diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c index 431508777..2f3bcf30b 100644 --- a/client/src/cmdhfmfdes.c +++ b/client/src/cmdhfmfdes.c @@ -1060,10 +1060,10 @@ static int handler_desfire_freemem(uint32_t *free_mem) { // AID == 000000 6bits LSB needs to be 0 key_no &= 0x0F; - + Desfire treats Des keys as TDes but with the first half = 2nd half As such, we should be able to convert the Des to TDes then run the code as TDes - + if (new_algo == MFDES_ALGO_DES) { memcpy(&new_key[8], new_key, 8); new_algo = MFDES_ALGO_3DES; @@ -4906,7 +4906,7 @@ static int CmdHF14ADesChangeKey(const char *Cmd) { arg_str0(NULL, "aid", "", "Application ID of application (3 hex bytes, big endian)"), arg_str0(NULL, "oldalgo", "", "Old key crypto algorithm: DES, 2TDEA, 3TDEA, AES"), arg_str0(NULL, "oldkey", "", "Old key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)"), - arg_int0(NULL, "newkeyno","", "Key number for change"), + arg_int0(NULL, "newkeyno", "", "Key number for change"), arg_str0(NULL, "newalgo", "", "New key crypto algorithm: DES, 2TDEA, 3TDEA, AES"), arg_str0(NULL, "newkey", "", "New key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes)"), arg_str0(NULL, "newver", "", "New key's version (1 hex byte)"), @@ -4929,7 +4929,7 @@ static int CmdHF14ADesChangeKey(const char *Cmd) { int oldkeytype = T_DES; if (CLIGetOptionList(arg_get_str(ctx, 12), DesfireAlgoOpts, &oldkeytype)) return PM3_ESOFT; - + uint8_t oldkey[DESFIRE_MAX_KEY_SIZE] = {0}; uint8_t keydata[200] = {0}; int oldkeylen = sizeof(keydata); @@ -4940,7 +4940,7 @@ static int CmdHF14ADesChangeKey(const char *Cmd) { } if (oldkeylen) memcpy(oldkey, keydata, oldkeylen); - + uint8_t newkeynum = arg_get_int_def(ctx, 14, 0); int newkeytype = T_DES; @@ -4968,7 +4968,7 @@ static int CmdHF14ADesChangeKey(const char *Cmd) { SetAPDULogging(APDULogging); CLIParserFree(ctx); - + // if we change the same key if (oldkeylen == 0 && newkeynum == dctx.keyNum) { oldkeytype = dctx.keyType; @@ -4979,7 +4979,7 @@ static int CmdHF14ADesChangeKey(const char *Cmd) { PrintAndLogEx(WARNING, "Changing the root aid (0x000000)"); return PM3_ESOFT; // TODO!!!! } - + if (appid) PrintAndLogEx(INFO, _CYAN_("Changing key in the application: ") _YELLOW_("%06x"), appid); else @@ -4990,7 +4990,7 @@ static int CmdHF14ADesChangeKey(const char *Cmd) { PrintAndLogEx(INFO, "new key: %s [%d] %s", CLIGetOptionListStr(DesfireAlgoOpts, newkeytype), desfire_get_key_length(newkeytype), sprint_hex(newkey, desfire_get_key_length(newkeytype))); if (newkeyver < 0x100 || newkeytype == T_AES) PrintAndLogEx(INFO, "new key version: 0x%02x", newkeyver & 0x00); - + res = DesfireSelectAndAuthenticate(&dctx, securechann, appid, verbose); if (res != PM3_SUCCESS) { DropField(); @@ -5023,99 +5023,99 @@ static int CmdHF14ADesChangeKey(const char *Cmd) { -/* CLIParserContext *ctx; - CLIParserInit(&ctx, "hf mfdes changekey", - "Change MIFARE DESFire Key.