diff --git a/armsrc/epa.c b/armsrc/epa.c index f535b89a3..3a44502ba 100644 --- a/armsrc/epa.c +++ b/armsrc/epa.c @@ -263,7 +263,7 @@ static void EPA_PACE_Collect_Nonce_Abort(uint8_t step, int func_return) { EPA_Finish(); // send the USB packet - reply_old(CMD_ACK, step, func_return, 0, 0, 0); + reply_mix(CMD_ACK, step, func_return, 0, 0, 0); } //----------------------------------------------------------------------------- @@ -280,12 +280,8 @@ void EPA_PACE_Collect_Nonce(PacketCommandNG *c) { * d: * Encrypted nonce */ - - // return value of a function - int func_return = 0; - // set up communication - func_return = EPA_Setup(); + int func_return = EPA_Setup(); if (func_return != 0) { EPA_PACE_Collect_Nonce_Abort(1, func_return); return; @@ -335,7 +331,7 @@ void EPA_PACE_Collect_Nonce(PacketCommandNG *c) { EPA_Finish(); // save received information - reply_old(CMD_ACK, 0, func_return, 0, nonce, func_return); + reply_mix(CMD_ACK, 0, func_return, 0, nonce, func_return); } //----------------------------------------------------------------------------- @@ -447,7 +443,7 @@ void EPA_PACE_Replay(PacketCommandNG *c) { if (c->oldarg[0] != 0) { // make sure it's not too big if (c->oldarg[2] > apdus_replay[c->oldarg[0] - 1].len) { - reply_old(CMD_ACK, 1, 0, 0, NULL, 0); + reply_mix(CMD_ACK, 1, 0, 0, NULL, 0); } memcpy(apdus_replay[c->oldarg[0] - 1].data + c->oldarg[1], c->data.asBytes, @@ -458,7 +454,7 @@ void EPA_PACE_Replay(PacketCommandNG *c) { } else { apdu_lengths_replay[c->oldarg[0] - 1] += c->oldarg[2]; } - reply_old(CMD_ACK, 0, 0, 0, NULL, 0); + reply_mix(CMD_ACK, 0, 0, 0, NULL, 0); return; } @@ -469,7 +465,7 @@ void EPA_PACE_Replay(PacketCommandNG *c) { func_return = EPA_Setup(); if (func_return != 0) { EPA_Finish(); - reply_old(CMD_ACK, 2, func_return, 0, NULL, 0); + reply_mix(CMD_ACK, 2, func_return, 0, NULL, 0); return; } @@ -492,12 +488,12 @@ void EPA_PACE_Replay(PacketCommandNG *c) { || response_apdu[func_return - 4] != 0x90 || response_apdu[func_return - 3] != 0x00)) { EPA_Finish(); - reply_old(CMD_ACK, 3 + i, func_return, 0, timings, 20); + reply_mix(CMD_ACK, 3 + i, func_return, 0, timings, 20); return; } } EPA_Finish(); - reply_old(CMD_ACK, 0, 0, 0, timings, 20); + reply_mix(CMD_ACK, 0, 0, 0, timings, 20); return; } @@ -506,14 +502,13 @@ void EPA_PACE_Replay(PacketCommandNG *c) { // Returns 0 on success or a non-zero error code on failure //----------------------------------------------------------------------------- int EPA_Setup() { - uint8_t uid[10]; - iso14a_card_select_t card_a_info; // first, look for type A cards // power up the field iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD); - // select the card - int return_code = iso14443a_select_card(uid, &card_a_info, NULL, true, 0, false); + iso14a_card_select_t card_a_info; + int return_code = iso14443a_select_card(NULL, &card_a_info, NULL, true, 0, false); + if (return_code == 1) { uint8_t pps_response[3]; uint8_t pps_response_par[1]; @@ -528,12 +523,14 @@ int EPA_Setup() { return 0; } + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + // if we're here, there is no type A card, so we look for type B // power up the field iso14443b_setup(); iso14b_card_select_t card_b_info; - // select the card return_code = iso14443b_select_card(&card_b_info); + if (return_code == 0) { Dbprintf("ISO 14443 Type B"); iso_type = 'b'; diff --git a/armsrc/felica.c b/armsrc/felica.c index b1e0253a2..2cb23b48c 100644 --- a/armsrc/felica.c +++ b/armsrc/felica.c @@ -621,7 +621,7 @@ void felica_sniff(uint32_t samplesToSkip, uint32_t triggersToSkip) { set_tracelen(BigBuf_max_traceLen()); Dbprintf("Felica sniffing done, tracelen: %i, use hf list felica for annotations", BigBuf_get_traceLen()); - reply_old(CMD_ACK, 1, numbts, 0, 0, 0); + reply_mix(CMD_ACK, 1, numbts, 0, 0, 0); LED_D_OFF(); } @@ -812,5 +812,5 @@ void felica_dump_lite_s() { //setting tracelen - important! it was set by buffer overflow before set_tracelen(cnt); - reply_old(CMD_ACK, isOK, cnt, 0, 0, 0); + reply_mix(CMD_ACK, isOK, cnt, 0, 0, 0); } diff --git a/armsrc/hitagS.c b/armsrc/hitagS.c index 78009496e..4268e82e5 100644 --- a/armsrc/hitagS.c +++ b/armsrc/hitagS.c @@ -1407,7 +1407,7 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) { set_tracing(false); lf_finalize(); - reply_old(CMD_ACK, bSuccessful, 0, 0, 0, 0); + reply_mix(CMD_ACK, bSuccessful, 0, 0, 0, 0); } /* @@ -1624,7 +1624,7 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) { lf_finalize(); - reply_old(CMD_ACK, bSuccessful, 0, 0, 0, 0); + reply_mix(CMD_ACK, bSuccessful, 0, 0, 0, 0); } /* @@ -1860,5 +1860,5 @@ void check_challenges(bool file_given, uint8_t *data) { set_tracing(false); lf_finalize(); - reply_old(CMD_ACK, bSuccessful, 0, 0, 0, 0); + reply_mix(CMD_ACK, bSuccessful, 0, 0, 0, 0); } diff --git a/armsrc/legicrf.c b/armsrc/legicrf.c index 35b638298..b411efcaf 100644 --- a/armsrc/legicrf.c +++ b/armsrc/legicrf.c @@ -438,7 +438,7 @@ void LegicRfInfo(void) { } // OK - reply_old(CMD_ACK, 1, 0, 0, (uint8_t *)&card, sizeof(legic_card_select_t)); + reply_mix(CMD_ACK, 1, 0, 0, (uint8_t *)&card, sizeof(legic_card_select_t)); OUT: switch_off(); @@ -513,7 +513,7 @@ void LegicRfReader(uint16_t offset, uint16_t len, uint8_t iv) { } // OK - reply_old(CMD_ACK, 1, len, 0, legic_mem, len); + reply_mix(CMD_ACK, 1, len, 0, 0, 0); OUT: switch_off(); @@ -552,7 +552,7 @@ void LegicRfWriter(uint16_t offset, uint16_t len, uint8_t iv, uint8_t *data) { } // OK - reply_old(CMD_ACK, 1, len, 0, legic_mem, len); + reply_mix(CMD_ACK, 1, len, 0, 0, 0); OUT: switch_off(); diff --git a/armsrc/mifaredesfire.c b/armsrc/mifaredesfire.c index 8ac788122..b2f45d117 100644 --- a/armsrc/mifaredesfire.c +++ b/armsrc/mifaredesfire.c @@ -609,6 +609,6 @@ void OnSuccess() { } void OnError(uint8_t reason) { - reply_old(CMD_ACK, 0, reason, 0, 0, 0); + reply_mix(CMD_ACK, 0, reason, 0, 0, 0); OnSuccess(); } diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c index d54e7fb91..60f54adaf 100644 --- a/client/cmdhf14a.c +++ b/client/cmdhf14a.c @@ -193,7 +193,7 @@ static int usage_hf_14a_sim(void) { PrintAndLogEx(NORMAL, _YELLOW_(" hf 14a sim t 1 u 11223344")); PrintAndLogEx(NORMAL, _YELLOW_(" hf 14a sim t 1 u 11223344556677")); // PrintAndLogEx(NORMAL, " hf 14a sim t 1 u 11223445566778899AA\n"); - return 0; + return PM3_SUCCESS; } static int usage_hf_14a_sniff(void) { PrintAndLogEx(NORMAL, "It get data from the field and saves it into command buffer."); @@ -203,7 +203,7 @@ static int usage_hf_14a_sniff(void) { PrintAndLogEx(NORMAL, "r - triggered by first 7-bit request from reader (REQ,WUP,...)"); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, _YELLOW_(" hf 14a sniff c r")); - return 0; + return PM3_SUCCESS; } static int usage_hf_14a_raw(void) { PrintAndLogEx(NORMAL, "Usage: hf 14a raw [-h] [-r] [-c] [-p] [-a] [-T] [-t] [-b] <0A 0B 0C ... hex>"); @@ -217,7 +217,7 @@ static int usage_hf_14a_raw(void) { PrintAndLogEx(NORMAL, " -t timeout in ms"); PrintAndLogEx(NORMAL, " -T use Topaz protocol to send command"); PrintAndLogEx(NORMAL, " -3 ISO14443-3 select only (skip RATS)"); - return 0; + return PM3_SUCCESS; } static int usage_hf_14a_reader(void) { PrintAndLogEx(NORMAL, "Usage: hf 14a reader [k|s|x] [3]"); @@ -225,7 +225,7 @@ static int usage_hf_14a_reader(void) { PrintAndLogEx(NORMAL, " s silent (no messages)"); PrintAndLogEx(NORMAL, " x just drop the signal field"); PrintAndLogEx(NORMAL, " 3 ISO14443-3 select only (skip RATS)"); - return 0; + return PM3_SUCCESS; } static int CmdHF14AList(const char *Cmd) { @@ -580,7 +580,7 @@ int ExchangeRAW14a(uint8_t *datain, int datainlen, bool activateField, bool leav if (resp.oldarg[0] == 2) { // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision // get ATS uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0 - SendCommandOLD(CMD_HF_ISO14443A_READER, ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT, 2, 0, rats, 2); + SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT, 2, 0, rats, sizeof(rats)); if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { if (!silentMode) PrintAndLogEx(ERR, "Proxmark3 connection timeout."); return 1; @@ -674,7 +674,7 @@ static int SelectCard14443_4(bool disconnect, iso14a_card_select_t *card) { if (resp.oldarg[0] == 2) { // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision // get ATS uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0 - SendCommandOLD(CMD_HF_ISO14443A_READER, ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT, sizeof(rats), 0, rats, sizeof(rats)); + SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT, sizeof(rats), 0, rats, sizeof(rats)); if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { PrintAndLogEx(ERR, "Proxmark3 connection timeout."); return 1; @@ -1237,7 +1237,7 @@ static command_t CommandTable[] = { static int CmdHelp(const char *Cmd) { (void)Cmd; // Cmd is not used so far CmdsHelp(CommandTable); - return 0; + return PM3_SUCCESS; } int CmdHF14A(const char *Cmd) { diff --git a/client/cmdhflegic.c b/client/cmdhflegic.c index c6de1379d..088800780 100644 --- a/client/cmdhflegic.c +++ b/client/cmdhflegic.c @@ -658,6 +658,14 @@ static int CmdLegicWrbl(const char *Cmd) { } } } + + // OUT-OF-BOUNDS checks + // UID 4+1 bytes can't be written to. + if (offset < 5) { + PrintAndLogEx(WARNING, "Out-of-bounds, bytes 0-1-2-3-4 can't be written to. Offset = %d", offset); + return PM3_EOUTOFBOUND; + } + //Validations if (errors || cmdp == 0) { if (data) @@ -674,14 +682,7 @@ static int CmdLegicWrbl(const char *Cmd) { legic_print_type(card.cardsize, 0); - // OUT-OF-BOUNDS checks - // UID 4+1 bytes can't be written to. - if (offset < 5) { - PrintAndLogEx(WARNING, "Out-of-bounds, bytes 0-1-2-3-4 can't be written to. Offset = %d", offset); - return PM3_EOUTOFBOUND; - } - - if (len + offset >= card.cardsize) { + if (len + offset > card.cardsize) { PrintAndLogEx(WARNING, "Out-of-bounds, Cardsize = %d, [offset+len = %d ]", card.cardsize, len + offset); return PM3_EOUTOFBOUND; } diff --git a/client/cmdhfmfdes.c b/client/cmdhfmfdes.c index de8ad2895..c4cab419a 100644 --- a/client/cmdhfmfdes.c +++ b/client/cmdhfmfdes.c @@ -22,6 +22,11 @@ #include "protocols.h" #include "mifare.h" // desfire raw command options #include "cmdtrace.h" +#include "cliparser/cliparser.h" +#include "emv/apduinfo.h" // APDU manipulation / errorcodes +#include "emv/emvcore.h" // APDU logging +#include "util_posix.h" // msleep +#include "mifare/mifare4.h" // MIFARE Authenticate / MAC uint8_t key_zero_data[16] = { 0x00 }; uint8_t key_ones_data[16] = { 0x01 }; @@ -37,13 +42,17 @@ typedef enum { LIGHT, } desfire_cardtype_t; +typedef struct { + uint8_t aid[3]; + uint8_t fid[2]; + uint8_t name[16]; +} dfname_t; static int CmdHelp(const char *Cmd); - static int SendDesfireCmd(uint8_t *c, size_t len, int p0, int p1, int p2, PacketResponseNG *response, int timeout) { - PacketResponseNG resp; + PacketResponseNG resp; if (response == NULL) response = &resp; @@ -83,7 +92,7 @@ static desfire_cardtype_t getCardType(uint8_t major, uint8_t minor) { //ICEMAN: Turn on field method? //none static int test_desfire_authenticate() { - uint8_t c[] = {AUTHENTICATE, 0x00, 0x00, 0x01, 0x00, 0x00}; // 0x0A, KEY 0 + uint8_t c[] = {MFDES_AUTHENTICATE, 0x00, 0x00, 0x01, 0x00, 0x00}; // 0x0A, KEY 0 SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c)); PacketResponseNG resp; if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) { @@ -96,7 +105,7 @@ static int test_desfire_authenticate() { } // none static int test_desfire_authenticate_iso() { - uint8_t c[] = {AUTHENTICATE_ISO, 0x00, 0x00, 0x01, 0x00, 0x00}; // 0x1A, KEY 0 + uint8_t c[] = {MFDES_AUTHENTICATE_ISO, 0x00, 0x00, 0x01, 0x00, 0x00}; // 0x1A, KEY 0 SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c)); PacketResponseNG resp; if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) { @@ -117,7 +126,7 @@ static int test_desfire_authenticate_aes() { const static u08_t CustomKey3[16] = {0x79, 0x70, 0x25, 0x53, 0x79, 0x70, 0x25, 0x53, 0x79, 0x70, 0x25, 0x53, 0x79, 0x70, 0x25, 0x53}; */ - uint8_t c[] = {AUTHENTICATE_AES, 0x00, 0x00, 0x01, 0x00, 0x00}; // 0xAA, KEY 0 + uint8_t c[] = {MFDES_AUTHENTICATE_AES, 0x00, 0x00, 0x01, 0x00, 0x00}; // 0xAA, KEY 0 SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c)); PacketResponseNG resp; if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) { @@ -137,7 +146,7 @@ static int desfire_print_freemem(uint32_t