]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhfmfhard.c
CHG: rename a local scope variable "data"->"cmd"
[proxmark3-svn] / client / cmdhfmfhard.c
CommitLineData
8ce3e4b4 1//-----------------------------------------------------------------------------
2// Copyright (C) 2015 piwi
3130ba4b 3// fiddled with 2016 Azcid (hardnested bitsliced Bruteforce imp)
87a513aa 4// fiddled with 2016 Matrix ( sub testing of nonces while collecting )
8ce3e4b4 5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// Implements a card only attack based on crypto text (encrypted nonces
10// received during a nested authentication) only. Unlike other card only
11// attacks this doesn't rely on implementation errors but only on the
12// inherent weaknesses of the crypto1 cypher. Described in
13// Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
14// Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
15// Computer and Communications Security, 2015
16//-----------------------------------------------------------------------------
2dcf60f3 17#include "cmdhfmfhard.h"
4d812c13 18#include "cmdhw.h"
8ce3e4b4 19
f8ada309 20#define CONFIDENCE_THRESHOLD 0.95 // Collect nonces until we are certain enough that the following brute force is successfull
0325c12f 21#define GOOD_BYTES_REQUIRED 13 // default 28, could be smaller == faster
8e4a0b35 22#define NONCES_THRESHOLD 5000 // every N nonces check if we can crack the key
4d812c13 23#define CRACKING_THRESHOLD 36.0f //38.50f // as 2^38.5
24#define MAX_BUCKETS 128
81ba7ee8 25
26#define END_OF_LIST_MARKER 0xFFFFFFFF
8ce3e4b4 27
28static const float p_K[257] = { // the probability that a random nonce has a Sum Property == K
29 0.0290, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
30 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
31 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
32 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
33 0.0083, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
34 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
35 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
36 0.0006, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
37 0.0339, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
38 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
39 0.0048, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
40 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
41 0.0934, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
42 0.0119, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
43 0.0489, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
44 0.0602, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
45 0.4180, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
46 0.0602, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
47 0.0489, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
48 0.0119, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
49 0.0934, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
50 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
51 0.0048, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
52 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
53 0.0339, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
54 0.0006, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
55 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
56 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
57 0.0083, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
58 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
59 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
60 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000, 0.0000,
61 0.0290 };
8ce3e4b4 62
63typedef struct noncelistentry {
64 uint32_t nonce_enc;
65 uint8_t par_enc;
66 void *next;
67} noncelistentry_t;
