 // Unsure
|
||||
// Chip timing from datasheet
|
||||
// Converted into Ticks for timing functions
|
||||
#define EM4X70_T_TAG_QUARTER_PERIOD (8 * TICKS_PER_FC)
|
||||
#define EM4X70_T_TAG_HALF_PERIOD (16 * TICKS_PER_FC)
|
||||
#define EM4X70_T_TAG_THREE_QUARTER_PERIOD (24 * TICKS_PER_FC)
|
||||
#define EM4X70_T_TAG_FULL_PERIOD (32 * TICKS_PER_FC) // 1 Bit Period
|
||||
#define EM4X70_T_TAG_TWA (128 * TICKS_PER_FC) // Write Access Time
|
||||
#define EM4X70_T_TAG_DIV (224 * TICKS_PER_FC) // Divergency Time
|
||||
#define EM4X70_T_TAG_AUTH (4224 * TICKS_PER_FC) // Authentication Time
|
||||
#define EM4X70_T_TAG_WEE (3072 * TICKS_PER_FC) // EEPROM write Time
|
||||
#define EM4X70_T_TAG_TWALB (672 * TICKS_PER_FC) // Write Access Time of Lock Bits
|
||||
#define EM4X70_T_TAG_BITMOD (4 * TICKS_PER_FC) // Initial time to stop modulation when sending 0
|
||||
#define EM4X70_T_TAG_TOLERANCE (8 * TICKS_PER_FC) // Tolerance in RF periods for receive/LIW
|
||||
|
||||
#define TICKS_PER_FC 12 // 1 fc = 8us, 1.5us per tick = 12 ticks
|
||||
#define EM4X70_MIN_AMPLITUDE 10 // Minimum difference between a high and low signal
|
||||
|
||||
#define EM4X70_TAG_TOLERANCE 10
|
||||
#define EM4X70_TAG_WORD 48
|
||||
#define EM4X70_T_TAG_TIMEOUT (4 * EM4X70_T_TAG_FULL_PERIOD) // Timeout if we ever get a pulse longer than this
|
||||
#define EM4X70_T_WAITING_FOR_LIW 50 // Pulses to wait for listen window
|
||||
#define EM4X70_T_READ_HEADER_LEN 16 // Read header length (16 bit periods)
|
||||
|
||||
#define EM4X70_COMMAND_RETRIES 5 // Attempts to send/read command
|
||||
#define EM4X70_MAX_RECEIVE_LENGTH 96 // Maximum bits to expect from any command
|
||||
|
||||
/**
|
||||
* These IDs are from the EM4170 datasheet
|
||||
* Some versions of the chip require a fourth
|
||||
* Some versions of the chip require a
|
||||
* (even) parity bit, others do not
|
||||
*/
|
||||
#define EM4X70_COMMAND_ID 0x01
|
||||
|
|
@ -52,24 +59,28 @@ static bool command_parity = true;
|
|||
#define EM4X70_COMMAND_WRITE 0x05
|
||||
#define EM4X70_COMMAND_UM2 0x07
|
||||
|
||||
static uint8_t gHigh = 0;
|
||||
static uint8_t gLow = 0;
|
||||
// Constants used to determing high/low state of signal
|
||||
#define EM4X70_NOISE_THRESHOLD 13 // May depend on noise in environment
|
||||
#define HIGH_SIGNAL_THRESHOLD (127 + EM4X70_NOISE_THRESHOLD)
|
||||
#define LOW_SIGNAL_THRESHOLD (127 - EM4X70_NOISE_THRESHOLD)
|
||||
|
||||
#define IS_HIGH(sample) (sample>gLow ? true : false)
|
||||
#define IS_LOW(sample) (sample<gHigh ? true : false)
|
||||
#define IS_HIGH(sample) (sample > LOW_SIGNAL_THRESHOLD ? true : false)
|
||||
#define IS_LOW(sample) (sample < HIGH_SIGNAL_THRESHOLD ? true : false)
|
||||
|
||||
// Timing related macros
|
||||
#define IS_TIMEOUT(timeout_ticks) (GetTicks() > timeout_ticks)
|
||||
#define TICKS_ELAPSED(start_ticks) (GetTicks() - start_ticks)
|
||||
|
||||
|
||||
static uint8_t bits2byte(uint8_t *bits, int length);
|
||||
static void bits2bytes(uint8_t *bits, int length, uint8_t *out);
|
||||
static int em4x70_receive(uint8_t *bits);
|
||||
static uint8_t bits2byte(const uint8_t *bits, int length);
|
||||
static void bits2bytes(const uint8_t *bits, int length, uint8_t *out);
|
||||
static int em4x70_receive(uint8_t *bits, size_t length);
|
||||
static bool find_listen_window(bool command);
|
||||
|
||||
static void init_tag(void) {
|
||||
memset(tag.data, 0x00, sizeof(tag.data)/sizeof(tag.data[0]));
|
||||
memset(tag.data, 0x00, sizeof(tag.data) / sizeof(tag.data[0]));
|
||||
}
|
||||
|
||||
static void EM4170_setup_read(void) {
|
||||
static void em4x70_setup_read(void) {
|
||||
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
|
||||
|
|
@ -102,208 +113,312 @@ static void EM4170_setup_read(void) {
|
|||
|
||||
static bool get_signalproperties(void) {
|
||||
|
||||
// calculate signal properties (mean amplitudes) from measured data:
|
||||
// 32 amplitudes (maximum values) -> mean amplitude value -> gHigh -> gLow
|
||||
bool signal_found = false;
|
||||
int no_periods = 32, pct = 50, noise = 140; // pct originally 75, found 50 was working better for me
|
||||
uint8_t sample_ref = 127;
|
||||
uint8_t sample_max_mean = 0;
|
||||
uint8_t sample_max[no_periods];
|
||||
uint32_t sample_max_sum = 0;
|
||||
|
||||
memset(sample_max, 0x00, sizeof(sample_max));
|
||||
// Simple check to ensure we see a signal above the noise threshold
|
||||
uint32_t no_periods = 32;
|
||||
|
||||
// wait until signal/noise > 1 (max. 32 periods)
|
||||
for (int i = 0; i < TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD * no_periods; i++) {
|
||||
for (int i = 0; i < EM4X70_T_TAG_FULL_PERIOD * no_periods; i++) {
|
||||
|
||||
// about 2 samples per bit period
|
||||
WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_HALF_PERIOD);
|
||||
WaitTicks(EM4X70_T_TAG_HALF_PERIOD);
|
||||
|
||||
if (AT91C_BASE_SSC->SSC_RHR > noise) {
|
||||
signal_found = true;
|
||||
break;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (signal_found == false)
|
||||
return false;
|
||||
|
||||
// calculate mean maximum value of 32 periods, each period has a length of
|
||||
// 3 single "full periods" to eliminate the influence of a listen window
|
||||
for (int i = 0; i < no_periods; i++) {
|
||||
|
||||
uint32_t start_ticks = GetTicks();
|
||||
//AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
|
||||
while (GetTicks() - start_ticks < TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD) {
|
||||
|
||||
volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
|
||||
if (sample > sample_max[i])
|
||||
sample_max[i] = sample;
|
||||
|
||||
}
|
||||
|
||||
sample_max_sum += sample_max[i];
|
||||
}
|
||||
|
||||
sample_max_mean = sample_max_sum / no_periods;
|
||||
|
||||
// set global envelope variables
|
||||
gHigh = sample_ref + pct * (sample_max_mean - sample_ref) / 100;
|
||||
gLow = sample_ref - pct * (sample_max_mean - sample_ref) / 100;
|
||||
|
||||
// Basic sanity check
|
||||
if(gHigh - gLow < EM4X70_MIN_AMPLITUDE) {
|
||||
return false;
|
||||
}
|
||||
|
||||
Dbprintf("%s: gHigh %d gLow: %d", __func__, gHigh, gLow);
|
||||
if (AT91C_BASE_SSC->SSC_RHR > HIGH_SIGNAL_THRESHOLD) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* get_pulse_length
|
||||
* get_falling_pulse_length
|
||||
*
|
||||
* Times falling edge pulses
|
||||
* Returns time between falling edge pulse in ticks
|
||||
*/
|
||||
static uint32_t get_pulse_length(void) {
|
||||
static uint32_t get_falling_pulse_length(void) {
|
||||
|
||||
uint8_t sample;
|
||||
uint32_t timeout = GetTicks() + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
|
||||
uint32_t timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
|
||||
|
||||
do {
|
||||
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
}while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
|
||||
while (IS_HIGH(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
|
||||
|
||||
if (IS_TIMEOUT(timeout))
|
||||
return 0;
|
||||
|
||||
uint32_t start_ticks = GetTicks();
|
||||
timeout = start_ticks + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
|
||||
|
||||
do {
|
||||
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
}while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
|
||||
while (IS_LOW(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
|
||||
|
||||
if (IS_TIMEOUT(timeout))
|
||||
return 0;
|
||||
|
||||
timeout = (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD) + GetTicks();
|
||||
do {
|
||||
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
}while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
|
||||
while (IS_HIGH(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
|
||||
|
||||
if (IS_TIMEOUT(timeout))
|
||||
return 0;
|
||||
|
||||
return GetTicks() - start_ticks;
|
||||
return TICKS_ELAPSED(start_ticks);
|
||||
}
|
||||
|
||||
/**
|
||||
* get_pulse_invert_length
|
||||
* get_rising_pulse_length
|
||||
*
|
||||
* Times rising edge pules
|
||||
* TODO: convert to single function with get_pulse_length()
|
||||
* Returns time between rising edge pulse in ticks
|
||||
*/
|
||||
static uint32_t get_pulse_invert_length(void) {
|
||||
static uint32_t get_rising_pulse_length(void) {
|
||||
|
||||
uint8_t sample;
|
||||
uint32_t timeout = GetTicks() + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
|
||||
uint32_t timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
|
||||
|
||||
do {
|
||||
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
}while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
|
||||
while (IS_LOW(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
|
||||
|
||||
if (IS_TIMEOUT(timeout))
|
||||
return 0;
|
||||
|
||||
uint32_t start_ticks = GetTicks();
|
||||
timeout = start_ticks + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
|
||||
|
||||
do {
|
||||
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
}while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
|
||||
while (IS_HIGH(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
|
||||
|
||||
if (IS_TIMEOUT(timeout))
|
||||
return 0;
|
||||
|
||||
timeout = GetTicks() + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
|
||||
do {
|
||||
sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
}while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
|
||||
while (IS_LOW(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
|
||||
|
||||
if (IS_TIMEOUT(timeout))
|
||||
return 0;
|
||||
|
||||
return GetTicks() - start_ticks;
|
||||
return TICKS_ELAPSED(start_ticks);
|
||||
|
||||
}
|
||||
|
||||
static bool check_pulse_length(uint32_t pl, int length, int margin) {
|
||||
static uint32_t get_pulse_length(edge_detection_t edge) {
|
||||
|
||||
if(edge == RISING_EDGE)
|
||||
return get_rising_pulse_length();
|
||||
else if(edge == FALLING_EDGE)
|
||||
return get_falling_pulse_length();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static bool check_pulse_length(uint32_t pl, uint32_t length) {
|
||||
// check if pulse length <pl> corresponds to given length <length>
|
||||
//Dbprintf("%s: pulse length %d vs %d", __func__, pl, length * TICKS_PER_FC);
|
||||
return ((pl >= TICKS_PER_FC * (length - margin)) & (pl <= TICKS_PER_FC * (length + margin)));
|
||||
return ((pl >= (length - EM4X70_T_TAG_TOLERANCE)) & (pl <= (length + EM4X70_T_TAG_TOLERANCE)));
|
||||
}
|
||||
|
||||
static void em4x70_send_bit(int bit) {
|
||||
static void em4x70_send_bit(bool bit) {
|
||||
|
||||
// send single bit according to EM4170 application note and datasheet
|
||||
|
||||
uint32_t start_ticks = GetTicks();
|
||||
|
||||
if (bit == 0) {
|
||||
|
||||
// disable modulation (drop the field) for 4 cycles of carrier
|
||||
// disable modulation (drop the field) n cycles of carrier
|
||||
LOW(GPIO_SSC_DOUT);
|
||||
while (GetTicks() - start_ticks <= TICKS_PER_FC * 4);
|
||||
while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_BITMOD);
|
||||
|
||||
// enable modulation (activates the field) for remaining first
|
||||
// half of bit period
|
||||
HIGH(GPIO_SSC_DOUT);
|
||||
while (GetTicks() - start_ticks <= TICKS_PER_FC * EM4X70_T_TAG_HALF_PERIOD);
|
||||
while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_HALF_PERIOD);
|
||||
|
||||
// disable modulation for second half of bit period
|
||||
LOW(GPIO_SSC_DOUT);
|
||||
while (GetTicks() - start_ticks <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
|
||||
while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_FULL_PERIOD);
|
||||
|
||||
} else {
|
||||
|
||||
// bit = "1" means disable modulation for full bit period
|
||||
LOW(GPIO_SSC_DOUT);
|
||||
while (GetTicks() - start_ticks <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
|
||||
while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_FULL_PERIOD);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* em4x70_send_command
|
||||
* em4x70_send_nibble
|
||||
*
|
||||
* sends 4 bits of data + 1 bit of parity (with_parity)
|
||||
*
|
||||
*/
|
||||
static void em4170_send_command(uint8_t command) {
|
||||
static void em4x70_send_nibble(uint8_t nibble, bool with_parity) {
|
||||
int parity = 0;
|
||||
int msb_bit = 0;
|
||||
|
||||
// Non automotive EM4x70 based tags are 3 bits + 1 parity.