free_mem) { // init / disconnect static int get_desfire_freemem(uint32_t *free_mem) { - uint8_t c[] = {GET_FREE_MEMORY, 0x00, 0x00, 0x00}; // 0x6E + uint8_t c[] = {MFDES_GET_FREE_MEMORY, 0x00, 0x00, 0x00}; // 0x6E SendCommandMIX(CMD_HF_DESFIRE_COMMAND, (INIT | DISCONNECT), sizeof(c), 0, c, sizeof(c)); PacketResponseNG resp; if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { @@ -167,7 +176,7 @@ static int desfire_print_signature(uint8_t *uid, uint8_t *signature, size_t sign {"DESFire EV2", "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3A"}, {"NTAG424DNA, NTAG424DNATT, DESFire Light EV2", "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3B"}, {"DESFire Light EV1", "040E98E117AAA36457F43173DC920A8757267F44CE4EC5ADD3C54075571AEBBF7B942A9774A1D94AD02572427E5AE0A2DD36591B1FB34FCF3D"}, - {"Mifare Plus", "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"} + {"Mifare Plus EV1", "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"} }; uint8_t i; @@ -192,17 +201,17 @@ static int desfire_print_signature(uint8_t *uid, uint8_t *signature, size_t sign PrintAndLogEx(NORMAL, ""); PrintAndLogEx(INFO, "--- " _CYAN_("Tag Signature")); - PrintAndLogEx(INFO, " IC signature public key name: %s", nxp_desfire_public_keys[i].desc); + PrintAndLogEx(INFO, " IC signature public key name: " _GREEN_("%s"), nxp_desfire_public_keys[i].desc); PrintAndLogEx(INFO, "IC signature public key value: %.32s", nxp_desfire_public_keys[i].value); PrintAndLogEx(INFO, " : %.32s", nxp_desfire_public_keys[i].value + 16); PrintAndLogEx(INFO, " : %.32s", nxp_desfire_public_keys[i].value + 32); PrintAndLogEx(INFO, " : %.32s", nxp_desfire_public_keys[i].value + 48); PrintAndLogEx(INFO, " Elliptic curve parameters: NID_secp224r1"); - PrintAndLogEx(INFO, " TAG IC Signature: %s", sprint_hex(signature, 16)); - PrintAndLogEx(INFO, " : %s", sprint_hex(signature + 16, 16)); - PrintAndLogEx(INFO, " : %s", sprint_hex(signature + 32, 16)); - PrintAndLogEx(INFO, " : %s", sprint_hex(signature + 48, signature_len - 48)); - PrintAndLogEx(SUCCESS, " Signature verified: " _GREEN_("successful")); + PrintAndLogEx(INFO, " TAG IC Signature: %s", sprint_hex_inrow(signature, 16)); + PrintAndLogEx(INFO, " : %s", sprint_hex_inrow(signature + 16, 16)); + PrintAndLogEx(INFO, " : %s", sprint_hex_inrow(signature + 32, 16)); + PrintAndLogEx(INFO, " : %s", sprint_hex_inrow(signature + 48, signature_len - 48)); + PrintAndLogEx(SUCCESS, " Signature verified: " _GREEN_("successful")); return PM3_SUCCESS; } @@ -301,7 +310,7 @@ static int get_desfire_select_application(uint8_t *aid) { if (aid == NULL) return PM3_ESOFT; DropField(); - uint8_t c[] = {SELECT_APPLICATION, 0x00, 0x00, 0x03, aid[0], aid[1], aid[2], 0x00}; // 0x5a + uint8_t c[] = {MFDES_SELECT_APPLICATION, 0x00, 0x00, 0x03, aid[0], aid[1], aid[2], 0x00}; // 0x5a PacketResponseNG resp; int ret = SendDesfireCmd(c, sizeof(c), INIT, sizeof(c), 0, &resp, 3000); if (ret != PM3_SUCCESS) { @@ -322,7 +331,7 @@ static int get_desfire_select_application(uint8_t *aid) { // init / disconnect static int get_desfire_appids(uint8_t *dest, uint8_t *app_ids_len) { - uint8_t c[] = {GET_APPLICATION_IDS, 0x00, 0x00, 0x00}; //0x6a + uint8_t c[] = {MFDES_GET_APPLICATION_IDS, 0x00, 0x00, 0x00}; //0x6a PacketResponseNG resp; int ret = SendDesfireCmd(c, sizeof(c), INIT | CLEARTRACE | DISCONNECT, sizeof(c), 0, &resp, 1500); if (ret != PM3_SUCCESS) return ret; @@ -345,12 +354,6 @@ static int get_desfire_appids(uint8_t *dest, uint8_t *app_ids_len) { return PM3_SUCCESS; } -typedef struct { - uint8_t aid[3]; - uint8_t fid[2]; - uint8_t name[16]; -} dfname_t; - static int get_desfire_dfnames(dfname_t *dest, uint8_t *dfname_count) { if (dest == NULL) return PM3_ESOFT; uint8_t c[] = {MFDES_GET_DF_NAMES, 0x00, 0x00, 0x00}; //0x6d @@ -362,8 +365,11 @@ static int get_desfire_dfnames(dfname_t *dest, uint8_t *dfname_count) { memcpy(&dest[count - 1], resp.data.asBytes + 1, resp.length - 5); if (resp.data.asBytes[resp.length - 3] == MFDES_ADDITIONAL_FRAME) { c[0] = MFDES_ADDITIONAL_FRAME; //0xAF + ret = SendDesfireCmd(c, sizeof(c), NONE, sizeof(c), 0, &resp, 