68
69typedef struct noncelist {
70 uint16_t num;
71 uint16_t Sum;
72 uint16_t Sum8_guess;
73 uint8_t BitFlip[2];
74 float Sum8_prob;
75 bool updated;
76 noncelistentry_t *first;
4d812c13 77 float score1;
78 uint_fast8_t score2;
8ce3e4b4 79} noncelist_t;
80
3130ba4b 81static size_t nonces_to_bruteforce = 0;
82static noncelistentry_t *brute_force_nonces[256];
810f5379 83static uint32_t cuid = 0;
8ce3e4b4 84static noncelist_t nonces[256];
fe8042f2 85static uint8_t best_first_bytes[256];
8ce3e4b4 86static uint16_t first_byte_Sum = 0;
87static uint16_t first_byte_num = 0;
88static uint16_t num_good_first_bytes = 0;
f8ada309 89static uint64_t maximum_states = 0;
90static uint64_t known_target_key;
0d5ee8e2 91static bool write_stats = false;
92static FILE *fstats = NULL;
8ce3e4b4 93
94
95typedef enum {
96 EVEN_STATE = 0,
97 ODD_STATE = 1
98} odd_even_t;
99
100#define STATELIST_INDEX_WIDTH 16
101#define STATELIST_INDEX_SIZE (1<<STATELIST_INDEX_WIDTH)
102
103typedef struct {
104 uint32_t *states[2];
105 uint32_t len[2];
106 uint32_t *index[2][STATELIST_INDEX_SIZE];
107} partial_indexed_statelist_t;
108
109typedef struct {
110 uint32_t *states[2];
111 uint32_t len[2];
112 void* next;
113} statelist_t;
114
115
f8ada309 116static partial_indexed_statelist_t partial_statelist[17];
117static partial_indexed_statelist_t statelist_bitflip;
f8ada309 118static statelist_t *candidates = NULL;
8ce3e4b4 119
383a1fb3
GG
120bool field_off = false;
121
4d812c13 122uint64_t foundkey = 0;
123size_t keys_found = 0;
124size_t bucket_count = 0;
125statelist_t* buckets[MAX_BUCKETS];
126static uint64_t total_states_tested = 0;
127size_t thread_count = 4;
128
129// these bitsliced states will hold identical states in all slices
130bitslice_t bitsliced_rollback_byte[ROLLBACK_SIZE];
131
132// arrays of bitsliced states with identical values in all slices
133bitslice_t bitsliced_encrypted_nonces[NONCE_TESTS][STATE_SIZE];
134bitslice_t bitsliced_encrypted_parity_bits[NONCE_TESTS][ROLLBACK_SIZE];
135
136#define EXACT_COUNT
137
057d2e91
GG
138static bool generate_candidates(uint16_t, uint16_t);
139static bool brute_force(void);
140
8ce3e4b4 141static int add_nonce(uint32_t nonce_enc, uint8_t par_enc)
142{
143 uint8_t first_byte = nonce_enc >> 24;
144 noncelistentry_t *p1 = nonces[first_byte].first;
145 noncelistentry_t *p2 = NULL;
146
147 if (p1 == NULL) { // first nonce with this 1st byte
148 first_byte_num++;
f8ada309 149 first_byte_Sum += evenparity32((nonce_enc & 0xff000000) | (par_enc & 0x08));
8ce3e4b4 150 // printf("Adding nonce 0x%08x, par_enc 0x%02x, parity(0x%08x) = %d\n",
151 // nonce_enc,
152 // par_enc,
153 // (nonce_enc & 0xff000000) | (par_enc & 0x08) |0x01,
f8ada309 154 // parity((nonce_enc & 0xff000000) | (par_enc & 0x08));
8ce3e4b4 155 }
156
157 while (p1 != NULL && (p1->nonce_enc & 0x00ff0000) < (nonce_enc & 0x00ff0000)) {
158 p2 = p1;
159 p1 = p1->next;
160 }
161
162 if (p1 == NULL) { // need to add at the end of the list
163 if (p2 == NULL) { // list is empty yet. Add first entry.
164 p2 = nonces[first_byte].first = malloc(sizeof(noncelistentry_t));
165 } else { // add new entry at end of existing list.
166 p2 = p2->next = malloc(sizeof(noncelistentry_t));
167 }
fa5974bb 168 if (p2 == NULL) return 0; // memory allocation failed
169 }
170 else if ((p1->nonce_enc & 0x00ff0000) != (nonce_enc & 0x00ff0000)) { // found distinct 2nd byte. Need to insert.
8ce3e4b4 171 if (p2 == NULL) { // need to insert at start of list
172 p2 = nonces[first_byte].first = malloc(sizeof(noncelistentry_t));
173 } else {
174 p2 = p2->next = malloc(sizeof(noncelistentry_t));
175 }
fa5974bb 176 if (p2 == NULL) return 0; // memory allocation failed
177 } else {
178 return 0; // we have seen this 2nd byte before. Nothing to add or insert.
8ce3e4b4 179 }
