github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-07-06 21:21:17 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add smartcard protocol T=0 (RRG repository PRs 71,72,74,75 by @merlokk) (#757)

Browse source
This commit is contained in:
pwpiwi 2019-01-17 07:50:01 +01:00 • committed by GitHub
parent 0d2624a0cc
commit 151a33c027
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 283 additions and 270 deletions
Download patch file Download diff file Expand all files Collapse all files

6
armsrc/i2c.c
View file

@ -713,7 +713,7 @@ void SmartCardRaw( uint64_t arg0, uint64_t arg1, uint8_t *data ) {
I2C_Reset_EnterMainProgram(); I2C_Reset_EnterMainProgram();
if (flags & SC_SELECT) { if ((flags & SC_SELECT)) {
smart_card_atr_t card; smart_card_atr_t card;
bool gotATR = GetATR( &card ); bool gotATR = GetATR( &card );
//cmd_send(CMD_ACK, gotATR, sizeof(smart_card_atr_t), 0, &card, sizeof(smart_card_atr_t)); //cmd_send(CMD_ACK, gotATR, sizeof(smart_card_atr_t), 0, &card, sizeof(smart_card_atr_t));
@ -722,14 +722,14 @@ void SmartCardRaw( uint64_t arg0, uint64_t arg1, uint8_t *data ) {
} }
} }
if ((flags & SC_RAW)) { if ((flags & SC_RAW) || (flags & SC_RAW_T0)) {
LogTrace(data, arg1, 0, 0, NULL, true); LogTrace(data, arg1, 0, 0, NULL, true);
// Send raw bytes // Send raw bytes
// asBytes = A0 A4 00 00 02 // asBytes = A0 A4 00 00 02
// arg1 = len 5 // arg1 = len 5
bool res = I2C_BufferWrite(data, arg1, I2C_DEVICE_CMD_SEND, I2C_DEVICE_ADDRESS_MAIN); bool res = I2C_BufferWrite(data, arg1, ((flags & SC_RAW_T0) ? I2C_DEVICE_CMD_SEND_T0 : I2C_DEVICE_CMD_SEND), I2C_DEVICE_ADDRESS_MAIN);
if ( !res && MF_DBGLEVEL > 3 ) DbpString(I2C_ERROR); if ( !res && MF_DBGLEVEL > 3 ) DbpString(I2C_ERROR);
// read bytes from module // read bytes from module

2
armsrc/i2c.h
View file

@ -23,6 +23,8 @@
#define I2C_DEVICE_CMD_SETBAUD 0x04 #define I2C_DEVICE_CMD_SETBAUD 0x04
#define I2C_DEVICE_CMD_SIM_CLC 0x05 #define I2C_DEVICE_CMD_SIM_CLC 0x05
#define I2C_DEVICE_CMD_GETVERSION 0x06 #define I2C_DEVICE_CMD_GETVERSION 0x06
#define I2C_DEVICE_CMD_SEND_T0 0x07
bool I2C_is_available(void); bool I2C_is_available(void);

195
client/cmdsmartcard.c
View file

@ -32,14 +32,15 @@ static int usage_sm_raw(void) {
PrintAndLogEx(NORMAL, "Usage: sc raw [h|r|c] d <0A 0B 0C ... hex>"); PrintAndLogEx(NORMAL, "Usage: sc raw [h|r|c] d <0A 0B 0C ... hex>");
PrintAndLogEx(NORMAL, " h : this help"); PrintAndLogEx(NORMAL, " h : this help");
PrintAndLogEx(NORMAL, " r : do not read response"); PrintAndLogEx(NORMAL, " r : do not read response");
PrintAndLogEx(NORMAL, " a : active smartcard without select"); PrintAndLogEx(NORMAL, " a : active smartcard without select (reset sc module)");
PrintAndLogEx(NORMAL, " s : active smartcard with select"); PrintAndLogEx(NORMAL, " s : active smartcard with select (get ATR)");
PrintAndLogEx(NORMAL, " t : executes TLV decoder if it possible"); PrintAndLogEx(NORMAL, " t : executes TLV decoder if it possible");
PrintAndLogEx(NORMAL, " 0 : use protocol T=0");
PrintAndLogEx(NORMAL, " d <bytes> : bytes to send"); PrintAndLogEx(NORMAL, " d <bytes> : bytes to send");
PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "");
PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, "Examples:");
PrintAndLogEx(NORMAL, " sc raw d 00a404000e315041592e5359532e444446303100 - `1PAY.SYS.DDF01` PPSE directory"); PrintAndLogEx(NORMAL, " sc raw s 0 d 00a404000e315041592e5359532e4444463031 - `1PAY.SYS.DDF01` PPSE directory with get ATR");
PrintAndLogEx(NORMAL, " sc raw d 00a404000e325041592e5359532e444446303100 - `2PAY.SYS.DDF01` PPSE directory"); PrintAndLogEx(NORMAL, " sc raw 0 d 00a404000e325041592e5359532e4444463031 - `2PAY.SYS.DDF01` PPSE directory");
return 0; return 0;
} }
@ -180,58 +181,46 @@ float GetATRF(uint8_t *atr, size_t atrlen) {
} }
static int PrintATR(uint8_t *atr, size_t atrlen) { static int PrintATR(uint8_t *atr, size_t atrlen) {
uint8_t vxor = 0;
for (int i = 1; i < atrlen; i++)
vxor ^= atr[i];
if (vxor)
PrintAndLogEx(WARNING, "Check summ error. Must be 0 but: 0x%02x", vxor);
else
PrintAndLogEx(INFO, "Check summ OK.");
if (atr[0] != 0x3b)
PrintAndLogEx(WARNING, "Not a direct convention: 0x%02x", atr[0]);
uint8_t T0 = atr[1]; uint8_t T0 = atr[1];
uint8_t K = T0 & 0x0F; uint8_t K = T0 & 0x0F;
uint8_t TD1 = 0; uint8_t TD1 = 0, T1len = 0, TD1len = 0, TDilen = 0;
uint8_t T1len = 0;
uint8_t TD1len = 0;
uint8_t TDilen = 0;
if (T0 & 0x10) { if (T0 & 0x10) {
PrintAndLog("TA1 (Maximum clock frequency, proposed bit duration): 0x%02x", atr[2 + T1len]); PrintAndLog("\t- TA1 (Maximum clock frequency, proposed bit duration) [ 0x%02x ]", atr[2 + T1len]);
T1len++; T1len++;
} }
if (T0 & 0x20) { if (T0 & 0x20) {
PrintAndLog("TB1 (Deprecated: VPP requirements): 0x%02x", atr[2 + T1len]); PrintAndLog("\t- TB1 (Deprecated: VPP requirements) [ 0x%02x ]", atr[2 + T1len]);
T1len++; T1len++;
} }
if (T0 & 0x40) { if (T0 & 0x40) {
PrintAndLog("TC1 (Extra delay between bytes required by card): 0x%02x", atr[2 + T1len]); PrintAndLog("\t- TC1 (Extra delay between bytes required by card) [ 0x%02x ]", atr[2 + T1len]);
T1len++; T1len++;
} }
if (T0 & 0x80) { if (T0 & 0x80) {
TD1 = atr[2 + T1len]; TD1 = atr[2 + T1len];
PrintAndLog("TD1 (First offered transmission protocol, presence of TA2..TD2): 0x%02x. Protocol T=%d", TD1, TD1 & 0x0f); PrintAndLog("\t- TD1 (First offered transmission protocol, presence of TA2..TD2) [ 0x%02x ] Protocol T%d", TD1, TD1 & 0x0f);
T1len++; T1len++;
if (TD1 & 0x10) { if (TD1 & 0x10) {
PrintAndLog("TA2 (Specific protocol and parameters to be used after the ATR): 0x%02x", atr[2 + T1len + TD1len]); PrintAndLog("\t- TA2 (Specific protocol and parameters to be used after the ATR) [ 0x%02x ]", atr[2 + T1len + TD1len]);