3000); if (ret != PM3_SUCCESS) return ret; + + count++; memcpy(&dest[count - 1], resp.data.asBytes + 1, resp.length - 5); } @@ -809,8 +815,126 @@ static int CmdHF14ADesEnumApplications(const char *Cmd) { */ +int DESFIRESendApdu(bool activate_field, bool leavefield_on, sAPDU apdu, uint8_t *result, int max_result_len, int *result_len, uint16_t *sw) { + + *result_len = 0; + if (sw) *sw = 0; + + uint16_t isw = 0; + int res = 0; + + if (activate_field) { + DropField(); + msleep(50); + } + + // select? + uint8_t data[APDU_RES_LEN] = {0}; + + // COMPUTE APDU + int datalen = 0; + //if (APDUEncodeS(&apdu, false, IncludeLe ? 0x100 : 0x00, data, &datalen)) { + if (APDUEncodeS(&apdu, false, 0x100, data, &datalen)) { + PrintAndLogEx(ERR, "APDU encoding error."); + return PM3_EAPDU_ENCODEFAIL; + } + + if (GetAPDULogging()) + PrintAndLogEx(SUCCESS, ">>>> %s", sprint_hex(data, datalen)); + + res = ExchangeAPDU14a(data, datalen, activate_field, leavefield_on, result, max_result_len, result_len); + if (res) { + return res; + } + + if (GetAPDULogging()) + PrintAndLogEx(SUCCESS, "<<<< %s", sprint_hex(result, *result_len)); + + if (*result_len < 2) { + return PM3_SUCCESS; + } + + *result_len -= 2; + isw = (result[*result_len] << 8) + result[*result_len + 1]; + if (sw) + *sw = isw; + + if (isw != 0x9000 && isw != 0x9100) { + if (GetAPDULogging()) { + if (isw >> 8 == 0x61) { + PrintAndLogEx(ERR, "APDU chaining len:%02x -->", isw & 0xff); + } else { + PrintAndLogEx(ERR, "APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(isw >> 8, isw & 0xff)); + return PM3_EAPDU_FAIL; + } + } + } + + return PM3_SUCCESS; +} + +static int CmdHF14ADesTEST(const char *Cmd) { + + uint8_t aid[3]; + uint8_t app_ids[78] = {0}; + int app_ids_len = 0; + +// uint8_t file_ids[33] = {0}; +// uint8_t file_ids_len = 0; + + uint8_t data[255*5] = {0}; + dfname_t dfnames[255] = {0}; + int dfname_count = 0; + uint16_t sw = 0; + + SetAPDULogging(true); + + // get application ids + sAPDU apdu = {0x90, MFDES_GET_APPLICATION_IDS, 0x00, 0x00, 0x00, NULL}; + int res = DESFIRESendApdu(true, true, apdu, app_ids, sizeof(app_ids), &app_ids_len, &sw); + if (res != PM3_SUCCESS) + goto out; + + // get dfnames + apdu.INS = MFDES_GET_DF_NAMES; + res = DESFIRESendApdu(true, false, apdu, data, sizeof(data), &dfname_count, &sw); + if (res != PM3_SUCCESS) + goto out; + + + // enum test... + for (int i = 0; i < app_ids_len; i += 3) { + + aid[0] = app_ids[i]; + aid[1] = app_ids[i + 1]; + aid[2] = app_ids[i + 2]; + + PrintAndLogEx(NORMAL, ""); + + if (memcmp(aid, "\x00\x00\x00", 3) == 0) { + // CARD MASTER KEY + PrintAndLogEx(INFO, "--- " _CYAN_("CMK - PICC, Card Master Key settings")); + } else { + PrintAndLogEx(SUCCESS, "--- " _CYAN_("AMK - Application Master Key settings")); + } + + PrintAndLogEx(SUCCESS, " AID : " _GREEN_("%s"), sprint_hex(aid, sizeof(aid))); + for (int m = 0; m < dfname_count; m++) { + if (memcmp (dfnames[m].aid, aid, 3) == 0) { + PrintAndLogEx(SUCCESS, " - DF " _YELLOW_("%02X %02X") " Name : " _YELLOW_("%s"), + dfnames[m].fid[0], dfnames[m].fid[1], + dfnames[m].name + ); + } + } + } +out: + SetAPDULogging(false); + return PM3_SUCCESS; +} + // MIAFRE DESFire Authentication // #define BUFSIZE 256 @@ -824,9 +948,9 @@ static int CmdHF14ADesAuth(const char *Cmd) { // 4 = AES 16 uint8_t keylength = 8; - unsigned char key[24]; + uint8_t key[24]; uint8_t aidlength = 3; - unsigned char aid[3]; + uint8_t aid[3]; if (strlen(Cmd) < 3) { PrintAndLogEx(NORMAL, "Usage: hf mfdes auth <1|2|3> <1|2|3|4> "); @@ -949,6 +1073,7 @@ static command_t CommandTable[] = { {"auth", CmdHF14ADesAuth, IfPm3Iso14443a, "Tries a MIFARE DesFire Authentication"}, // {"rdbl", CmdHF14ADesRb, IfPm3Iso14443a, "Read MIFARE DesFire block"}, // {"wrbl", CmdHF14ADesWb, IfPm3Iso14443a, "write MIFARE DesFire block"}, + {"test", CmdHF14ADesTEST, IfPm3Iso14443a, "testing command"}, {NULL, NULL, NULL, NULL} }; diff --git a/client/cmdhfmfdes.h b/client/cmdhfmfdes.h index 5c4dcb5e2..4f6605cff 100644 --- a/client/cmdhfmfdes.h +++ b/client/cmdhfmfdes.h @@ -19,50 +19,14 @@ char *getProtocolStr(uint8_t id); char *getVersionStr(uint8_t major, uint8_t