X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/a6d4e93cb55b2cdfbdcb84a57ff3a3609325ec47..5b12974a7f01a94c40552402b66b01bf8ec0e214:/client/loclass/elite_crack.c
diff --git a/client/loclass/elite_crack.c b/client/loclass/elite_crack.c
index 777efe08..21a67f54 100644
--- a/client/loclass/elite_crack.c
+++ b/client/loclass/elite_crack.c
@@ -22,7 +22,7 @@
*
* This is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as published
- * by the Free Software Foundation.
+ * by the Free Software Foundation, or, at your option, any later version.
*
* This file is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -33,7 +33,6 @@
* along with loclass. If not, see .
*
*
- *
****************************************************************************/
#include
@@ -47,7 +46,7 @@
#include "ikeys.h"
#include "elite_crack.h"
#include "fileutils.h"
-#include "polarssl/des.h"
+#include "mbedtls/des.h"
/**
* @brief Permutes a key from standard NIST format to Iclass specific format
@@ -180,22 +179,22 @@ void rk(uint8_t *key, uint8_t n, uint8_t *outp_key)
return;
}
-static des_context ctx_enc = {DES_ENCRYPT,{0}};
-static des_context ctx_dec = {DES_DECRYPT,{0}};
+static mbedtls_des_context ctx_enc = { {0} };
+static mbedtls_des_context ctx_dec = { {0} };
void desdecrypt_iclass(uint8_t *iclass_key, uint8_t *input, uint8_t *output)
{
uint8_t key_std_format[8] = {0};
permutekey_rev(iclass_key, key_std_format);
- des_setkey_dec( &ctx_dec, key_std_format);
- des_crypt_ecb(&ctx_dec,input,output);
+ mbedtls_des_setkey_dec( &ctx_dec, key_std_format);
+ mbedtls_des_crypt_ecb(&ctx_dec,input,output);
}
void desencrypt_iclass(uint8_t *iclass_key, uint8_t *input, uint8_t *output)
{
uint8_t key_std_format[8] = {0};
permutekey_rev(iclass_key, key_std_format);
- des_setkey_enc( &ctx_enc, key_std_format);
- des_crypt_ecb(&ctx_enc,input,output);
+ mbedtls_des_setkey_enc( &ctx_enc, key_std_format);
+ mbedtls_des_crypt_ecb(&ctx_enc,input,output);
}
/**
@@ -334,16 +333,14 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
* Only the lower eight bits correspond to the (hopefully cracked) key-value.
**/
uint8_t bytes_to_recover[3] = {0};
- uint8_t numbytes_to_recover = 0 ;
- int i;
- for(i =0 ; i < 8 ; i++)
- {
- if(keytable[key_index[i]] & (CRACKED | BEING_CRACKED)) continue;
+ uint8_t numbytes_to_recover = 0;
+
+ for(int i = 0; i < 8; i++) {
+ if (keytable[key_index[i]] & (CRACKED | BEING_CRACKED)) continue;
bytes_to_recover[numbytes_to_recover++] = key_index[i];
keytable[key_index[i]] |= BEING_CRACKED;
- if(numbytes_to_recover > 3)
- {
+ if(numbytes_to_recover > 3) {
prnlog("The CSN requires > 3 byte bruteforce, not supported");
printvar("CSN", item.csn,8);
printvar("HASH1", key_index,8);
@@ -371,15 +368,14 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
uint32_t endmask = 1 << 8*numbytes_to_recover;
- for(i =0 ; i < numbytes_to_recover && numbytes_to_recover > 1; i++)
+ for (int i = 0; i < numbytes_to_recover && numbytes_to_recover > 1; i++) {
prnlog("Bruteforcing byte %d", bytes_to_recover[i]);
+ }
- while(!found && !(brute & endmask))
- {
