Semi-Automated SendCommand -> SendCommandOLD

This commit is contained in:
Philippe Teuwen 2019-04-19 17:03:39 +02:00
commit c4766b2649
41 changed files with 543 additions and 957 deletions

View file

@ -347,10 +347,8 @@ static int smart_responseEx(uint8_t *data, bool silent) {
int len = data[datalen - 1];
if (!silent) PrintAndLogEx(INFO, "Requesting 0x%02X bytes response", len);
uint8_t getstatus[] = {0x00, ISO7816_GET_RESPONSE, 0x00, 0x00, len};
PacketCommandOLD cStatus = {CMD_SMART_RAW, {SC_RAW, sizeof(getstatus), 0}, {{0}}};
memcpy(cStatus.d.asBytes, getstatus, sizeof(getstatus));
clearCommandBuffer();
SendCommand(&cStatus);
SendCommandOLD(CMD_SMART_RAW, SC_RAW, sizeof(getstatus), 0, getstatus, sizeof(getstatus));
datalen = smart_wait(data, silent);
@ -452,26 +450,22 @@ static int CmdSmartRaw(const char *Cmd) {
//Validations
if (errors || cmdp == 0) return usage_sm_raw();
// arg0 = RFU flags
// arg1 = length
PacketCommandOLD c = {CMD_SMART_RAW, {0, hexlen, 0}, {{0}}};
uint8_t flags = 0;
if (active || active_select) {
c.arg[0] |= SC_CONNECT;
flags |= SC_CONNECT;
if (active_select)
c.arg[0] |= SC_SELECT;
flags |= SC_SELECT;
}
if (hexlen > 0) {
if (useT0)
c.arg[0] |= SC_RAW_T0;
flags |= SC_RAW_T0;
else
c.arg[0] |= SC_RAW;
flags |= SC_RAW;
}
memcpy(c.d.asBytes, data, hexlen);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_RAW, flags, hexlen, 0, data, hexlen);
// reading response from smart card
if (reply) {
@ -489,9 +483,8 @@ static int CmdSmartRaw(const char *Cmd) {
if (buf[0] == 0x6C) {
data[4] = buf[1];
memcpy(c.d.asBytes, data, sizeof(data));
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_RAW, 0, hexlen, 0, data, hexlen);
len = smart_response(buf);
data[4] = 0;
@ -652,13 +645,8 @@ static int CmdSmartUpgrade(const char *Cmd) {
while (bytes_remaining > 0) {
uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
PacketCommandOLD c = {CMD_SMART_UPLOAD, {index + bytes_sent, bytes_in_packet, 0}, {{0}}};
// Fill usb bytes with 0xFF
memset(c.d.asBytes, 0xFF, USB_CMD_DATA_SIZE);
memcpy(c.d.asBytes, dump + bytes_sent, bytes_in_packet);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_UPLOAD, index + bytes_sent, bytes_in_packet, 0, dump + bytes_sent, bytes_in_packet);
if (!WaitForResponseTimeout(CMD_ACK, NULL, 2000)) {
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
free(dump);
@ -675,9 +663,8 @@ static int CmdSmartUpgrade(const char *Cmd) {
PrintAndLogEx(SUCCESS, "Sim module firmware updating, don\'t turn off your PM3!");
// trigger the firmware upgrade
PacketCommandOLD c = {CMD_SMART_UPGRADE, {firmware_size, 0, 0}, {{0}}};
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_UPGRADE, firmware_size, 0, 0, NULL, 0);
PacketResponseNG resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
@ -714,9 +701,8 @@ static int CmdSmartInfo(const char *Cmd) {
//Validations
if (errors) return usage_sm_info();
PacketCommandOLD c = {CMD_SMART_ATR, {0, 0, 0}, {{0}}};
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_ATR, 0, 0, 0, NULL, 0);
PacketResponseNG resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
@ -789,9 +775,8 @@ static int CmdSmartReader(const char *Cmd) {
//Validations
if (errors) return usage_sm_reader();
PacketCommandOLD c = {CMD_SMART_ATR, {0, 0, 0}, {{0}}};
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_ATR, 0, 0, 0, NULL, 0);
PacketResponseNG resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
@ -835,9 +820,8 @@ static int CmdSmartSetClock(const char *Cmd) {
//Validations
if (errors || cmdp == 0) return usage_sm_setclock();
PacketCommandOLD c = {CMD_SMART_SETCLOCK, {clock1, 0, 0}, {{0}}};
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_SETCLOCK, clock1, 0, 0, NULL, 0);
PacketResponseNG resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
PrintAndLogEx(WARNING, "smart card select failed");
@ -887,13 +871,10 @@ static void smart_brute_prim() {
PrintAndLogEx(INFO, "Reading primitives");
PacketCommandOLD c = {CMD_SMART_RAW, {SC_RAW_T0, 5, 0}, {{0}}};
for (int i = 0; i < sizeof(get_card_data); i += 5) {
memcpy(c.d.asBytes, get_card_data + i, 5);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_RAW, SC_RAW_T0, 5, 0, get_card_data + i, 5);