TD1len++; TD1len++;
} }
if (TD1 & 0x20) { if (TD1 & 0x20) {
PrintAndLog("TB2 (Deprecated: VPP precise voltage requirement): 0x%02x", atr[2 + T1len + TD1len]); PrintAndLog("\t- TB2 (Deprecated: VPP precise voltage requirement) [ 0x%02x ]", atr[2 + T1len + TD1len]);
TD1len++; TD1len++;
} }
if (TD1 & 0x40) { if (TD1 & 0x40) {
PrintAndLog("TC2 (Maximum waiting time for protocol T=0): 0x%02x", atr[2 + T1len + TD1len]); PrintAndLog("\t- TC2 (Maximum waiting time for protocol T=0) [ 0x%02x ]", atr[2 + T1len + TD1len]);
TD1len++; TD1len++;
} }
if (TD1 & 0x80) { if (TD1 & 0x80) {
uint8_t TDi = atr[2 + T1len + TD1len]; uint8_t TDi = atr[2 + T1len + TD1len];
PrintAndLog("TD2 (A supported protocol or more global parameters, presence of TA3..TD3): 0x%02x. Protocol T=%d", TDi, TDi & 0x0f); PrintAndLog("\t- TD2 (A supported protocol or more global parameters, presence of TA3..TD3) [ 0x%02x ] Protocol T%d", TDi, TDi & 0x0f);
TD1len++; TD1len++;
bool nextCycle = true; bool nextCycle = true;
@ -239,20 +228,20 @@ static int PrintATR(uint8_t *atr, size_t atrlen) {
while (nextCycle) { while (nextCycle) {
nextCycle = false; nextCycle = false;
if (TDi & 0x10) { if (TDi & 0x10) {
PrintAndLog("TA%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]); PrintAndLog("\t- TA%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]);
TDilen++; TDilen++;
} }
if (TDi & 0x20) { if (TDi & 0x20) {
PrintAndLog("TB%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]); PrintAndLog("\t- TB%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]);
TDilen++; TDilen++;
} }
if (TDi & 0x40) { if (TDi & 0x40) {
PrintAndLog("TC%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]); PrintAndLog("\t- TC%d: 0x%02x", vi, atr[2 + T1len + TD1len + TDilen]);
TDilen++; TDilen++;
} }
if (TDi & 0x80) { if (TDi & 0x80) {
TDi = atr[2 + T1len + TD1len + TDilen]; TDi = atr[2 + T1len + TD1len + TDilen];
PrintAndLog("TD%d: 0x%02x. Protocol T=%d", vi, TDi, TDi & 0x0f); PrintAndLog("\t- TD%d [ 0x%02x ] Protocol T%d", vi, TDi, TDi & 0x0f);
TDilen++; TDilen++;
nextCycle = true; nextCycle = true;
@ -262,25 +251,35 @@ static int PrintATR(uint8_t *atr, size_t atrlen) {
} }
} }
uint8_t vxor = 0;
for (int i = 1; i < atrlen; i++)
vxor ^= atr[i];
if (vxor)
PrintAndLogEx(WARNING, "Check summ error. Must be 0 got 0x%02X", vxor);
else
PrintAndLogEx(INFO, "Check summ OK.");
if (atr[0] != 0x3b)
PrintAndLogEx(WARNING, "Not a direct convention [ 0x%02x ]", atr[0]);
uint8_t calen = 2 + T1len + TD1len + TDilen + K; uint8_t calen = 2 + T1len + TD1len + TDilen + K;
if (atrlen != calen && atrlen != calen + 1) // may be CRC if (atrlen != calen && atrlen != calen + 1) // may be CRC
PrintAndLogEx(ERR, "ATR length error. len: %d, T1len: %d, TD1len: %d, TDilen: %d, K: %d", atrlen, T1len, TD1len, TDilen, K); PrintAndLogEx(ERR, "ATR length error. len: %d, T1len: %d, TD1len: %d, TDilen: %d, K: %d", atrlen, T1len, TD1len, TDilen, K);
else
PrintAndLogEx(INFO, "ATR length OK.");
PrintAndLog("Historical bytes len: 0x%02x", K);
if (K > 0) if (K > 0)
PrintAndLog("The format of historical bytes: %02x", atr[2 + T1len + TD1len + TDilen]); PrintAndLogEx(INFO, "\nHistorical bytes | len 0x%02d | format %02x", K, atr[2 + T1len + TD1len + TDilen]);
if (K > 1) { if (K > 1) {
PrintAndLog("Historical bytes:"); PrintAndLogEx(INFO, "\tHistorical bytes");
dump_buffer(&atr[2 + T1len + TD1len + TDilen], K, NULL, 1); dump_buffer(&atr[2 + T1len + TD1len + TDilen], K, NULL, 1);
} }
return 0; return 0;
} }
static bool smart_select(bool silent) { static bool smart_select(bool silent) {
UsbCommand c = {CMD_SMART_ATR, {0, 0, 0}}; UsbCommand c = {CMD_SMART_ATR, {0, 0, 0}};
clearCommandBuffer(); clearCommandBuffer();
@ -310,7 +309,7 @@ static bool smart_select(bool silent) {
static int smart_wait(uint8_t *data) { static int smart_wait(uint8_t *data) {
UsbCommand resp; UsbCommand resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) { if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
PrintAndLogEx(WARNING, "smart card response failed"); PrintAndLogEx(WARNING, "smart card response timeout");
return -1; return -1;
} }
@ -320,15 +319,16 @@ static int smart_wait(uint8_t *data) {
return -2; return -2;
} }
memcpy(data, resp.d.asBytes, len); memcpy(data, resp.d.asBytes, len);
PrintAndLogEx(SUCCESS, " %d | %s", len, sprint_hex_inrow_ex(data, len, 32));
if (len >= 2) { if (len >= 2) {
PrintAndLogEx(SUCCESS, "%02X%02X | %s", data[len - 2], data[len - 1], GetAPDUCodeDescription(data[len - 2], data[len - 1])); PrintAndLogEx(SUCCESS, "%02X%02X | %s", data[len - 2], data[len - 1], GetAPDUCodeDescription(data[len - 2], data[len - 1]));
} else {
PrintAndLogEx(SUCCESS, " %d | %s", len, sprint_hex_inrow_ex(data, len, 8));
} }
return len; return len;
} }
static int smart_response(uint8_t apduINS, uint8_t *data) { static int smart_response(uint8_t *data) {
int datalen = smart_wait(data); int datalen = smart_wait(data);
bool needGetData = false; bool needGetData = false;
@ -337,20 +337,14 @@ static int smart_response(uint8_t apduINS, uint8_t *data) {
goto out; goto out;
} }
if (datalen > 2 && data[0] != apduINS) {
PrintAndLogEx(ERR, "Card ACK error. len=0x%x data[0]=%02x", datalen, data[0]);
datalen = 0;
goto out;
}
if ( data[datalen - 2] == 0x61 || data[datalen - 2] == 0x9F ) { if ( data[datalen - 2] == 0x61 || data[datalen - 2] == 0x9F ) {
needGetData = true; needGetData = true;
} }
if (needGetData) { if (needGetData) {
int len = data[datalen - 1]; int len = data[datalen - 1];
PrintAndLogEx(INFO, "Requesting response. len=0x%x", len); PrintAndLogEx(INFO, "Requesting 0x%02X bytes response", len);
