RFID Hacking---rfidiot Doc Test/Example Programs

There are two basic type of device supported by RFIDIOt: serial and PCSC. Note that both types may have a USB physical interface, but the low level communications protocol  will be handled differently for each.

ACG LF/HF Serial/RS232

ACG LF/HF USB

ACG LAHF USB

FROSCH Serial/RS232

FROSCH USB

<a href="http://www.iaik.tugraz.at/content/research/rfid/tag_emulators/" target="_blank">AIAK DemoTAG</a>

<a target="_blank" href="http://omnikey.aaitg.com/index.php?id=products&amp;tx_okprod_pi1%5Bproduct%5D=41">OmniKey 5321</a>

<a href="http://www.scmmicro.com/en/products-services/pc-security-solutions/contactless-dual-interface-readers/sdi010.html" target="_blank">SCM SDI010</a>

<a href="http://www.touchatag.com/" target="_blank">Tikitag / Touchatag</a>

<a href="http://www.acs.com.hk/acr122.php" target="_blank">ACS ACR 122</a>

Serial devices with a USB interface use an FTDI serial converter, which requires an external driver (ftdi_sio). This should be autoloaded by your O/S, but if not you can get it from here:

<a href="http://www.ftdichip.com/Drivers/VCP/Linux/ftdi_sio.tar.gz" target="_blank">Linux</a>

<a href="http://www.ftdichip.com/Drivers/CDM/CDM%202.04.06%20WHQL%20Certified.zip" target="_blank">Windows</a>

<a href="http://www.ftdichip.com/Drivers/VCP/MacOSX/UniBin/FTDIUSBSerialDriver_v2_2_10.dmg" target="_blank">OS/X Intel</a>

<a href="http://www.ftdichip.com/Drivers/VCP/MacOSX/FTDIUSBSerialDriver_v2_1_10.dmg" target="_blank">OS/X</a>

Under Linux and OS/X, the device will normally appear as /dev/ttyUSBn, where 'n' is the device number, starting at 0. e.g. /dev/ttyUSB0. If you can't find it, run 'dmesg' and you should see the device loading:

Under Windows, the device will be installed as a virtual COM port. It is important that this is lower than COM10, as external libraries used by RFIDIOt may have trouble addressing COM10 and above. If it appears above COM9, use the control panel hardware manager to renumber it.

Try:

PCSC devices are supported by the pcscd daemon, which is part of the pcscs-lite project, in conjunction with specific device driver 'bundles', which are either part of pcscs-lite, or distributed separately by the manufacturer:

Tikitag/Touchatag - pcsc-lite native

ACS - pcsc-lite native

If you are running OS-X Jaguar (10.2) or later, pcsc-lite is already installed, but you may still need additional drivers.

    You need to disable support from the native pcscs-lite drivers and use the omniKey manufacturer driver instead. You do this by editing the pcsc bundle or removing it altogether if you don't need to support any other devices. To remove it, simply move the following sub-directory to a backup location and restart pcscd:

    To leave the driver in place, but remove CardMan 5321 device support, edit the following file:

    note that on some distributions, this may also be found here: 

    Look for the Vendor array:

    and within that, the OmniKey vendor ID, which you can find by running 'lsusb':

    so in this case, our device is vendor number '076B', which you should be able to find within the array:

    Note that there may be more than one entry for this vendor, as this array is linked to another which contains individual product reference numbers. It is vital, therefore, that you only remove one entry, or you will skew the arrays which will cause unpredictable results.

    Now find the product in the Product array (in this case '5321'):

    and remove that line too.

    Finally, in the Friendly Name array, remove the human readable description:

    Now restart pcscd in the foreground, and check that it uses the manufacturer's driver:

    Run pcscd in the foreground so you can watch the error log, and if you get something like this:

    You need to rebuild pcsc-lite without HAL support.

    Tikitag/Touchatag readers need the CCID_EXCHANGE_AUTHORIZED option set for pcscd. Edit the file:

    find the section:

    and change the value to 0x0001:

    Now restart pcscd.

    Check that the reader number is correctly set in RFIDIOtconfig.py - you can find out your reader number by running any command with the '-L' flag. e.g.

