]>
git.zerfleddert.de Git - proxmark3-svn/blob - client/mifarehost.c
2 // people from mifare@nethemba.com, 2010
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
9 //-----------------------------------------------------------------------------
11 #include "mifarehost.h"
18 #include "crapto1/crapto1.h"
19 #include "proxmark3.h"
24 #include "iso14443crc.h"
28 // mifare tracer flags used in mfTraceDecode()
29 #define TRACE_IDLE 0x00
30 #define TRACE_AUTH1 0x01
31 #define TRACE_AUTH2 0x02
32 #define TRACE_AUTH_OK 0x03
33 #define TRACE_READ_DATA 0x04
34 #define TRACE_WRITE_OK 0x05
35 #define TRACE_WRITE_DATA 0x06
36 #define TRACE_ERROR 0xFF
39 static int compare_uint64 ( const void * a
, const void * b
) {
40 // didn't work: (the result is truncated to 32 bits)
41 //return (*(int64_t*)b - *(int64_t*)a);
44 if (*( uint64_t *) b
== *( uint64_t *) a
) return 0 ;
45 else if (*( uint64_t *) b
< *( uint64_t *) a
) return 1 ;
50 // create the intersection (common members) of two sorted lists. Lists are terminated by -1. Result will be in list1. Number of elements is returned.
51 static uint32_t intersection ( uint64_t * list1
, uint64_t * list2
)
53 if ( list1
== NULL
|| list2
== NULL
) {
56 uint64_t * p1
, * p2
, * p3
;
60 while ( * p1
!= - 1 && * p2
!= - 1 ) {
61 if ( compare_uint64 ( p1
, p2
) == 0 ) {
66 while ( compare_uint64 ( p1
, p2
) < 0 ) ++ p1
;
67 while ( compare_uint64 ( p1
, p2
) > 0 ) ++ p2
;
75 // Darkside attack (hf mf mifare)
76 static uint32_t nonce2key ( uint32_t uid
, uint32_t nt
, uint32_t nr
, uint64_t par_info
, uint64_t ks_info
, uint64_t ** keys
) {
77 struct Crypto1State
* states
;
78 uint32_t i
, pos
, rr
; //nr_diff;
79 uint8_t bt
, ks3x
[ 8 ], par
[ 8 ][ 8 ];
80 uint64_t key_recovered
;
81 static uint64_t * keylist
;
84 // Reset the last three significant bits of the reader nonce
87 for ( pos
= 0 ; pos
< 8 ; pos
++) {
88 ks3x
[ 7 - pos
] = ( ks_info
>> ( pos
* 8 )) & 0x0f ;
89 bt
= ( par_info
>> ( pos
* 8 )) & 0xff ;
91 par
[ 7 - pos
][ i
] = ( bt
>> i
) & 0x01 ;
95 states
= lfsr_common_prefix ( nr
, rr
, ks3x
, par
, ( par_info
== 0 ));
102 keylist
= ( uint64_t *) states
;
104 for ( i
= 0 ; keylist
[ i
]; i
++) {
105 lfsr_rollback_word ( states
+ i
, uid
^ nt
, 0 );
106 crypto1_get_lfsr ( states
+ i
, & key_recovered
);
107 keylist
[ i
] = key_recovered
;
116 int mfDarkside ( uint64_t * key
)
119 uint32_t nt
= 0 , nr
= 0 ;
120 uint64_t par_list
= 0 , ks_list
= 0 ;
121 uint64_t * keylist
= NULL
, * last_keylist
= NULL
;
122 uint32_t keycount
= 0 ;
125 UsbCommand c
= { CMD_READER_MIFARE
, { true , 0 , 0 }};
128 printf ( "------------------------------------------------------------------------- \n " );
129 printf ( "Executing command. Expected execution time: 25sec on average \n " );
130 printf ( "Press button on the proxmark3 device to abort both proxmark3 and client. \n " );
131 printf ( "------------------------------------------------------------------------- \n " );
135 clearCommandBuffer ();
140 int c
= getchar (); ( void ) c