uint8_t getstatus[] = {ISO7816_GETSTATUS, 0x00, 0x00, len}; uint8_t getstatus[] = {0x00, ISO7816_GETSTATUS, 0x00, 0x00, len};
UsbCommand cStatus = {CMD_SMART_RAW, {SC_RAW, sizeof(getstatus), 0}}; UsbCommand cStatus = {CMD_SMART_RAW, {SC_RAW, sizeof(getstatus), 0}};
memcpy(cStatus.d.asBytes, getstatus, sizeof(getstatus) ); memcpy(cStatus.d.asBytes, getstatus, sizeof(getstatus) );
clearCommandBuffer(); clearCommandBuffer();
@ -361,21 +355,26 @@ static int smart_response(uint8_t apduINS, uint8_t *data) {
if (datalen < 2 ) { if (datalen < 2 ) {
goto out; goto out;
} }
if (datalen > 2 && data[0] != ISO7816_GETSTATUS) {
PrintAndLogEx(ERR, "GetResponse ACK error. len=0x%x data[0]=%02x", len, data[0]); // data wo ACK
if (datalen != len + 2) {
// data with ACK
if (datalen == len + 2 + 1) { // 2 - response, 1 - ACK
if (data[0] != ISO7816_GETSTATUS) {
PrintAndLogEx(ERR, "GetResponse ACK error. len 0x%x | data[0] %02X", len, data[0]);
datalen = 0; datalen = 0;
goto out; goto out;
} }
if (datalen != len + 2 + 1) { // 2 - response, 1 - ACK datalen--;
PrintAndLogEx(WARNING, "GetResponse wrong length. Must be: 0x%02x but: 0x%02x", len, datalen - 3); memmove(data, &data[1], datalen);
} else {
// wrong length
PrintAndLogEx(WARNING, "GetResponse wrong length. Must be 0x%02X got 0x%02X", len, datalen - 3);
}
} }
} }
if (datalen > 2) {
datalen--;
memmove(data, &data[1], datalen);
}
out: out:
return datalen; return datalen;
} }
@ -385,6 +384,7 @@ int CmdSmartRaw(const char *Cmd) {
int hexlen = 0; int hexlen = 0;
bool active = false; bool active = false;
bool active_select = false; bool active_select = false;
bool useT0 = false;
uint8_t cmdp = 0; uint8_t cmdp = 0;
bool errors = false, reply = true, decodeTLV = false, breakloop = false; bool errors = false, reply = true, decodeTLV = false, breakloop = false;
uint8_t data[USB_CMD_DATA_SIZE] = {0x00}; uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
@ -408,6 +408,10 @@ int CmdSmartRaw(const char *Cmd) {
decodeTLV = true; decodeTLV = true;
cmdp++; cmdp++;
break; break;
case '0':
useT0 = true;
cmdp++;
break;
case 'd': { case 'd': {
switch (param_gethex_to_eol(Cmd, cmdp+1, data, sizeof(data), &hexlen)) { switch (param_gethex_to_eol(Cmd, cmdp+1, data, sizeof(data), &hexlen)) {
case 1: case 1:
@ -448,6 +452,9 @@ int CmdSmartRaw(const char *Cmd) {
} }
if (hexlen > 0) { if (hexlen > 0) {
if (useT0)
c.arg[0] |= SC_RAW_T0;
else
c.arg[0] |= SC_RAW; c.arg[0] |= SC_RAW;
} }
@ -462,7 +469,7 @@ int CmdSmartRaw(const char *Cmd) {
if ( !buf ) if ( !buf )
return 1; return 1;
int len = smart_response(data[1], buf); int len = smart_response(buf);
if ( len < 0 ) { if ( len < 0 ) {
free(buf); free(buf);
return 2; return 2;
@ -474,13 +481,13 @@ int CmdSmartRaw(const char *Cmd) {
memcpy(c.d.asBytes, data, sizeof(data) ); memcpy(c.d.asBytes, data, sizeof(data) );
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
len = smart_response(data[1], buf); len = smart_response(buf);
data[4] = 0; data[4] = 0;
} }
if (decodeTLV && len > 4) if (decodeTLV && len > 4)
TLVPrintFromBuffer(buf+1, len-3); TLVPrintFromBuffer(buf, len-2);
free(buf); free(buf);
} }
@ -492,38 +499,35 @@ int ExchangeAPDUSC(uint8_t *datain, int datainlen, bool activateCard, bool leave
if (activateCard) if (activateCard)
smart_select(false); smart_select(false);
printf("* APDU SC\n");
UsbCommand c = {CMD_SMART_RAW, {SC_RAW | SC_CONNECT, datainlen, 0}}; PrintAndLogEx(DEBUG, "APDU SC");
UsbCommand c = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}};
if (activateCard) { if (activateCard) {
c.arg[0] |= SC_SELECT; c.arg[0] |= SC_SELECT | SC_CONNECT;
} }
memcpy(c.d.asBytes, datain, datainlen); memcpy(c.d.asBytes, datain, datainlen);
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
int len = smart_response(datain[1], dataout); int len = smart_response(dataout);
if ( len < 0 ) { if ( len < 0 ) {
return 2; return 2;
} }
// retry // retry
if (len > 1 && dataout[len - 2] == 0x6c && datainlen > 4) { if (len > 1 && dataout[len - 2] == 0x6c && datainlen > 4) {
UsbCommand c2 = {CMD_SMART_RAW, {SC_RAW, datainlen, 0}}; UsbCommand c2 = {CMD_SMART_RAW, {SC_RAW_T0, datainlen, 0}};
memcpy(c2.d.asBytes, datain, datainlen); memcpy(c2.d.asBytes, datain, 5);
int vlen = 5 + datain[4]; // transfer length via T=0
if (datainlen == vlen) c2.d.asBytes[4] = dataout[len - 1];
datainlen++;
c2.d.asBytes[vlen] = dataout[len - 1];
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c2); SendCommand(&c2);
len = smart_response(datain[1], dataout); len = smart_response(dataout);
} }
*dataoutlen = len; *dataoutlen = len;
@ -552,7 +556,6 @@ int CmdSmartUpgrade(const char *Cmd) {
errors = true; errors = true;
break; break;
} }
cmdp += 2; cmdp += 2;
break; break;
case 'h': case 'h':
@ -581,7 +584,7 @@ int CmdSmartUpgrade(const char *Cmd) {
return 1; return 1;
} }
char sha512filename[FILE_PATH_SIZE] = {'\0'}; char sha512filename[FILE_PATH_SIZE];
char *bin_extension = filename; char *bin_extension = filename;
char *dot_position = NULL; char *dot_position = NULL;
while ((dot_position = strchr(bin_extension, '.')) != NULL) { while ((dot_position = strchr(bin_extension, '.')) != NULL) {
@ -592,7 +595,7 @@ int CmdSmartUpgrade(const char *Cmd) {
|| !strcmp(bin_extension, "bin") || !strcmp(bin_extension, "bin")
#endif #endif
) { ) {
memcpy(sha512filename, filename, strlen(filename) - strlen("bin")); strncpy(sha512filename, filename, strlen(filename) - strlen("bin"));
strcat(sha512filename, "sha512.txt"); strcat(sha512filename, "sha512.txt");
} else { } else {
PrintAndLogEx(FAILED, "Filename extension of Firmware Upgrade File must be .BIN"); PrintAndLogEx(FAILED, "Filename extension of Firmware Upgrade File must be .BIN");