\n" - "Make sure to select aid or authenticate aid before running this command.", - "hf mfdes changekey -n 0 -t 1 -k 0000000000000000 -u 1 -j 0102030405060708 -> DES, keynumber 0" - ); + /* CLIParserContext *ctx; + CLIParserInit(&ctx, "hf mfdes changekey", + "Change MIFARE DESFire Key.\n" + "Make sure to select aid or authenticate aid before running this command.", + "hf mfdes changekey -n 0 -t 1 -k 0000000000000000 -u 1 -j 0102030405060708 -> DES, keynumber 0" + ); - void *argtable[] = { - arg_param_begin, - arg_int0("n", "keyno", "", "Key number used for authentification"), - arg_int0("t", "algo", "", "Current key algo (1 = DES, 2 = 3DES(2K2DES), 3 = 3K3DES, 4 = AES)"), - arg_str0("k", "key", "", "Current Key (HEX 8-24 bytes)"), - arg_int0("u", "newalgo", "", "New key algo (1 = DES, 2 = 3DES(2K2DES), 3 = 3K3DES, 4 = AES)"), - arg_str0("j", "newkey", "", "New Key (HEX 8-24 bytes)"), - arg_int0("v", "aesver", "", "AES version (if AES is used)"), - arg_param_end - }; - CLIExecWithReturn(ctx, Cmd, argtable, false); + void *argtable[] = { + arg_param_begin, + arg_int0("n", "keyno", "", "Key number used for authentification"), + arg_int0("t", "algo", "", "Current key algo (1 = DES, 2 = 3DES(2K2DES), 3 = 3K3DES, 4 = AES)"), + arg_str0("k", "key", "", "Current Key (HEX 8-24 bytes)"), + arg_int0("u", "newalgo", "", "New key algo (1 = DES, 2 = 3DES(2K2DES), 3 = 3K3DES, 4 = AES)"), + arg_str0("j", "newkey", "", "New Key (HEX 8-24 bytes)"), + arg_int0("v", "aesver", "", "AES version (if AES is used)"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, false); - uint8_t cmdKeyNo = arg_get_int_def(ctx, 1, 0); - uint8_t cmdAuthAlgo = arg_get_int_def(ctx, 2, 0); - uint8_t key[24] = {0}; - int keylen = 0; - int res_klen = CLIParamHexToBuf(arg_get_str(ctx, 3), key, 24, &keylen); + uint8_t cmdKeyNo = arg_get_int_def(ctx, 1, 0); + uint8_t cmdAuthAlgo = arg_get_int_def(ctx, 2, 0); + uint8_t key[24] = {0}; + int keylen = 0; + int res_klen = CLIParamHexToBuf(arg_get_str(ctx, 3), key, 24, &keylen); - uint8_t newcmdAuthAlgo = arg_get_int_def(ctx, 4, 0); - uint8_t newkey[24] = {0}; - int newkeylen = 0; - int res_newklen = CLIParamHexToBuf(arg_get_str(ctx, 5), newkey, 24, &newkeylen); + uint8_t newcmdAuthAlgo = arg_get_int_def(ctx, 4, 0); + uint8_t newkey[24] = {0}; + int newkeylen = 0; + int res_newklen = CLIParamHexToBuf(arg_get_str(ctx, 5), newkey, 24, &newkeylen); - uint8_t aesversion = arg_get_int_def(ctx, 6, 0); - CLIParserFree(ctx); + uint8_t aesversion = arg_get_int_def(ctx, 6, 0); + CLIParserFree(ctx); - //DropFieldDesfire(); - // NR DESC KEYLENGHT - // ------------------------ - // 1 = DES 8 - // 2 = 3DES 16 - // 3 = 3K 3DES 24 - // 4 = AES 16 - uint8_t keylength = 8; - if (cmdAuthAlgo == MFDES_ALGO_AES) { - keylength = 16; - } else if (cmdAuthAlgo == MFDES_ALGO_3DES) { - keylength = 16; - } else if (cmdAuthAlgo == MFDES_ALGO_DES) { - keylength = 8; - } else if (cmdAuthAlgo == MFDES_ALGO_3K3DES) { - keylength = 24; - } + //DropFieldDesfire(); + // NR DESC KEYLENGHT + // ------------------------ + // 1 = DES 8 + // 2 = 3DES 16 + // 3 = 3K 3DES 24 + // 4 = AES 16 + uint8_t keylength = 8; + if (cmdAuthAlgo == MFDES_ALGO_AES) { + keylength = 16; + } else if (cmdAuthAlgo == MFDES_ALGO_3DES) { + keylength = 16; + } else if (cmdAuthAlgo == MFDES_ALGO_DES) { + keylength = 8; + } else if (cmdAuthAlgo == MFDES_ALGO_3K3DES) { + keylength = 24; + } - uint8_t newkeylength = 8; - if (newcmdAuthAlgo == MFDES_ALGO_AES) { - newkeylength = 16; - } else if (newcmdAuthAlgo == MFDES_ALGO_3DES) { - newkeylength = 16; - } else if (newcmdAuthAlgo == MFDES_ALGO_DES) { - newkeylength = 8; - } else if (newcmdAuthAlgo == MFDES_ALGO_3K3DES) { - newkeylength = 24; - } + uint8_t newkeylength = 8; + if (newcmdAuthAlgo == MFDES_ALGO_AES) { + newkeylength = 16; + } else if (newcmdAuthAlgo == MFDES_ALGO_3DES) { + newkeylength = 16; + } else if (newcmdAuthAlgo == MFDES_ALGO_DES) { + newkeylength = 8; + } else if (newcmdAuthAlgo == MFDES_ALGO_3K3DES) { + newkeylength = 24; + } - if (res_klen || (keylen < 8) || (keylen > 24)) { - PrintAndLogEx(ERR, "Specified key must have %d bytes length", keylen); - return PM3_EINVARG; - } + if (res_klen || (keylen < 8) || (keylen > 24)) { + PrintAndLogEx(ERR, "Specified key must have %d bytes length", keylen); + return PM3_EINVARG; + } - if (res_newklen || (newkeylen < 8) || (newkeylen > 24)) { - PrintAndLogEx(ERR, "Specified new key must have %d bytes length", newkeylen); - return PM3_EINVARG; - } + if (res_newklen || (newkeylen < 8) || (newkeylen > 24)) { + PrintAndLogEx(ERR, "Specified new key must have %d bytes length", newkeylen); + return PM3_EINVARG; + } - if (keylen != keylength) { - PrintAndLogEx(WARNING, "Key must include %d hex symbols, got %d", keylength, keylen); - return PM3_EINVARG; - } + if (keylen != keylength) { + PrintAndLogEx(WARNING, "Key must include %d hex symbols, got %d", keylength, keylen); + return PM3_EINVARG; + } - if (newkeylen != newkeylength) { - PrintAndLogEx(WARNING, "New key must include %d hex symbols, got %d", keylength, newkeylen); - return PM3_EINVARG; - } + if (newkeylen != newkeylength) { + PrintAndLogEx(WARNING, "New key must include %d hex symbols, got %d", keylength, newkeylen); + return PM3_EINVARG; + } - PrintAndLogEx(INFO, "changing key number " _YELLOW_("0x%02x"), cmdKeyNo); - PrintAndLogEx(INFO, "old key: %s ( %s )", sprint_hex_inrow(key, keylen), getEncryptionAlgoStr(cmdAuthAlgo)); - PrintAndLogEx(INFO, "new key: %s ( %s )", sprint_hex_inrow(newkey, newkeylen), getEncryptionAlgoStr(newcmdAuthAlgo)); + PrintAndLogEx(INFO, "changing key number " _YELLOW_("0x%02x"), cmdKeyNo); + PrintAndLogEx(INFO, "old key: %s ( %s )", sprint_hex_inrow(key, keylen), getEncryptionAlgoStr(cmdAuthAlgo)); + PrintAndLogEx(INFO, "new key: %s ( %s )", sprint_hex_inrow(newkey, newkeylen), getEncryptionAlgoStr(newcmdAuthAlgo)); - int res = mifare_desfire_change_key(cmdKeyNo, newkey, newcmdAuthAlgo, key, cmdAuthAlgo, aesversion); - if (res == PM3_SUCCESS) { - PrintAndLogEx(SUCCESS, "Change