180
181 // add or insert new data
182 p2->next = p1;
183 p2->nonce_enc = nonce_enc;
184 p2->par_enc = par_enc;
185
3130ba4b 186 if(nonces_to_bruteforce < 256){
187 brute_force_nonces[nonces_to_bruteforce] = p2;
188 nonces_to_bruteforce++;
189 }
190
8ce3e4b4 191 nonces[first_byte].num++;
f8ada309 192 nonces[first_byte].Sum += evenparity32((nonce_enc & 0x00ff0000) | (par_enc & 0x04));
8ce3e4b4 193 nonces[first_byte].updated = true; // indicates that we need to recalculate the Sum(a8) probability for this first byte
194
fa5974bb 195 return 1; // new nonce added
8ce3e4b4 196}
197
0d5ee8e2 198static void init_nonce_memory(void)
199{
200 for (uint16_t i = 0; i < 256; i++) {
201 nonces[i].num = 0;
202 nonces[i].Sum = 0;
203 nonces[i].Sum8_guess = 0;
204 nonces[i].Sum8_prob = 0.0;
205 nonces[i].updated = true;
206 nonces[i].first = NULL;
207 }
208 first_byte_num = 0;
209 first_byte_Sum = 0;
210 num_good_first_bytes = 0;
211}
212
0d5ee8e2 213static void free_nonce_list(noncelistentry_t *p)
214{
215 if (p == NULL) {
216 return;
217 } else {
218 free_nonce_list(p->next);
219 free(p);
220 }
221}
222
0d5ee8e2 223static void free_nonces_memory(void)
224{
225 for (uint16_t i = 0; i < 256; i++) {
226 free_nonce_list(nonces[i].first);
227 }
228}
229
8ce3e4b4 230static uint16_t PartialSumProperty(uint32_t state, odd_even_t odd_even)
231{
232 uint16_t sum = 0;
233 for (uint16_t j = 0; j < 16; j++) {
234 uint32_t st = state;
235 uint16_t part_sum = 0;
236 if (odd_even == ODD_STATE) {
237 for (uint16_t i = 0; i < 5; i++) {
238 part_sum ^= filter(st);
239 st = (st << 1) | ((j >> (3-i)) & 0x01) ;
240 }
f8ada309 241 part_sum ^= 1; // XOR 1 cancelled out for the other 8 bits
8ce3e4b4 242 } else {
243 for (uint16_t i = 0; i < 4; i++) {
244 st = (st << 1) | ((j >> (3-i)) & 0x01) ;
245 part_sum ^= filter(st);
246 }
247 }
248 sum += part_sum;
249 }
250 return sum;
251}
252
fe8042f2 253// static uint16_t SumProperty(struct Crypto1State *s)
254// {
255 // uint16_t sum_odd = PartialSumProperty(s->odd, ODD_STATE);
256 // uint16_t sum_even = PartialSumProperty(s->even, EVEN_STATE);
257 // return (sum_odd*(16-sum_even) + (16-sum_odd)*sum_even);
258// }
8ce3e4b4 259
8ce3e4b4 260static double p_hypergeometric(uint16_t N, uint16_t K, uint16_t n, uint16_t k)
261{
262 // for efficient computation we are using the recursive definition
263 // (K-k+1) * (n-k+1)
264 // P(X=k) = P(X=k-1) * --------------------
265 // k * (N-K-n+k)
266 // and
267 // (N-K)*(N-K-1)*...*(N-K-n+1)
268 // P(X=0) = -----------------------------
269 // N*(N-1)*...*(N-n+1)
270
271 if (n-k > N-K || k > K) return 0.0; // avoids log(x<=0) in calculation below
272 if (k == 0) {
273 // use logarithms to avoid overflow with huge factorials (double type can only hold 170!)
274 double log_result = 0.0;
275 for (int16_t i = N-K; i >= N-K-n+1; i--) {
276 log_result += log(i);
277 }
278 for (int16_t i = N; i >= N-n+1; i--) {
279 log_result -= log(i);
280 }
8e4a0b35 281 return exp(log_result);
8ce3e4b4 282 } else {
283 if (n-k == N-K) { // special case. The published recursion below would fail with a divide by zero exception
284 double log_result = 0.0;
285 for (int16_t i = k+1; i <= n; i++) {
286 log_result += log(i);
287 }
288 for (int16_t i = K+1; i <= N; i++) {
289 log_result -= log(i);
290 }
8e4a0b35 291 return exp(log_result);
8ce3e4b4 292 } else { // recursion
293 return (p_hypergeometric(N, K, n, k-1) * (K-k+1) * (n-k+1) / (k * (N-K-n+k)));
294 }
295 }
296}
3130ba4b 297
8ce3e4b4 298static float sum_probability(uint16_t K, uint16_t n, uint16_t k)
299{
300 const uint16_t N = 256;
8ce3e4b4 301
4b2e63be 302 if (k > K || p_K[K] == 0.0) return 0.0;
8ce3e4b4 303
4b2e63be 304 double p_T_is_k_when_S_is_K = p_hypergeometric(N, K, n, k);
71ac327b 305 if (p_T_is_k_when_S_is_K == 0.0) return 0.0;