RFIDIOt uses a number of external libraries which will also need to be installed:

<a href="http://pyserial.sourceforge.net/" target="_blank">pySerial</a>

<a href="http://sourceforge.net/project/showfiles.php?group_id=196342" target="_blank">pyscard</a>

<a href="http://www.amk.ca/files/python/crypto/pycrypto-2.0.1.tar.gz" target="_blank">pycrypto</a>

<a href="http://www.voidspace.org.uk/python/modules.shtml#pycrypto">pycrypto for Windows</a>

<a href="https://launchpad.net/pyreadline/+download">pyreadline for Windows</a>

<a href="http://www.pythonware.com/products/pil/" target="_blank">PIL (Python Imaging Library)</a>

RFIDIOt is configured by entries in a file called 'RFIDIOtconfig.py', which is expected to be in the working directory, or the import path of your python installation. For simple setups, with only one device, configuring this one file is all that is required. 

The options that need to be specified are:

Reader Type:

ACS

PCSC

FROSCH

DEMOTAG

Reader Port (Serial Only):

/dev/ttyXXX

Reader BAUD Rate (Serial Only):

9600

57600

115200

230400

460800

To configure the reader type, find the reader type section:

and ensure that only one type is uncommented. In this case, PCSC is set. If your device is PCSC, then this is the only option you need to set as the port, speed and sub-type (Omnikey, Tikitag etc.) will be determined automatically.

To configure to port, find the serial port section:

and ensure only one entry is uncommented. In this case '/dev/ttyUSB0'.

Finally, to set the serial port speed:

Each of these options can be overridden on the command line by using the appropriate option flag, e.g. '-s' for speed. All test programs will accept '-h' to display help, giving details of all possible options. To set the port to /dev/ttyUSB1 and the reader type to ACG, you would specify:

For more complex setups, options specified in this file can be overridden by a local file, the location of which is specified by one of the following (in search order):

options should be specified on the first line as if typed on the command line, e.g.    

command line options will take precedence over this file.

RFIDIOt is a collection of routines designed to abstract the hardware from the function, so that a single program can provide the same functionality regardless of what reader type is plugged in. However, because different readers have different capabilities, not all functions are supported on all readers, and it is therefore not possible to run all commands against all hardware types.

Test programs are provided as examples of how to perform certain functions, and my be useful in their own right, but not all programs have been tested against all TAGs that they may be applicable to, so please report any problems you come across. 

All test programs support the '-h' option, which will give you detailed help on options and arguments. Options are applied by RFIDIOt itself, and so are generic for all programs, and inappropriate options (e.g. -g 'No GUI' for a program that doesn't have a GUI anyway) will be ignored.

Readers: ACG, Frosch, PCSC

TAGS: ALL

Show a TAG's UID.

Readers: ACG, Frosch, PCSC

TAGS: ALL Non-authenticated

Attempt to copy data blocks of non password or crypto protected TAG to a blank of the same type.

Readers: ACG

TAGS: n/a

Display contents of an ACG reader's EEPROM. Refer to ACG user manuals for detailed description.

Readers: ACG LF, ACG LAHF, Frosch

TAGS: Q5, Hitag2

Program a TAG with an ISO-11784/5 (FDX-B) UID, or decode values read from an existing TAG.

Readers: ACG HF, ACG LAHF, PCSC

TAGS: Mifare1K

Format Mifare1K data blocks according to the MIFARE value block standard (with value of 0.00).

Readers: Frosch

TAGS: Hitag1, Hitag2, HitagS

Test read functionality of Frosch reader.

Readers: PCSC

TAGS: HID ProxCard

Read Prox Facility Code and Card Number.

Note that this command only seems to work reliably with the OmniKey 5325 reader. Due to the way the 5125 polls the tags, it is somewhat hit and miss if you will get a good read or not.

Readers: Frosch, ACG LF, ACG LAHF

TAGS: Hitag2

Attempt to login to Hitag2 password protected TAG with random passwords.

Reset Hitag2 to native r/w mode. If a Hitag2 TAG has been set to emulate Unique or FDX-B, this is a required step before it can be re-used.

