Semi-Automated SendCommand -> SendCommandOLD

This commit is contained in:
Philippe Teuwen 2019-04-19 17:03:39 +02:00
commit c4766b2649
41 changed files with 543 additions and 957 deletions

View file

@ -281,8 +281,7 @@ static int CmdHFiClassList(const char *Cmd) {
static int CmdHFiClassSniff(const char *Cmd) {
char cmdp = tolower(param_getchar(Cmd, 0));
if (cmdp == 'h') return usage_hf_iclass_sniff();
PacketCommandOLD c = {CMD_SNIFF_ICLASS, {0, 0, 0}, {{0}}};
SendCommand(&c);
SendCommandOLD(CMD_SNIFF_ICLASS, 0, 0, 0, NULL, 0);
return 0;
}
@ -380,11 +379,9 @@ static int CmdHFiClassSim(const char *Cmd) {
case 2: {
PrintAndLogEx(INFO, "Starting iCLASS sim 2 attack (elite mode)");
PrintAndLogEx(INFO, "press keyboard to cancel");
PacketCommandOLD c = {CMD_SIMULATE_TAG_ICLASS, {simType, NUM_CSNS}, {{0}}};
PacketResponseNG resp;
memcpy(c.d.asBytes, csns, 8 * NUM_CSNS);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SIMULATE_TAG_ICLASS, simType, NUM_CSNS, 0, csns, 8 * NUM_CSNS);
while (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
tries++;
@ -433,11 +430,9 @@ static int CmdHFiClassSim(const char *Cmd) {
// reader in key roll mode, when it has two keys it alternates when trying to verify.
PrintAndLogEx(INFO, "Starting iCLASS sim 4 attack (elite mode, reader in key roll mode)");
PrintAndLogEx(INFO, "press keyboard to cancel");
PacketCommandOLD c = {CMD_SIMULATE_TAG_ICLASS, {simType, NUM_CSNS}, {{0}}};
PacketResponseNG resp;
memcpy(c.d.asBytes, csns, 8 * NUM_CSNS);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SIMULATE_TAG_ICLASS, simType, NUM_CSNS, 0, csns, 8 * NUM_CSNS);
while (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
tries++;
@ -501,10 +496,8 @@ static int CmdHFiClassSim(const char *Cmd) {
case 1:
case 3:
default: {
PacketCommandOLD c = {CMD_SIMULATE_TAG_ICLASS, {simType, numberOfCSNs}, {{0}}};
memcpy(c.d.asBytes, CSN, 8);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SIMULATE_TAG_ICLASS, simType, numberOfCSNs, 0, CSN, 8);
break;
}
}
@ -531,19 +524,15 @@ static int CmdHFiClassReader_Replay(const char *Cmd) {
return 1;
}
PacketCommandOLD c = {CMD_READER_ICLASS_REPLAY, {readerType}, {{0}}};
memcpy(c.d.asBytes, MAC, 4);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_READER_ICLASS_REPLAY, readerType, 0, 0, MAC, 4);
return 0;
}
/*
static int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
PacketCommandOLD c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}, {{0}}};
memcpy(c.d.asBytes, data, blocksCount * 16);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_MIFARE_EML_MEMSET, blockNum, blocksCount, 0, data, blocksCount * 16);
return 0;
}
*/
@ -603,10 +592,8 @@ static int CmdHFiClassELoad(const char *Cmd) {
while (bytes_remaining > 0) {
uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
PacketCommandOLD c = {CMD_ICLASS_EML_MEMSET, {bytes_sent, bytes_in_packet, 0}, {{0}}};
memcpy(c.d.asBytes, dump + bytes_sent, bytes_in_packet);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_ICLASS_EML_MEMSET, bytes_sent, bytes_in_packet, 0, dump + bytes_sent, bytes_in_packet);
bytes_remaining -= bytes_in_packet;
bytes_sent += bytes_in_packet;
}
@ -768,14 +755,13 @@ static void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_
static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
PacketResponseNG resp;
PacketCommandOLD c = {CMD_READER_ICLASS, {0}, {{0}}};
c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
uint8_t flags = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
if (use_credit_key)
c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
flags |= FLAG_ICLASS_READER_CEDITKEY;
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_READER_ICLASS, flags, 0, 0, NULL, 0);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4000)) {
PrintAndLogEx(WARNING, "command execute timeout");
return false;
@ -819,10 +805,8 @@ static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool u
doMAC(CCNR, div_key, MAC);
PacketResponseNG resp;
PacketCommandOLD d = {CMD_ICLASS_AUTHENTICATION, {0, 0, 0}, {{0}}};
memcpy(d.d.asBytes, MAC, 4);
clearCommandBuffer();
SendCommand(&d);
SendCommandOLD(CMD_ICLASS_AUTHENTICATION, 0, 0, 0, MAC, 4);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4000)) {
if (verbose) PrintAndLogEx(FAILED, "auth command execute timeout");
return false;
@ -939,12 +923,11 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
FLAG_ICLASS_READER_ONE_TRY;
//get config and first 3 blocks
PacketCommandOLD c = {CMD_READER_ICLASS, {flags, 0, 0}, {{0}}};
PacketResponseNG resp;
uint8_t tag_data[255 * 8];