;
153 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1000 )) {
158 uid
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 0 , 4 );
159 nt
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 4 , 4 );
160 par_list
= bytes_to_num ( resp
. d
. asBytes
+ 8 , 8 );
161 ks_list
= bytes_to_num ( resp
. d
. asBytes
+ 16 , 8 );
162 nr
= bytes_to_num ( resp
. d
. asBytes
+ 24 , 4 );
167 if ( par_list
== 0 && c
. arg
[ 0 ] == true ) {
168 PrintAndLog ( "Parity is all zero. Most likely this card sends NACK on every failed authentication." );
169 PrintAndLog ( "Attack will take a few seconds longer because we need two consecutive successful runs." );
173 keycount
= nonce2key ( uid
, nt
, nr
, par_list
, ks_list
, & keylist
);
176 PrintAndLog ( "Key not found (lfsr_common_prefix list is null). Nt=%08x" , nt
);
177 PrintAndLog ( "This is expected to happen in 25%% of all cases. Trying again with a different reader nonce..." );
181 qsort ( keylist
, keycount
, sizeof (* keylist
), compare_uint64
);
182 keycount
= intersection ( last_keylist
, keylist
);
185 last_keylist
= keylist
;
190 PrintAndLog ( "Found %u possible keys. Trying to authenticate with each of them ... \n " , keycount
);
192 PrintAndLog ( "Found a possible key. Trying to authenticate... \n " );
196 uint8_t keyBlock
[ USB_CMD_DATA_SIZE
];
197 int max_keys
= USB_CMD_DATA_SIZE
/ 6 ;
198 for ( int i
= 0 ; i
< keycount
; i
+= max_keys
) {
199 int size
= keycount
- i
> max_keys
? max_keys
: keycount
- i
;
200 for ( int j
= 0 ; j
< size
; j
++) {
201 if ( last_keylist
== NULL
) {
202 num_to_bytes ( keylist
[ i
* max_keys
+ j
], 6 , keyBlock
);
204 num_to_bytes ( last_keylist
[ i
* max_keys
+ j
], 6 , keyBlock
);
207 if (! mfCheckKeys ( 0 , 0 , false , size
, keyBlock
, key
)) {
217 PrintAndLog ( "Authentication failed. Trying again..." );
219 last_keylist
= keylist
;
227 int mfCheckKeys ( uint8_t blockNo
, uint8_t keyType
, bool clear_trace
, uint8_t keycnt
, uint8_t * keyBlock
, uint64_t * key
){
231 UsbCommand c
= { CMD_MIFARE_CHKKEYS
, {(( blockNo
& 0xff ) | (( keyType
& 0xff ) << 8 )), clear_trace
, keycnt
}};
232 memcpy ( c
. d
. asBytes
, keyBlock
, 6 * keycnt
);
236 if (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 3000 )) return 1 ;
237 if (( resp
. arg
[ 0 ] & 0xff ) != 0x01 ) return 2 ;
238 * key
= bytes_to_num ( resp
. d
. asBytes
, 6 );
242 int mfCheckKeysSec ( uint8_t sectorCnt
, uint8_t keyType
, uint8_t timeout14a
, bool clear_trace
, uint8_t keycnt
, uint8_t * keyBlock
, sector_t
* e_sector
){
246 if ( e_sector
== NULL
)
249 UsbCommand c
= { CMD_MIFARE_CHKKEYS
, {(( sectorCnt
& 0xff ) | (( keyType
& 0xff ) << 8 )), ( clear_trace
| 0x02 )|(( timeout14a
& 0xff ) << 8 ), keycnt
}};
250 memcpy ( c
. d
. asBytes
, keyBlock
, 6 * keycnt
);
254 if (! WaitForResponseTimeoutW ( CMD_ACK
, & resp
, MAX ( 3000 , 1000 + 13 * sectorCnt
* keycnt
* ( keyType
== 2 ? 2 : 1 )), false )) return 1 ; // timeout: 13 ms / fail auth
255 if (( resp
. arg
[ 0 ] & 0xff ) != 0x01 ) return 2 ;