|
||||
// So drop the MSB and send a parity bit instead after the command
|
||||
if(command_parity)
|
||||
if (command_parity)
|
||||
msb_bit = 1;
|
||||
|
||||
for (int i = msb_bit; i < 4; i++) {
|
||||
int bit = (command >> (3 - i)) & 1;
|
||||
int bit = (nibble >> (3 - i)) & 1;
|
||||
em4x70_send_bit(bit);
|
||||
parity ^= bit;
|
||||
}
|
||||
|
||||
if(command_parity)
|
||||
if (with_parity)
|
||||
em4x70_send_bit(parity);
|
||||
|
||||
}
|
||||
|
||||
static void em4x70_send_byte(uint8_t byte) {
|
||||
// Send byte msb first
|
||||
for (int i = 0; i < 8; i++)
|
||||
em4x70_send_bit((byte >> (7 - i)) & 1);
|
||||
}
|
||||
|
||||
static void em4x70_send_word(const uint16_t word) {
|
||||
|
||||
// Split into nibbles
|
||||
uint8_t nibbles[4];
|
||||
uint8_t j = 0;
|
||||
for (int i = 0; i < 2; i++) {
|
||||
uint8_t byte = (word >> (8 * i)) & 0xff;
|
||||
nibbles[j++] = (byte >> 4) & 0xf;
|
||||
nibbles[j++] = byte & 0xf;
|
||||
}
|
||||
|
||||
// send 16 bit word with parity bits according to EM4x70 datasheet
|
||||
// sent as 4 x nibbles (4 bits + parity)
|
||||
for (int i = 0; i < 4; i++) {
|
||||
em4x70_send_nibble(nibbles[i], true);
|
||||
}
|
||||
|
||||
// send column parities (4 bit)
|
||||
em4x70_send_nibble(nibbles[0] ^ nibbles[1] ^ nibbles[2] ^ nibbles[3], false);
|
||||
|
||||
// send final stop bit (always "0")
|
||||
em4x70_send_bit(0);
|
||||
}
|
||||
|
||||
static bool check_ack(void) {
|
||||
// returns true if signal structue corresponds to ACK, anything else is
|
||||
// counted as NAK (-> false)
|
||||
// ACK 64 + 64
|
||||
// NACK 64 + 48
|
||||
if (check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD) &&
|
||||
check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
|
||||
// ACK
|
||||
return true;
|
||||
}
|
||||
|
||||
// Othewise it was a NACK or Listen Window
|
||||
return false;
|
||||
}
|
||||
|
||||
static int authenticate(const uint8_t *rnd, const uint8_t *frnd, uint8_t *response) {
|
||||
|
||||
if (find_listen_window(true)) {
|
||||
|
||||
em4x70_send_nibble(EM4X70_COMMAND_AUTH, true);
|
||||
|
||||
// Send 56-bit Random number
|
||||
for (int i = 0; i < 7; i++) {
|
||||
em4x70_send_byte(rnd[i]);
|
||||
}
|
||||
|
||||
// Send 7 x 0's (Diversity bits)
|
||||
for (int i = 0; i < 7; i++) {
|
||||
em4x70_send_bit(0);
|
||||
}
|
||||
|
||||
// Send 28-bit f(RN)
|
||||
|
||||
// Send first 24 bits
|
||||
for (int i = 0; i < 3; i++) {
|
||||
em4x70_send_byte(frnd[i]);
|
||||
}
|
||||
|
||||
// Send last 4 bits (no parity)
|
||||
em4x70_send_nibble((frnd[3] >> 4) & 0xf, false);
|
||||
|
||||
// Receive header, 20-bit g(RN), LIW
|
||||
uint8_t grnd[EM4X70_MAX_RECEIVE_LENGTH] = {0};
|
||||
int num = em4x70_receive(grnd, 20);
|
||||
if (num < 20) {
|
||||
Dbprintf("Auth failed");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
bits2bytes(grnd, 24, response);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
static int send_pin(const uint32_t pin) {
|
||||
|
||||
// sends pin code for unlocking
|
||||
if (find_listen_window(true)) {
|
||||
|
||||
// send PIN command
|
||||
em4x70_send_nibble(EM4X70_COMMAND_PIN, true);
|
||||
|
||||
// --> Send TAG ID (bytes 4-7)
|
||||
for (int i = 0; i < 4; i++) {
|
||||
em4x70_send_byte(tag.data[7 - i]);
|
||||
}
|
||||
|
||||
// --> Send PIN
|
||||
for (int i = 0; i < 4 ; i++) {
|
||||
em4x70_send_byte((pin >> (i * 8)) & 0xff);
|
||||
}
|
||||
|
||||
// Wait TWALB (write access lock bits)
|
||||
WaitTicks(EM4X70_T_TAG_TWALB);
|
||||
|
||||
// <-- Receive ACK
|
||||
if (check_ack()) {
|
||||
|
||||
// <w> Writes Lock Bits
|
||||
WaitTicks(EM4X70_T_TAG_WEE);
|
||||
// <-- Receive header + ID
|
||||
uint8_t tag_id[EM4X70_MAX_RECEIVE_LENGTH];
|
||||
int num = em4x70_receive(tag_id, 32);
|
||||
if (num < 32) {
|
||||
Dbprintf("Invalid ID Received");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
bits2bytes(tag_id, num, &tag.data[4]);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
}
|
||||
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
static int write(const uint16_t word, const uint8_t address) {
|
||||
|
||||
// writes <word> to specified <address>
|
||||
if (find_listen_window(true)) {
|
||||
|
||||
// send write command
|
||||
em4x70_send_nibble(EM4X70_COMMAND_WRITE, true);
|
||||
|
||||
// send address data with parity bit
|
||||
em4x70_send_nibble(address, true);
|
||||
|
||||
// send data word
|
||||
em4x70_send_word(word);
|
||||
|
||||
// Wait TWA
|
||||
WaitTicks(EM4X70_T_TAG_TWA);
|
||||
|
||||
// look for ACK sequence
|
||||
if (check_ack()) {
|
||||
|
||||
// now EM4x70 needs EM4X70_T_TAG_TWEE (EEPROM write time)
|
||||
// for saving data and should return with ACK
|
||||
WaitTicks(EM4X70_T_TAG_WEE);
|
||||
if (check_ack()) {
|
||||
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
}
|
||||
}
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
|
||||
static bool find_listen_window(bool command) {
|
||||
|
||||
int cnt = 0;
|
||||
while(cnt < EM4X70_T_WAITING_FOR_SNGLLIW) {
|
||||
while (cnt < EM4X70_T_WAITING_FOR_LIW) {
|
||||
/*
|
||||
80 ( 64 + 16 )
|
||||
80 ( 64 + 16 )
|
||||
|
|
@ -311,49 +426,46 @@ static bool find_listen_window(bool command) {
|
|||
96 ( 64 + 32 )
|
||||
64 ( 32 + 16 +16 )*/
|
||||
|
||||
if (check_pulse_length(get_pulse_invert_length(), 80, EM4X70_TAG_TOLERANCE)) {
|
||||
if (check_pulse_length(get_pulse_invert_length(), 80, EM4X70_TAG_TOLERANCE)) {
|
||||
if (check_pulse_length(get_pulse_length(), 96, EM4X70_TAG_TOLERANCE)) {
|
||||
if (check_pulse_length(get_pulse_length(), 64, EM4X70_TAG_TOLERANCE)) {
|
||||
if(command) {
|
||||
if (check_pulse_length(get_pulse_length(RISING_EDGE), (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
|
||||
check_pulse_length(get_pulse_length(RISING_EDGE), (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
|
||||
check_pulse_length(get_pulse_length(FALLING_EDGE), (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD) &&
|
||||
check_pulse_length(get_pulse_length(FALLING_EDGE), EM4X70_T_TAG_FULL_PERIOD + (2*EM4X70_T_TAG_HALF_PERIOD))) {
|
||||
|
||||
if (command) {
|
||||
/* Here we are after the 64 duration edge.
|
||||
* em4170 says we need to wait about 48 RF clock cycles.