@ -772,32 +775,36 @@ int CmdSmartInfo(const char *Cmd){
memcpy(&card, (smart_card_atr_t *)resp.d.asBytes, sizeof(smart_card_atr_t)); memcpy(&card, (smart_card_atr_t *)resp.d.asBytes, sizeof(smart_card_atr_t));
// print header // print header
PrintAndLogEx(INFO, "\n--- Smartcard Information ---------"); PrintAndLogEx(INFO, "--- Smartcard Information ---------");
PrintAndLogEx(INFO, "-------------------------------------------------------------"); PrintAndLogEx(INFO, "-------------------------------------------------------------");
PrintAndLogEx(INFO, "ISO76183 ATR : %s", sprint_hex(card.atr, card.atr_len)); PrintAndLogEx(INFO, "ISO7618-3 ATR : %s", sprint_hex(card.atr, card.atr_len));
PrintAndLogEx(INFO, "look up ATR"); PrintAndLogEx(INFO, "\nhttp://smartcard-atr.appspot.com/parse?ATR=%s", sprint_hex_inrow(card.atr, card.atr_len) );
PrintAndLogEx(INFO, "http://smartcard-atr.appspot.com/parse?ATR=%s", sprint_hex_inrow(card.atr, card.atr_len) );
// print ATR // print ATR
PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "");
PrintAndLogEx(NORMAL, "* ATR:"); PrintAndLogEx(INFO, "ATR");
PrintATR(card.atr, card.atr_len); PrintATR(card.atr, card.atr_len);
// print D/F (brom byte TA1 or defaults) // print D/F (brom byte TA1 or defaults)
PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "");
PrintAndLogEx(NORMAL, "* D/F (TA1):"); PrintAndLogEx(INFO, "D/F (TA1)");
int Di = GetATRDi(card.atr, card.atr_len); int Di = GetATRDi(card.atr, card.atr_len);
int Fi = GetATRFi(card.atr, card.atr_len); int Fi = GetATRFi(card.atr, card.atr_len);
float F = GetATRF(card.atr, card.atr_len); float F = GetATRF(card.atr, card.atr_len);
if (GetATRTA1(card.atr, card.atr_len) == 0x11) if (GetATRTA1(card.atr, card.atr_len) == 0x11)
PrintAndLogEx(INFO, "Using default values..."); PrintAndLogEx(INFO, "Using default values...");
PrintAndLogEx(NORMAL, "Di=%d", Di); PrintAndLogEx(NORMAL, "\t- Di=%d", Di);
PrintAndLogEx(NORMAL, "Fi=%d", Fi); PrintAndLogEx(NORMAL, "\t- Fi=%d", Fi);
PrintAndLogEx(NORMAL, "F=%.1f MHz", F); PrintAndLogEx(NORMAL, "\t- F=%.1f MHz", F);
PrintAndLogEx(NORMAL, "Cycles/ETU=%d", Fi/Di);
PrintAndLogEx(NORMAL, "%.1f bits/sec at 4MHz", (float)4000000 / (Fi/Di)); if (Di && Fi) {
PrintAndLogEx(NORMAL, "%.1f bits/sec at Fmax=%.1fMHz", (F * 1000000) / (Fi/Di), F); PrintAndLogEx(NORMAL, "\t- Cycles/ETU=%d", Fi/Di);
PrintAndLogEx(NORMAL, "\t- %.1f bits/sec at 4MHz", (float)4000000 / (Fi/Di));
PrintAndLogEx(NORMAL, "\t- %.1f bits/sec at Fmax=%.1fMHz", (F * 1000000) / (Fi/Di), F);
} else {
PrintAndLogEx(WARNING, "\t- Di or Fi is RFU.");
};
return 0; return 0;
} }
@ -917,8 +924,9 @@ int CmdSmartBruteforceSFI(const char *Cmd) {
} }
PrintAndLogEx(INFO, "Selecting PPSE aid"); PrintAndLogEx(INFO, "Selecting PPSE aid");
CmdSmartRaw("d 00a404000e325041592e5359532e444446303100"); CmdSmartRaw("s 0 t d 00a404000e325041592e5359532e4444463031");
CmdSmartRaw("d 00a4040007a000000004101000"); CmdSmartRaw("0 t d 00a4040007a000000004101000"); // mastercard
// CmdSmartRaw("0 t d 00a4040007a0000000031010"); // visa
PrintAndLogEx(INFO, "starting"); PrintAndLogEx(INFO, "starting");
@ -937,16 +945,15 @@ int CmdSmartBruteforceSFI(const char *Cmd) {
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
smart_response(data[1], buf); smart_response(buf);
// if 0x6C
if ( buf[0] == 0x6C ) { if ( buf[0] == 0x6C ) {
data[4] = buf[1]; data[4] = buf[1];
memcpy(c.d.asBytes, data, sizeof(data) ); memcpy(c.d.asBytes, data, sizeof(data) );
clearCommandBuffer(); clearCommandBuffer();
SendCommand(&c); SendCommand(&c);
uint8_t len = smart_response(data[1], buf); uint8_t len = smart_response(buf);
// TLV decoder // TLV decoder
if (len > 4) if (len > 4)

143
client/emv/emvcore.c
View file

@ -127,12 +127,12 @@ void TLVPrintFromBuffer(uint8_t *data, int datalen) {
struct tlvdb *t = NULL; struct tlvdb *t = NULL;
t = tlvdb_parse_multi(data, datalen); t = tlvdb_parse_multi(data, datalen);
if (t) { if (t) {
PrintAndLog("-------------------- TLV decoded --------------------"); PrintAndLogEx(NORMAL, "-------------------- TLV decoded --------------------");
tlvdb_visit(t, print_cb, NULL, 0); tlvdb_visit(t, print_cb, NULL, 0);
tlvdb_free(t); tlvdb_free(t);
} else { } else {
PrintAndLog("TLV ERROR: Can't parse response as TLV tree."); PrintAndLogEx(WARNING, "TLV ERROR: Can't parse response as TLV tree.");
} }
} }
@ -148,13 +148,13 @@ void TLVPrintFromTLV(struct tlvdb *tlv) {
} }
void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv) { void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv) {
PrintAndLog("|------------------|--------|-------------------------|"); PrintAndLogEx(NORMAL, "|------------------|--------|-------------------------|");
PrintAndLog("| AID |Priority| Name |"); PrintAndLogEx(NORMAL, "| AID |Priority| Name |");
PrintAndLog("|------------------|--------|-------------------------|"); PrintAndLogEx(NORMAL, "|------------------|--------|-------------------------|");
struct tlvdb *ttmp = tlvdb_find(tlv, 0x6f); struct tlvdb *ttmp = tlvdb_find(tlv, 0x6f);
if (!ttmp) if (!ttmp)
PrintAndLog("| none |"); PrintAndLogEx(NORMAL, "| none |");
while (ttmp) { while (ttmp) {
const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x84, NULL); const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x84, NULL);
@ -162,7 +162,7 @@ void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv) {
const struct tlv *tgPrio = tlvdb_get_inchild(ttmp, 0x87, NULL); const struct tlv *tgPrio = tlvdb_get_inchild(ttmp, 0x87, NULL);
if (!tgAID) if (!tgAID)
break; break;
PrintAndLog("|%s| %s |%s|", PrintAndLogEx(NORMAL, "|%s| %s |%s|",
sprint_hex_inrow_ex(tgAID->value, tgAID->len, 18), sprint_hex_inrow_ex(tgAID->value, tgAID->len, 18),