257 bool foundAKey
= false ;
258 for ( int sec
= 0 ; sec
< sectorCnt
; sec
++){
259 for ( int keyAB
= 0 ; keyAB
< 2 ; keyAB
++){
260 keyPtr
= *( resp
. d
. asBytes
+ keyAB
* 40 + sec
);
262 e_sector
[ sec
]. foundKey
[ keyAB
] = true ;
263 e_sector
[ sec
]. Key
[ keyAB
] = bytes_to_num ( keyBlock
+ ( keyPtr
- 1 ) * 6 , 6 );
268 return foundAKey
? 0 : 3 ;
271 // Compare 16 Bits out of cryptostate
272 int Compare16Bits ( const void * a
, const void * b
) {
273 if ((*( uint64_t *) b
& 0x00ff000000ff0000 ) == (*( uint64_t *) a
& 0x00ff000000ff0000 )) return 0 ;
274 else if ((*( uint64_t *) b
& 0x00ff000000ff0000 ) > (*( uint64_t *) a
& 0x00ff000000ff0000 )) return 1 ;
281 struct Crypto1State
* slhead
;
285 struct Crypto1State
* sltail
;
297 // wrapper function for multi-threaded lfsr_recovery32
299 #ifdef __has_attribute
300 #if __has_attribute(force_align_arg_pointer)
301 __attribute__ (( force_align_arg_pointer
))
304 * nested_worker_thread ( void * arg
)
306 struct Crypto1State
* p1
;
307 StateList_t
* statelist
= arg
;
309 statelist
-> head
. slhead
= lfsr_recovery32 ( statelist
-> ks1
, statelist
-> nt
^ statelist
-> uid
);
310 for ( p1
= statelist
-> head
. slhead
; *( uint64_t *) p1
!= 0 ; p1
++);
311 statelist
-> len
= p1
- statelist
-> head
. slhead
;
312 statelist
-> tail
. sltail
= -- p1
;
313 qsort ( statelist
-> head
. slhead
, statelist
-> len
, sizeof ( uint64_t ), Compare16Bits
);
315 return statelist
-> head
. slhead
;
319 int mfnested ( uint8_t blockNo
, uint8_t keyType
, uint8_t * key
, uint8_t trgBlockNo
, uint8_t trgKeyType
, uint8_t * resultKey
, bool calibrate
)
325 StateList_t statelists
[ 2 ];
326 struct Crypto1State
* p1
, * p2
, * p3
, * p4
;
329 WaitForResponseTimeout ( CMD_ACK
, NULL
, 100 );
331 UsbCommand c
= { CMD_MIFARE_NESTED
, { blockNo
+ keyType
* 0x100 , trgBlockNo
+ trgKeyType
* 0x100 , calibrate
}};
332 memcpy ( c
. d
. asBytes
, key
, 6 );
335 if (! WaitForResponseTimeout ( CMD_ACK
, & resp
, 1500 )) {
340 return resp
. arg
[ 0 ]; // error during nested
343 memcpy (& uid
, resp
. d
. asBytes
, 4 );
344 PrintAndLog ( "uid:%08x trgbl=%d trgkey=%x" , uid
, ( uint16_t ) resp
. arg
[ 2 ] & 0xff , ( uint16_t ) resp
. arg
[ 2 ] >> 8 );
346 for ( i
= 0 ; i
< 2 ; i
++) {
347 statelists
[ i
]. blockNo
= resp
. arg
[ 2 ] & 0xff ;
348 statelists
[ i
]. keyType
= ( resp
. arg
[ 2 ] >> 8 ) & 0xff ;
349 statelists
[ i
]. uid
= uid
;
350 memcpy (& statelists
[ i
]. nt
, ( void *)( resp
. d
. asBytes
+ 4 + i
* 8 + 0 ), 4 );
351 memcpy (& statelists
[ i
]. ks1
, ( void *)( resp
. d
. asBytes
+ 4 + i
* 8 + 4 ), 4 );
356 pthread_t thread_id
[ 2 ];
358 // create and run worker threads
359 for ( i
= 0 ; i
< 2 ; i
++) {
360 pthread_create ( thread_id
+ i
, NULL
, nested_worker_thread
, & statelists
[ i
]);
363 // wait for threads to terminate:
364 for ( i
= 0 ; i
< 2 ; i
++) {
365 pthread_join ( thread_id
[ i
], ( void *)& statelists
[ i
]. head
. slhead
);
369 // the first 16 Bits of the cryptostate already contain part of our key.