|
||||
* depends on the delay between tag and us
|
||||
*
|
||||
* I've found between 4-5 quarter periods (32-40) works best
|
||||
*/
|
||||
WaitTicks(TICKS_PER_FC * 5 * EM4X70_T_TAG_QUARTER_PERIOD);
|
||||
WaitTicks( 4 * EM4X70_T_TAG_QUARTER_PERIOD );
|
||||
// Send RM Command
|
||||
em4x70_send_bit(0);
|
||||
em4x70_send_bit(0);
|
||||
}
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
cnt++;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
static void bits2bytes(uint8_t *bits, int length, uint8_t *out) {
|
||||
static void bits2bytes(const uint8_t *bits, int length, uint8_t *out) {
|
||||
|
||||
if(length%8 != 0) {
|
||||
if (length % 8 != 0) {
|
||||
Dbprintf("Should have a multiple of 8 bits, was sent %d", length);
|
||||
}
|
||||
|
||||
int num_bytes = length / 8; // We should have a multiple of 8 here
|
||||
|
||||
for(int i=1; i <= num_bytes; i++) {
|
||||
out[num_bytes-i] = bits2byte(bits, 8);
|
||||
bits+=8;
|
||||
//Dbprintf("Read: %02X", out[num_bytes-i]);
|
||||
for (int i = 1; i <= num_bytes; i++) {
|
||||
out[num_bytes - i] = bits2byte(bits, 8);
|
||||
bits += 8;
|
||||
}
|
||||
}
|
||||
|
||||
static uint8_t bits2byte(uint8_t *bits, int length) {
|
||||
static uint8_t bits2byte(const uint8_t *bits, int length) {
|
||||
|
||||
// converts <length> separate bits into a single "byte"
|
||||
uint8_t byte = 0;
|
||||
|
|
@ -368,22 +480,28 @@ static uint8_t bits2byte(uint8_t *bits, int length) {
|
|||
return byte;
|
||||
}
|
||||
|
||||
/*static void print_array(uint8_t *bits, int len) {
|
||||
static bool send_command_and_read(uint8_t command, uint8_t *bytes, size_t length) {
|
||||
|
||||
if(len%8 != 0) {
|
||||
Dbprintf("Should have a multiple of 8 bits, was sent %d", len);
|
||||
int retries = EM4X70_COMMAND_RETRIES;
|
||||
while (retries) {
|
||||
retries--;
|
||||
|
||||
if (find_listen_window(true)) {
|
||||
uint8_t bits[EM4X70_MAX_RECEIVE_LENGTH] = {0};
|
||||
size_t out_length_bits = length * 8;
|
||||
em4x70_send_nibble(command, command_parity);
|
||||
int len = em4x70_receive(bits, out_length_bits);
|
||||
if (len < out_length_bits) {
|
||||
Dbprintf("Invalid data received length: %d, expected %d", len, out_length_bits);
|
||||
return false;
|
||||
}
|
||||
|
||||
int num_bytes = len / 8; // We should have a multiple of 8 here
|
||||
|
||||
uint8_t bytes[8];
|
||||
|
||||
for(int i=0;i<num_bytes;i++) {
|
||||
bytes[i] = bits2byte(bits, 8);
|
||||
bits+=8;
|
||||
Dbprintf("Read: %02X", bytes[i]);
|
||||
bits2bytes(bits, len, bytes);
|
||||
return true;
|
||||
}
|
||||
}*/
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/**
|
||||
|
|
@ -393,18 +511,8 @@ static uint8_t bits2byte(uint8_t *bits, int length) {
|
|||
*/
|
||||
static bool em4x70_read_id(void) {
|
||||
|
||||
if(find_listen_window(true)) {
|
||||
uint8_t bits[64] = {0};
|
||||
em4170_send_command(EM4X70_COMMAND_ID);
|
||||
int num = em4x70_receive(bits);
|
||||
if(num < 32) {
|
||||
Dbprintf("Invalid ID Received");
|
||||
return false;
|
||||
}
|
||||
bits2bytes(bits, num, &tag.data[4]);
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
return send_command_and_read(EM4X70_COMMAND_ID, &tag.data[4], 4);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
@ -413,18 +521,9 @@ static bool em4x70_read_id(void) {
|
|||
* read user memory 1 (4 bytes including lock bits)
|
||||
*/
|
||||
static bool em4x70_read_um1(void) {
|
||||
if(find_listen_window(true)) {
|
||||
uint8_t bits[64] = {0};
|
||||
em4170_send_command(EM4X70_COMMAND_UM1);
|
||||
int num = em4x70_receive(bits);
|
||||
if(num < 32) {
|
||||
Dbprintf("Invalid UM1 data received");
|
||||
return false;
|
||||
}
|
||||
bits2bytes(bits, num, &tag.data[0]);
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
|
||||
return send_command_and_read(EM4X70_COMMAND_UM1, &tag.data[0], 4);
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -434,34 +533,22 @@ static bool em4x70_read_um1(void) {
|
|||
* read user memory 2 (8 bytes)
|
||||
*/
|
||||
static bool em4x70_read_um2(void) {
|
||||
if(find_listen_window(true)) {
|
||||
uint8_t bits[64] = {0};
|
||||
em4170_send_command(EM4X70_COMMAND_UM2);
|
||||
int num = em4x70_receive(bits);
|
||||
if(num < 64) {
|
||||
Dbprintf("Invalid UM2 data received");
|
||||
return false;
|
||||
}
|
||||
bits2bytes(bits, num, &tag.data[24]);
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
|
||||
return send_command_and_read(EM4X70_COMMAND_UM2, &tag.data[24], 8);
|
||||
|
||||
}
|
||||
|
||||
static bool find_EM4X70_Tag(void) {
|
||||
Dbprintf("%s: Start", __func__);
|
||||
static bool find_em4x70_tag(void) {
|
||||
// function is used to check wether a tag on the proxmark is an
|
||||
// EM4170 tag or not -> speed up "lf search" process
|
||||
return find_listen_window(false);
|
||||
}
|
||||
|
||||
static int em4x70_receive(uint8_t *bits) {
|
||||
static int em4x70_receive(uint8_t *bits, size_t length) {
|
||||
|
||||
uint32_t pl;
|
||||
int bit_pos = 0;
|
||||
uint8_t edge = 0;
|
||||
|
||||
|
||||
edge_detection_t edge = RISING_EDGE;
|
||||
bool foundheader = false;
|
||||
|
||||
// Read out the header
|
||||
|
|
@ -469,60 +556,58 @@ static int em4x70_receive(uint8_t *bits) {
|
|||
// 4 Manchester 0's
|
||||
|
||||
// Skip a few leading 1's as it could be noisy
|
||||
WaitTicks(TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
|
||||
WaitTicks(6 * EM4X70_T_TAG_FULL_PERIOD);
|
||||
|
||||
// wait until we get the transition from 1's to 0's which is 1.5 full windows
|
||||
int pulse_count = 0;
|
||||
while(pulse_count < 12){
|
||||
pl = get_pulse_invert_length();
|
||||
pulse_count++;
|
||||
if(check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD, EM4X70_TAG_TOLERANCE)) {
|
||||
for(int i = 0; i < EM4X70_T_READ_HEADER_LEN; i++) {
|
||||
pl = get_pulse_length(edge);
|
||||
if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
|
||||
foundheader = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if(!foundheader) {
|
||||
if (!foundheader) {
|
||||
Dbprintf("Failed to find read header");
|
||||
return 0;
|
||||
}
|
||||
|
||||
// Skip next 3 0's, header check consumes the first 0
|
||||
for(int i = 0; i < 3; i++) {
|
||||
get_pulse_invert_length();
|
||||
for (int i = 0; i < 3; i++) {
|
||||
// If pulse length is not 1 bit, then abort early
|
||||
if(!check_pulse_length(get_pulse_length(edge), EM4X70_T_TAG_FULL_PERIOD)) {
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
// identify remaining bits based on pulse lengths
|
||||
// between two listen windows only pulse lengths of 1, 1.5 and 2 are possible
|
||||
while (true) {
|
||||
// between listen windows only pulse lengths of 1, 1.5 and 2 are possible
|
||||
while (bit_pos < length) {
|
||||
|
||||
if(edge)
|
||||
pl = get_pulse_length();
|
||||
else
|
||||
pl = get_pulse_invert_length();
|
||||
pl = get_pulse_length(edge);
|
||||
|
||||
if (check_pulse_length(pl, EM4X70_T_TAG_FULL_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) {
|
||||
if (check_pulse_length(pl, EM4X70_T_TAG_FULL_PERIOD)) {
|
||||
|
||||
// pulse length = 1
|
||||
bits[bit_pos++] = edge;
|
||||
// pulse length 1 -> assign bit
|
||||
bits[bit_pos++] = edge == FALLING_EDGE ? 1 : 0;
|
||||
|
||||
} else if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) {
|
||||
} else if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
|
||||
|
||||
// pulse length = 1.5 -> flip edge detection
|
||||
if(edge) {
|
||||
// pulse length 1.5 -> 2 bits + flip edge detection
|
||||
if (edge == FALLING_EDGE) {
|
||||
bits[bit_pos++] = 0;
|
||||
bits[bit_pos++] = 0;
|
||||
edge = 0;
|
||||
edge = RISING_EDGE;
|
||||
} else {
|
||||
bits[bit_pos++] = 1;
|
||||
bits[bit_pos++] = 1;
|
||||
edge = 1;
|
||||
edge = FALLING_EDGE;
|
||||
}
|
||||
|
||||
} else if (check_pulse_length(pl, 2 * EM4X70_T_TAG_FULL_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) {
|
||||
} else if (check_pulse_length(pl, 2 * EM4X70_T_TAG_FULL_PERIOD)) {
|
||||
|
||||
// pulse length of 2
|
||||
if(edge) {
|
||||
// pulse length of 2 -> two bits
|
||||
if (edge == FALLING_EDGE) {
|
||||
bits[bit_pos++] = 0;
|
||||
bits[bit_pos++] = 1;
|
||||
} else {
|
||||
|
|
@ -530,15 +615,13 @@ static int em4x70_receive(uint8_t *bits) {
|
|||
bits[bit_pos++] = 0;
|
||||
}
|
||||
|
||||
} else if ( (edge && check_pulse_length(pl, 3 * EM4X70_T_TAG_FULL_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) ||
|
||||
(!edge && check_pulse_length(pl, 80, EM4X70_T_TAG_QUARTER_PERIOD))) {
|
||||
} else {
|
||||
// Listen Window, or invalid bit
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// LIW detected (either invert or normal)
|
||||
return --bit_pos;
|
||||
}
|
||||
}
|
||||
return bit_pos;
|
||||
|
||||
}
|
||||
|
||||
void em4x70_info(em4x70_data_t *etd) {
|
||||
|
|
@ -549,10 +632,10 @@ void em4x70_info(em4x70_data_t *etd) {
|
|||
command_parity = etd->parity;
|
||||
|
||||
init_tag();
|
||||
EM4170_setup_read();
|
||||
em4x70_setup_read();
|
||||
|
||||
// Find the Tag
|
||||
if (get_signalproperties() && find_EM4X70_Tag()) {
|
||||
if (get_signalproperties() && find_em4x70_tag()) {
|
||||
// Read ID, UM1 and UM2
|
||||
status = em4x70_read_id() && em4x70_read_um1() && em4x70_read_um2();
|
||||
}
|
||||
|
|
@ -561,3 +644,165 @@ void em4x70_info(em4x70_data_t *etd) {
|
|||
lf_finalize();
|
||||
reply_ng(CMD_LF_EM4X70_INFO, status, tag.data, sizeof(tag.data));
|
||||
}
|
||||
|
||||
void em4x70_write(em4x70_data_t *etd) {
|
||||
|
||||
uint8_t status = 0;
|
||||
|
||||
command_parity = etd->parity;
|
||||
|
||||
init_tag();
|
||||
em4x70_setup_read();
|
||||
|
||||
// Find the Tag
|
||||
if (get_signalproperties() && find_em4x70_tag()) {
|
||||
|
||||
// Write
|
||||
status = write(etd->word, etd->address) == PM3_SUCCESS;