(tgPrio) ? sprint_hex(tgPrio->value, 1) : " ", (tgPrio) ? sprint_hex(tgPrio->value, 1) : " ",
(tgName) ? sprint_ascii_ex(tgName->value, tgName->len, 25) : " "); (tgName) ? sprint_ascii_ex(tgName->value, tgName->len, 25) : " ");
@ -170,7 +170,7 @@ void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv) {
ttmp = tlvdb_find_next(ttmp, 0x6f); ttmp = tlvdb_find_next(ttmp, 0x6f);
} }
PrintAndLog("|------------------|--------|-------------------------|"); PrintAndLogEx(NORMAL, "|------------------|--------|-------------------------|");
} }
struct tlvdb *GetPANFromTrack2(const struct tlv *track2) { struct tlvdb *GetPANFromTrack2(const struct tlv *track2) {
@ -252,7 +252,7 @@ int EMVExchangeEx(EMVCommandChannel channel, bool ActivateField, bool LeaveField
memcpy(&data[5], apdu.data, apdu.Lc); memcpy(&data[5], apdu.data, apdu.Lc);
if (APDULogging) if (APDULogging)
PrintAndLog(">>>> %s", sprint_hex(data, (IncludeLe?6:5) + apdu.Lc)); PrintAndLogEx(SUCCESS, ">>>> %s", sprint_hex(data, (IncludeLe?6:5) + apdu.Lc));
switch(channel) { switch(channel) {
case ECC_CONTACTLESS: case ECC_CONTACTLESS:
@ -274,7 +274,7 @@ int EMVExchangeEx(EMVCommandChannel channel, bool ActivateField, bool LeaveField
} }
if (APDULogging) if (APDULogging)
PrintAndLog("<<<< %s", sprint_hex(Result, *ResultLen)); PrintAndLogEx(SUCCESS, "<<<< %s", sprint_hex(Result, *ResultLen));
if (*ResultLen < 2) { if (*ResultLen < 2) {
return 200; return 200;
@ -288,9 +288,9 @@ int EMVExchangeEx(EMVCommandChannel channel, bool ActivateField, bool LeaveField
if (isw != 0x9000) { if (isw != 0x9000) {
if (APDULogging) { if (APDULogging) {
if (*sw >> 8 == 0x61) { if (*sw >> 8 == 0x61) {
PrintAndLog("APDU chaining len:%02x -->", *sw & 0xff); PrintAndLogEx(ERR, "APDU chaining len:%02x -->", *sw & 0xff);
} else { } else {
PrintAndLog("APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff)); PrintAndLogEx(ERR, "APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
return 5; return 5;
} }
} }
@ -306,11 +306,11 @@ int EMVExchangeEx(EMVCommandChannel channel, bool ActivateField, bool LeaveField
} }
int EMVExchange(EMVCommandChannel channel, bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) { int EMVExchange(EMVCommandChannel channel, bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
return EMVExchangeEx(channel, false, LeaveFieldON, apdu, true, Result, MaxResultLen, ResultLen, sw, tlv); return EMVExchangeEx(channel, false, LeaveFieldON, apdu, (channel == ECC_CONTACTLESS), Result, MaxResultLen, ResultLen, sw, tlv);
} }
int EMVSelect(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) { int EMVSelect(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
return EMVExchangeEx(channel, ActivateField, LeaveFieldON, (sAPDU){0x00, 0xa4, 0x04, 0x00, AIDLen, AID}, true, Result, MaxResultLen, ResultLen, sw, tlv); return EMVExchangeEx(channel, ActivateField, LeaveFieldON, (sAPDU){0x00, 0xa4, 0x04, 0x00, AIDLen, AID}, (channel == ECC_CONTACTLESS), Result, MaxResultLen, ResultLen, sw, tlv);
} }
int EMVSelectPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw) { int EMVSelectPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw) {
@ -351,7 +351,7 @@ int EMVSearchPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldO
int retrycnt = 0; int retrycnt = 0;
struct tlvdb *ttmp = tlvdb_find_path(t, (tlv_tag_t[]){0x6f, 0xa5, 0xbf0c, 0x61, 0x00}); struct tlvdb *ttmp = tlvdb_find_path(t, (tlv_tag_t[]){0x6f, 0xa5, 0xbf0c, 0x61, 0x00});
if (!ttmp) if (!ttmp)
PrintAndLog("PPSE don't have records."); PrintAndLogEx(FAILED, "PPSE don't have records.");
while (ttmp) { while (ttmp) {
const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x4f, NULL); const struct tlv *tgAID = tlvdb_get_inchild(ttmp, 0x4f, NULL);
@ -365,12 +365,12 @@ int EMVSearchPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldO
} else { } else {
// card select error, proxmark error // card select error, proxmark error
if (res == 1) { if (res == 1) {
PrintAndLog("Exit..."); PrintAndLogEx(WARNING, "Exit...");
return 1; return 1;
} }
retrycnt = 0; retrycnt = 0;
PrintAndLog("Retry failed [%s]. Skiped...", sprint_hex_inrow(tgAID->value, tgAID->len)); PrintAndLogEx(NORMAL, "Retry failed [%s]. Skiped...", sprint_hex_inrow(tgAID->value, tgAID->len));
} }
// next element // next element
@ -381,7 +381,7 @@ int EMVSearchPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldO
// all is ok // all is ok
if (decodeTLV){ if (decodeTLV){
PrintAndLog("%s:", sprint_hex_inrow(tgAID->value, tgAID->len)); PrintAndLogEx(NORMAL, "%s:", sprint_hex_inrow(tgAID->value, tgAID->len));
TLVPrintFromBuffer(data, datalen); TLVPrintFromBuffer(data, datalen);
} }
} }
@ -391,10 +391,10 @@ int EMVSearchPSE(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldO
tlvdb_free(t); tlvdb_free(t);
} else { } else {
PrintAndLog("PPSE ERROR: Can't get TLV from response."); PrintAndLogEx(WARNING, "PPSE ERROR: Can't get TLV from response.");
} }
} else { } else {
PrintAndLog("PPSE ERROR: Can't select PPSE AID. Error: %d", res); PrintAndLogEx(WARNING, "PPSE ERROR: Can't select PPSE AID. Error: %d", res);
} }
if(!LeaveFieldON) if(!LeaveFieldON)
@ -427,7 +427,7 @@ int EMVSearch(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON,
} }
retrycnt = 0; retrycnt = 0;
PrintAndLog("Retry failed [%s]. Skiped...", AIDlist[i].aid); PrintAndLogEx(FAILED, "Retry failed [%s]. Skipped...", AIDlist[i].aid);
} }
continue; continue;
} }
@ -436,8 +436,11 @@ int EMVSearch(EMVCommandChannel channel, bool ActivateField, bool LeaveFieldON,
if (res) if (res)
continue; continue;
if (!datalen)
continue;
if (decodeTLV) { if (decodeTLV) {
PrintAndLog("%s:", AIDlist[i].aid); PrintAndLogEx(SUCCESS, "%s", AIDlist[i].aid);