370 // Create the intersection of the two lists based on these 16 Bits and
371 // roll back the cryptostate
372 p1
= p3
= statelists
[ 0 ]. head
. slhead
;
373 p2
= p4
= statelists
[ 1 ]. head
. slhead
;
374 while ( p1
<= statelists
[ 0 ]. tail
. sltail
&& p2
<= statelists
[ 1 ]. tail
. sltail
) {
375 if ( Compare16Bits ( p1
, p2
) == 0 ) {
376 struct Crypto1State savestate
, * savep
= & savestate
;
378 while ( Compare16Bits ( p1
, savep
) == 0 && p1
<= statelists
[ 0 ]. tail
. sltail
) {
380 lfsr_rollback_word ( p3
, statelists
[ 0 ]. nt
^ statelists
[ 0 ]. uid
, 0 );
385 while ( Compare16Bits ( p2
, savep
) == 0 && p2
<= statelists
[ 1 ]. tail
. sltail
) {
387 lfsr_rollback_word ( p4
, statelists
[ 1 ]. nt
^ statelists
[ 1 ]. uid
, 0 );
393 while ( Compare16Bits ( p1
, p2
) == - 1 ) p1
++;
394 while ( Compare16Bits ( p1
, p2
) == 1 ) p2
++;
399 statelists
[ 0 ]. len
= p3
- statelists
[ 0 ]. head
. slhead
;
400 statelists
[ 1 ]. len
= p4
- statelists
[ 1 ]. head
. slhead
;
401 statelists
[ 0 ]. tail
. sltail
=-- p3
;
402 statelists
[ 1 ]. tail
. sltail
=-- p4
;
404 // the statelists now contain possible keys. The key we are searching for must be in the
405 // intersection of both lists. Create the intersection:
406 qsort ( statelists
[ 0 ]. head
. keyhead
, statelists
[ 0 ]. len
, sizeof ( uint64_t ), compare_uint64
);
407 qsort ( statelists
[ 1 ]. head
. keyhead
, statelists
[ 1 ]. len
, sizeof ( uint64_t ), compare_uint64
);
408 statelists
[ 0 ]. len
= intersection ( statelists
[ 0 ]. head
. keyhead
, statelists
[ 1 ]. head
. keyhead
);
410 memset ( resultKey
, 0 , 6 );
411 // The list may still contain several key candidates. Test each of them with mfCheckKeys
412 for ( i
= 0 ; i
< statelists
[ 0 ]. len
; i
++) {
415 crypto1_get_lfsr ( statelists
[ 0 ]. head
. slhead
+ i
, & key64
);
416 num_to_bytes ( key64
, 6 , keyBlock
);
418 if (! mfCheckKeys ( statelists
[ 0 ]. blockNo
, statelists
[ 0 ]. keyType
, false , 1 , keyBlock
, & key64
)) {
419 num_to_bytes ( key64
, 6 , resultKey
);
424 free ( statelists
[ 0 ]. head
. slhead
);
425 free ( statelists
[ 1 ]. head
. slhead
);
432 int mfEmlGetMem ( uint8_t * data
, int blockNum
, int blocksCount
) {
433 UsbCommand c
= { CMD_MIFARE_EML_MEMGET
, { blockNum
, blocksCount
, 0 }};
437 if (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) return 1 ;
438 memcpy ( data
, resp
. d
. asBytes
, blocksCount
* 16 );
442 int mfEmlSetMem ( uint8_t * data
, int blockNum
, int blocksCount
) {
443 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, { blockNum
, blocksCount
, 0 }};
444 memcpy ( c
. d
. asBytes
, data
, blocksCount
* 16 );
451 int mfCGetBlock ( uint8_t blockNo
, uint8_t * data
, uint8_t params
) {
454 UsbCommand c
= { CMD_MIFARE_CGETBLOCK
, { params
, 0 , blockNo
}};
458 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