+ while(!found && !(brute & endmask)) {
//Update the keytable with the brute-values
- for(i =0 ; i < numbytes_to_recover; i++)
- {
+ for (int i = 0; i < numbytes_to_recover; i++) {
keytable[bytes_to_recover[i]] &= 0xFF00;
keytable[bytes_to_recover[i]] |= (brute >> (i*8) & 0xFF);
}
@@ -395,42 +391,34 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
//Diversify
diversifyKey(item.csn, key_sel_p, div_key);
//Calc mac
- doMAC(item.cc_nr, div_key,calculated_MAC);
+ doMAC(item.cc_nr, div_key, calculated_MAC);
- if(memcmp(calculated_MAC, item.mac, 4) == 0)
- {
- for(i =0 ; i < numbytes_to_recover; i++)
- prnlog("=> %d: 0x%02x", bytes_to_recover[i],0xFF & keytable[bytes_to_recover[i]]);
+ if (memcmp(calculated_MAC, item.mac, 4) == 0) {
+ for (int i =0 ; i < numbytes_to_recover; i++)
+ prnlog("=> %d: 0x%02x", bytes_to_recover[i], 0xFF & keytable[bytes_to_recover[i]]);
found = true;
break;
}
brute++;
- if((brute & 0xFFFF) == 0)
- {
+ if ((brute & 0xFFFF) == 0) {
printf("%d",(brute >> 16) & 0xFF);
fflush(stdout);
}
}
- if(! found)
- {
+ if (! found) {
prnlog("Failed to recover %d bytes using the following CSN",numbytes_to_recover);
printvar("CSN",item.csn,8);
errors++;
//Before we exit, reset the 'BEING_CRACKED' to zero
- for(i =0 ; i < numbytes_to_recover; i++)
- {
+ for (int i = 0; i < numbytes_to_recover; i++) {
keytable[bytes_to_recover[i]] &= 0xFF;
keytable[bytes_to_recover[i]] |= CRACK_FAILED;
}
-
- }else
- {
- for(i =0 ; i < numbytes_to_recover; i++)
- {
+ } else {
+ for (int i = 0 ;i < numbytes_to_recover; i++) {
keytable[bytes_to_recover[i]] &= 0xFF;
keytable[bytes_to_recover[i]] |= CRACKED;
}
-
}
return errors;
}
@@ -450,7 +438,7 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
*/
int calculateMasterKey(uint8_t first16bytes[], uint64_t master_key[] )
{
- des_context ctx_e = {DES_ENCRYPT,{0}};
+ mbedtls_des_context ctx_e = { {0} };
uint8_t z_0[8] = {0};
uint8_t y_0[8] = {0};
@@ -469,8 +457,8 @@ int calculateMasterKey(uint8_t first16bytes[], uint64_t master_key[] )
permutekey_rev(z_0, z_0_rev);
// ~K_cus = DESenc(z[0], y[0])
- des_setkey_enc( &ctx_e, z_0_rev );
- des_crypt_ecb(&ctx_e, y_0, key64_negated);
+ mbedtls_des_setkey_enc( &ctx_e, z_0_rev );
+ mbedtls_des_crypt_ecb(&ctx_e, y_0, key64_negated);
int i;
for(i = 0; i < 8 ; i++)
@@ -483,8 +471,8 @@ int calculateMasterKey(uint8_t first16bytes[], uint64_t master_key[] )
uint8_t key64_stdformat[8] = {0};
permutekey_rev(key64, key64_stdformat);
- des_setkey_enc( &ctx_e, key64_stdformat );
- des_crypt_ecb(&ctx_e, key64_negated, result);
+ mbedtls_des_setkey_enc( &ctx_e, key64_stdformat );
+ mbedtls_des_crypt_ecb(&ctx_e, key64_negated, result);
prnlog("\nHigh security custom key (Kcus):");
printvar("Std format ", key64_stdformat,8);
printvar("Iclass format", key64,8);
@@ -517,7 +505,7 @@ int bruteforceDump(uint8_t dump[], size_t dumpsize, uint16_t keytable[])
dumpdata* attack = (dumpdata* ) malloc(itemsize);
- for(i = 0 ; i * itemsize < dumpsize ; i++ )
+ for (i = 0 ; i * itemsize < dumpsize ; i++ )
{
memcpy(attack,dump+i*itemsize, itemsize);
errors += bruteforceItem(*attack, keytable);