306
4b2e63be 307 double p_S_is_K = p_K[K];
4d812c13 308 double p_T_is_k = 0.0;
4b2e63be 309 for (uint16_t i = 0; i <= 256; i++) {
310 if (p_K[i] != 0.0) {
71ac327b 311 p_T_is_k += p_K[i] * p_hypergeometric(N, i, n, k);
8ce3e4b4 312 }
4b2e63be 313 }
71ac327b 314 if (p_T_is_k == 0.0) return 0.0;
4b2e63be 315 return(p_T_is_k_when_S_is_K * p_S_is_K / p_T_is_k);
8ce3e4b4 316}
317
a531720a 318static inline uint_fast8_t common_bits(uint_fast8_t bytes_diff)
319{
320 static const uint_fast8_t common_bits_LUT[256] = {
321 8, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
322 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
323 5, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
324 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
325 6, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
326 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
327 5, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
328 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
329 7, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
330 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
331 5, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
332 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
333 6, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
334 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
335 5, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0,
336 4, 0, 1, 0, 2, 0, 1, 0, 3, 0, 1, 0, 2, 0, 1, 0
337 };
338
339 return common_bits_LUT[bytes_diff];
340}
341
8ce3e4b4 342static void Tests()
343{
fe8042f2 344 // printf("Tests: Partial Statelist sizes\n");
345 // for (uint16_t i = 0; i <= 16; i+=2) {
346 // printf("Partial State List Odd [%2d] has %8d entries\n", i, partial_statelist[i].len[ODD_STATE]);
347 // }
348 // for (uint16_t i = 0; i <= 16; i+=2) {
349 // printf("Partial State List Even [%2d] has %8d entries\n", i, partial_statelist[i].len[EVEN_STATE]);
350 // }
8ce3e4b4 351
352 // #define NUM_STATISTICS 100000
8ce3e4b4 353 // uint32_t statistics_odd[17];
f8ada309 354 // uint64_t statistics[257];
8ce3e4b4 355 // uint32_t statistics_even[17];
356 // struct Crypto1State cs;
357 // time_t time1 = clock();
358
359 // for (uint16_t i = 0; i < 257; i++) {
360 // statistics[i] = 0;
361 // }
362 // for (uint16_t i = 0; i < 17; i++) {
363 // statistics_odd[i] = 0;
364 // statistics_even[i] = 0;
365 // }
366
367 // for (uint64_t i = 0; i < NUM_STATISTICS; i++) {
368 // cs.odd = (rand() & 0xfff) << 12 | (rand() & 0xfff);
369 // cs.even = (rand() & 0xfff) << 12 | (rand() & 0xfff);
370 // uint16_t sum_property = SumProperty(&cs);
371 // statistics[sum_property] += 1;
372 // sum_property = PartialSumProperty(cs.even, EVEN_STATE);
373 // statistics_even[sum_property]++;
374 // sum_property = PartialSumProperty(cs.odd, ODD_STATE);
375 // statistics_odd[sum_property]++;
376 // if (i%(NUM_STATISTICS/100) == 0) printf(".");
377 // }
378
379 // printf("\nTests: Calculated %d Sum properties in %0.3f seconds (%0.0f calcs/second)\n", NUM_STATISTICS, ((float)clock() - time1)/CLOCKS_PER_SEC, NUM_STATISTICS/((float)clock() - time1)*CLOCKS_PER_SEC);
380 // for (uint16_t i = 0; i < 257; i++) {
381 // if (statistics[i] != 0) {
382 // printf("probability[%3d] = %0.5f\n", i, (float)statistics[i]/NUM_STATISTICS);
383 // }
384 // }
385 // for (uint16_t i = 0; i <= 16; i++) {
386 // if (statistics_odd[i] != 0) {
387 // printf("probability odd [%2d] = %0.5f\n", i, (float)statistics_odd[i]/NUM_STATISTICS);
388 // }
389 // }
390 // for (uint16_t i = 0; i <= 16; i++) {
391 // if (statistics_odd[i] != 0) {
392 // printf("probability even [%2d] = %0.5f\n", i, (float)statistics_even[i]/NUM_STATISTICS);
393 // }
394 // }
395
396 // printf("Tests: Sum Probabilities based on Partial Sums\n");