|
||||
|
||||
if (status) {
|
||||
// Read Tag after writing
|
||||
em4x70_read_id();
|
||||
em4x70_read_um1();
|
||||
em4x70_read_um2();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
StopTicks();
|
||||
lf_finalize();
|
||||
reply_ng(CMD_LF_EM4X70_WRITE, status, tag.data, sizeof(tag.data));
|
||||
}
|
||||
|
||||
void em4x70_unlock(em4x70_data_t *etd) {
|
||||
|
||||
uint8_t status = 0;
|
||||
|
||||
command_parity = etd->parity;
|
||||
|
||||
init_tag();
|
||||
em4x70_setup_read();
|
||||
|
||||
// Find the Tag
|
||||
if (get_signalproperties() && find_em4x70_tag()) {
|
||||
|
||||
// Read ID (required for send_pin command)
|
||||
if (em4x70_read_id()) {
|
||||
|
||||
// Send PIN
|
||||
status = send_pin(etd->pin) == PM3_SUCCESS;
|
||||
|
||||
// If the write succeeded, read the rest of the tag
|
||||
if (status) {
|
||||
// Read Tag
|
||||
// ID doesn't change
|
||||
em4x70_read_um1();
|
||||
em4x70_read_um2();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
StopTicks();
|
||||
lf_finalize();
|
||||
reply_ng(CMD_LF_EM4X70_UNLOCK, status, tag.data, sizeof(tag.data));
|
||||
}
|
||||
|
||||
void em4x70_auth(em4x70_data_t *etd) {
|
||||
|
||||
uint8_t status = 0;
|
||||
uint8_t response[3] = {0};
|
||||
|
||||
command_parity = etd->parity;
|
||||
|
||||
init_tag();
|
||||
em4x70_setup_read();
|
||||
|
||||
// Find the Tag
|
||||
if (get_signalproperties() && find_em4x70_tag()) {
|
||||
|
||||
// Authenticate and get tag response
|
||||
status = authenticate(etd->rnd, etd->frnd, response) == PM3_SUCCESS;
|
||||
}
|
||||
|
||||
StopTicks();
|
||||
lf_finalize();
|
||||
reply_ng(CMD_LF_EM4X70_AUTH, status, response, sizeof(response));
|
||||
}
|
||||
|
||||
void em4x70_write_pin(em4x70_data_t *etd) {
|
||||
|
||||
uint8_t status = 0;
|
||||
|
||||
command_parity = etd->parity;
|
||||
|
||||
init_tag();
|
||||
em4x70_setup_read();
|
||||
|
||||
// Find the Tag
|
||||
if (get_signalproperties() && find_em4x70_tag()) {
|
||||
|
||||
// Read ID (required for send_pin command)
|
||||
if (em4x70_read_id()) {
|
||||
|
||||
// Write new PIN
|
||||
if( (write( etd->pin & 0xFFFF, EM4X70_PIN_WORD_UPPER) == PM3_SUCCESS) &&
|
||||
(write((etd->pin >> 16) & 0xFFFF, EM4X70_PIN_WORD_LOWER) == PM3_SUCCESS)) {
|
||||
|
||||
// Now Try to authenticate using the new PIN
|
||||
|
||||
// Send PIN
|
||||
status = send_pin(etd->pin) == PM3_SUCCESS;
|
||||
|
||||
// If the write succeeded, read the rest of the tag
|
||||
if (status) {
|
||||
// Read Tag
|
||||
// ID doesn't change
|
||||
em4x70_read_um1();
|
||||
em4x70_read_um2();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
StopTicks();
|
||||
lf_finalize();
|
||||
reply_ng(CMD_LF_EM4X70_WRITEPIN, status, tag.data, sizeof(tag.data));
|
||||
}
|
||||
|
||||
void em4x70_write_key(em4x70_data_t *etd) {
|
||||
|
||||
uint8_t status = 0;
|
||||
|
||||
command_parity = etd->parity;
|
||||
|
||||
init_tag();
|
||||
em4x70_setup_read();
|
||||
|
||||
// Find the Tag
|
||||
if (get_signalproperties() && find_em4x70_tag()) {
|
||||
|
||||
// Read ID to ensure we can write to card
|
||||
if (em4x70_read_id()) {
|
||||
status = 1;
|
||||
|
||||
// Write each crypto block
|
||||
for(int i = 0; i < 6; i++) {
|
||||
|
||||
uint16_t key_word = (etd->crypt_key[(i*2)+1] << 8) + etd->crypt_key[i*2];
|
||||
// Write each word, abort if any failure occurs
|
||||
if (write(key_word, 9-i) != PM3_SUCCESS) {
|
||||
status = 0;
|
||||
break;
|
||||
}
|
||||
}
|
||||
// TODO: Ideally here we would perform a test authentication
|
||||
// to ensure the new key was written correctly. This is
|
||||
// what the datasheet suggests. We can't do that until
|
||||
// we have the crypto algorithm implemented.
|
||||
}
|
||||
}
|
||||
|
||||
StopTicks();
|
||||
lf_finalize();
|
||||
reply_ng(CMD_LF_EM4X70_WRITEKEY, status, tag.data, sizeof(tag.data));
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,6 +17,16 @@ typedef struct {
|
|||
uint8_t data[32];
|
||||
} em4x70_tag_t;
|
||||
|
||||
typedef enum {
|
||||
RISING_EDGE,
|
||||
FALLING_EDGE
|
||||
}edge_detection_t;
|
||||
|
||||
void em4x70_info(em4x70_data_t *etd);
|
||||
void em4x70_write(em4x70_data_t *etd);
|
||||
void em4x70_unlock(em4x70_data_t *etd);
|
||||
void em4x70_auth(em4x70_data_t *etd);
|
||||
void em4x70_write_pin(em4x70_data_t *etd);
|
||||
void em4x70_write_key(em4x70_data_t *etd);
|
||||
|
||||
#endif /* EM4x70_H */
|
||||
|
|
|
|||
|
|
@ -228,6 +228,7 @@ set (TARGET_SOURCES
|
|||
${PM3_ROOT}/client/src/cmdhf15.c
|
||||
${PM3_ROOT}/client/src/cmdhfcryptorf.c
|
||||
${PM3_ROOT}/client/src/cmdhfepa.c
|
||||
${PM3_ROOT}/client/src/cmdhfemrtd.c
|
||||
${PM3_ROOT}/client/src/cmdhffelica.c
|
||||
${PM3_ROOT}/client/src/cmdhffido.c
|
||||
${PM3_ROOT}/client/src/cmdhficlass.c
|
||||
|
|
|
|||
|
|
@ -469,6 +469,7 @@ SRCS = aiddesfire.c \
|
|||
cmdhf15.c \
|
||||
cmdhfcryptorf.c \
|
||||
cmdhfepa.c \
|
||||
cmdhfemrtd.c \
|
||||
cmdhffelica.c \
|
||||
cmdhffido.c \
|
||||
cmdhficlass.c \
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@
|
|||
43464F494D48504E4C4359454E528841 #NHIF
|
||||
6AC292FAA1315B4D858AB3A3D7D5933A
|
||||
404142434445464748494a4b4c4d4e4f
|
||||
3112B738D8862CCD34302EB299AAB456 # Gallagher AES (https://pastebin.com/GkbGLz8r)
|
||||
00112233445566778899aabbccddeeff
|
||||
2b7e151628aed2a6abf7158809cf4f3c
|
||||
fbeed618357133667c85e08f7236a8de
|
||||
|
|
|
|||
|
|
@ -23,6 +23,7 @@
|
|||
#include "cmdhf14b.h" // ISO14443-B
|
||||
#include "cmdhf15.h" // ISO15693
|
||||
#include "cmdhfepa.h"
|
||||
#include "cmdhfemrtd.h" // eMRTD
|
||||
#include "cmdhflegic.h" // LEGIC
|
||||
#include "cmdhficlass.h" // ICLASS
|
||||
#include "cmdhfmf.h" // CLASSIC
|
||||
|
|
@ -362,6 +363,7 @@ static command_t CommandTable[] = {
|
|||
{"15", CmdHF15, AlwaysAvailable, "{ ISO15693 RFIDs... }"},
|
||||
// {"cryptorf", CmdHFCryptoRF, AlwaysAvailable, "{ CryptoRF RFIDs... }"},
|
||||
{"epa", CmdHFEPA, AlwaysAvailable, "{ German Identification Card... }"},
|
||||
{"emrtd", CmdHFeMRTD, AlwaysAvailable, "{ Machine Readable Travel Document... }"},
|
||||
{"felica", CmdHFFelica, AlwaysAvailable, "{ ISO18092 / FeliCa RFIDs... }"},
|
||||
{"fido", CmdHFFido, AlwaysAvailable, "{ FIDO and FIDO2 authenticators... }"},
|
||||
{"iclass", CmdHFiClass, AlwaysAvailable, "{ ICLASS RFIDs... }"},
|
||||
|
|
|
|||
|
|
@ -2127,128 +2127,163 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
|
|||
n -= 2;
|
||||
return d[n] * 0x0100 + d[n + 1];
|
||||
}
|
||||
static int CmdHf14AFuzzapdu(const char *Cmd) {
|
||||
|
||||
static int CmdHf14AFindapdu(const char *Cmd) {
|
||||
// TODO: What response values should be considerd "valid" or "instersting" (worth dispalying)?
|
||||
// TODO: Option to select AID/File (and skip INS 0xA4).
|
||||
// TODO: Validate the decoding of the APDU (not specific to this command, check
|
||||
// https://cardwerk.com/smartcards/smartcard_standard_ISO7816-4_5_basic_organizations.aspx#chap5_3_2).
|
||||
// TODO: Check all cases (APDUs) with no data bytes (no/short/extended length).
|
||||
// TODO: Option to blacklist instructions (or whole APDUs).
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 14a apdufuzz",
|
||||
"Fuzz APDU's of ISO7816 protocol to find valid CLS/INS/P1P2/LE commands.\n"
|
||||
CLIParserInit(&ctx, "hf 14a apdufind",
|
||||
"Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1P2 commands.\n"
|
||||
"It loops all 256 possible values for each byte.\n"
|
||||
"The loop oder is INS -> P1/P2 (alternating) -> CLA\n"
|
||||
"Tag must be on antenna before running.",
|
||||
"hf 14a apdufuzz\n"
|
||||
"hf 14a apdufuzz --cla 80\n"
|
||||
"hf 14a apdufind\n"
|
||||
"hf 14a apdufind --cla 80\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_str0(NULL, "cla", "<hex>", "start CLASS value (1 hex byte)"),
|
||||
arg_str0(NULL, "ins", "<hex>", "start INSTRUCTION value (1 hex byte)"),
|
||||
arg_str0(NULL, "p1", "<hex>", "start P1 value (1 hex byte)"),
|
||||
arg_str0(NULL, "p2", "<hex>", "start P2 value (1 hex byte)"),
|
||||
arg_str0(NULL, "le", "<hex>", "start LENGTH value (1 hex byte)"),
|
||||
arg_lit0("v", "verbose", "verbose output"),
|
||||
arg_str0("c", "cla", "<hex>", "Start value of CLASS (1 hex byte)"),
|
||||
arg_str0("i", "ins", "<hex>", "Start value of INSTRUCTION (1 hex byte)"),
|
||||
arg_str0(NULL, "p1", "<hex>", "Start value of P1 (1 hex byte)"),
|
||||
arg_str0(NULL, "p2", "<hex>", "Start value of P2 (1 hex byte)"),
|
||||
arg_u64_0("r", "reset", "<number>", "Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes"),
|
||||
arg_lit0("v", "verbose", "Verbose output"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
int cla_len = 0;
|
||||
uint8_t cla[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 1, cla, &cla_len);
|
||||
|
||||
uint8_t cla_arg[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 1, cla_arg, &cla_len);
|
||||
int ins_len = 0;
|
||||
uint8_t ins[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 2, ins, &ins_len);
|
||||
|
||||
uint8_t ins_arg[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 2, ins_arg, &ins_len);
|
||||
int p1_len = 0;
|
||||
uint8_t p1[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 3, p1, &p1_len);
|
||||
|
||||
uint8_t p1_arg[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 3, p1_arg, &p1_len);
|
||||
int p2_len = 0;
|
||||
uint8_t p2[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 4, p2, &p2_len);
|
||||
|
||||
int le_len = 0;
|
||||
uint8_t le[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 5, le, &le_len);
|
||||
|
||||
uint8_t p2_arg[1] = {0};
|
||||
CLIGetHexWithReturn(ctx, 4, p2_arg, &p2_len);
|
||||
uint64_t reset_time = arg_get_u64_def(ctx, 5, 5 * 60); // Reset every 5 minutes.