TLVPrintFromBuffer(data, datalen); TLVPrintFromBuffer(data, datalen);
} }
} }
@ -526,7 +529,7 @@ static struct emv_pk *get_ca_pk(struct tlvdb *db) {
if (!df_tlv || !caidx_tlv || df_tlv->len < 6 || caidx_tlv->len != 1) if (!df_tlv || !caidx_tlv || df_tlv->len < 6 || caidx_tlv->len != 1)
return NULL; return NULL;
PrintAndLog("CA public key index 0x%0x", caidx_tlv->value[0]); PrintAndLogEx(NORMAL, "CA public key index 0x%0x", caidx_tlv->value[0]);
return emv_pk_get_ca_pk(df_tlv->value, caidx_tlv->value[0]); return emv_pk_get_ca_pk(df_tlv->value, caidx_tlv->value[0]);
} }
@ -534,18 +537,18 @@ int trSDA(struct tlvdb *tlv) {
struct emv_pk *pk = get_ca_pk(tlv); struct emv_pk *pk = get_ca_pk(tlv);
if (!pk) { if (!pk) {
PrintAndLog("ERROR: Key not found. Exit."); PrintAndLogEx(WARNING, "Error: Key not found. Exit.");
return 2; return 2;
} }
struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv); struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv);
if (!issuer_pk) { if (!issuer_pk) {
emv_pk_free(pk); emv_pk_free(pk);
PrintAndLog("ERROR: Issuer certificate not found. Exit."); PrintAndLogEx(WARNING, "Error: Issuer certificate not found. Exit.");
return 2; return 2;
} }
PrintAndLog("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx", PrintAndLogEx(SUCCESS, "Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx",
issuer_pk->rid[0], issuer_pk->rid[0],
issuer_pk->rid[1], issuer_pk->rid[1],
issuer_pk->rid[2], issuer_pk->rid[2],
@ -561,19 +564,19 @@ int trSDA(struct tlvdb *tlv) {
if (!sda_tlv || sda_tlv->len < 1) { if (!sda_tlv || sda_tlv->len < 1) {
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
emv_pk_free(pk); emv_pk_free(pk);
PrintAndLog("ERROR: Can't find input list for Offline Data Authentication. Exit."); PrintAndLogEx(WARNING, "Can't find input list for Offline Data Authentication. Exit.");
return 3; return 3;
} }
struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv); struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv);
if (dac_db) { if (dac_db) {
const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL); const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL);
PrintAndLog("SDA verified OK. (%02hhx:%02hhx)\n", dac_tlv->value[0], dac_tlv->value[1]); PrintAndLogEx(NORMAL, "SDA verified OK. (%02hhx:%02hhx)\n", dac_tlv->value[0], dac_tlv->value[1]);
tlvdb_add(tlv, dac_db); tlvdb_add(tlv, dac_db);
} else { } else {
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
emv_pk_free(pk); emv_pk_free(pk);
PrintAndLog("ERROR: SSAD verify error"); PrintAndLogEx(WARNING, "SSAD verify error");
return 4; return 4;
} }
@ -592,24 +595,24 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
struct emv_pk *pk = get_ca_pk(tlv); struct emv_pk *pk = get_ca_pk(tlv);
if (!pk) { if (!pk) {
PrintAndLog("ERROR: Key not found. Exit."); PrintAndLogEx(WARNING, "Error: Key not found. Exit.");
return 2; return 2;
} }
const struct tlv *sda_tlv = tlvdb_get(tlv, 0x21, NULL); const struct tlv *sda_tlv = tlvdb_get(tlv, 0x21, NULL);
if (!sda_tlv || sda_tlv->len < 1) { if (!sda_tlv || sda_tlv->len < 1) {
emv_pk_free(pk); emv_pk_free(pk);
PrintAndLog("ERROR: Can't find input list for Offline Data Authentication. Exit."); PrintAndLogEx(WARNING, "Error: Can't find input list for Offline Data Authentication. Exit.");
return 3; return 3;
} }
struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv); struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv);
if (!issuer_pk) { if (!issuer_pk) {
emv_pk_free(pk); emv_pk_free(pk);
PrintAndLog("ERROR: Issuer certificate not found. Exit."); PrintAndLogEx(WARNING, "Error: Issuer certificate not found. Exit.");
return 2; return 2;
} }
printf("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n", PrintAndLogEx(SUCCESS, "Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
issuer_pk->rid[0], issuer_pk->rid[0],
issuer_pk->rid[1], issuer_pk->rid[1],
issuer_pk->rid[2], issuer_pk->rid[2],
@ -625,10 +628,10 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
if (!icc_pk) { if (!icc_pk) {
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
PrintAndLog("ERROR: ICC setrificate not found. Exit."); PrintAndLogEx(WARNING, "Error: ICC setrificate not found. Exit.");
return 2; return 2;
} }
printf("ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n", PrintAndLogEx(SUCCESS, "ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
icc_pk->rid[0], icc_pk->rid[0],
icc_pk->rid[1], icc_pk->rid[1],
icc_pk->rid[2], icc_pk->rid[2],
@ -642,9 +645,9 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
struct emv_pk *icc_pe_pk = emv_pki_recover_icc_pe_cert(issuer_pk, tlv); struct emv_pk *icc_pe_pk = emv_pki_recover_icc_pe_cert(issuer_pk, tlv);
if (!icc_pe_pk) { if (!icc_pe_pk) {
PrintAndLog("WARNING: ICC PE PK recover error. "); PrintAndLogEx(WARNING, "WARNING: ICC PE PK recover error. ");
} else { } else {
printf("ICC PE PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n", PrintAndLogEx(SUCCESS, "ICC PE PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
icc_pe_pk->rid[0], icc_pe_pk->rid[0],
icc_pe_pk->rid[1], icc_pe_pk->rid[1],
icc_pe_pk->rid[2], icc_pe_pk->rid[2],
@ -662,11 +665,11 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
// DDA with internal authenticate OR fDDA with filled 0x9F4B tag (GPO result) // DDA with internal authenticate OR fDDA with filled 0x9F4B tag (GPO result)
// EMV kernel3 v2.4, contactless book C-3, C.1., page 147 // EMV kernel3 v2.4, contactless book C-3, C.1., page 147
if (sdad_tlv) { if (sdad_tlv) {
PrintAndLog("\n* * Got Signed Dynamic Application Data (9F4B) form GPO. Maybe fDDA..."); PrintAndLogEx(NORMAL, "\n* * Got Signed Dynamic Application Data (9F4B) form GPO. Maybe fDDA...");
const struct tlvdb *atc_db = emv_pki_recover_atc_ex(icc_pk, tlv, true); const struct tlvdb *atc_db = emv_pki_recover_atc_ex(icc_pk, tlv, true);
if (!atc_db) { if (!atc_db) {
PrintAndLog("ERROR: Can't recover IDN (ICC Dynamic Number)"); PrintAndLogEx(WARNING, "Error: Can't recover IDN (ICC Dynamic Number)");
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
emv_pk_free(icc_pk); emv_pk_free(icc_pk);
@ -676,17 +679,17 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
// 9f36 Application Transaction Counter (ATC) // 9f36 Application Transaction Counter (ATC)
const struct tlv *atc_tlv = tlvdb_get(atc_db, 0x9f36, NULL); const struct tlv *atc_tlv = tlvdb_get(atc_db, 0x9f36, NULL);
if(atc_tlv) { if(atc_tlv) {
PrintAndLog("\nATC (Application Transaction Counter) [%zu] %s", atc_tlv->len, sprint_hex_inrow(atc_tlv->value, atc_tlv->len)); PrintAndLogEx(NORMAL, "\nATC (Application Transaction Counter) [%zu] %s", atc_tlv->len, sprint_hex_inrow(atc_tlv->value, atc_tlv->len));
const struct tlv *core_atc_tlv = tlvdb_get(tlv, 0x9f36, NULL); const struct tlv *core_atc_tlv = tlvdb_get(tlv, 0x9f36, NULL);
if(tlv_equal(core_atc_tlv, atc_tlv)) { if(tlv_equal(core_atc_tlv, atc_tlv)) {
PrintAndLog("ATC check OK."); PrintAndLogEx(SUCCESS, "ATC check OK.");
PrintAndLog("fDDA (fast DDA) verified OK."); PrintAndLogEx(SUCCESS, "fDDA (fast DDA) verified OK.");
} else { } else {
PrintAndLog("ERROR: fDDA verified, but ATC in the certificate and ATC in the record not the same."); PrintAndLogEx(WARNING, "Error: fDDA verified, but ATC in the certificate and ATC in the record not the same.");
} }
} else { } else {
PrintAndLog("\nERROR: fDDA (fast DDA) verify error"); PrintAndLogEx(NORMAL, "\nERROR: fDDA (fast DDA) verify error");
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
emv_pk_free(icc_pk); emv_pk_free(icc_pk);
@ -696,35 +699,35 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv); struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv);
if (dac_db) { if (dac_db) {
const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL); const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL);
printf("SDA verified OK. (%02hhx:%02hhx)\n", dac_tlv->value[0], dac_tlv->value[1]); PrintAndLogEx(NORMAL, "SDA verified OK. (%02hhx:%02hhx)\n", dac_tlv->value[0], dac_tlv->value[1]);
tlvdb_add(tlv, dac_db); tlvdb_add(tlv, dac_db);
} else { } else {
PrintAndLog("ERROR: SSAD verify error"); PrintAndLogEx(WARNING, "Error: SSAD verify error");
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
emv_pk_free(icc_pk); emv_pk_free(icc_pk);
return 4; return 4;
} }
PrintAndLog("\n* Calc DDOL"); PrintAndLogEx(NORMAL, "\n* Calc DDOL");
const struct tlv *ddol_tlv = tlvdb_get(tlv, 0x9f49, NULL); const struct tlv *ddol_tlv = tlvdb_get(tlv, 0x9f49, NULL);
if (!ddol_tlv) { if (!ddol_tlv) {
ddol_tlv = &default_ddol_tlv; ddol_tlv = &default_ddol_tlv;
PrintAndLog("DDOL [9f49] not found. Using default DDOL"); PrintAndLogEx(NORMAL, "DDOL [9f49] not found. Using default DDOL");
} }
struct tlv *ddol_data_tlv = dol_process(ddol_tlv, tlv, 0); struct tlv *ddol_data_tlv = dol_process(ddol_tlv, tlv, 0);
if (!ddol_data_tlv) { if (!ddol_data_tlv) {
PrintAndLog("ERROR: Can't create DDOL TLV"); PrintAndLogEx(WARNING, "Error: Can't create DDOL TLV");
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
emv_pk_free(icc_pk); emv_pk_free(icc_pk);
return 5; return 5;
} }
PrintAndLog("DDOL data[%d]: %s", ddol_data_tlv->len, sprint_hex(ddol_data_tlv->value, ddol_data_tlv->len)); PrintAndLogEx(NORMAL, "DDOL data[%d]: %s", ddol_data_tlv->len, sprint_hex(ddol_data_tlv->value, ddol_data_tlv->len));
PrintAndLog("\n* Internal Authenticate"); PrintAndLogEx(NORMAL, "\n* Internal Authenticate");
int res = EMVInternalAuthenticate(channel, true, (uint8_t *)ddol_data_tlv->value, ddol_data_tlv->len, buf, sizeof(buf), &len, &sw, NULL); int res = EMVInternalAuthenticate(channel, true, (uint8_t *)ddol_data_tlv->value, ddol_data_tlv->len, buf, sizeof(buf), &len, &sw, NULL);
if (res) { if (res) {
PrintAndLogEx(WARNING, "Internal Authenticate error(%d): %4x. Exit...", res, sw); PrintAndLogEx(WARNING, "Internal Authenticate error(%d): %4x. Exit...", res, sw);
@ -738,20 +741,20 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
struct tlvdb *dda_db = NULL; struct tlvdb *dda_db = NULL;
if (buf[0] == 0x80) { if (buf[0] == 0x80) {
if (len < 3 ) { if (len < 3 ) {
PrintAndLog("ERROR: Internal Authenticate format1 parsing error. length=%d", len); PrintAndLogEx(WARNING, "Error: Internal Authenticate format1 parsing error. length=%d", len);
} else { } else {
// 9f4b Signed Dynamic Application Data // 9f4b Signed Dynamic Application Data
dda_db = tlvdb_fixed(0x9f4b, len - 2, buf + 2); dda_db = tlvdb_fixed(0x9f4b, len - 2, buf + 2);
tlvdb_add(tlv, dda_db); tlvdb_add(tlv, dda_db);
if (decodeTLV){ if (decodeTLV){
PrintAndLog("* * Decode response format 1:"); PrintAndLogEx(NORMAL, "* * Decode response format 1:");
TLVPrintFromTLV(dda_db); TLVPrintFromTLV(dda_db);
} }
} }
} else { } else {
dda_db = tlvdb_parse_multi(buf, len); dda_db = tlvdb_parse_multi(buf, len);
if(!dda_db) { if(!dda_db) {
PrintAndLog("ERROR: Can't parse Internal Authenticate result as TLV"); PrintAndLogEx(WARNING, "Error: Can't parse Internal Authenticate result as TLV");
free(ddol_data_tlv); free(ddol_data_tlv);
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
@ -767,7 +770,7 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
struct tlvdb *idn_db = emv_pki_recover_idn_ex(icc_pk, dda_db, ddol_data_tlv, true); struct tlvdb *idn_db = emv_pki_recover_idn_ex(icc_pk, dda_db, ddol_data_tlv, true);
free(ddol_data_tlv); free(ddol_data_tlv);