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_READER_ICLASS, flags, 0, 0, NULL, 0);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLogEx(WARNING, "command execute timeout");
DropField();
@ -981,9 +964,8 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
}
// begin dump
PacketCommandOLD w = {CMD_ICLASS_DUMP, {blockno, numblks - blockno + 1}, {{0}}};
clearCommandBuffer();
SendCommand(&w);
SendCommandOLD(CMD_ICLASS_DUMP, blockno, numblks - blockno + 1, 0, NULL, 0);
while (true) {
printf(".");
fflush(stdout);
@ -1038,10 +1020,8 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
// do we still need to read more block? (aa2 enabled?)
if (maxBlk > blockno + numblks + 1) {
// setup dump and start
w.arg[0] = blockno + blocksRead;
w.arg[1] = maxBlk - (blockno + blocksRead);
clearCommandBuffer();
SendCommand(&w);
SendCommandOLD(CMD_ICLASS_DUMP, blockno + blocksRead, maxBlk - (blockno + blocksRead), 0, NULL, 0);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLogEx(WARNING, "command execute timeout 2");
return 0;
@ -1100,12 +1080,12 @@ static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_c
PacketResponseNG resp;
Calc_wb_mac(blockno, bldata, div_key, MAC);
PacketCommandOLD w = {CMD_ICLASS_WRITEBLOCK, {blockno}, {{0}}};
memcpy(w.d.asBytes, bldata, 8);
memcpy(w.d.asBytes + 8, MAC, 4);
uint8_t data[12];
memcpy(data, bldata, 8);
memcpy(data + 8, MAC, 4);
clearCommandBuffer();
SendCommand(&w);
SendCommandOLD(CMD_ICLASS_WRITEBLOCK, blockno, 0, 0, data, sizeof(data));
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
if (verbose) PrintAndLogEx(WARNING, "Write Command execute timeout");
return 0;
@ -1321,8 +1301,8 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
return 0;
}
PacketCommandOLD w = {CMD_ICLASS_CLONE, {startblock, endblock}, {{0}}};
uint8_t *ptr;
uint8_t data[(endblock - startblock) * 12];
// calculate all mac for every the block we will write
for (i = startblock; i <= endblock; i++) {
Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC);
@ -1330,13 +1310,13 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
// memcpy(pointer,tag_data[i - 6],8) 8 bytes
// memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
// next one
ptr = w.d.asBytes + (i - startblock) * 12;
ptr = data + (i - startblock) * 12;
memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
memcpy(ptr + 8, MAC, 4);
}
uint8_t p[12];
for (i = 0; i <= endblock - startblock; i++) {
memcpy(p, w.d.asBytes + (i * 12), 12);
memcpy(p, data + (i * 12), 12);
PrintAndLogEx(NORMAL, "Block |%02x|", i + startblock);
PrintAndLogEx(NORMAL, " %02x%02x%02x%02x%02x%02x%02x%02x |", p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
PrintAndLogEx(NORMAL, " MAC |%02x%02x%02x%02x|\n", p[8], p[9], p[10], p[11]);
@ -1344,7 +1324,7 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
PacketResponseNG resp;
clearCommandBuffer();
SendCommand(&w);
SendCommandOLD(CMD_ICLASS_CLONE, startblock, endblock, 0, data, (endblock - startblock) * 12);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLogEx(WARNING, "command execute timeout");
return 0;
@ -1368,9 +1348,8 @@ static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite,
}
PacketResponseNG resp;
PacketCommandOLD c = {CMD_ICLASS_READBLOCK, {blockno}, {{0}}};
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_ICLASS_READBLOCK, blockno, 0, 0, NULL, 0);
if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
PrintAndLogEx(WARNING, "Command execute timeout");
return 0;
@ -1977,16 +1956,14 @@ static int CmdHFiClassCheckKeys(const char *Cmd) {
if (keys == keycnt - i)
lastChunk = true;
PacketCommandOLD c = {CMD_ICLASS_CHECK_KEYS, { (lastChunk << 8), keys, 0}, {{0}}};
uint32_t flags = lastChunk << 8;
// bit 16
// - 1 indicates credit key
// - 0 indicates debit key (default)
c.arg[0] |= (use_credit_key << 16);
flags |= (use_credit_key << 16);
memcpy(c.d.asBytes, pre + i, 4 * keys);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_ICLASS_CHECK_KEYS, flags, keys, 0, pre + i, 4 * keys);
PacketResponseNG resp;
while (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
@ -2464,13 +2441,12 @@ int readIclass(bool loop, bool verbose) {
FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE |
FLAG_ICLASS_READER_ONE_TRY;
PacketCommandOLD c = {CMD_READER_ICLASS, {flags, 0, 0}, {{0}}};
// loop in client not device - else on windows have a communication error
PacketResponseNG resp;
while (!ukbhit()) {
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_READER_ICLASS, flags, 0, 0, NULL, 0);
if (WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
uint8_t readStatus = resp.oldarg[0] & 0xff;
uint8_t *data = resp.data.asBytes;