#include "picopass_device.h" #include <toolbox/path.h> #include <flipper_format/flipper_format.h> #include <Picopass_icons.h> #define TAG "PicopassDevice" static const char* picopass_file_header = "Flipper Picopass device"; static const uint32_t picopass_file_version = 1; const uint8_t picopass_iclass_decryptionkey[] = {0xb4, 0x21, 0x2c, 0xca, 0xb7, 0xed, 0x21, 0x0f, 0x7b, 0x93, 0xd4, 0x59, 0x39, 0xc7, 0xdd, 0x36}; PicopassDevice* picopass_device_alloc() { PicopassDevice* picopass_dev = malloc(sizeof(PicopassDevice)); picopass_dev->dev_data.pacs.legacy = false; picopass_dev->dev_data.pacs.se_enabled = false; picopass_dev->dev_data.pacs.pin_length = 0; picopass_dev->storage = furi_record_open(RECORD_STORAGE); picopass_dev->dialogs = furi_record_open(RECORD_DIALOGS); picopass_dev->load_path = furi_string_alloc(); return picopass_dev; } void picopass_device_set_name(PicopassDevice* dev, const char* name) { furi_assert(dev); strlcpy(dev->dev_name, name, PICOPASS_DEV_NAME_MAX_LEN); } static bool picopass_device_save_file( PicopassDevice* dev, const char* dev_name, const char* folder, const char* extension, bool use_load_path) { furi_assert(dev); bool saved = false; FlipperFormat* file = flipper_format_file_alloc(dev->storage); PicopassPacs* pacs = &dev->dev_data.pacs; PicopassBlock* AA1 = dev->dev_data.AA1; FuriString* temp_str; temp_str = furi_string_alloc(); do { if(use_load_path && !furi_string_empty(dev->load_path)) { // Get directory name path_extract_dirname(furi_string_get_cstr(dev->load_path), temp_str); // Make path to file to save furi_string_cat_printf(temp_str, "/%s%s", dev_name, extension); } else { // First remove picopass device file if it was saved furi_string_printf(temp_str, "%s/%s%s", folder, dev_name, extension); } // Open file if(!flipper_format_file_open_always(file, furi_string_get_cstr(temp_str))) break; if(dev->format == PicopassDeviceSaveFormatHF) { uint32_t fc = pacs->record.FacilityCode; uint32_t cn = pacs->record.CardNumber; // Write header if(!flipper_format_write_header_cstr(file, picopass_file_header, picopass_file_version)) break; if(pacs->record.valid) { if(!flipper_format_write_uint32(file, "Facility Code", &fc, 1)) break; if(!flipper_format_write_uint32(file, "Card Number", &cn, 1)) break; if(!flipper_format_write_hex( file, "Credential", pacs->credential, PICOPASS_BLOCK_LEN)) break; if(pacs->pin_length > 0) { if(!flipper_format_write_hex(file, "PIN\t\t", pacs->pin0, PICOPASS_BLOCK_LEN)) break; if(!flipper_format_write_hex( file, "PIN(cont.)\t", pacs->pin1, PICOPASS_BLOCK_LEN)) break; } } if(!flipper_format_write_comment_cstr(file, "Picopass blocks")) break; bool block_saved = true; size_t app_limit = AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[0] < PICOPASS_MAX_APP_LIMIT ? AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[0] : PICOPASS_MAX_APP_LIMIT; for(size_t i = 0; i < app_limit; i++) { furi_string_printf(temp_str, "Block %d", i); if(!flipper_format_write_hex( file, furi_string_get_cstr(temp_str), AA1[i].data, PICOPASS_BLOCK_LEN)) { block_saved = false; break; } } if(!block_saved) break; } else if(dev->format == PicopassDeviceSaveFormatLF) { const char* lf_header = "Flipper RFID key"; // Write header if(!flipper_format_write_header_cstr(file, lf_header, 1)) break; if(!flipper_format_write_comment_cstr( file, "This was generated from the Picopass plugin and may not match current lfrfid")) break; // When lfrfid supports more formats, update this if(!flipper_format_write_string_cstr(file, "Key type", "H10301")) break; uint8_t H10301[3] = {0}; H10301[0] = pacs->record.FacilityCode; H10301[1] = pacs->record.CardNumber >> 8; H10301[2] = pacs->record.CardNumber & 0x00FF; if(!flipper_format_write_hex(file, "Data", H10301, 