if (!idn_db) { if (!idn_db) {
PrintAndLog("ERROR: Can't recover IDN (ICC Dynamic Number)"); PrintAndLogEx(WARNING, "Error: Can't recover IDN (ICC Dynamic Number)");
tlvdb_free(dda_db); tlvdb_free(dda_db);
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
@ -779,12 +782,12 @@ int trDDA(EMVCommandChannel channel, bool decodeTLV, struct tlvdb *tlv) {
// 9f4c ICC Dynamic Number // 9f4c ICC Dynamic Number
const struct tlv *idn_tlv = tlvdb_get(idn_db, 0x9f4c, NULL); const struct tlv *idn_tlv = tlvdb_get(idn_db, 0x9f4c, NULL);
if(idn_tlv) { if(idn_tlv) {
PrintAndLog("\nIDN (ICC Dynamic Number) [%zu] %s", idn_tlv->len, sprint_hex_inrow(idn_tlv->value, idn_tlv->len)); PrintAndLogEx(NORMAL, "\nIDN (ICC Dynamic Number) [%zu] %s", idn_tlv->len, sprint_hex_inrow(idn_tlv->value, idn_tlv->len));
PrintAndLog("DDA verified OK."); PrintAndLogEx(NORMAL, "DDA verified OK.");
tlvdb_add(tlv, idn_db); tlvdb_add(tlv, idn_db);
tlvdb_free(idn_db); tlvdb_free(idn_db);
} else { } else {
PrintAndLog("\nERROR: DDA verify error"); PrintAndLogEx(NORMAL, "\nERROR: DDA verify error");
tlvdb_free(idn_db); tlvdb_free(idn_db);
emv_pk_free(pk); emv_pk_free(pk);
@ -804,24 +807,24 @@ int trCDA(struct tlvdb *tlv, struct tlvdb *ac_tlv, struct tlv *pdol_data_tlv, st
struct emv_pk *pk = get_ca_pk(tlv); struct emv_pk *pk = get_ca_pk(tlv);
if (!pk) { if (!pk) {
PrintAndLog("ERROR: Key not found. Exit."); PrintAndLogEx(WARNING, "Error: Key not found. Exit.");
return 2; return 2;
} }
const struct tlv *sda_tlv = tlvdb_get(tlv, 0x21, NULL); const struct tlv *sda_tlv = tlvdb_get(tlv, 0x21, NULL);
if (!sda_tlv || sda_tlv->len < 1) { if (!sda_tlv || sda_tlv->len < 1) {
PrintAndLog("ERROR: Can't find input list for Offline Data Authentication. Exit."); PrintAndLogEx(WARNING, "Error: Can't find input list for Offline Data Authentication. Exit.");
emv_pk_free(pk); emv_pk_free(pk);
return 3; return 3;
} }
struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv); struct emv_pk *issuer_pk = emv_pki_recover_issuer_cert(pk, tlv);
if (!issuer_pk) { if (!issuer_pk) {
PrintAndLog("ERROR: Issuer certificate not found. Exit."); PrintAndLogEx(WARNING, "Error: Issuer certificate not found. Exit.");
emv_pk_free(pk); emv_pk_free(pk);
return 2; return 2;
} }
printf("Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n", PrintAndLogEx(SUCCESS, "Issuer PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
issuer_pk->rid[0], issuer_pk->rid[0],
issuer_pk->rid[1], issuer_pk->rid[1],
issuer_pk->rid[2], issuer_pk->rid[2],
@ -835,12 +838,12 @@ int trCDA(struct tlvdb *tlv, struct tlvdb *ac_tlv, struct tlv *pdol_data_tlv, st
struct emv_pk *icc_pk = emv_pki_recover_icc_cert(issuer_pk, tlv, sda_tlv); struct emv_pk *icc_pk = emv_pki_recover_icc_cert(issuer_pk, tlv, sda_tlv);
if (!icc_pk) { if (!icc_pk) {
PrintAndLog("ERROR: ICC setrificate not found. Exit."); PrintAndLogEx(WARNING, "Error: ICC setrificate not found. Exit.");
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
return 2; return 2;
} }
printf("ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n", PrintAndLogEx(SUCCESS, "ICC PK recovered. RID %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx CSN %02hhx:%02hhx:%02hhx\n",
icc_pk->rid[0], icc_pk->rid[0],
icc_pk->rid[1], icc_pk->rid[1],
icc_pk->rid[2], icc_pk->rid[2],
@ -855,17 +858,17 @@ int trCDA(struct tlvdb *tlv, struct tlvdb *ac_tlv, struct tlv *pdol_data_tlv, st
struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv); struct tlvdb *dac_db = emv_pki_recover_dac(issuer_pk, tlv, sda_tlv);
if (dac_db) { if (dac_db) {
const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL); const struct tlv *dac_tlv = tlvdb_get(dac_db, 0x9f45, NULL);
PrintAndLog("SSAD verified OK. (%02hhx:%02hhx)", dac_tlv->value[0], dac_tlv->value[1]); PrintAndLogEx(NORMAL, "SSAD verified OK. (%02hhx:%02hhx)", dac_tlv->value[0], dac_tlv->value[1]);
tlvdb_add(tlv, dac_db); tlvdb_add(tlv, dac_db);
} else { } else {
PrintAndLog("ERROR: SSAD verify error"); PrintAndLogEx(WARNING, "Error: SSAD verify error");
emv_pk_free(pk); emv_pk_free(pk);
emv_pk_free(issuer_pk); emv_pk_free(issuer_pk);
emv_pk_free(icc_pk); emv_pk_free(icc_pk);
return 4; return 4;
} }
PrintAndLog("\n* * Check Signed Dynamic Application Data (SDAD)"); PrintAndLogEx(NORMAL, "\n* * Check Signed Dynamic Application Data (SDAD)");
struct tlvdb *idn_db = emv_pki_perform_cda_ex(icc_pk, tlv, ac_tlv, struct tlvdb *idn_db = emv_pki_perform_cda_ex(icc_pk, tlv, ac_tlv,
pdol_data_tlv, // pdol pdol_data_tlv, // pdol
ac_data_tlv, // cdol1 ac_data_tlv, // cdol1
@ -873,11 +876,11 @@ int trCDA(struct tlvdb *tlv, struct tlvdb *ac_tlv, struct tlv *pdol_data_tlv, st
true); true);
if (idn_db) { if (idn_db) {
const struct tlv *idn_tlv = tlvdb_get(idn_db, 0x9f4c, NULL); const struct tlv *idn_tlv = tlvdb_get(idn_db, 0x9f4c, NULL);
PrintAndLog("\nIDN (ICC Dynamic Number) [%zu] %s", idn_tlv->len, sprint_hex_inrow(idn_tlv->value, idn_tlv->len)); PrintAndLogEx(NORMAL, "\nIDN (ICC Dynamic Number) [%zu] %s", idn_tlv->len, sprint_hex_inrow(idn_tlv->value, idn_tlv->len));
PrintAndLog("CDA verified OK."); PrintAndLogEx(NORMAL, "CDA verified OK.");
tlvdb_add(tlv, idn_db); tlvdb_add(tlv, idn_db);
} else { } else {
PrintAndLog("\nERROR: CDA verify error"); PrintAndLogEx(NORMAL, "\nERROR: CDA verify error");
} }
emv_pk_free(pk); emv_pk_free(pk);

3
include/smartcard.h
View file

@ -22,7 +22,8 @@ typedef enum SMARTCARD_COMMAND {
SC_CONNECT = (1 << 0), SC_CONNECT = (1 << 0),
SC_NO_DISCONNECT = (1 << 1), SC_NO_DISCONNECT = (1 << 1),
SC_RAW = (1 << 2), SC_RAW = (1 << 2),
SC_SELECT = (1 << 3) SC_SELECT = (1 << 3),
SC_RAW_T0 = (1 << 4)
} smartcard_command_t; } smartcard_command_t;