|
||||
bool verbose = arg_get_lit(ctx, 6);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
bool activate_field = true;
|
||||
bool keep_field_on = true;
|
||||
|
||||
uint8_t a = cla[0];
|
||||
uint8_t b = ins[0];
|
||||
uint8_t c = p1[0];
|
||||
uint8_t d = p2[0];
|
||||
uint8_t e = le[0];
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Starting the apdu fuzzer [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " LE " _GREEN_("%02x")" ]", a,b,c,d,e);
|
||||
PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
|
||||
|
||||
uint8_t cla = cla_arg[0];
|
||||
uint8_t ins = ins_arg[0];
|
||||
uint8_t p1 = p1_arg[0];
|
||||
uint8_t p2 = p2_arg[0];
|
||||
uint8_t response[PM3_CMD_DATA_SIZE];
|
||||
int resplen = 0;
|
||||
|
||||
int response_n = 0;
|
||||
uint8_t aSELECT_AID[80];
|
||||
int aSELECT_AID_n = 0;
|
||||
|
||||
// Check if the tag reponds to APDUs.
|
||||
PrintAndLogEx(INFO, "Sending a test APDU (select file command) to check if the tag is responding to APDU");
|
||||
param_gethex_to_eol("00a404000aa000000440000101000100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n);
|
||||
int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
|
||||
int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, true, false, response, sizeof(response), &response_n);
|
||||
if (res) {
|
||||
DropField();
|
||||
PrintAndLogEx(FAILED, "Tag did not responde to a test APDU (select file command). Aborting");
|
||||
return res;
|
||||
}
|
||||
PrintAndLogEx(SUCCESS, "Got response. Starting the APDU finder [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
|
||||
PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
|
||||
|
||||
if (activate_field)
|
||||
activate_field = false;
|
||||
bool inc_p1 = true;
|
||||
uint64_t t_start = msclock();
|
||||
uint64_t t_last_reset = msclock();
|
||||
|
||||
uint64_t t1 = msclock();
|
||||
do {
|
||||
do {
|
||||
// Enumerate APDUs.
|
||||
do {
|
||||
do {
|
||||
do {
|
||||
// Exit (was the Enter key pressed)?
|
||||
if (kbd_enter_pressed()) {
|
||||
PrintAndLogEx(INFO, "User interrupted detected. Aborting");
|
||||
goto out;
|
||||
}
|
||||
|
||||
uint8_t foo[5] = {a, b, c, d, e};
|
||||
int foo_n = sizeof(foo);
|
||||
|
||||
if (verbose) {
|
||||
PrintAndLogEx(INFO, "%s", sprint_hex(foo, sizeof(foo)));
|
||||
PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
|
||||
}
|
||||
res = ExchangeAPDU14a(foo, foo_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
|
||||
|
||||
// Send APDU.
|
||||
uint8_t command[4] = {cla, ins, p1, p2};
|
||||
int command_n = sizeof(command);
|
||||
res = ExchangeAPDU14a(command, command_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
|
||||
if (res) {
|
||||
e++;
|
||||
continue;
|
||||
}
|
||||
|
||||
uint16_t sw = get_sw(response, resplen);
|
||||
// Was there and length error? If so, try with Le length (case 2 instad of case 1,
|
||||
// https://stackoverflow.com/a/30679558). Le = 0x00 will get interpreted as extended length APDU
|
||||
// with Le being 0x0100.
|
||||
uint16_t sw = get_sw(response, response_n);
|
||||
bool command_with_le = false;
|
||||
if (sw == 0x6700) {
|
||||
PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
|
||||
sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
|
||||
PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
|
||||
uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
|
||||
int command2_n = sizeof(command2);
|
||||
res = ExchangeAPDU14a(command2, command2_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
|
||||
if (res) {
|
||||
continue;
|
||||
}
|
||||
command_with_le = true;
|
||||
}
|
||||
|
||||
// Check response.
|
||||
sw = get_sw(response, response_n);
|
||||
if (sw != 0x6a86 &&
|
||||
sw != 0x6986 &&
|
||||
sw != 0x6d00
|
||||
) {
|
||||
PrintAndLogEx(INFO, "%02X %02X %02X %02X %02X (%04x - %s)", a,b,c,d,e, sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
|
||||
if (command_with_le) {
|
||||
PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X00\": %04X (%s)", cla, ins, p1, p2,
|
||||
sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
|
||||
} else {
|
||||
PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
|
||||
sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
|
||||
}
|
||||
e++;
|
||||
if (verbose) {
|
||||
PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
|
||||
// Show response data.
|
||||
if (response_n > 2) {
|
||||
PrintAndLogEx(SUCCESS, "Response data is: %s | %s", sprint_hex_inrow(response, response_n - 2),
|
||||
sprint_ascii(response, response_n - 2));
|
||||
}
|
||||
|
||||
} while (e);
|
||||
d++;
|
||||
PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
|
||||
} while (d);
|
||||
c++;
|
||||
PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
|
||||
} while (c);
|
||||
b++;
|
||||
PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
|
||||
} while (b);
|
||||
a++;
|
||||
PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
|
||||
} while(a);
|
||||
}
|
||||
activate_field = false; // Do not reativate the filed until the next reset.
|
||||
} while (++ins != ins_arg[0]);
|
||||
// Increment P1/P2 in an alternating fashion.
|
||||
if (inc_p1) {
|
||||
p1++;
|
||||
} else {
|
||||
p2++;
|
||||
}
|
||||
inc_p1 = !inc_p1;
|
||||
// Check if re-selecting the card is needed.
|
||||
uint64_t t_since_last_reset = ((msclock() - t_last_reset) / 1000);
|
||||
if (t_since_last_reset > reset_time) {
|
||||
DropField();
|
||||
activate_field = true;
|
||||
t_last_reset = msclock();
|
||||
PrintAndLogEx(INFO, "Last reset was %" PRIu64 " seconds ago. Reseting the tag to prevent timeout issues", t_since_last_reset);
|
||||
}
|
||||
PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
|
||||
} while (p1 != p1_arg[0] || p2 != p2_arg[0]);
|
||||
cla++;
|
||||
PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
|
||||
} while (cla != cla_arg[0]);
|
||||
|
||||
out:
|
||||
PrintAndLogEx(SUCCESS, "time: %" PRIu64 " seconds\n", (msclock() - t1) / 1000);
|
||||
PrintAndLogEx(SUCCESS, "Runtime: %" PRIu64 " seconds\n", (msclock() - t_start) / 1000);
|
||||
DropField();
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
|
@ -2266,7 +2301,7 @@ static command_t CommandTable[] = {
|
|||
{"raw", CmdHF14ACmdRaw, IfPm3Iso14443a, "Send raw hex data to tag"},
|
||||
{"antifuzz", CmdHF14AAntiFuzz, IfPm3Iso14443a, "Fuzzing the anticollision phase. Warning! Readers may react strange"},
|
||||
{"config", CmdHf14AConfig, IfPm3Iso14443a, "Configure 14a settings (use with caution)"},
|
||||
{"apdufuzz", CmdHf14AFuzzapdu, IfPm3Iso14443a, "Fuzz APDU - CLA/INS/P1P2"},
|
||||
{"apdufind", CmdHf14AFindapdu, IfPm3Iso14443a, "Enuerate APDUs - CLA/INS/P1P2"},
|
||||
{NULL, NULL, NULL, NULL}
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@
|
|||
#include "mifare/ndef.h" // NDEFRecordsDecodeAndPrint
|
||||
|
||||
#define TIMEOUT 2000
|
||||
#define APDU_TIMEOUT 4000
|
||||
|
||||
// iso14b apdu input frame length
|
||||
static uint16_t apdu_frame_length = 0;
|
||||
|
|
@ -1438,7 +1439,7 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
|
|||
SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, 0, 0, NULL, 0);
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT)) {
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, APDU_TIMEOUT)) {
|
||||
uint8_t *recv = resp.data.asBytes;
|
||||
int rlen = resp.oldarg[0];
|
||||
uint8_t res = resp.oldarg[1];
|
||||
|
|
@ -1488,7 +1489,7 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
|
|||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
|
||||
int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
|
||||
*dataoutlen = 0;
|
||||
bool chaining = false;
|
||||
int res;
|
||||
|
|
|
|||
|
|
@ -15,6 +15,8 @@
|
|||
|
||||
int CmdHF14B(const char *Cmd);
|
||||
|
||||
int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);
|
||||
|
||||
int infoHF14B(bool verbose);
|
||||
int readHF14B(bool verbose);
|
||||
#endif
|
||||
|
|
|
|||
1330
client/src/cmdhfemrtd.c
Normal file
1330
client/src/cmdhfemrtd.c
Normal file
File diff suppressed because it is too large
Load diff
20
client/src/cmdhfemrtd.h
Normal file
20
client/src/cmdhfemrtd.h
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
//-----------------------------------------------------------------------------
|
||||
// Copyright (C) 2020 A. Ozkal
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// High frequency Electronic Machine Readable Travel Document commands
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
#ifndef CMDHFEMRTD_H__
|
||||
#define CMDHFEMRTD_H__
|
||||
|
||||
#include "common.h"
|
||||
|
||||
int CmdHFeMRTD(const char *Cmd);
|
||||
|
||||
int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
|
||||
int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
|
||||
#endif
|
||||
|
|
@ -3449,11 +3449,11 @@ static int CmdHFiClassEncode(const char *Cmd) {
|
|||
|
||||
int isok = PM3_SUCCESS;
|
||||
// write
|
||||
for (uint8_t i=0; i<4; i++) {
|
||||
isok = iclass_write_block(6 + i, credential + (i*8), key, use_credit_key, elite, rawkey, false, false, auth);
|
||||
for (uint8_t i = 0; i < 4; i++) {
|
||||
isok = iclass_write_block(6 + i, credential + (i * 8), key, use_credit_key, elite, rawkey, false, false, auth);
|
||||
switch (isok) {
|
||||
case PM3_SUCCESS:
|
||||
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " ) --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i*8), 8));
|
||||
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " ) --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i * 8), 8));
|
||||
break;
|
||||
default:
|
||||
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _RED_("fail") " )", 6 + i, 6 + i);
|
||||
|
|
|
|||
|
|
@ -791,7 +791,7 @@ int CmdEM4x05Write(const char *Cmd) {
|
|||
}
|
||||
|
||||
bool use_pwd = false;
|
||||
uint32_t pwd = ( inputpwd != 0xFFFFFFFFFFFFFFFF) ? (inputpwd & 0xFFFFFFFF) : 0;
|
||||
uint32_t pwd = (inputpwd != 0xFFFFFFFFFFFFFFFF) ? (inputpwd & 0xFFFFFFFF) : 0;
|
||||
if (pwd == 0xFFFFFFFF) {
|
||||
if (protect_operation)
|
||||
PrintAndLogEx(INFO, "Writing protection words data %08X", data);
|
||||
|
|
@ -809,12 +809,12 @@ int CmdEM4x05Write(const char *Cmd) {
|
|||
// set Protect Words
|
||||
if (protect_operation) {
|
||||
res = em4x05_protect(pwd, use_pwd, data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
} else {
|
||||
res = em4x05_write_word_ext(addr, pwd, use_pwd, data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
}
|
||||
|
|
@ -888,25 +888,25 @@ int CmdEM4x05Wipe(const char *Cmd) {
|
|||
|
||||
bool use_pwd = false;
|
||||
uint32_t pwd = 0;
|
||||
if ( inputpwd != 0xFFFFFFFFFFFFFFFF) {
|
||||
if (inputpwd != 0xFFFFFFFFFFFFFFFF) {
|
||||
pwd = (inputpwd & 0xFFFFFFFF);
|
||||
use_pwd = true;
|
||||
}
|
||||
// block 0 : User Data or Chip Info
|
||||
int res = em4x05_write_word_ext(0, pwd, use_pwd, chip_info);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