key ( " _GREEN_("ok") " )"); - } else { - PrintAndLogEx(FAILED, "Change key ( " _RED_("fail") " )"); - } - return res;*/ + int res = mifare_desfire_change_key(cmdKeyNo, newkey, newcmdAuthAlgo, key, cmdAuthAlgo, aesversion); + if (res == PM3_SUCCESS) { + PrintAndLogEx(SUCCESS, "Change key ( " _GREEN_("ok") " )"); + } else { + PrintAndLogEx(FAILED, "Change key ( " _RED_("fail") " )"); + } + return res;*/ } static int CmdHF14ADesCreateApp(const char *Cmd) { diff --git a/client/src/mifare/desfirecore.c b/client/src/mifare/desfirecore.c index 2554e9288..0045ca1b0 100644 --- a/client/src/mifare/desfirecore.c +++ b/client/src/mifare/desfirecore.c @@ -1080,7 +1080,7 @@ void PrintKeySettings(uint8_t keysettings, uint8_t numkeys, bool applevel, bool } int DesfireChangeKey(DesfireContext *dctx, uint8_t newkeynum, DesfireCryptoAlgorythm newkeytype, uint32_t newkeyver, uint8_t *newkey, DesfireCryptoAlgorythm oldkeytype, uint8_t *oldkey, bool verbose) { - + uint8_t okeybuf[DESFIRE_MAX_KEY_SIZE] = {0}; uint8_t nkeybuf[DESFIRE_MAX_KEY_SIZE] = {0}; uint8_t pckcdata[DESFIRE_MAX_KEY_SIZE + 10] = {0}; @@ -1089,22 +1089,22 @@ int DesfireChangeKey(DesfireContext *dctx, uint8_t newkeynum, DesfireCryptoAlgor keynodata |= (DesfireKeyAlgoToType(newkeytype) & 0x03) << 6; pckcdata[0] = MFDES_CHANGE_KEY; // TODO pckcdata[1] = keynodata; - + // DES -> 2TDEA memcpy(okeybuf, oldkey, desfire_get_key_length(oldkeytype)); if (oldkeytype == T_DES) { memcpy(&okeybuf[8], oldkey, 8); - } + } memcpy(nkeybuf, newkey, desfire_get_key_length(newkeytype)); size_t nkeylen = desfire_get_key_length(newkeytype); if (newkeytype == T_DES) { memcpy(&nkeybuf[8], newkey, 8); nkeylen = desfire_get_key_length(T_3DES); - } + } -PrintAndLogEx(SUCCESS, "--oldk [%d]: %s", desfire_get_key_length(oldkeytype), sprint_hex(okeybuf, desfire_get_key_length(oldkeytype))); -PrintAndLogEx(SUCCESS, "--newk [%d]: %s", nkeylen, sprint_hex(nkeybuf, nkeylen)); + PrintAndLogEx(SUCCESS, "--oldk [%d]: %s", desfire_get_key_length(oldkeytype), sprint_hex(okeybuf, desfire_get_key_length(oldkeytype))); + PrintAndLogEx(SUCCESS, "--newk [%d]: %s", nkeylen, sprint_hex(nkeybuf, nkeylen)); // set key version for DES. if newkeyver > 0xff - setting key version is disabled if (newkeytype != T_AES && newkeyver < 0x100) { @@ -1112,9 +1112,9 @@ PrintAndLogEx(SUCCESS, "--newk [%d]: %s", nkeylen, sprint_hex(nkeybuf, nkeylen)) if (verbose) PrintAndLogEx(INFO, "changed new key: %s [%d] %s", CLIGetOptionListStr(DesfireAlgoOpts, newkeytype), desfire_get_key_length(newkeytype), sprint_hex(newkey, desfire_get_key_length(newkeytype))); } - -PrintAndLogEx(SUCCESS, "--newk [%d]: %s", nkeylen, sprint_hex(nkeybuf, nkeylen)); - + + PrintAndLogEx(SUCCESS, "--newk [%d]: %s", nkeylen, sprint_hex(nkeybuf, nkeylen)); + // xor if we change current auth key if (newkeynum == dctx->keyNum) { memcpy(cdata, nkeybuf, nkeylen); @@ -1122,16 +1122,16 @@ PrintAndLogEx(SUCCESS, "--newk [%d]: %s", nkeylen, sprint_hex(nkeybuf, nkeylen)) memcpy(cdata, nkeybuf, nkeylen); bin_xor(cdata, okeybuf, nkeylen); } - + // add key version for AES size_t cdatalen = nkeylen; -PrintAndLogEx(SUCCESS, "--cdata [%d]: %s kv = 0x%02x", cdatalen, sprint_hex(cdata, cdatalen), newkeyver); + PrintAndLogEx(SUCCESS, "--cdata [%d]: %s kv = 0x%02x", cdatalen, sprint_hex(cdata, cdatalen), newkeyver); if (newkeytype == T_AES) { cdata[cdatalen] = newkeyver; cdatalen++; } -PrintAndLogEx(SUCCESS, "--cdata [%d]: %s", cdatalen, sprint_hex(cdata, cdatalen)); - + PrintAndLogEx(SUCCESS, "--cdata [%d]: %s", cdatalen, sprint_hex(cdata, cdatalen)); + // add crc||crc_new_key if (dctx->secureChannel == DACd40) { iso14443a_crc_append(cdata, cdatalen); @@ -1149,23 +1149,23 @@ PrintAndLogEx(SUCCESS, "--cdata [%d]: %s", cdatalen, sprint_hex(cdata, cdatalen) cdatalen += 4; } } -PrintAndLogEx(SUCCESS, "--cdata [%d]: %s", cdatalen, sprint_hex(cdata, cdatalen)); - + PrintAndLogEx(SUCCESS, "--cdata [%d]: %s", cdatalen, sprint_hex(cdata, cdatalen)); + // get padded data length size_t rlen = padded_data_length(cdatalen, desfire_get_key_block_length(newkeytype)); - + // send command uint8_t resp[257] = {0}; size_t resplen = 0; -PrintAndLogEx(SUCCESS, "--pckdata [%d]: %s", rlen + 1, sprint_hex(&pckcdata[1], rlen + 1)); + PrintAndLogEx(SUCCESS, "--pckdata [%d]: %s", rlen + 1, sprint_hex(&pckcdata[1], rlen + 1)); int res = DesfireChangeKeyCmd(dctx, &pckcdata[1], rlen + 1, resp, &resplen); - + // check response - + // clear auth if (newkeynum == dctx->keyNum) DesfireClearSession(dctx); - + return res; } diff --git a/client/src/mifare/desfiresecurechan.c b/client/src/mifare/desfiresecurechan.c index c5b90c29d..c5407f627 100644 --- a/client/src/mifare/desfiresecurechan.c +++ b/client/src/mifare/desfiresecurechan.c @@ -74,10 +74,10 @@ AllowedChannelModesS AllowedChannelModes[] = { static uint8_t DesfireGetCmdHeaderLen(uint8_t cmd) { if (cmd == MFDES_CHANGE_KEY || cmd == MFDES_CHANGE_CONFIGURATION) return 1; - + if (cmd == MFDES_CHANGE_KEY_EV2) return 2; - + return 0; } @@ -165,15 +165,15 @@ static void DesfireSecureChannelEncodeEV1(DesfireContext *ctx, uint8_t cmd, uint if (srcdatalen == 0 || srcdatalen <= hdrlen) return; -PrintAndLogEx(SUCCESS, "--ch hdrlen: %d, cmd: %02x", hdrlen, cmd); + PrintAndLogEx(SUCCESS, "--ch hdrlen: %d, cmd: %02x", hdrlen, cmd); //dstdata[0] = cmd; memcpy(&dstdata[0], srcdata, hdrlen); memcpy(data, &srcdata[hdrlen], srcdatalen); rlen = padded_data_length(srcdatalen - hdrlen, desfire_get_key_block_length(ctx->keyType)); -PrintAndLogEx(SUCCESS, "--ch src rlen: %d data: %s", rlen, sprint_hex(data, rlen)); + PrintAndLogEx(SUCCESS, "--ch src rlen: %d data: %s", rlen, sprint_hex(data, rlen)); DesfireCryptoEncDec(ctx, true, data, rlen, &dstdata[hdrlen], true); *dstdatalen = hdrlen + rlen; -PrintAndLogEx(SUCCESS, "--ch dst len: %d data: %s", *dstdatalen, sprint_hex(dstdata, *dstdatalen)); + PrintAndLogEx(SUCCESS, "--ch dst len: %d data: %s", *dstdatalen, sprint_hex(dstdata, *dstdatalen)); } }