minor); void getKeySettings(uint8_t *aid); -#define CREATE_APPLICATION 0xca -#define DELETE_APPLICATION 0xda -#define GET_APPLICATION_IDS 0x6a -#define SELECT_APPLICATION 0x5a -#define FORMAT_PICC 0xfc -#define GET_VERSION 0x60 -#define READ_DATA 0xbd -#define WRITE_DATA 0x3d -#define GET_VALUE 0x6c -#define CREDIT 0x0c -#define DEBIT 0xdc -#define LIMITED_CREDIT 0x1c -#define WRITE_RECORD 0x3b -#define READ_RECORDS 0xbb -#define CLEAR_RECORD_FILE 0xeb -#define COMMIT_TRANSACTION 0xc7 -#define ABORT_TRANSACTION 0xa7 -#define GET_FREE_MEMORY 0x6e -#define GET_FILE_IDS 0x6f -#define GET_ISOFILE_IDS 0x61 -#define GET_FILE_SETTINGS 0xf5 -#define CHANGE_FILE_SETTINGS 0x5f -#define CREATE_STD_DATA_FILE 0xcd -#define CREATE_BACKUP_DATA_FILE 0xcb -#define CREATE_VALUE_FILE 0xcc -#define CREATE_LINEAR_RECORD_FILE 0xc1 -#define CREATE_CYCLIC_RECORD_FILE 0xc0 -#define DELETE_FILE 0xdf -#define AUTHENTICATE 0x0a // AUTHENTICATE_NATIVE -#define AUTHENTICATE_ISO 0x1a // AUTHENTICATE_STANDARD -#define AUTHENTICATE_AES 0xaa -#define CHANGE_KEY_SETTINGS 0x54 -#define GET_KEY_SETTINGS 0x45 -#define CHANGE_KEY 0xc4 -#define GET_KEY_VERSION 0x64 -#define AUTHENTICATION_FRAME 0xAF - +// Ev1 card limits #define MAX_NUM_KEYS 0x0F #define MAX_APPLICATION_COUNT 28 #define MAX_FILE_COUNT 32 #define MAX_FRAME_SIZE 60 -#define NOT_YET_AUTHENTICATED 255 #define FRAME_PAYLOAD_SIZE (MAX_FRAME_SIZE - 5) +#define NOT_YET_AUTHENTICATED 0xFF // status- and error codes | #define OPERATION_OK 0x00 // Successful operation diff --git a/client/cmdhfmfp.c b/client/cmdhfmfp.c index 56963819c..31acb1a24 100644 --- a/client/cmdhfmfp.c +++ b/client/cmdhfmfp.c @@ -10,12 +10,9 @@ //----------------------------------------------------------------------------- #include "cmdhfmfp.h" - #include - #include "cmdparser.h" // command_t #include "commonutil.h" // ARRAYLEN - #include "comms.h" #include "ui.h" #include "cmdhf14a.h" @@ -40,7 +37,7 @@ static int CmdHFMFPInfo(const char *Cmd) { PrintAndLogEx(WARNING, "command don't have any parameters.\n"); PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "-- Mifare Plus Tag Information ------------------------------"); + PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") "---------------------------"); PrintAndLogEx(INFO, "-------------------------------------------------------------"); // info about 14a part @@ -48,7 +45,6 @@ static int CmdHFMFPInfo(const char *Cmd) { // Mifare Plus info SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT, 0, 0, NULL, 0); - PacketResponseNG resp; WaitForResponse(CMD_ACK, &resp); @@ -59,53 +55,44 @@ static int CmdHFMFPInfo(const char *Cmd) { if (select_status == 1 || select_status == 2) { - PrintAndLogEx(INFO, "-------------------------------------------------------------"); - PrintAndLogEx(INFO, " Fingerprint"); + PrintAndLogEx(INFO, "--- " _CYAN_("Fingerprint")); // MIFARE Type Identification Procedure // https://www.nxp.com/docs/en/application-note/AN10833.pdf uint16_t ATQA = card.atqa[0] + (card.atqa[1] << 8); bool isPlus = false; - if (ATQA == 0x0004) { - PrintAndLogEx(INFO, " ATQA - " _GREEN_("Mifare Plus 2K") " (4b UID)"); + if (ATQA & 0x0004) { + PrintAndLogEx(INFO, " ATQA - " _GREEN_("MIFARE Plus 2K") "(%s UID)", (ATQA & 0x0040) ? "7" : "4"); isPlus = true; } - if (ATQA == 0x0002) { - PrintAndLogEx(INFO, " ATQA - " _GREEN_("Mifare Plus 4K") " (4b UID)"); - isPlus = true; - } - if (ATQA == 0x0044) { - PrintAndLogEx(INFO, " ATQA - " _GREEN_("Mifare Plus 2K") " (7b UID)"); - isPlus = true; - } - if (ATQA == 0x0042) { - PrintAndLogEx(INFO, " ATQA - " _GREEN_("Mifare Plus 4K") " (7b UID)"); + if (ATQA & 0x0002) { + PrintAndLogEx(INFO, " ATQA - " _GREEN_("MIFARE Plus 4K") "(%s UID)", (ATQA & 0x0040) ? "7" : "4"); isPlus = true; } uint8_t SLmode = 0xff; if (isPlus) { if (card.sak == 0x08) { - PrintAndLogEx(INFO, " SAK - " _GREEN_("Mifare Plus 2K 7b UID")); + PrintAndLogEx(INFO, " SAK - " _GREEN_("MIFARE Plus 2K 7b UID")); if (select_status == 2) SLmode = 1; } if (card.sak == 0x18) { - PrintAndLogEx(INFO, " SAK - " _GREEN_("Mifare Plus 4K 7b UID")); + PrintAndLogEx(INFO, " SAK - " _GREEN_("MIFARE