// block 1 : UID - this should be read only for EM4205 and EM4305 not sure about others
|
||||
res = em4x05_write_word_ext(1, pwd, use_pwd, chip_UID);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
PrintAndLogEx(INFO, "UID block write failed");
|
||||
}
|
||||
|
||||
// block 2 : password
|
||||
res = em4x05_write_word_ext(2, pwd, use_pwd, block_data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
|
|
@ -914,20 +914,20 @@ int CmdEM4x05Wipe(const char *Cmd) {
|
|||
pwd = block_data;
|
||||
// block 3 : user data
|
||||
res = em4x05_write_word_ext(3, pwd, use_pwd, block_data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
// block 4 : config
|
||||
res = em4x05_write_word_ext(4, pwd, use_pwd, config);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
// Remainder of user/data blocks
|
||||
for (addr = 5; addr < 14; addr++) {// Clear user data blocks
|
||||
res = em4x05_write_word_ext(addr, pwd, use_pwd, block_data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -359,10 +359,10 @@ int CmdEM4x50Brute(const char *Cmd) {
|
|||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
int first_len = 0;
|
||||
uint8_t first[4] = {0,0,0,0};
|
||||
uint8_t first[4] = {0, 0, 0, 0};
|
||||
CLIGetHexWithReturn(ctx, 1, first, &first_len);
|
||||
int last_len = 0;
|
||||
uint8_t last[4] = {0,0,0,0};
|
||||
uint8_t last[4] = {0, 0, 0, 0};
|
||||
CLIGetHexWithReturn(ctx, 2, last, &last_len);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
|
@ -652,7 +652,7 @@ int CmdEM4x50Info(const char *Cmd) {
|
|||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if ( resp.status == PM3_SUCCESS)
|
||||
if (resp.status == PM3_SUCCESS)
|
||||
print_info_result(resp.data.asBytes);
|
||||
else
|
||||
PrintAndLogEx(FAILED, "Reading tag " _RED_("failed"));
|
||||
|
|
@ -1013,7 +1013,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
|
|||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if ( resp.status != PM3_SUCCESS) {
|
||||
if (resp.status != PM3_SUCCESS) {
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(FAILED, "Wiping data " _RED_("failed"));
|
||||
return PM3_ESOFT;
|
||||
|
|
@ -1160,10 +1160,10 @@ static command_t CommandTable[] = {
|
|||
{"login", CmdEM4x50Login, IfPm3EM4x50, "login into EM4x50"},
|
||||
{"rdbl", CmdEM4x50Read, IfPm3EM4x50, "read word data from EM4x50"},
|
||||
{"wrbl", CmdEM4x50Write, IfPm3EM4x50, "write word data to EM4x50"},
|
||||
{"writepwd",CmdEM4x50WritePwd, IfPm3EM4x50, "change password of EM4x50"},
|
||||
{"writepwd", CmdEM4x50WritePwd, IfPm3EM4x50, "change password of EM4x50"},
|
||||
{"wipe", CmdEM4x50Wipe, IfPm3EM4x50, "wipe EM4x50 tag"},
|
||||
{"reader", CmdEM4x50Reader, IfPm3EM4x50, "show standard read mode data of EM4x50"},
|
||||
{"restore",CmdEM4x50Restore, IfPm3EM4x50, "restore EM4x50 dump to tag"},
|
||||
{"restore", CmdEM4x50Restore, IfPm3EM4x50, "restore EM4x50 dump to tag"},
|
||||
{"sim", CmdEM4x50Sim, IfPm3EM4x50, "simulate EM4x50 tag"},
|
||||
{"eload", CmdEM4x50ELoad, IfPm3EM4x50, "upload dump of EM4x50 to emulator memory"},
|
||||
{"esave", CmdEM4x50ESave, IfPm3EM4x50, "save emulator memory to file"},
|
||||
|
|
|
|||
|
|
@ -16,25 +16,62 @@
|
|||
#include "commonutil.h"
|
||||
#include "em4x70.h"
|
||||
|
||||
#define LOCKBIT_0 BITMASK(6)
|
||||
#define LOCKBIT_1 BITMASK(7)
|
||||
|
||||
#define BYTES2UINT16(x) ((x[1] << 8) | (x[0]))
|
||||
#define BYTES2UINT32(x) ((x[3] << 24) | (x[2] << 16) | (x[1] << 8) | (x[0]))
|
||||
|
||||
#define INDEX_TO_BLOCK(x) (((32-x)/2)-1)
|
||||
|
||||
static int CmdHelp(const char *Cmd);
|
||||
|
||||
static void print_info_result(uint8_t *data) {
|
||||
static void print_info_result(const uint8_t *data) {
|
||||
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------");
|
||||
PrintAndLogEx(INFO, "-------------------------------------------------------------");
|
||||
PrintAndLogEx(INFO, "-----------------------------------------------");
|
||||
|
||||
// data section
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(INFO, _YELLOW_("EM4x70 data:"));
|
||||
PrintAndLogEx(INFO, "Block | data | info");
|
||||
PrintAndLogEx(INFO, "------+----------+-----------------------------");
|
||||
|
||||
for(int i=1; i <= 32; i+=2) {
|
||||
PrintAndLogEx(NORMAL, "%02X %02X", data[32-i], data[32-i-1]);
|
||||
// Print out each section as memory map in datasheet
|
||||
|
||||
// Start with UM2
|
||||
for (int i = 0; i < 8; i += 2) {
|
||||
PrintAndLogEx(INFO, " %2d | %02X %02X | UM2", INDEX_TO_BLOCK(i), data[31 - i], data[31 - i - 1]);
|
||||
}
|
||||
PrintAndLogEx(NORMAL, "Tag ID: %02X %02X %02X %02X", data[7], data[6], data[5], data[4]);
|
||||
PrintAndLogEx(NORMAL, "Lockbit 0: %d", (data[3] & 0x40) ? 1:0);
|
||||
PrintAndLogEx(NORMAL, "Lockbit 1: %d", (data[3] & 0x80) ? 1:0);
|
||||
PrintAndLogEx(INFO, "------+----------+-----------------------------");
|
||||
|
||||
// Print PIN (will never have data)
|
||||
for (int i = 8; i < 12; i += 2) {
|
||||
PrintAndLogEx(INFO, " %2d | -- -- | PIN write only", INDEX_TO_BLOCK(i));
|
||||
}
|
||||
PrintAndLogEx(INFO, "------+----------+-----------------------------");
|
||||
|
||||
// Print Crypt Key (will never have data)
|
||||
for (int i = 12; i < 24; i += 2) {
|
||||
PrintAndLogEx(INFO, " %2d | -- -- | KEY write-only", INDEX_TO_BLOCK(i));
|
||||
}
|
||||
PrintAndLogEx(INFO, "------+----------+-----------------------------");
|
||||
|
||||
// Print ID
|
||||
for (int i = 24; i < 28; i += 2) {
|
||||
PrintAndLogEx(INFO, " %2d | %02X %02X | ID", INDEX_TO_BLOCK(i), data[31 - i], data[31 - i - 1]);
|
||||
}
|
||||
PrintAndLogEx(INFO, "------+----------+-----------------------------");
|
||||
|
||||
// Print UM1
|
||||
for (int i = 28; i < 32; i += 2) {
|
||||
PrintAndLogEx(INFO, " %2d | %02X %02X | UM1", INDEX_TO_BLOCK(i), data[31 - i], data[31 - i - 1]);
|
||||
}
|
||||
PrintAndLogEx(INFO, "------+----------+-----------------------------");
|
||||
|
||||
PrintAndLogEx(INFO, "");
|
||||
PrintAndLogEx(INFO, "Tag ID: %02X %02X %02X %02X", data[7], data[6], data[5], data[4]);
|
||||
PrintAndLogEx(INFO, "Lockbit 0: %d", (data[3] & LOCKBIT_0) ? 1 : 0);
|
||||
PrintAndLogEx(INFO, "Lockbit 1: %d", (data[3] & LOCKBIT_1) ? 1 : 0);
|
||||
PrintAndLogEx(INFO, "Tag is %s.", (data[3] & LOCKBIT_0) ? _RED_("LOCKED") : _GREEN_("UNLOCKED"));
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
|
||||
}
|
||||
|
|
@ -50,7 +87,7 @@ int em4x70_info(void) {
|
|||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_INFO, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "(em4x70) timeout while waiting for reply.");
|
||||
PrintAndLogEx(WARNING, "(em4x70) Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
|
|
@ -77,18 +114,18 @@ int CmdEM4x70Info(const char *Cmd) {
|
|||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x10 info",
|
||||
CLIParserInit(&ctx, "lf em 4x70 info",
|
||||
"Tag Information EM4x70\n"
|
||||
" Tag variants include ID48 automotive transponder.\n"
|
||||
" ID48 does not use command parity (default).\n"
|
||||
" V4070 and EM4170 do require parity bit.",
|
||||
"lf em 4x70 info\n"
|
||||
"lf em 4x70 -p -> adds parity bit to commands\n"
|
||||
"lf em 4x70 info --par -> adds parity bit to command\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0("p", "parity", "Add parity bit when sending commands"),
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
|
|
@ -101,7 +138,7 @@ int CmdEM4x70Info(const char *Cmd) {
|
|||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_INFO, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
|
|
@ -110,13 +147,312 @@ int CmdEM4x70Info(const char *Cmd) {
|
|||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "reading tag " _RED_("failed"));
|
||||
PrintAndLogEx(FAILED, "Reading " _RED_("Failed"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int CmdEM4x70Write(const char *Cmd) {
|
||||
|
||||
// write one block/word (16 bits) to the tag at given block address (0-15)
|
||||
em4x70_data_t etd = {0};
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x70 write",
|
||||
"Write EM4x70\n",
|
||||
"lf em 4x70 write -b 15 -d c0de -> write 'c0de' to block 15\n"
|
||||
"lf em 4x70 write -b 15 -d c0de --par -> adds parity bit to commands\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_int1("b", "block", "<dec>", "block/word address, dec"),
|
||||
arg_str1("d", "data", "<hex>", "data, 2 bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
int addr = arg_get_int(ctx, 2);
|
||||
|
||||
int word_len = 0;
|
||||
uint8_t word[2] = {0x0};
|
||||
CLIGetHexWithReturn(ctx, 3, word, &word_len);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (addr < 0 || addr >= EM4X70_NUM_BLOCKS) {
|
||||
PrintAndLogEx(FAILED, "block has to be within range [0, 15]");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (word_len != 2) {
|
||||
PrintAndLogEx(FAILED, "word/data length must be 2 bytes instead of %d", word_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
etd.address = (uint8_t) addr;
|
||||
etd.word = BYTES2UINT16(word);;
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_WRITE, (uint8_t *)&etd, sizeof(etd));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_WRITE, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.status) {
|
||||
print_info_result(resp.data.asBytes);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "Writing " _RED_("Failed"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int CmdEM4x70Unlock(const char *Cmd) {
|
||||
|
||||
// send pin code to device, unlocking it for writing
|
||||
em4x70_data_t etd = {0};
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x70 unlock",
|
||||
"Unlock EM4x70 by sending PIN\n"
|
||||
"Default pin may be:\n"
|
||||
" AAAAAAAA\n"
|
||||
" 00000000\n",
|
||||
"lf em 4x70 unlock -p 11223344 -> Unlock with PIN\n"
|
||||
"lf em 4x70 unlock -p 11223344 --par -> Unlock with PIN using parity commands\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_str1("p", "pin", "<hex>", "pin, 4 bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
int pin_len = 0;
|
||||
uint8_t pin[4] = {0x0};
|
||||
|
||||
CLIGetHexWithReturn(ctx, 2, pin, &pin_len);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (pin_len != 4) {
|
||||
PrintAndLogEx(FAILED, "PIN length must be 4 bytes instead of %d", pin_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
etd.pin = BYTES2UINT32(pin);
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_UNLOCK, (uint8_t *)&etd, sizeof(etd));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_UNLOCK, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.status) {
|
||||
print_info_result(resp.data.asBytes);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "Unlocking tag " _RED_("failed"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int CmdEM4x70Auth(const char *Cmd) {
|
||||
|
||||
// Authenticate transponder
|
||||
// Send 56-bit random number + pre-computed f(rnd, k) to transponder.