int len = smart_responseEx(buf, true);
@ -917,8 +898,6 @@ static int smart_brute_sfi(bool decodeTLV) {
int len;
// READ RECORD
uint8_t READ_RECORD[] = {0x00, 0xB2, 0x00, 0x00, 0x00};
PacketCommandOLD c = {CMD_SMART_RAW, {SC_RAW_T0, sizeof(READ_RECORD), 0}, {{0}}};
PrintAndLogEx(INFO, "Start SFI brute forcing");
for (uint8_t sfi = 1; sfi <= 31; sfi++) {
@ -939,18 +918,16 @@ static int smart_brute_sfi(bool decodeTLV) {
READ_RECORD[2] = rec;
READ_RECORD[3] = (sfi << 3) | 4;
memcpy(c.d.asBytes, READ_RECORD, sizeof(READ_RECORD));
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_RAW, SC_RAW_T0, sizeof(READ_RECORD), 0, READ_RECORD, sizeof(READ_RECORD));
len = smart_responseEx(buf, true);
if (buf[0] == 0x6C) {
READ_RECORD[4] = buf[1];
memcpy(c.d.asBytes, READ_RECORD, sizeof(READ_RECORD));
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_RAW, SC_RAW_T0, sizeof(READ_RECORD), 0, READ_RECORD, sizeof(READ_RECORD));
len = smart_responseEx(buf, true);
READ_RECORD[4] = 0;
@ -984,10 +961,8 @@ static void smart_brute_options(bool decodeTLV) {
uint8_t GET_PROCESSING_OPTIONS[] = {0x80, 0xA8, 0x00, 0x00, 0x02, 0x83, 0x00, 0x00};
// Get processing options command
PacketCommandOLD c = {CMD_SMART_RAW, {SC_RAW_T0, sizeof(GET_PROCESSING_OPTIONS), 0}, {{0}}};
memcpy(c.d.asBytes, GET_PROCESSING_OPTIONS, sizeof(GET_PROCESSING_OPTIONS));
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_RAW, SC_RAW_T0, sizeof(GET_PROCESSING_OPTIONS), 0, GET_PROCESSING_OPTIONS, sizeof(GET_PROCESSING_OPTIONS));
int len = smart_responseEx(buf, true);
if (len > 4) {
@ -1040,9 +1015,6 @@ static int CmdSmartBruteforceSFI(const char *Cmd) {
// uint8_t UNBLOCK_PIN[] = {0x84, 0x24, 0x00, 0x00, 0x00};
// uint8_t VERIFY[] = {0x00, 0x20, 0x00, 0x80};
// Select AID command
PacketCommandOLD cAid = {CMD_SMART_RAW, {SC_RAW_T0, 0, 0}, {{0}}};
PrintAndLogEx(INFO, "Importing AID list");
json_t *root = NULL;
smart_loadjson("aidlist", "json", &root);
@ -1092,14 +1064,13 @@ static int CmdSmartBruteforceSFI(const char *Cmd) {
snprintf(caid, 8 + 2 + aidlen + 1, SELECT, aidlen >> 1, aid);
int hexlen = 0;
int res = param_gethex_to_eol(caid, 0, cAid.d.asBytes, sizeof(cAid.d.asBytes), &hexlen);
uint8_t cmddata[USB_CMD_DATA_SIZE];
int res = param_gethex_to_eol(caid, 0, cmddata, sizeof(cmddata), &hexlen);
if (res)
continue;
cAid.arg[1] = hexlen;
clearCommandBuffer();
SendCommand(&cAid);
SendCommandOLD(CMD_SMART_RAW, SC_RAW_T0, hexlen, 0, cmddata, hexlen);
int len = smart_responseEx(buf, true);
if (len < 3)
@ -1177,13 +1148,12 @@ int ExchangeAPDUSC(uint8_t *datain, int datainlen, bool activateCard, bool leave
PrintAndLogEx(DEBUG, "APDU SC");
PacketCommandOLD c = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}, {{0}}};
uint8_t flags = SC_RAW_T0;
if (activateCard) {
c.arg[0] |= SC_SELECT | SC_CONNECT;
flags |= SC_SELECT | SC_CONNECT;
}
memcpy(c.d.asBytes, datain, datainlen);
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_RAW, flags, datainlen, 0, datain, datainlen);
int len = smart_responseEx(dataout, true);
@ -1193,14 +1163,15 @@ int ExchangeAPDUSC(uint8_t *datain, int datainlen, bool activateCard, bool leave
// retry
if (len > 1 && dataout[len - 2] == 0x6c && datainlen > 4) {
PacketCommandOLD c2 = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}, {{0}}};
memcpy(c2.d.asBytes, datain, 5);
uint8_t data [5];
memcpy(data, datain, 5);
// transfer length via T=0
c2.d.asBytes[4] = dataout[len - 1];
data[4] = dataout[len - 1];
clearCommandBuffer();
SendCommand(&c2);
// something fishy: we have only 5 bytes but we put datainlen in arg1?
SendCommandOLD(CMD_SMART_RAW, SC_RAW_T0, datainlen, 0, data, sizeof(data));
len = smart_responseEx(dataout, true);
}
@ -1213,9 +1184,8 @@ bool smart_select(bool silent, smart_card_atr_t *atr) {
if (atr)
memset(atr, 0, sizeof(smart_card_atr_t));
PacketCommandOLD c = {CMD_SMART_ATR, {0, 0, 0}, {{0}}};
clearCommandBuffer();
SendCommand(&c);
SendCommandOLD(CMD_SMART_ATR, 0, 0, 0, NULL, 0);
PacketResponseNG resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
if (!silent) PrintAndLogEx(WARNING, "smart card select failed");