459 isOK
= resp
. arg
[ 0 ] & 0xff ;
460 memcpy ( data
, resp
. d
. asBytes
, 16 );
463 PrintAndLog ( "Command execute timeout" );
469 int mfCSetBlock ( uint8_t blockNo
, uint8_t * data
, uint8_t * uid
, bool wantWipe
, uint8_t params
) {
472 UsbCommand c
= { CMD_MIFARE_CSETBLOCK
, { wantWipe
, params
& ( 0xFE | ( uid
== NULL
? 0 : 1 )), blockNo
}};
473 memcpy ( c
. d
. asBytes
, data
, 16 );
477 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1500 )) {
478 isOK
= resp
. arg
[ 0 ] & 0xff ;
480 memcpy ( uid
, resp
. d
. asBytes
, 4 );
484 PrintAndLog ( "Command execute timeout" );
491 int mfCWipe ( uint32_t numSectors
, bool gen1b
, bool wantWipe
, bool wantFill
) {
493 uint8_t cmdParams
= wantWipe
+ wantFill
* 0x02 + gen1b
* 0x04 ;
494 UsbCommand c
= { CMD_MIFARE_CWIPE
, { numSectors
, cmdParams
, 0 }};
498 WaitForResponse ( CMD_ACK
,& resp
);
499 isOK
= resp
. arg
[ 0 ] & 0xff ;
504 int mfCSetUID ( uint8_t * uid
, uint8_t * atqa
, uint8_t * sak
, uint8_t * oldUID
) {
505 uint8_t oldblock0
[ 16 ] = { 0x00 };
506 uint8_t block0
[ 16 ] = { 0x00 };
511 /* generation 1a magic card by default */
512 uint8_t cmdParams
= CSETBLOCK_SINGLE_OPER
;
514 /* generation 1b magic card */
515 cmdParams
= CSETBLOCK_SINGLE_OPER
| CSETBLOCK_MAGIC_1B
;
518 res
= mfCGetBlock ( 0 , oldblock0
, cmdParams
);
521 memcpy ( block0
, oldblock0
, 16 );
522 PrintAndLog ( "old block 0: %s" , sprint_hex ( block0
, 16 ));
524 PrintAndLog ( "Couldn't get old data. Will write over the last bytes of Block 0." );
527 // fill in the new values
529 memcpy ( block0
, uid
, 4 );
531 block0
[ 4 ] = block0
[ 0 ] ^ block0
[ 1 ] ^ block0
[ 2 ] ^ block0
[ 3 ];
532 // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)
539 PrintAndLog ( "new block 0: %s" , sprint_hex ( block0
, 16 ));
541 res
= mfCSetBlock ( 0 , block0
, oldUID
, false , cmdParams
);
543 PrintAndLog ( "Can't set block 0. Error: %d" , res
);
551 UsbCommand c
= { CMD_MIFARE_CIDENT
, { 0 , 0 , 0 }};
554 WaitForResponse ( CMD_ACK
,& resp
);
556 uint8_t isGeneration
= resp
. arg
[ 0 ] & 0xff ;
557 switch ( isGeneration
){
558 case 1 : PrintAndLog ( "Chinese magic backdoor commands (GEN 1a) detected" ); break ;
559 case 2 : PrintAndLog ( "Chinese magic backdoor command (GEN 1b) detected" ); break ;
560 default : PrintAndLog ( "No chinese magic backdoor command detected" ); break ;
563 return ( int ) isGeneration
;
570 static uint8_t trailerAccessBytes
[ 4 ] = { 0x08 , 0x77 , 0x8F , 0x00 };
573 char logHexFileName
[ FILE_PATH_SIZE
] = { 0x00 };
574 static uint8_t traceCard
[ 4096 ] = { 0x00 };
575 static char traceFileName
[ FILE_PATH_SIZE
] = { 0x00 };
576 static int traceState
= TRACE_IDLE
;
577 static uint8_t traceCurBlock
= 0 ;
578 static uint8_t traceCurKey
= 0 ;
580 struct Crypto1State
* traceCrypto1
= NULL
;
582 struct Crypto1State
* revstate