|
||||
// Transponder will respond with a response
|
||||
em4x70_data_t etd = {0};
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x70 auth",
|
||||
"Authenticate against an EM4x70 by sending random number (RN) and F(RN)\n"
|
||||
" If F(RN) is incorrect based on the tag crypt key, the tag will not respond",
|
||||
"lf em 4x70 auth --rnd 45F54ADA252AAC --frn 4866BB70 --> Test authentication, tag will respond if successful\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_str1(NULL, "rnd", "<hex>", "Random 56-bit"),
|
||||
arg_str1(NULL, "frn", "<hex>", "F(RN) 28-bit as 4 hex bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
int rnd_len = 7;
|
||||
CLIGetHexWithReturn(ctx, 2, etd.rnd, &rnd_len);
|
||||
|
||||
int frnd_len = 4;
|
||||
CLIGetHexWithReturn(ctx, 3, etd.frnd, &frnd_len);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (rnd_len != 7) {
|
||||
PrintAndLogEx(FAILED, "Random number length must be 7 bytes instead of %d", rnd_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (frnd_len != 4) {
|
||||
PrintAndLogEx(FAILED, "F(RN) length must be 4 bytes instead of %d", frnd_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_AUTH, (uint8_t *)&etd, sizeof(etd));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_AUTH, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.status) {
|
||||
// Response is 20-bit from tag
|
||||
PrintAndLogEx(INFO, "Tag Auth Response: %02X %02X %02X", resp.data.asBytes[2], resp.data.asBytes[1], resp.data.asBytes[0]);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "TAG Authentication " _RED_("Failed"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int CmdEM4x70WritePIN(const char *Cmd) {
|
||||
|
||||
em4x70_data_t etd = {0};
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x70 writepin",
|
||||
"Write PIN\n",
|
||||
"lf em 4x70 writepin -p 11223344 -> Write PIN\n"
|
||||
"lf em 4x70 writepin -p 11223344 --par -> Write PIN using parity commands\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_str1("p", "pin", "<hex>", "pin, 4 bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
int pin_len = 0;
|
||||
uint8_t pin[4] = {0x0};
|
||||
|
||||
CLIGetHexWithReturn(ctx, 2, pin, &pin_len);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (pin_len != 4) {
|
||||
PrintAndLogEx(FAILED, "PIN length must be 4 bytes instead of %d", pin_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
etd.pin = BYTES2UINT32(pin);
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_WRITEPIN, (uint8_t *)&etd, sizeof(etd));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_WRITEPIN, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.status) {
|
||||
print_info_result(resp.data.asBytes);
|
||||
PrintAndLogEx(INFO, "Writing new PIN: " _GREEN_("SUCCESS"));
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "Writing new PIN: " _RED_("FAILED"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int CmdEM4x70WriteKey(const char *Cmd) {
|
||||
|
||||
// Write new crypt key to tag
|
||||
em4x70_data_t etd = {0};
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x70 writekey",
|
||||
"Write new 96-bit key to tag\n",
|
||||
"lf em 4x70 writekey -k F32AA98CF5BE4ADFA6D3480B\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_str1("k", "key", "<hex>", "Crypt Key as 12 hex bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
int key_len = 12;
|
||||
CLIGetHexWithReturn(ctx, 2, etd.crypt_key, &key_len);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (key_len != 12) {
|
||||
PrintAndLogEx(FAILED, "Crypt key length must be 12 bytes instead of %d", key_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_WRITEKEY, (uint8_t *)&etd, sizeof(etd));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_WRITEKEY, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.status) {
|
||||
PrintAndLogEx(INFO, "Writing new crypt key: " _GREEN_("SUCCESS"));
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "Writing new crypt key: " _RED_("FAILED"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
static command_t CommandTable[] = {
|
||||
{"help", CmdHelp, AlwaysAvailable, "This help"},
|
||||
{"info", CmdEM4x70Info, IfPm3EM4x70, "tag information EM4x70"},
|
||||
{"info", CmdEM4x70Info, IfPm3EM4x70, "Tag information EM4x70"},
|
||||
{"write", CmdEM4x70Write, IfPm3EM4x70, "Write EM4x70"},
|
||||
{"unlock", CmdEM4x70Unlock, IfPm3EM4x70, "Unlock EM4x70 for writing"},
|
||||
{"auth", CmdEM4x70Auth, IfPm3EM4x70, "Authenticate EM4x70"},
|
||||
{"writepin", CmdEM4x70WritePIN, IfPm3EM4x70, "Write PIN"},
|
||||
{"writekey", CmdEM4x70WriteKey, IfPm3EM4x70, "Write Crypt Key"},
|
||||
{NULL, NULL, NULL, NULL}
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -18,6 +18,11 @@
|
|||
|
||||
int CmdLFEM4X70(const char *Cmd);
|
||||
int CmdEM4x70Info(const char *Cmd);
|
||||
int CmdEM4x70Write(const char *Cmd);
|
||||
int CmdEM4x70Unlock(const char *Cmd);
|
||||
int CmdEM4x70Auth(const char *Cmd);
|
||||
int CmdEM4x70WritePIN(const char *Cmd);
|
||||
int CmdEM4x70WriteKey(const char *Cmd);
|
||||
|
||||
int em4x70_info(void);
|
||||
bool detect_4x70_block(void);
|
||||
|
|
|
|||
|
|
@ -454,7 +454,7 @@ static int CmdLFNedapClone(const char *Cmd) {
|
|||
NedapGen(sub_type, customer_code, id, is_long, data);
|
||||
|
||||
for (uint8_t i = 1; i < max ; i++) {
|
||||
blocks[i] = bytes_to_num (data + ((i - 1) * 4), 4);
|
||||
blocks[i] = bytes_to_num(data + ((i - 1) * 4), 4);
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Preparing to clone NEDAP to " _YELLOW_("%s") " tag", cardtype);
|
||||
|
|
|
|||
|
|
@ -134,7 +134,7 @@ static int CmdLFPCF7931Config(const char *Cmd) {
|
|||
configPcf.OffsetWidth = (ow & 0xFFFF);
|
||||
}
|
||||
if (op != 0xFFFF) {
|
||||
configPcf.OffsetPosition =(op & 0xFFFF);
|
||||
configPcf.OffsetPosition = (op & 0xFFFF);
|
||||
}
|
||||
|
||||
pcf7931_printConfig();
|
||||
|
|
|
|||
|
|
@ -354,7 +354,7 @@ static int CmdTIWrite(const char *Cmd) {
|
|||
payload.crc = bytes_to_num(crc, crc_len);
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_TI_WRITE, (uint8_t*)&payload, sizeof(payload));
|
||||
SendCommandNG(CMD_LF_TI_WRITE, (uint8_t *)&payload, sizeof(payload));
|
||||
PrintAndLogEx(SUCCESS, "Done");
|
||||
PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf ti reader`") " to verify");
|
||||
return PM3_SUCCESS;
|
||||
|
|
|
|||
|
|
@ -165,19 +165,35 @@ int CmdRem(const char *Cmd) {
|
|||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "rem",
|
||||
"Add a text line in log file",
|
||||
"rem"
|
||||
"rem my message -> adds a timestamp with `my message`"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_strx1(NULL, NULL, NULL, "message line you want inserted"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIParserFree(ctx);
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
||||
struct arg_str* foo = arg_get_str(ctx, 1);
|
||||
size_t count = 0;
|
||||
size_t len = 0;
|
||||
do {
|
||||
count += strlen(foo->sval[len]);
|
||||
} while (len++ < (foo->count - 1));
|
||||
|
||||
char s[count + foo->count];
|
||||
memset(s, 0, sizeof(s));
|
||||
|
||||
len = 0;
|
||||
do {
|
||||
snprintf(s + strlen(s), sizeof(s) - strlen(s), "%s ", foo->sval[len]);
|
||||
} while (len++ < (foo->count - 1));
|
||||
|
||||
CLIParserFree(ctx);
|
||||
char buf[22] = {0};
|
||||
AppendDate(buf, sizeof(buf), NULL);
|
||||
PrintAndLogEx(NORMAL, "%s remark: %s", buf, Cmd);
|
||||
PrintAndLogEx(SUCCESS, "%s remark: %s", buf, s);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -617,7 +617,7 @@ int EMVSelectApplication(struct tlvdb *tlv, uint8_t *AID, size_t *AIDlen) {
|
|||
}
|
||||
|
||||
int EMVGPO(EMVCommandChannel channel, bool LeaveFieldON, uint8_t *PDOL, size_t PDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
|
||||
return EMVExchange(channel, LeaveFieldON, (sAPDU) {0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
|
||||
return EMVExchangeEx(channel, false, LeaveFieldON, (sAPDU) {0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, true, Result, MaxResultLen, ResultLen, sw, tlv);
|
||||
}
|
||||
|
||||
int EMVReadRecord(EMVCommandChannel channel, bool LeaveFieldON, uint8_t SFI, uint8_t SFIrec, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
|
||||
|
|
|
|||
|
|
@ -53,7 +53,7 @@ int preferences_load(void) {
|
|||
session.overlay.h = 200;
|
||||
session.overlay.w = session.plot.w;
|
||||
session.overlay_sliders = true;
|
||||
session.show_hints = false;
|
||||
session.show_hints = true;
|
||||
|
||||
// setDefaultPath (spDefault, "");
|
||||
// setDefaultPath (spDump, "");
|
||||
|
|
|
|||
|
|
@ -109,7 +109,7 @@ uint32_t reflect32(uint32_t b) {
|
|||
// swap bytes
|
||||
v = ((v >> 8) & 0x00FF00FF) | ((v & 0x00FF00FF) << 8);
|
||||
// swap 2-byte long pairs
|
||||
v = ( v >> 16 ) | ( v << 16);
|
||||
v = (v >> 16) | (v << 16);
|
||||
return v;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1082,8 +1082,8 @@ int DetectPSKClock(uint8_t *dest, size_t size, int clock, size_t *firstPhaseShif
|
|||
if (g_debugMode == 2) prnt("DEBUG PSK: firstFullWave: %zu, waveLen: %d", firstFullWave, fullWaveLen);
|
||||
|
||||
// Avoid autodetect if user selected a clock
|
||||
for(uint8_t validClk = 1; validClk < 8; validClk++) {
|
||||
if(clock == clk[validClk]) return(clock);
|
||||
for (uint8_t validClk = 1; validClk < 8; validClk++) {
|
||||
if (clock == clk[validClk]) return (clock);
|
||||
}
|
||||
|
||||
//test each valid clock from greatest to smallest to see which lines up
|
||||
|
|
|
|||
|
|
@ -38,7 +38,6 @@ Check column "offline" for their availability.