Plus 4K 7b UID")); if (select_status == 2) SLmode = 1; } if (card.sak == 0x10) { - PrintAndLogEx(INFO, " SAK - " _GREEN_("Mifare Plus 2K")); + PrintAndLogEx(INFO, " SAK - " _GREEN_("MIFARE Plus 2K")); if (select_status == 2) SLmode = 2; } if (card.sak == 0x11) { - PrintAndLogEx(INFO, " SAK - " _GREEN_("Mifare Plus 4K")); + PrintAndLogEx(INFO, " SAK - " _GREEN_("MIFARE Plus 4K")); if (select_status == 2) SLmode = 2; } } if (card.sak == 0x20) { - PrintAndLogEx(INFO, " SAK - " _GREEN_("Mifare Plus SL0/SL3") "or " _GREEN_("Mifare DESFire")); + PrintAndLogEx(INFO, " SAK - " _GREEN_("MIFARE Plus SL0/SL3") "or " _GREEN_("MIFARE DESFire")); if (card.ats_len > 0) { @@ -118,7 +105,7 @@ static int CmdHFMFPInfo(const char *Cmd) { int res = ExchangeRAW14a(cmd, sizeof(cmd), true, false, data, sizeof(data), &datalen, false); if (memcmp(data, "\x67\x00", 2) == 0) { - PrintAndLogEx(INFO, "\tMost likely a Mifare DESFire tag"); + PrintAndLogEx(INFO, "\tMost likely a MIFARE DESFire tag"); PrintAndLogEx(HINT, "Hint: Try " _YELLOW_("`hf mfdes info`")); DropField(); return PM3_SUCCESS; @@ -131,28 +118,29 @@ static int CmdHFMFPInfo(const char *Cmd) { } // How do we detect SL0 / SL1 / SL2 / SL3 modes?!? - PrintAndLogEx(INFO, "Security Level (SL)"); + PrintAndLogEx(INFO, "--- " _CYAN_("Security Level (SL)")); + + if (SLmode != 0xFF) + PrintAndLogEx(SUCCESS, " MIFARE Plus SL mode: " _YELLOW_("SL%d"), SLmode); + else + PrintAndLogEx(WARNING, " MIFARE Plus SL mode: " _YELLOW_("unknown")); + switch(SLmode) { case 0: - PrintAndLogEx(INFO, "SL 0: initial delivery configuration, used for card personalization"); + PrintAndLogEx(INFO, " SL 0: initial delivery configuration, used for card personalization"); break; case 1: - PrintAndLogEx(INFO, "SL 1: backwards functional compatibility mode (with MIFARE Classic 1K / 4K) with an optional AES authentication"); + PrintAndLogEx(INFO, " SL 1: backwards functional compatibility mode (with MIFARE Classic 1K / 4K) with an optional AES authentication"); break; case 2: - PrintAndLogEx(INFO, "SL 2: 3-Pass Authentication based on AES followed by MIFARE CRYPTO1 authentication, communication secured by MIFARE CRYPTO1"); + PrintAndLogEx(INFO, " SL 2: 3-Pass Authentication based on AES followed by MIFARE CRYPTO1 authentication, communication secured by MIFARE CRYPTO1"); break; case 3: - PrintAndLogEx(INFO, "SL 3: 3-Pass authentication based on AES, data manipulation commands secured by AES encryption and an AES based MACing method."); + PrintAndLogEx(INFO, " SL 3: 3-Pass authentication based on AES, data manipulation commands secured by AES encryption and an AES based MACing method."); break; default: break; } - - if (SLmode != 0xFF) - PrintAndLogEx(SUCCESS, "\tMifare Plus SL mode: " _YELLOW_("SL%d"), SLmode); - else - PrintAndLogEx(WARNING, "\tMifare Plus SL mode: " _YELLOW_("unknown")); } else { PrintAndLogEx(INFO, "\tMifare Plus info not available."); } diff --git a/client/emv/apduinfo.c b/client/emv/apduinfo.c index 35735fb47..b64696628 100644 --- a/client/emv/apduinfo.c +++ b/client/emv/apduinfo.c @@ -503,7 +503,17 @@ void APDUPrint(APDUStruct apdu) { void APDUPrintEx(APDUStruct apdu, size_t maxdatalen) { PrintAndLogEx(INFO, "APDU: %scase=0x%02x cla=0x%02x ins=0x%02x p1=0x%02x p2=0x%02x Lc=0x%02x(%d) Le=0x%02x(%d)", - apdu.extended_apdu ? "[e]" : "", apdu.case_type, apdu.cla, apdu.ins, apdu.p1, apdu.p2, apdu.lc, apdu.lc, apdu.le, apdu.le); + apdu.extended_apdu ? "[e]" : "", + apdu.case_type, + apdu.cla, + apdu.ins, + apdu.p1, + apdu.p2, + apdu.lc, + apdu.lc, + apdu.le, + apdu.le + ); if (maxdatalen > 0) PrintAndLogEx(INFO, "data: %s%s", sprint_hex(apdu.data, MIN(apdu.lc, maxdatalen)), apdu.lc > maxdatalen ? "..." : ""); } diff --git a/client/emv/emvcore.c b/client/emv/emvcore.c index fe5ff3a31..852d801c7 100644 --- a/client/emv/emvcore.c +++ b/client/emv/emvcore.c @@ -136,6 +136,10 @@ void SetAPDULogging(bool logging) { APDULogging = logging; } +bool GetAPDULogging(void) { + return APDULogging; +} + enum CardPSVendor GetCardPSVendor(uint8_t *AID, size_t AIDlen) { char buf[100] = {0}; if (AIDlen < 1) diff --git a/client/emv/emvcore.h