;
587 uint32_t uid
; // serial number
588 uint32_t nt
; // tag challenge
589 uint32_t nr_enc
; // encrypted reader challenge
590 uint32_t ar_enc
; // encrypted reader response
591 uint32_t at_enc
; // encrypted tag response
593 int isTraceCardEmpty ( void ) {
594 return (( traceCard
[ 0 ] == 0 ) && ( traceCard
[ 1 ] == 0 ) && ( traceCard
[ 2 ] == 0 ) && ( traceCard
[ 3 ] == 0 ));
597 int isBlockEmpty ( int blockN
) {
598 for ( int i
= 0 ; i
< 16 ; i
++)
599 if ( traceCard
[ blockN
* 16 + i
] != 0 ) return 0 ;
604 int isBlockTrailer ( int blockN
) {
605 return (( blockN
& 0x03 ) == 0x03 );
608 int saveTraceCard ( void ) {
611 if ((! strlen ( traceFileName
)) || ( isTraceCardEmpty ())) return 0 ;
613 f
= fopen ( traceFileName
, "w+" );
616 for ( int i
= 0 ; i
< 64 ; i
++) { // blocks
617 for ( int j
= 0 ; j
< 16 ; j
++) // bytes
618 fprintf ( f
, "%02x" , *( traceCard
+ i
* 16 + j
));
626 int loadTraceCard ( uint8_t * tuid
) {
628 char buf
[ 64 ] = { 0x00 };
629 uint8_t buf8
[ 64 ] = { 0x00 };
632 if (! isTraceCardEmpty ())
635 memset ( traceCard
, 0x00 , 4096 );
636 memcpy ( traceCard
, tuid
+ 3 , 4 );
638 FillFileNameByUID ( traceFileName
, tuid
, ".eml" , 7 );
640 f
= fopen ( traceFileName
, "r" );
647 memset ( buf
, 0 , sizeof ( buf
));
648 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
649 PrintAndLog ( "File reading error." );
654 if ( strlen ( buf
) < 32 ){
656 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
660 for ( i
= 0 ; i
< 32 ; i
+= 2 )
661 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
663 memcpy ( traceCard
+ blockNum
* 16 , buf8
, 16 );
672 int mfTraceInit ( uint8_t * tuid
, uint8_t * atqa
, uint8_t sak
, bool wantSaveToEmlFile
) {
675 crypto1_destroy ( traceCrypto1
);
679 if ( wantSaveToEmlFile
)
682 traceCard
[ 4 ] = traceCard
[ 0 ] ^ traceCard
[ 1 ] ^ traceCard
[ 2 ] ^ traceCard
[ 3 ];
684 memcpy (& traceCard
[ 6 ], atqa
, 2 );
686 uid
= bytes_to_num ( tuid
+ 3 , 4 );
688 traceState
= TRACE_IDLE
;
693 void mf_crypto1_decrypt ( struct Crypto1State
* pcs
, uint8_t * data
, int len
, bool isEncrypted
){
698 for ( i
= 0 ; i
< len
; i
++)
699 data
[ i
] = crypto1_byte ( pcs
, 0x00 , isEncrypted
) ^ data
[ i
];
702 for ( i
= 0 ; i
< 4 ; i
++)
703 bt
|= ( crypto1_bit ( pcs
, 0 , isEncrypted
) ^ BIT ( data
[ 0 ], i
)) << i
;
711 int mfTraceDecode ( uint8_t * data_src
, int len
, bool wantSaveToEmlFile
) {
714 if ( traceState
== TRACE_ERROR
) return 1 ;
716 traceState
= TRACE_ERROR
;
720 memcpy ( data
, data_src
, len
);
721 if (( traceCrypto1
) && (( traceState
== TRACE_IDLE
) || ( traceState
> TRACE_AUTH_OK
))) {
722 mf_crypto1_decrypt ( traceCrypto1
, data
, len
, 0 );
723 PrintAndLog ( "dec> %s" , sprint_hex ( data
, len
));
724 AddLogHex ( logHexFileName
, "dec> " , data
, len
);
727 switch ( traceState
) {
729 // check packet crc16!