3)) break; } saved = true; } while(0); if(!saved) { dialog_message_show_storage_error(dev->dialogs, "Can not save\nfile"); } furi_string_free(temp_str); flipper_format_free(file); return saved; } bool picopass_device_save(PicopassDevice* dev, const char* dev_name) { if(dev->format == PicopassDeviceSaveFormatHF) { return picopass_device_save_file( dev, dev_name, STORAGE_APP_DATA_PATH_PREFIX, PICOPASS_APP_EXTENSION, true); } else if(dev->format == PicopassDeviceSaveFormatLF) { return picopass_device_save_file(dev, dev_name, ANY_PATH("lfrfid"), ".rfid", true); } return false; } static bool picopass_device_load_data(PicopassDevice* dev, FuriString* path, bool show_dialog) { bool parsed = false; FlipperFormat* file = flipper_format_file_alloc(dev->storage); PicopassBlock* AA1 = dev->dev_data.AA1; PicopassPacs* pacs = &dev->dev_data.pacs; FuriString* temp_str; temp_str = furi_string_alloc(); bool deprecated_version = false; if(dev->loading_cb) { dev->loading_cb(dev->loading_cb_ctx, true); } do { if(!flipper_format_file_open_existing(file, furi_string_get_cstr(path))) break; // Read and verify file header uint32_t version = 0; if(!flipper_format_read_header(file, temp_str, &version)) break; if(furi_string_cmp_str(temp_str, picopass_file_header) || (version != picopass_file_version)) { deprecated_version = true; break; } // Parse header blocks bool block_read = true; for(size_t i = 0; i < 6; i++) { furi_string_printf(temp_str, "Block %d", i); if(!flipper_format_read_hex( file, furi_string_get_cstr(temp_str), AA1[i].data, PICOPASS_BLOCK_LEN)) { block_read = false; break; } } size_t app_limit = AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[0]; // Fix for unpersonalized cards that have app_limit set to 0xFF if(app_limit > PICOPASS_MAX_APP_LIMIT) app_limit = PICOPASS_MAX_APP_LIMIT; for(size_t i = 6; i < app_limit; i++) { furi_string_printf(temp_str, "Block %d", i); if(!flipper_format_read_hex( file, furi_string_get_cstr(temp_str), AA1[i].data, PICOPASS_BLOCK_LEN)) { block_read = false; break; } } if(!block_read) break; if(picopass_device_parse_credential(AA1, pacs) != ERR_NONE) break; if(picopass_device_parse_wiegand(pacs->credential, &pacs->record) != ERR_NONE) break; parsed = true; } while(false); if(dev->loading_cb) { dev->loading_cb(dev->loading_cb_ctx, false); } if((!parsed) && (show_dialog)) { if(deprecated_version) { dialog_message_show_storage_error(dev->dialogs, "File format deprecated"); } else { dialog_message_show_storage_error(dev->dialogs, "Can not parse\nfile"); } } furi_string_free(temp_str); flipper_format_free(file); return parsed; } void picopass_device_clear(PicopassDevice* dev) { furi_assert(dev); picopass_device_data_clear(&dev->dev_data); memset(&dev->dev_data, 0, sizeof(dev->dev_data)); dev->format = PicopassDeviceSaveFormatHF; furi_string_reset(dev->load_path); } void picopass_device_free(PicopassDevice* picopass_dev) { furi_assert(picopass_dev); picopass_device_clear(picopass_dev); furi_record_close(RECORD_STORAGE); furi_record_close(RECORD_DIALOGS); furi_string_free(picopass_dev->load_path); free(picopass_dev); } bool picopass_file_select(PicopassDevice* dev) { furi_assert(dev); FuriString* picopass_app_folder; picopass_app_folder = furi_string_alloc_set(STORAGE_APP_DATA_PATH_PREFIX); DialogsFileBrowserOptions browser_options; dialog_file_browser_set_basic_options(&browser_options, PICOPASS_APP_EXTENSION, &I_Nfc_10px); browser_options.base_path = STORAGE_APP_DATA_PATH_PREFIX; bool res = dialog_file_browser_show( dev->dialogs, dev->load_path, picopass_app_folder, &browser_options); furi_string_free(picopass_app_folder); if(res) { FuriString* filename; filename = furi_string_alloc(); path_extract_filename(dev->load_path, filename, true); strncpy(dev->dev_name, furi_string_get_cstr(filename), PICOPASS_DEV_NAME_MAX_LEN); res = picopass_device_load_data(dev, dev->load_path, true); if(res) { picopass_device_set_name(dev, dev->dev_name); } furi_string_free(filename); } return res; } void picopass_device_data_clear(PicopassDeviceData* dev_data) { for(size_t i = 0; i < PICOPASS_MAX_APP_LIMIT; i++) { memset(dev_data->AA1[i].data, 0, sizeof(dev_data->AA1[i].data)); } dev_data->pacs.legacy = false; dev_data->pacs.se_enabled = false; dev_data->pacs.pin_length = 0; } bool picopass_device_delete(PicopassDevice* dev, bool use_load_path) { furi_assert(dev); bool deleted = false; FuriString* file_path; file_path = furi_string_alloc(); do { // Delete original file if(use_load_path && !furi_string_empty(dev->load_path)) { furi_string_set(file_path, dev->load_path); } else { furi_string_printf( file_path, APP_DATA_PATH("%s%s"), dev->dev_name, PICOPASS_APP_EXTENSION); } if(!storage_simply_remove(dev->storage, furi_string_get_cstr(file_path))) break; deleted = true; } while(0); if(!deleted) { dialog_message_show_storage_error(dev->dialogs, "Can not remove file"); } furi_string_free(file_path); return deleted; } void picopass_device_set_loading_callback( PicopassDevice* dev, PicopassLoadingCallback callback, void* context) { furi_assert(dev); dev->loading_cb = callback; dev->loading_cb_ctx = context; } ReturnCode picopass_device_decrypt(uint8_t* enc_data, uint8_t* dec_data) { uint8_t key[32] = {0}; memcpy(key, picopass_iclass_decryptionkey, sizeof(picopass_iclass_decryptionkey)); mbedtls_des3_context ctx; mbedtls_des3_init(&ctx); mbedtls_des3_set2key_dec(&ctx, key); mbedtls_des3_crypt_ecb(&ctx, enc_data, dec_data); mbedtls_des3_free(&ctx); return ERR_NONE; } ReturnCode picopass_device_parse_credential(PicopassBlock* AA1, PicopassPacs* pacs) { ReturnCode err; pacs->biometrics = AA1[6].data[4]; pacs->pin_length = AA1[6].data[6] & 0x0F; pacs->encryption = AA1[6].data[7]; if(pacs->encryption == PicopassDeviceEncryption3DES) { FURI_LOG_D(TAG, "3DES Encrypted"); err = picopass_device_decrypt(AA1[7].data, pacs->credential); if(err != ERR_NONE) { FURI_LOG_E(TAG, "decrypt error %d", err); return err; } err = picopass_device_decrypt(AA1[8].data, pacs->pin0); if(err != ERR_NONE) { FURI_LOG_E(TAG, "decrypt error %d", err); return err; } err = picopass_device_decrypt(AA1[9].data, pacs->pin1); if(err != ERR_NONE) { FURI_LOG_E(TAG, "decrypt error %d", err); return err; } } else if(pacs->encryption == PicopassDeviceEncryptionNone) { FURI_LOG_D(TAG, "No Encryption"); memcpy(pacs->credential, AA1[7].data, PICOPASS_BLOCK_LEN); memcpy(pacs->pin0, AA1[8].data, PICOPASS_BLOCK_LEN); memcpy(pacs->pin1, AA1[9].data, PICOPASS_BLOCK_LEN); } else if(pacs->encryption == PicopassDeviceEncryptionDES) { FURI_LOG_D(TAG, "DES Encrypted"); } else { FURI_LOG_D(TAG, "Unknown encryption"); } pacs->sio = (AA1[10].data[0] == 0x30); // rough check return ERR_NONE; } ReturnCode picopass_device_parse_wiegand(uint8_t* data, PicopassWiegandRecord* record) { uint32_t* halves = (uint32_t*)data; if(halves[0] == 0) { uint8_t leading0s = __builtin_clz(REVERSE_BYTES_U32(halves[1])); record->bitLength = 31 - leading0s; } else { uint8_t leading0s = __builtin_clz(REVERSE_BYTES_U32(halves[0])); record->bitLength = 63 - leading0s; } FURI_LOG_D(TAG, "bitLength: %d", record->bitLength); if(record->bitLength == 26) { uint8_t* v4 = data + 4; uint32_t bot = v4[3] | (v4[2] << 8) | (v4[1] << 16) | (v4[0] << 24); record->CardNumber = (bot >> 1) & 0xFFFF; record->FacilityCode = (bot >> 17) & 0xFF; FURI_LOG_D(TAG, "FC: %u CN: %u", record->FacilityCode, record->CardNumber); record->valid = true; } else { record->CardNumber = 0; record->FacilityCode = 0; record->valid = false; } return ERR_NONE; }