b/client/emv/emvcore.h index d5dccd037..1c422e483 100644 --- a/client/emv/emvcore.h +++ b/client/emv/emvcore.h @@ -57,6 +57,7 @@ struct tlvdb *GetPANFromTrack2(const struct tlv *track2); struct tlvdb *GetdCVVRawFromTrack2(const struct tlv *track2); void SetAPDULogging(bool logging); +bool GetAPDULogging(void); // exchange int EMVExchange(EMVCommandChannel channel, bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv); diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index d97fae6ed..6ce271aab 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -618,6 +618,11 @@ typedef struct { #define PM3_EOUTOFBOUND -17 // exchange with card error client/pm3: error when cant get answer from card or got an incorrect answer #define PM3_ECARDEXCHANGE -18 + +// Failed to create APDU, +#define PM3_EAPDU_ENCODEFAIL -19 +// APDU responded with a failure code +#define PM3_EAPDU_FAIL -20 // No data pm3: no data available, no host frame available (not really an error) #define PM3_ENODATA -98 // Quit program client: reserved, order to quit the program diff --git a/include/protocols.h b/include/protocols.h index 75be78ae9..76b891b9a 100644 --- a/include/protocols.h +++ b/include/protocols.h @@ -349,45 +349,58 @@ ISO 7816-4 Basic interindustry commands. For command APDU's. // 6x xx = ERROR // MIFARE DESFire command set: -#define MFDES_CREATE_APPLICATION 0xca -#define MFDES_DELETE_APPLICATION 0xda -#define MFDES_GET_APPLICATION_IDS 0x6a -#define MFDES_SELECT_APPLICATION 0x5a -#define MFDES_FORMAT_PICC 0xfc + + #define MFDES_GET_VERSION 0x60 -#define MFDES_READ_DATA 0xbd -#define MFDES_WRITE_DATA 0x3d -#define MFDES_GET_VALUE 0x6c -#define MFDES_CREDIT 0x0c -#define MFDES_DEBIT 0xdc -#define MFDES_LIMITED_CREDIT 0x1c -#define MFDES_WRITE_RECORD 0x3b -#define MFDES_READ_RECORDS 0xbb -#define MFDES_CLEAR_RECORD_FILE 0xeb -#define MFDES_COMMIT_TRANSACTION 0xc7 -#define MFDES_ABORT_TRANSACTION 0xa7 -#define MFDES_GET_FREE_MEMORY 0x6e -#define MFDES_GET_FILE_IDS 0x6f -#define MFDES_GET_ISOFILE_IDS 0x61 -#define MFDES_GET_FILE_SETTINGS 0xf5 -#define MFDES_CHANGE_FILE_SETTINGS 0x5f -#define MFDES_CREATE_STD_DATA_FILE 0xcd -#define MFDES_CREATE_BACKUP_DATA_FILE 0xcb -#define MFDES_CREATE_VALUE_FILE 0xcc -#define MFDES_CREATE_LINEAR_RECORD_FILE 0xc1 -#define MFDES_CREATE_CYCLIC_RECORD_FILE 0xc0 -#define MFDES_DELETE_FILE 0xdf -#define MFDES_AUTHENTICATE 0x0a // AUTHENTICATE_NATIVE -#define MFDES_AUTHENTICATE_ISO 0x1a // AUTHENTICATE_STANDARD -#define MFDES_AUTHENTICATE_AES 0xaa -#define MFDES_CHANGE_KEY_SETTINGS 0x54 + +#define MFDES_AUTHENTICATE 0x0A // AUTHENTICATE_NATIVE +#define MFDES_AUTHENTICATE_ISO 0x1A // AUTHENTICATE_STANDARD +#define MFDES_AUTHENTICATE_AES 0xAA + +#define MFDES_CREDIT 0x0C +#define MFDES_LIMITED_CREDIT 0x1C +#define MFDES_DEBIT 0xDC + +#define MFDES_WRITE_RECORD 0x3B +#define MFDES_READSIG 0x3C +#define MFDES_WRITE_DATA 0x3D + #define MFDES_GET_KEY_SETTINGS 0x45 -#define MFDES_CHANGE_KEY 0xc4 +#define MFDES_CHANGE_KEY_SETTINGS 0x54 +#define MFDES_SELECT_APPLICATION 0x5A +#define MFDES_CHANGE_FILE_SETTINGS 0x5F +#define MFDES_GET_ISOFILE_IDS 0x61 #define MFDES_GET_KEY_VERSION 0x64 +#define MFDES_GET_APPLICATION_IDS 0x6A +#define MFDES_GET_VALUE 0x6C +#define MFDES_GET_FREE_MEMORY 0x6E +#define MFDES_GET_DF_NAMES 0x6D +#define MFDES_GET_FILE_IDS 0x6F + + +#define MFDES_ABORT_TRANSACTION 0xA7 #define MFDES_AUTHENTICATION_FRAME 0xAF #define MFDES_ADDITIONAL_FRAME 0xAF -#define MFDES_READSIG 0x3C -#define MFDES_GET_DF_NAMES 0x6D + +#define MFDES_READ_RECORDS 0xBB +#define MFDES_READ_DATA 0xBD + +#define MFDES_CREATE_CYCLIC_RECORD_FILE 0xC0 +#define MFDES_CREATE_LINEAR_RECORD_FILE 0xC1 +#define MFDES_CHANGE_KEY 0xC4 +#define MFDES_COMMIT_TRANSACTION 0xC7 +#define MFDES_CREATE_APPLICATION 0xCA +#define MFDES_CREATE_BACKUP_DATA_FILE 0xCB +#define MFDES_CREATE_VALUE_FILE 0xCC +#define MFDES_CREATE_STD_DATA_FILE 0xCD + +#define MFDES_CLEAR_RECORD_FILE 0xEB + +#define MFDES_DELETE_APPLICATION 0xDA +#define MFDES_DELETE_FILE 0xDF + +#define MFDES_GET_FILE_SETTINGS 0xF5 +#define MFDES_FORMAT_PICC 0xFC // LEGIC Commands #define LEGIC_MIM_22 0x0D