730 if (( len
>= 4 ) && (! CheckCrc14443 ( CRC_14443_A
, data
, len
))) {
731 PrintAndLog ( "dec> CRC ERROR!!!" );
732 AddLogLine ( logHexFileName
, "dec> " , "CRC ERROR!!!" );
733 traceState
= TRACE_ERROR
; // do not decrypt the next commands
738 if (( len
== 4 ) && (( data
[ 0 ] == 0x60 ) || ( data
[ 0 ] == 0x61 ))) {
739 traceState
= TRACE_AUTH1
;
740 traceCurBlock
= data
[ 1 ];
741 traceCurKey
= data
[ 0 ] == 60 ? 1 : 0 ;
746 if (( len
== 4 ) && (( data
[ 0 ] == 0x30 ))) {
747 traceState
= TRACE_READ_DATA
;
748 traceCurBlock
= data
[ 1 ];
753 if (( len
== 4 ) && (( data
[ 0 ] == 0xA0 ))) {
754 traceState
= TRACE_WRITE_OK
;
755 traceCurBlock
= data
[ 1 ];
760 if (( len
== 4 ) && (( data
[ 0 ] == 0x50 ) && ( data
[ 1 ] == 0x00 ))) {
761 traceState
= TRACE_ERROR
; // do not decrypt the next commands
768 case TRACE_READ_DATA
:
770 traceState
= TRACE_IDLE
;
772 if ( isBlockTrailer ( traceCurBlock
)) {
773 memcpy ( traceCard
+ traceCurBlock
* 16 + 6 , data
+ 6 , 4 );
775 memcpy ( traceCard
+ traceCurBlock
* 16 , data
, 16 );
777 if ( wantSaveToEmlFile
) saveTraceCard ();
780 traceState
= TRACE_ERROR
;
786 if (( len
== 1 ) && ( data
[ 0 ] == 0x0a )) {
787 traceState
= TRACE_WRITE_DATA
;
791 traceState
= TRACE_ERROR
;
796 case TRACE_WRITE_DATA
:
798 traceState
= TRACE_IDLE
;
800 memcpy ( traceCard
+ traceCurBlock
* 16 , data
, 16 );
801 if ( wantSaveToEmlFile
) saveTraceCard ();
804 traceState
= TRACE_ERROR
;
811 traceState
= TRACE_AUTH2
;
812 nt
= bytes_to_num ( data
, 4 );
815 traceState
= TRACE_ERROR
;
822 traceState
= TRACE_AUTH_OK
;
824 nr_enc
= bytes_to_num ( data
, 4 );
825 ar_enc
= bytes_to_num ( data
+ 4 , 4 );
828 traceState
= TRACE_ERROR
;
835 traceState
= TRACE_IDLE
;
838 at_enc
= bytes_to_num ( data
, 4 );
841 ks2
= ar_enc
^ prng_successor ( nt
, 64 );
842 ks3
= at_enc
^ prng_successor ( nt
, 96 );
843 revstate
= lfsr_recovery64 ( ks2
, ks3
);
844 lfsr_rollback_word ( revstate
, 0 , 0 );
845 lfsr_rollback_word ( revstate
, 0 , 0 );
846 lfsr_rollback_word ( revstate
, nr_enc
, 1 );
847 lfsr_rollback_word ( revstate
, uid
^ nt
, 0 );
849 crypto1_get_lfsr ( revstate
, & lfsr
);
850 printf ( "key> %x%x \n " , ( unsigned int )(( lfsr
& 0xFFFFFFFF00000000 ) >> 32 ), ( unsigned int )( lfsr
& 0xFFFFFFFF ));
851 AddLogUint64 ( logHexFileName
, "key> " , lfsr
);
853 printf ( "key> nested not implemented! \n " );
854 at_enc
= bytes_to_num ( data
, 4 );
856 crypto1_destroy ( traceCrypto1
);
859 traceState
= TRACE_ERROR
;
862 int blockShift
= (( traceCurBlock
& 0xFC ) + 3 ) * 16 ;
863 if ( isBlockEmpty (( traceCurBlock
& 0xFC ) + 3 )) memcpy ( traceCard
+ blockShift
+ 6 , trailerAccessBytes
, 4 );
866 num_to_bytes ( lfsr
, 6 , traceCard
