iCLASS wiegand formatting incorrect

[00Waz]

Encoding an iCLASS card with wiegand format H10302 writes the incorect bit string to the card.

Example:

[usb] pm3 --> hf iclass encode -w h10302 --cn 12345678910 --ki 0
[+] Using key[0] AE A6 84 A6 DA B2 32 78 
[+] Loaded 16 bytes from binary file `iclass_decryptionkey.bin`
[+] Write block 6/0x06 ( ok )  --> 030303030003E017
[+] Write block 7/0x07 ( ok )  --> 8B182644DD7B19C0
[+] Write block 8/0x08 ( ok )  --> 2AD4C8211F996871
[+] Write block 9/0x09 ( ok )  --> 2AD4C8211F996871
[usb] pm3 --> hf iclass dump --ki 0
[+] Using AA1 (debit) key[0] AE A6 84 A6 DA B2 32 78 
[=] Card has at least 2 application areas. AA1 limit 18 (0x12) AA2 limit 31 (0x1F)
.

[=] --------------------------- Tag memory ----------------------------

[=]  block#  | data                    | ascii    |lck| info
[=] ---------+-------------------------+----------+---+----------------
[=]   0/0x00 | 2D 38 11 00 F6 FF 12 E0 | -8...... |   | CSN 
[=]   1/0x01 | 12 FF FF FF F9 1F FF 3C | .......< |   | Config
[=]   2/0x02 | 7C FF FF FF FF FF FF FF | |....... |   | E-purse
[=]   3/0x03 | 7C 58 59 17 D4 A5 68 93 | |XY...h. |   | Debit
[=]   4/0x04 | FF FF FF FF FF FF FF FF | ........ |   | Credit
[=]   5/0x05 | FF FF FF FF FF FF FF FF | ........ |   | AIA
[=]   6/0x06 | 03 03 03 03 00 03 E0 17 | ........ |   | User / HID CFG 
[=]   7/0x07 | 8B 18 26 44 DD 7B 19 C0 | ..&D.{.. |   | User / Enc Cred 
[=]   8/0x08 | 2A D4 C8 21 1F 99 68 71 | *..!..hq |   | User / Enc Cred 
[=]   9/0x09 | 2A D4 C8 21 1F 99 68 71 | *..!..hq |   | User / Enc Cred 
[=]  10/0x0A | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  11/0x0B | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  12/0x0C | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  13/0x0D | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  14/0x0E | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  15/0x0F | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  16/0x10 | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  17/0x11 | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  18/0x12 | FF FF FF FF FF FF FF FF | ........ |   | User
[=] ---------+-------------------------+----------+---+----------------
[?] yellow = legacy credential

[+] saving dump file - 19 blocks read
[+] Saved 152 bytes to binary file `/home/poe/hf-iclass-2D381100F6FF12E0-dump-003.bin`
[+] Saved to json file /home/poe/hf-iclass-2D381100F6FF12E0-dump-003.json
[?] Hint: Try `hf iclass decrypt -f` to decrypt dump file
[?] Hint: Try `hf iclass view -f` to view dump file

[usb] pm3 --> hf iclass decrypt -f /home/poe/hf-iclass-2D381100F6FF12E0-dump-003.bin
[+] Loaded 152 bytes from binary file `/home/poe/hf-iclass-2D381100F6FF12E0-dump-003.bin`
[+] Loaded 16 bytes from binary file `iclass_decryptionkey.bin`
[!] Actual file len 152 vs HID app-limit len 144
[=] Setting limit to 144
[+] Saved 152 bytes to binary file `/home/poe/hf-iclass-2D381100F6FF12E0-dump-decrypted-001.bin`
[+] Saved to json file /home/poe/hf-iclass-2D381100F6FF12E0-dump-decrypted-001.json

[=] --------------------------- Tag memory ----------------------------

[=]  block#  | data                    | ascii    |lck| info
[=] ---------+-------------------------+----------+---+----------------
[=]   0/0x00 | 2D 38 11 00 F6 FF 12 E0 | -8...... |   | CSN 
[=]   1/0x01 | 12 FF FF FF F9 1F FF 3C | .......< |   | Config
[=]   2/0x02 | 7C FF FF FF FF FF FF FF | |....... |   | E-purse
[=]   3/0x03 | 7C 58 59 17 D4 A5 68 93 | |XY...h. |   | Debit
[=]   4/0x04 | FF FF FF FF FF FF FF FF | ........ |   | Credit
[=]   5/0x05 | FF FF FF FF FF FF FF FF | ........ |   | AIA
[=]   6/0x06 | 03 03 03 03 00 03 E0 14 | ........ |   | User / HID CFG 
[=]   7/0x07 | 00 00 00 21 BF B8 38 7D | ...!..8} |   | User / Cred 
[=]   8/0x08 | 00 00 00 00 00 00 00 00 | ........ |   | User / Cred 
[=]   9/0x09 | 00 00 00 00 00 00 00 00 | ........ |   | User / Cred 
[=]  10/0x0A | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  11/0x0B | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  12/0x0C | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  13/0x0D | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  14/0x0E | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  15/0x0F | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  16/0x10 | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  17/0x11 | FF FF FF FF FF FF FF FF | ........ |   | User
[=]  18/0x12 | FF FF FF FF FF FF FF FF | ........ |   | User
[=] ---------+-------------------------+----------+---+----------------
[?] yellow = legacy credential


[=] ------------------------ Block 7 decoder --------------------------
[+] Bin... 0000110111111101110000011100001111101 ( 37 )

[+] [H10302  ] HID H10302 37-bit huge ID          CN: 3755744318  parity ( ok )
[+] [H10304  ] HID H10304 37-bit                FC: 7163  CN: 269374  parity ( ok )
[+] [P10004  ] HID P10004 37-bit PCSC           FC: 895  CN: 115139
[+] [HGen37  ] HID Generic 37-bit                 CN: 3755744318  parity ( fail )
[+] [MDI37   ] PointGuard MDI 37-bit            FC: 6  CN: 534518846  parity ( ok )
[=] found 5 matching 37-bit formats

[=] -------------------------------------------------------------------

The leading 3 bits are incorrect when read back from the card. This is fixed if wrote with the raw bit string and not using the encode function.