|
|||
|`analyse nuid `|Y |`create NUID from 7byte UID`
|
||||
|`analyse demodbuff `|Y |`Load binary string to demodbuffer`
|
||||
|`analyse freq `|Y |`Calc wave lengths`
|
||||
|`analyse foo `|Y |`muxer`
|
||||
|
||||
|
||||
### data
|
||||
|
|
@ -143,6 +142,7 @@ Check column "offline" for their availability.
|
|||
|`hf 14a raw `|N |`Send raw hex data to tag`
|
||||
|`hf 14a antifuzz `|N |`Fuzzing the anticollision phase. Warning! Readers may react strange`
|
||||
|`hf 14a config `|N |`Configure 14a settings (use with caution)`
|
||||
|`hf 14a apdufind `|N |`Enuerate APDUs - CLA/INS/P1P2`
|
||||
|
||||
|
||||
### hf 14b
|
||||
|
|
@ -248,28 +248,29 @@ Check column "offline" for their availability.
|
|||
|
||||
|command |offline |description
|
||||
|------- |------- |-----------
|
||||
|`hf iclass help `|Y |`This help`
|
||||
|`hf iclass dump `|N |`[options..] Dump Picopass / iCLASS tag to file`
|
||||
|`hf iclass help `|Y |` This help`
|
||||
|`hf iclass dump `|N |`[*] Dump Picopass / iCLASS tag to file`
|
||||
|`hf iclass info `|Y |` Tag information`
|
||||
|`hf iclass list `|Y |` List iclass history`
|
||||
|`hf iclass rdbl `|N |`[options..] Read Picopass / iCLASS block`
|
||||
|`hf iclass rdbl `|N |`[*] Read Picopass / iCLASS block`
|
||||
|`hf iclass reader `|N |` Act like an Picopass / iCLASS reader`
|
||||
|`hf iclass restore `|N |`[options..] Restore a dump file onto a Picopass / iCLASS tag`
|
||||
|`hf iclass restore `|N |`[*] Restore a dump file onto a Picopass / iCLASS tag`
|
||||
|`hf iclass sniff `|N |` Eavesdrop Picopass / iCLASS communication`
|
||||
|`hf iclass wrbl `|N |`[options..] Write Picopass / iCLASS block`
|
||||
|`hf iclass chk `|N |`[options..] Check keys`
|
||||
|`hf iclass loclass `|Y |`[options..] Use loclass to perform bruteforce reader attack`
|
||||
|`hf iclass lookup `|Y |`[options..] Uses authentication trace to check for key in dictionary file`
|
||||
|`hf iclass sim `|N |`[options..] Simulate iCLASS tag`
|
||||
|`hf iclass eload `|N |`[f <fn> ] Load Picopass / iCLASS dump file into emulator memory`
|
||||
|`hf iclass esave `|N |`[f <fn> ] Save emulator memory to file`
|
||||
|`hf iclass eview `|N |`[options..] View emulator memory`
|
||||
|`hf iclass calcnewkey `|Y |`[options..] Calc diversified keys (blocks 3 & 4) to write new keys`
|
||||
|`hf iclass encrypt `|Y |`[options..] Encrypt given block data`
|
||||
|`hf iclass decrypt `|Y |`[options..] Decrypt given block data or tag dump file`
|
||||
|`hf iclass managekeys `|Y |`[options..] Manage keys to use with iclass commands`
|
||||
|`hf iclass wrbl `|N |`[*] Write Picopass / iCLASS block`
|
||||
|`hf iclass chk `|N |`[*] Check keys`
|
||||
|`hf iclass loclass `|Y |`[*] Use loclass to perform bruteforce reader attack`
|
||||
|`hf iclass lookup `|Y |`[*] Uses authentication trace to check for key in dictionary file`
|
||||
|`hf iclass sim `|N |`[*] Simulate iCLASS tag`
|
||||
|`hf iclass eload `|N |`[*] Load Picopass / iCLASS dump file into emulator memory`
|
||||
|`hf iclass esave `|N |`[*] Save emulator memory to file`
|
||||
|`hf iclass eview `|N |`[.] View emulator memory`
|
||||
|`hf iclass calcnewkey `|Y |`[*] Calc diversified keys (blocks 3 & 4) to write new keys`
|
||||
|`hf iclass encode `|Y |`[*] Encode binary wiegand to block 7`
|
||||
|`hf iclass encrypt `|Y |`[*] Encrypt given block data`
|
||||
|`hf iclass decrypt `|Y |`[*] Decrypt given block data or tag dump file`
|
||||
|`hf iclass managekeys `|Y |`[*] Manage keys to use with iclass commands`
|
||||
|`hf iclass permutekey `|N |` Permute function from 'heart of darkness' paper`
|
||||
|`hf iclass view `|Y |`[options..] Display content from tag dump file`
|
||||
|`hf iclass view `|Y |`[*] Display content from tag dump file`
|
||||
|
||||
|
||||
### hf legic
|
||||
|
|
@ -577,10 +578,10 @@ Check column "offline" for their availability.
|
|||
|command |offline |description
|
||||
|------- |------- |-----------
|
||||
|`lf em help `|Y |`This help`
|
||||
|`lf em 410x `|Y |`EM 410x commands...`
|
||||
|`lf em 4x05 `|Y |`EM 4x05 commands...`
|
||||
|`lf em 4x50 `|Y |`EM 4x50 commands...`
|
||||
|`lf em 4x70 `|Y |`EM 4x70 commands...`
|
||||
|`lf em 410x `|Y |`EM 4102 commands...`
|
||||
|`lf em 4x05 `|Y |`EM 4205 / 4305 / 4369 / 4469 commands...`
|
||||
|`lf em 4x50 `|Y |`EM 4350 / 4450 commands...`
|
||||
|`lf em 4x70 `|Y |`EM 4070 / 4170 commands...`
|
||||
|
||||
|
||||
### lf fdxb
|
||||
|
|
@ -672,9 +673,9 @@ Check column "offline" for their availability.
|
|||
|command |offline |description
|
||||
|------- |------- |-----------
|
||||
|`lf indala help `|Y |`this help`
|
||||
|`lf indala demod `|Y |`demodulate an indala tag (PSK1) from GraphBuffer`
|
||||
|`lf indala altdemod `|Y |`alternative method to Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)`
|
||||
|`lf indala reader `|N |`read an Indala Prox tag from the antenna`
|
||||
|`lf indala demod `|Y |`demodulate an Indala tag (PSK1) from GraphBuffer`
|
||||
|`lf indala altdemod `|Y |`alternative method to demodulate samples for Indala 64 bit UID (option '224' for 224 bit)`
|
||||
|`lf indala reader `|N |`read an Indala tag from the antenna`
|
||||
|`lf indala clone `|N |`clone Indala tag to T55x7 or Q5/T5555`
|
||||
|`lf indala sim `|N |`simulate Indala tag`
|
||||
|
||||
|
|
@ -686,10 +687,10 @@ Check column "offline" for their availability.
|
|||
|command |offline |description
|
||||
|------- |------- |-----------
|
||||
|`lf io help `|Y |`this help`
|
||||
|`lf io demod `|Y |`demodulate an IOProx tag from the GraphBuffer`
|
||||
|`lf io demod `|Y |`demodulate an ioProx tag from the GraphBuffer`
|
||||
|`lf io reader `|N |`attempt to read and extract tag data`
|
||||
|`lf io clone `|N |`clone IOProx tag to T55x7 or Q5/T5555`
|
||||
|`lf io sim `|N |`simulate IOProx tag`
|
||||
|`lf io clone `|N |`clone ioProx tag to T55x7 or Q5/T5555`
|
||||
|`lf io sim `|N |`simulate ioProx tag`
|
||||
|`lf io watch `|N |`continuously watch for cards. Reader mode`
|
||||
|
||||
|
||||
|
|
@ -1001,7 +1002,7 @@ Check column "offline" for their availability.
|
|||
|------- |------- |-----------
|
||||
|`wiegand help `|Y |`This help`
|
||||
|`wiegand list `|Y |`List available wiegand formats`
|
||||
|`wiegand encode `|Y |`Encode to wiegand raw hex`
|
||||
|`wiegand decode `|Y |`Convert raw hex to decoded wiegand format`
|
||||
|`wiegand encode `|Y |`Encode to wiegand raw hex (currently for HID Prox)`
|
||||
|`wiegand decode `|Y |`Convert raw hex to decoded wiegand format (currently for HID Prox)`
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -426,6 +426,12 @@ Note: it seems some cards only accept the "change UID" command.
|
|||
|
||||
It accepts direct read of block0 (and only block0) without prior auth.
|
||||
|
||||
Writing to block 0 has some side-effects:
|
||||
|
||||
* It changes also the UID. Changing the UID *does not* change block 0.
|
||||
* ATQA and SAK bytes are automatically replaced by fixed values.
|
||||
* On 4-byte UID cards, BCC byte is automatically corrected.
|
||||
|
||||
### Characteristics
|
||||
|
||||
* UID: 4b and 7b versions
|
||||
|
|
@ -452,6 +458,8 @@ Equivalent:
|
|||
```
|
||||
# change just UID:
|
||||
hf 14a raw -s -c -t 2000 90FBCCCC07 11223344556677
|
||||
# read block0:
|
||||
hf 14a raw -s -c 3000
|
||||
# write block0:
|
||||
hf 14a raw -s -c -t 2000 90F0CCCC10 041219c3219316984200e32000000000
|
||||
# lock (uid/block0?) forever:
|
||||
|
|
|
|||
|
|
@ -11,8 +11,29 @@
|
|||
#ifndef EM4X70_H__
|
||||
#define EM4X70_H__
|
||||
|
||||
#define EM4X70_NUM_BLOCKS 16
|
||||
|
||||
// Common word/block addresses
|
||||
#define EM4X70_PIN_WORD_LOWER 10
|
||||
#define EM4X70_PIN_WORD_UPPER 11
|
||||
|
||||
typedef struct {
|
||||
bool parity;
|
||||
|
||||
// Used for writing address
|
||||
uint8_t address;
|
||||
uint16_t word;
|
||||
|
||||
// PIN to unlock
|
||||
uint32_t pin;
|
||||
|
||||
// Used for authentication
|
||||
uint8_t rnd[7];
|
||||
uint8_t frnd[4];
|
||||
|
||||
// Used to write new key
|
||||
uint8_t crypt_key[12];
|
||||
|
||||
} em4x70_data_t;
|
||||
|
||||
#endif /* EM4X70_H__ */
|
||||
|
|
|
|||
|
|
@ -517,6 +517,11 @@ typedef struct {
|
|||
#define CMD_LF_EM4X50_ESET 0x0252
|
||||
#define CMD_LF_EM4X50_CHK 0x0253
|
||||
#define CMD_LF_EM4X70_INFO 0x0260
|
||||
#define CMD_LF_EM4X70_WRITE 0x0261
|
||||
#define CMD_LF_EM4X70_UNLOCK 0x0262
|
||||
#define CMD_LF_EM4X70_AUTH 0x0263
|
||||
#define CMD_LF_EM4X70_WRITEPIN 0x0264
|
||||
#define CMD_LF_EM4X70_WRITEKEY 0x0265
|
||||
// Sampling configuration for LF reader/sniffer
|
||||
#define CMD_LF_SAMPLING_SET_CONFIG 0x021D
|
||||
#define CMD_LF_FSK_SIMULATE 0x021E
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue