fix 'hf iclass chk'

* Check for Credidt Keys as well
* reduce authentication tries from 6 to 3
* correct text in 'hf iclass clone' for 'l' parameter
* some reformatting and whitespace fixes
This commit is contained in:
pwpiwi 2019-12-02 07:37:31 +01:00
commit f3a75efb1c
3 changed files with 53 additions and 74 deletions

View file

@ -646,8 +646,8 @@ static void ReaderTransmitIClass(uint8_t *frame, int len, uint32_t *start_time)
static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size, static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size,
uint8_t expected_size, uint8_t retries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) { uint8_t expected_size, uint8_t tries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
while (retries-- > 0) { while (tries-- > 0) {
ReaderTransmitIClass(command, cmdsize, &start_time); ReaderTransmitIClass(command, cmdsize, &start_time);
if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) { if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
return true; return true;
@ -781,7 +781,7 @@ void iClass_Check(uint8_t *NRMAC) {
uint8_t resp[4]; uint8_t resp[4];
memcpy(check+1, NRMAC, 8); memcpy(check+1, NRMAC, 8);
uint32_t eof_time; uint32_t eof_time;
bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp)); cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
} }
@ -793,7 +793,7 @@ void iClass_Readcheck(uint8_t block, bool use_credit_key) {
} }
uint8_t resp[8]; uint8_t resp[8];
uint32_t eof_time; uint32_t eof_time;
bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp)); cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
} }
@ -892,24 +892,24 @@ void iClass_WriteBlock(uint8_t blockNo, uint8_t *data) {
void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) { void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
LED_A_ON();
int i; int i;
int written = 0; int written = 0;
int total_block = (endblock - startblock) + 1; int total_blocks = (endblock - startblock) + 1;
for (i = 0; i < total_block; i++) {
for (i = 0; i < total_blocks; i++) {
// block number // block number
if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){ if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
Dbprintf("Write block [%02x] successful", i + startblock); Dbprintf("Write block [%02x] successful", i + startblock);
written++; written++;
} else { } else {
if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){ Dbprintf("Write block [%02x] failed", i + startblock);
Dbprintf("Write block [%02x] successful", i + startblock);
written++;
} else {
Dbprintf("Write block [%02x] failed", i + startblock);
}
} }
} }
if (written == total_block)
if (written == total_blocks)
Dbprintf("Clone complete"); Dbprintf("Clone complete");
else else
Dbprintf("Clone incomplete"); Dbprintf("Clone incomplete");
@ -917,5 +917,6 @@ void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
cmd_send(CMD_ACK, 1, 0, 0, 0, 0); cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF(); LED_D_OFF();
LED_A_OFF(); LED_A_OFF();
} }

View file

@ -192,7 +192,7 @@ static int CmdHFiClassSnoop(const char *Cmd) {
bool jam_epurse_update = arg_get_lit(1); bool jam_epurse_update = arg_get_lit(1);
const uint8_t update_epurse_sequence[2] = {0x87, 0x02}; const uint8_t update_epurse_sequence[2] = {0x87, 0x02};
UsbCommand c = {CMD_SNOOP_ICLASS, {0}}; UsbCommand c = {CMD_SNOOP_ICLASS, {0}};
if (jam_epurse_update) { if (jam_epurse_update) {
c.arg[0] = sizeof(update_epurse_sequence); c.arg[0] = sizeof(update_epurse_sequence);
@ -704,7 +704,7 @@ static bool iClass_authenticate(uint8_t *CSN, uint8_t *KEY, uint8_t *MAC, uint8_
} else if (elite) { } else if (elite) {
strcpy(keytypetext, "Elite diversified key"); strcpy(keytypetext, "Elite diversified key");
} }
if (verbose) PrintAndLog("Authenticating with %s: %s", keytypetext, sprint_hex(div_key, 8)); if (verbose) PrintAndLog("Authenticating with %s: %s", keytypetext, sprint_hex(div_key, 8));
UsbCommand resp; UsbCommand resp;
@ -917,7 +917,7 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n"); PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
errors = true; errors = true;
} }
if (errors || cmdp < 2) { if (errors || cmdp < 2) {
usage_hf_iclass_dump(); usage_hf_iclass_dump();
return 0; return 0;
@ -1118,7 +1118,7 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) {
bool errors = false; bool errors = false;
uint8_t cmdp = 0; uint8_t cmdp = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch(param_getchar(Cmd, cmdp)) { switch(param_getchar(Cmd, cmdp)) {
case 'h': case 'h':
case 'H': case 'H':
@ -1189,7 +1189,7 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) {
PrintAndLog("You cannot combine the 'e' and 'r' options\n"); PrintAndLog("You cannot combine the 'e' and 'r' options\n");
errors = true; errors = true;
} }
if (cmdp < 6) { if (cmdp < 6) {
usage_hf_iclass_writeblock(); usage_hf_iclass_writeblock();
return 0; return 0;
@ -1205,7 +1205,7 @@ static void usage_hf_iclass_clone(void) {
PrintAndLog("Options:"); PrintAndLog("Options:");
PrintAndLog(" f <filename>: specify a filename to clone from"); PrintAndLog(" f <filename>: specify a filename to clone from");
PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols"); PrintAndLog(" b <Block> : The first block to clone as 2 hex symbols");
PrintAndLog(" l <Last Blk>: Set the Data to write as 16 hex symbols"); PrintAndLog(" l <Last Blk>: The last block to clone as 2 hex symbols");
PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory"); PrintAndLog(" k <Key> : Access Key as 16 hex symbols or 1 hex to select key from memory");
PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n"); PrintAndLog(" c : If 'c' is specified, the key set is assumed to be the credit key\n");
PrintAndLog(" e : If 'e' is specified, elite computations applied to key"); PrintAndLog(" e : If 'e' is specified, elite computations applied to key");
@ -1231,9 +1231,9 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
bool rawkey = false; bool rawkey = false;
bool errors = false; bool errors = false;
uint8_t cmdp = 0; uint8_t cmdp = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch(param_getchar(Cmd, cmdp)) { switch (param_getchar(Cmd, cmdp)) {
case 'h': case 'h':
case 'H': case 'H':
usage_hf_iclass_clone(); usage_hf_iclass_clone();
@ -1287,7 +1287,7 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
case 'l': case 'l':
case 'L': case 'L':
if (param_gethex(Cmd, cmdp+1, &endblock, 2)) { if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
PrintAndLog("Start Block No must include 2 HEX symbols\n"); PrintAndLog("Last Block No must include 2 HEX symbols\n");
errors = true; errors = true;
} }
cmdp += 2; cmdp += 2;
@ -1356,7 +1356,7 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}}; UsbCommand w = {CMD_ICLASS_CLONE, {startblock, endblock}};
uint8_t *ptr; uint8_t *ptr;
// calculate all mac for every the block we will write // calculate all mac for every the block we will write
for (i = startblock; i <= endblock; i++){ for (i = startblock; i <= endblock; i++) {
Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC); Calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC);
// usb command d start pointer = d + (i - 6) * 12 // usb command d start pointer = d + (i - 6) * 12
// memcpy(pointer,tag_data[i - 6],8) 8 bytes // memcpy(pointer,tag_data[i - 6],8) 8 bytes
@ -1376,12 +1376,12 @@ static int CmdHFiClassCloneTag(const char *Cmd) {
UsbCommand resp; UsbCommand resp;
SendCommand(&w); SendCommand(&w);
if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) if (!WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
{
PrintAndLog("Command execute timeout"); PrintAndLog("Command execute timeout");
DropField(); DropField();
return 0; return 0;
} }
return 1; return 1;
} }
@ -1517,7 +1517,7 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) {
break; break;
} }
} }
if (elite + rawkey + NRMAC_replay > 1) { if (elite + rawkey + NRMAC_replay > 1) {
PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n"); PrintAndLog("You cannot combine the 'e', 'r', and 'n' options\n");
errors = true; errors = true;
@ -1705,7 +1705,7 @@ static int CmdHFiClassCalcNewKey(const char *Cmd) {
bool elite = false; bool elite = false;
bool errors = false; bool errors = false;
uint8_t cmdp = 0; uint8_t cmdp = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch(param_getchar(Cmd, cmdp)) { switch(param_getchar(Cmd, cmdp)) {
case 'h': case 'h':
@ -1991,12 +1991,12 @@ static int CmdHFiClassCheckKeys(const char *Cmd) {
bool found_credit = false; bool found_credit = false;
bool errors = false; bool errors = false;
uint8_t cmdp = 0x00; uint8_t cmdp = 0x00;
FILE * f; FILE *f;
char filename[FILE_PATH_SIZE] = {0}; char filename[FILE_PATH_SIZE] = {0};
uint8_t fileNameLen = 0; uint8_t fileNameLen = 0;
char buf[17]; char buf[17];
uint8_t *keyBlock = NULL, *p; uint8_t *keyBlock = NULL, *p;
int keyitems = 0, keycnt = 0; int keycnt = 0;
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
switch (param_getchar(Cmd, cmdp)) { switch (param_getchar(Cmd, cmdp)) {
@ -2035,27 +2035,27 @@ static int CmdHFiClassCheckKeys(const char *Cmd) {
return 0; return 0;
} }
if ( !(f = fopen( filename , "r")) ) { if (!(f = fopen(filename , "r"))) {
PrintAndLog("File: %s: not found or locked.", filename); PrintAndLog("File %s not found or locked.", filename);
return 1; return 1;
} }
while( fgets(buf, sizeof(buf), f) ){ while (fgets(buf, sizeof(buf), f)) {
if (strlen(buf) < 16 || buf[15] == '\n') if (strlen(buf) < 16 || buf[15] == '\n')
continue; continue;
while (fgetc(f) != '\n' && !feof(f)) ; //goto next line while (fgetc(f) != '\n' && !feof(f)) ; //goto next line
if( buf[0]=='#' ) continue; //The line start with # is comment, skip if (buf[0] == '#') continue; //The line start with # is comment, skip
if (!isxdigit(buf[0])){ if (!isxdigit(buf[0])){
PrintAndLog("File content error. '%s' must include 16 HEX symbols",buf); PrintAndLog("File content error. '%s' must include 16 HEX symbols", buf);
continue; continue;
} }
buf[16] = 0; buf[16] = 0;
p = realloc(keyBlock, 8 * (keyitems += 64)); p = realloc(keyBlock, 8 * (keycnt + 1));
if (!p) { if (!p) {
PrintAndLog("Cannot allocate memory for default keys"); PrintAndLog("Cannot allocate memory for default keys");
free(keyBlock); free(keyBlock);
@ -2067,60 +2067,39 @@ static int CmdHFiClassCheckKeys(const char *Cmd) {
memset(keyBlock + 8 * keycnt, 0, 8); memset(keyBlock + 8 * keycnt, 0, 8);
num_to_bytes(strtoull(buf, NULL, 16), 8, keyBlock + 8 * keycnt); num_to_bytes(strtoull(buf, NULL, 16), 8, keyBlock + 8 * keycnt);
//PrintAndLog("check key[%2d] %016" PRIx64, keycnt, bytes_to_num(keyBlock + 8*keycnt, 8));
keycnt++; keycnt++;
memset(buf, 0, sizeof(buf)); memset(buf, 0, sizeof(buf));
} }
fclose(f); fclose(f);
PrintAndLog("Loaded %2d keys from %s", keycnt, filename); PrintAndLog("Loaded %2d keys from %s", keycnt, filename);
// time
uint64_t t1 = msclock();
uint8_t CSN[8]; uint8_t CSN[8];
if (!iClass_select(CSN, false, true, true)) { if (!iClass_select(CSN, false, true, true)) {
PrintAndLog("Couldn't select card");
DropField(); DropField();
return 0; return 0;
} }
for (uint32_t c = 0; c < keycnt; c++) { for (uint32_t c = 0; c < keycnt; c++) {
printf("."); fflush(stdout);
if (ukbhit()) {
int gc = getchar(); (void)gc;
printf("\naborted via keyboard!\n");
break;
}
memcpy(key, keyBlock + 8 * c , 8); memcpy(key, keyBlock + 8 * c, 8);
// debit key // debit key
if (!iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false, false)) if (iClass_authenticate(CSN, key, mac, div_key, false, use_elite, use_raw, false, false)) {
continue; PrintAndLog("\n Found AA1 debit key\t\t[%s]", sprint_hex(key, 8));
found_debit = true;
// key found. }
PrintAndLog("\n--------------------------------------------------------");
PrintAndLog(" Found AA1 debit key\t\t[%s]", sprint_hex(key, 8));
found_debit = true;
// credit key // credit key
if (!iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false, false)) if (iClass_authenticate(CSN, key, mac, div_key, true, use_elite, use_raw, false, false)) {
continue; PrintAndLog("\n Found AA2 credit key\t\t[%s]", sprint_hex(key, 8));
found_credit = true;
// key found }
PrintAndLog("\n--------------------------------------------------------");
PrintAndLog(" Found AA2 credit key\t\t[%s]", sprint_hex(key, 8));
found_credit = true;
// both keys found. // both keys found.
if (found_debit && found_credit) if (found_debit && found_credit)
break; break;
} }
t1 = msclock() - t1;
PrintAndLog("\nTime in iclass checkkeys: %.0f seconds\n", (float)t1/1000.0);
DropField(); DropField();
free(keyBlock); free(keyBlock);
PrintAndLog(""); PrintAndLog("");

View file

@ -169,23 +169,22 @@ void hex_to_buffer(const uint8_t *buf, const uint8_t *hex_data, const size_t hex
const size_t min_str_len, const size_t spaces_between, bool uppercase) { const size_t min_str_len, const size_t spaces_between, bool uppercase) {
char *tmp = (char *)buf; char *tmp = (char *)buf;
size_t i;
memset(tmp, 0x00, hex_max_len);
int maxLen = ( hex_len > hex_max_len) ? hex_max_len : hex_len; int maxLen = (hex_len > hex_max_len) ? hex_max_len : hex_len;
for (i = 0; i < maxLen; ++i, tmp += 2 + spaces_between) { for (int i = 0; i < maxLen; ++i, tmp += 2 + spaces_between) {
sprintf(tmp, (uppercase) ? "%02X" : "%02x", (unsigned int) hex_data[i]); sprintf(tmp, (uppercase) ? "%02X" : "%02x", (unsigned int) hex_data[i]);
for (int j = 0; j < spaces_between; j++) if (i != maxLen - 1)
sprintf(tmp + 2 + j, " "); for (int j = 0; j < spaces_between; j++)
sprintf(tmp + 2 + j, " ");
} }
i *= (2 + spaces_between); size_t len = strlen(tmp);
int minStrLen = min_str_len > i ? min_str_len : 0; int minStrLen = min_str_len > len ? min_str_len : 0;
if (minStrLen > hex_max_len) if (minStrLen > hex_max_len)
minStrLen = hex_max_len; minStrLen = hex_max_len;
for(; i < minStrLen; i++, tmp += 1) for (int i = len; i < minStrLen; i++, tmp += 1)
sprintf(tmp, " "); sprintf(tmp, " ");
return; return;