TAGS: ISO 14443 A/B, ISO 15693, ISO 18000-3, NFC, I-CODE, HID iCLASS, FeliCa, Innovision Jewel, Mifare, JCOP

Attempt to determine HF TAG type and, where appropriate, show ATR/ATS values.

TAGS: JCOP

Provide READ/WRITE access to Mifare blocks on JCOP card running jcopmifare applet (jcop_mifare_access.cap), or set RANDOM_UID mode.

Java applet to be installed to JCOP card for Mifare block access and setting of RANDOM_UID mode. See Makefile for installation instructions. Full source not available.

Set ATR Historical Bytes on JCOP card running jcopatrhist applet (jcop_set_atr_hist.cap).

Java applet to be installed to JCOP card for setting of ATR Historical Bytes. See java subdirectory for full source, Makefile etc.

Show some useful information about JCOP card including manufacture date, mask etc. and installed applications.

TAGS: EM4x02, EM4x50, EM4x05 (ISO 11784/5 FDX-B), Hitag 1 / 2 / S, Q5, TI 64 bit R/O &amp; R/W, TI 1088 bit Multipage

Attempt to determine LF TAG type, and, if appropriate, emulation mode it is running in.

TAGS: Mifare

Attempt to login to each sector of a Mifare TAG with standard transport keys.

Readers: n/a

Calculate 3DES keys for access to Mifare sectors on JCOP cards running Mifare access applet  (jcop_mifare_access.cap).

Readers: ACS HF, ACS LAHF, PCSC

TAGS: ISO-14443 ePassport/eID, JCOP JMRTD/vonJeek, NFC vonJeek

Read/Write/Clone contents of Machine Readable Travel Document.

Repeatedly select and display TAG UID.

TAGS: ISO-14443-3, ISO-14443-4, Mifare, Felica

Switch NXP PN532 into emulation mode and set various parameters to be sent to initiator, then process a single APDU.

This command will only work with readers that contain an NXP PN532 chip, and then only if support for that specific reader has been added. Readers currently supported are:

  ACS ACR 38U-CCID  

  Alcatel-Lucent TikiTag / TouchaTag

PN532 Man-In-The-Middle. Drive two NXP PN532 devices: one as a reader, and one as an emulator, and log all traffic that passes between them. Both readers can be on a single machine, or traffic can be relayed via a TCP socket between two separate systems.

Readers: ACG LF, ACG LAHF

TAGS: Q5

Reset Q5 TAG into default r/w mode and set UID. This command will recover a Q5 TAG that has been put into an unusable state by programming an invalid configuration block, and can also be used to change the UID.

TAGS: EM4x50, EM4x05 (ISO 11784/5 FDX-B), Hitag 1 / 2 / S, Q5, TI 64 bit R/O &amp; R/W, TI 1088 bit Multipage

Read LF TAG datablocks.

TAGS: Mifare1K, Mifare4K

Read all data blocks from Mifare TAGs, using transport (or specified) keys and optionally copy data to a blank or reset TAG to factory defaults.

TAGS: Mifare UltraLight

Read Mifare UltraLight data blocks.

TAGS: All non-authenticated

Read all data blocks from non password or crypto protected TAGs.

Readers: ACG LF

Program Q5 to emulate FDI Matalec 'TRANSIT 500' or 'TRANSIT 999'.

Attempt to find X509 data in EF_SOD.BIN as read by mrpkey.py from a MRTD.

Readers: ACG LF, ACG HF

TAGS: ANY

Test an ACG LF or ACG HF reader by selecting a TAG and displaying it's UID.

Readers: ACG LAHF

Test an ACG LAHF reader by selecting a TAG and displaying it's UID on both the LF and HF elements.

Readers: ACG LF, Frosch

Set EM4x02 (Unique/Mira) UID and emulation mode on Q5 or Hitag2.

TAGS: Q5, Hitag 1/2/S

Read and then write back all LF data blocks.

Readers: ACG HF, PCSC

Write random data to all Mifare1K data blocks using transport keys

本文转hackfreer51CTO博客，原文链接：http://blog.51cto.com/pnig0s1992/605636，如需转载请自行联系原作者