Support non-06 iCLASS SE AIA SIO blocks

CHANGELOG.md

@@ -5,6 +5,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 ## [unreleased][unreleased]
 - Added `hf mfdes getversion` command (@kormax)
 - Added DES transport mode support for iCLASS credential encode/decode helpers. (@cindersocket)
+- Changed `hf iclass view` to detect iCLASS SE SIO blocks from AIA values that point past block 6. (@cindersocket)
 - Changed `doc/magic_cards_notes.md` - updated the ID82xx / Hitag µ clone section with current Proxmark3 support, chip variations, default passwords and detection notes (@mishamyte)
 - Added two Mifare Classic keys into extensive dictionary which are hardcoded into Mifare Plus SE (@team-orangeBlue)
 - Fixed `hf mfp rdbl` when using "read multiple" blocks by decrypting the entire buffer instead of one block only (@team-orangeBlue)

client/src/cmdhficlass.c

@@ -5065,13 +5065,17 @@ static void detect_credential(uint8_t *iclass_dump, size_t dump_len, bool *is_le
                 }
             }
         }
-    } else if (memcmp(hdr->app_issuer_area, "\xFF\xFF\xFF\x00\x06\xFF\xFF\xFF", PICOPASS_BLOCK_SIZE) == 0) {
+    } else {
+        uint8_t blockno = hdr->app_issuer_area[4];
+        if (blockno < 0x06 || blockno == 0xFF || dump_len < (blockno + 1) * PICOPASS_BLOCK_SIZE) {
+            return;
+        }
+
         // SE AIA
         *is_se = true;
 
         if (sio_start_ptr != NULL) {
-            // SE SIO starts at block 6
-            *sio_start_ptr = iclass_dump + (6 * PICOPASS_BLOCK_SIZE);
+            *sio_start_ptr = iclass_dump + (blockno * PICOPASS_BLOCK_SIZE);
         }
     }
 
@@ -5084,11 +5088,13 @@ static void detect_credential(uint8_t *iclass_dump, size_t dump_len, bool *is_le
 
     if (sio_start[0] != 0x30) {
         // SIOs always start with a SEQUENCE(P), if this is missing then bail
+        *sio_start_ptr = NULL;
         return;
     }
 
     if (sio_start[1] >= 0x80 || sio_start[1] == 0x00) {
         // We only support definite short form lengths
+        *sio_start_ptr = NULL;
         return;
     }
 
@@ -5288,7 +5294,7 @@ void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t e
     bool is_legacy, is_se, is_sr;
     uint8_t *sio_start;
     size_t sio_length;
-    detect_credential(iclass_dump, endblock * 8, &is_legacy, &is_se, &is_sr, &sio_start, &sio_length);
+    detect_credential(iclass_dump, filesize, &is_legacy, &is_se, &is_sr, &sio_start, &sio_length);
 
     bool is_legacy_decrypted = is_legacy && (iclass_dump[(6 * PICOPASS_BLOCK_SIZE) + 7] & 0x03) == 0x00;
 
@@ -5380,7 +5386,7 @@ void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t e
                              );
             } else if (sio_start_block != 0 && i >= sio_start_block && i <= sio_end_block) {
                 // SIO credential
-                PrintAndLogEx(INFO, "%3d/0x%02X | " _CYAN_("%s") "| " _CYAN_("%s") " | %s | User / SIO / %s"
+                PrintAndLogEx(INFO, "%3d/0x%02X | " _CYAN_("%s") "| " _CYAN_("%s") " | %s | SIO / %s"
                               , i
                               , i
                               , sprint_hex(blk, 8)

tools/pm3_tests.sh

@@ -508,6 +508,8 @@ while true; do
       if ! CheckExecute "hf iclass encrypt des"           "$CLIENTBIN -c 'hf iclass encrypt -d 00000000063E02A3 --enc des -k $ICLASS_TRANSPORT_KEY'" "encrypted\\.\\.\\. D50D3FC66AF7E0F3"; then break; fi
       if ! CheckExecute "hf iclass decrypt des"           "$CLIENTBIN -c 'hf iclass decrypt -d D50D3FC66AF7E0F3 --enc des -k $ICLASS_TRANSPORT_KEY'" "plain\\.\\.\\.\\.\\.\\.\\. 00000000063E02A3"; then break; fi
       if ! CheckExecute "hf iclass view dump"             "$CLIENTBIN -c 'hf iclass view -f traces/iclass/hf-iclass-dump.json'" "7/0x07 \\| 78 36 02 A2 28 30 10 E8"; then break; fi
+      if ! CheckExecute "hf iclass view SE AIA SIO block" "$CLIENTBIN -c 'hf iclass view -f traces/iclass/hf-iclass-se-weird.json'" "SIO / SE"; then break; fi
+      if ! CheckExecute "hf iclass view SE AIA SIO raw"   "$CLIENTBIN -c 'hf iclass view -f traces/iclass/hf-iclass-se-weird.json'" "SIO - RAW"; then break; fi
       if ! CheckExecute "hf iclass decrypt dump"          "$CLIENTBIN -c 'hf iclass decrypt -f traces/iclass/hf-iclass-dump.json --ns -k $ICLASS_TRANSPORT_KEY'" "C1k48s.*FC: 69  CN: 69420  parity \\( ok \\)"; then break; fi
       if ! CheckExecute "wiegand Verkada40 encode test 1" "$CLIENTBIN -c 'wiegand encode -w Verkada40 --fc 50 --cn 1001'" "86400007D3"; then break; fi
       if ! CheckExecute "wiegand Verkada40 decode test 1" "$CLIENTBIN -c 'wiegand decode --raw 86400007D3'" "Verkada40.*FC: 50  CN: 1001  parity \( ok \)"; then break; fi

traces/iclass/hf-iclass-se-weird.json

@@ -0,0 +1,33 @@
+{
+  "Created": "proxmark3",
+  "FileType": "iclass",
+  "Card": {
+    "CSN": "034D9D00F9FF12E0",
+    "Configuration": "12FFFFFF7F1FFF3C",
+    "Epurse": "F3FFFFFFFFFFFFFF",
+    "Kd": "F0D402F6059E34DE",
+    "Kc": "FFFFFFFFFFFFFFFF",
+    "AIA": "FFFFFF000CFFFFFF"
+  },
+  "blocks": {
+    "0": "034D9D00F9FF12E0",
+    "1": "12FFFFFF7F1FFF3C",
+    "2": "F3FFFFFFFFFFFFFF",
+    "3": "F0D402F6059E34DE",
+    "4": "FFFFFFFFFFFFFFFF",
+    "5": "FFFFFF000CFFFFFF",
+    "6": "FFFFFFFFFFFFFFFF",
+    "7": "FFFFFFFFFFFFFFFF",
+    "8": "FFFFFFFFFFFFFFFF",
+    "9": "FFFFFFFFFFFFFFFF",
+    "10": "FFFFFFFFFFFFFFFF",
+    "11": "FFFFFFFFFFFFFFFF",
+    "12": "3033810238A68302",
+    "13": "0410A5020500A608",
+    "14": "8101010403030008",
+    "15": "A7178515E0967E2E",
+    "16": "857DFCF205B44EDD",
+    "17": "8F90A578FADBD7E7",
+    "18": "33A9020500050000"
+  }
+}