+ blockShift
+ 10 );
868 num_to_bytes ( lfsr
, 6 , traceCard
+ blockShift
);
870 if ( wantSaveToEmlFile
) saveTraceCard ();
873 crypto1_destroy ( traceCrypto1
);
876 // set cryptosystem state
877 traceCrypto1
= lfsr_recovery64 ( ks2
, ks3
);
880 traceState
= TRACE_ERROR
;
886 traceState
= TRACE_ERROR
;
895 int tryDecryptWord ( uint32_t nt
, uint32_t ar_enc
, uint32_t at_enc
, uint8_t * data
, int len
){
897 uint32_t nt; // tag challenge
898 uint32_t ar_enc; // encrypted reader response
899 uint32_t at_enc; // encrypted tag response
902 crypto1_destroy ( traceCrypto1
);
904 ks2
= ar_enc
^ prng_successor ( nt
, 64 );
905 ks3
= at_enc
^ prng_successor ( nt
, 96 );
906 traceCrypto1
= lfsr_recovery64 ( ks2
, ks3
);
908 mf_crypto1_decrypt ( traceCrypto1
, data
, len
, 0 );
910 PrintAndLog ( "Decrypted data: [%s]" , sprint_hex ( data
, len
) );
911 crypto1_destroy ( traceCrypto1
);
915 /** validate_prng_nonce
916 * Determine if nonce is deterministic. ie: Suspectable to Darkside attack.
919 * false = hardend prng
921 bool validate_prng_nonce ( uint32_t nonce
) {
925 dist
= malloc ( 2 << 16 );
930 for ( x
= i
= 1 ; i
; ++ i
) {
931 dist
[( x
& 0xff ) << 8 | x
>> 8 ] = i
;
932 x
= x
>> 1 | ( x
^ x
>> 2 ^ x
>> 3 ^ x
>> 5 ) << 15 ;
935 uint32_t res
= ( 65535 - dist
[ nonce
>> 16 ] + dist
[ nonce
& 0xffff ]) % 65535 ;
942 * function performs a partial AUTH, where it tries to authenticate against block0, key A, but only collects tag nonce.
943 * the tag nonce is check to see if it has a predictable PRNG.
945 * TRUE if tag uses WEAK prng (ie Now the NACK bug also needs to be present for Darkside attack)
946 * FALSE is tag uses HARDEND prng (ie hardnested attack possible, with known key)
948 int DetectClassicPrng ( void ){
950 UsbCommand resp
, respA
;
951 uint8_t cmd
[] = { 0x60 , 0x00 }; // MIFARE_AUTH_KEYA
952 uint32_t flags
= ISO14A_CONNECT
| ISO14A_RAW
| ISO14A_APPEND_CRC
| ISO14A_NO_RATS
;
954 UsbCommand c
= { CMD_READER_ISO_14443a
, { flags
, sizeof ( cmd
), 0 }};
955 memcpy ( c
. d
. asBytes
, cmd
, sizeof ( cmd
));
957 clearCommandBuffer ();
959 if (! WaitForResponseTimeout ( CMD_ACK
, & resp
, 2000 )) {
960 PrintAndLog ( "PRNG UID: Reply timeout." );
964 // if select tag failed.
965 if ( resp
. arg
[ 0 ] == 0 ) {
966 PrintAndLog ( "PRNG error: selecting tag failed, can't detect prng." );
970 if (! WaitForResponseTimeout ( CMD_ACK
, & respA
, 5000 )) {
971 PrintAndLog ( "PRNG data: Reply timeout." );
976 if ( respA
. arg
[ 0 ] != 4 ) {
977 PrintAndLog ( "PRNG data error: Wrong length: %d" , respA
. arg
[ 0 ]);
981 uint32_t nonce
= bytes_to_num ( respA
. d
. asBytes
, respA
. arg
[ 0 ]);
982 return validate_prng_nonce ( nonce
);