397 // for (uint16_t i = 0; i < 257; i++) {
398 // statistics[i] = 0;
399 // }
400 // uint64_t num_states = 0;
401 // for (uint16_t oddsum = 0; oddsum <= 16; oddsum += 2) {
402 // for (uint16_t evensum = 0; evensum <= 16; evensum += 2) {
403 // uint16_t sum = oddsum*(16-evensum) + (16-oddsum)*evensum;
404 // statistics[sum] += (uint64_t)partial_statelist[oddsum].len[ODD_STATE] * partial_statelist[evensum].len[EVEN_STATE] * (1<<8);
405 // num_states += (uint64_t)partial_statelist[oddsum].len[ODD_STATE] * partial_statelist[evensum].len[EVEN_STATE] * (1<<8);
406 // }
407 // }
408 // printf("num_states = %lld, expected %lld\n", num_states, (1LL<<48));
409 // for (uint16_t i = 0; i < 257; i++) {
410 // if (statistics[i] != 0) {
411 // printf("probability[%3d] = %0.5f\n", i, (float)statistics[i]/num_states);
412 // }
413 // }
414
415 // printf("\nTests: Hypergeometric Probability for selected parameters\n");
416 // printf("p_hypergeometric(256, 206, 255, 206) = %0.8f\n", p_hypergeometric(256, 206, 255, 206));
417 // printf("p_hypergeometric(256, 206, 255, 205) = %0.8f\n", p_hypergeometric(256, 206, 255, 205));
418 // printf("p_hypergeometric(256, 156, 1, 1) = %0.8f\n", p_hypergeometric(256, 156, 1, 1));
419 // printf("p_hypergeometric(256, 156, 1, 0) = %0.8f\n", p_hypergeometric(256, 156, 1, 0));
420 // printf("p_hypergeometric(256, 1, 1, 1) = %0.8f\n", p_hypergeometric(256, 1, 1, 1));
421 // printf("p_hypergeometric(256, 1, 1, 0) = %0.8f\n", p_hypergeometric(256, 1, 1, 0));
422
fe8042f2 423 // struct Crypto1State *pcs;
424 // pcs = crypto1_create(0xffffffffffff);
425 // printf("\nTests: for key = 0xffffffffffff:\nSum(a0) = %d\nodd_state = 0x%06x\neven_state = 0x%06x\n",
426 // SumProperty(pcs), pcs->odd & 0x00ffffff, pcs->even & 0x00ffffff);
427 // crypto1_byte(pcs, (cuid >> 24) ^ best_first_bytes[0], true);
428 // printf("After adding best first byte 0x%02x:\nSum(a8) = %d\nodd_state = 0x%06x\neven_state = 0x%06x\n",
429 // best_first_bytes[0],
430 // SumProperty(pcs),
431 // pcs->odd & 0x00ffffff, pcs->even & 0x00ffffff);
432 // //test_state_odd = pcs->odd & 0x00ffffff;
433 // //test_state_even = pcs->even & 0x00ffffff;
434 // crypto1_destroy(pcs);
435 // pcs = crypto1_create(0xa0a1a2a3a4a5);
436 // printf("Tests: for key = 0xa0a1a2a3a4a5:\nSum(a0) = %d\nodd_state = 0x%06x\neven_state = 0x%06x\n",
437 // SumProperty(pcs), pcs->odd & 0x00ffffff, pcs->even & 0x00ffffff);
438 // crypto1_byte(pcs, (cuid >> 24) ^ best_first_bytes[0], true);
439 // printf("After adding best first byte 0x%02x:\nSum(a8) = %d\nodd_state = 0x%06x\neven_state = 0x%06x\n",
440 // best_first_bytes[0],
441 // SumProperty(pcs),
442 // pcs->odd & 0x00ffffff, pcs->even & 0x00ffffff);
443 // //test_state_odd = pcs->odd & 0x00ffffff;
444 // //test_state_even = pcs->even & 0x00ffffff;
445 // crypto1_destroy(pcs);
446 // pcs = crypto1_create(0xa6b9aa97b955);
447 // printf("Tests: for key = 0xa6b9aa97b955:\nSum(a0) = %d\nodd_state = 0x%06x\neven_state = 0x%06x\n",
448 // SumProperty(pcs), pcs->odd & 0x00ffffff, pcs->even & 0x00ffffff);
449 // crypto1_byte(pcs, (cuid >> 24) ^ best_first_bytes[0], true);
450 // printf("After adding best first byte 0x%02x:\nSum(a8) = %d\nodd_state = 0x%06x\neven_state = 0x%06x\n",
451 // best_first_bytes[0],
452 // SumProperty(pcs),
453 // pcs->odd & 0x00ffffff, pcs->even & 0x00ffffff);
f8ada309 454 //test_state_odd = pcs->odd & 0x00ffffff;
455 //test_state_even = pcs->even & 0x00ffffff;
fe8042f2 456 // crypto1_destroy(pcs);
8ce3e4b4 457
458
fe8042f2 459 // printf("\nTests: number of states with BitFlipProperty: %d, (= %1.3f%% of total states)\n", statelist_bitflip.len[0], 100.0 * statelist_bitflip.len[0] / (1<<20));
8ce3e4b4 460
cd777a05 461 // printf("\nTests: Actual BitFlipProperties odd/even:\n");
462 // for (uint16_t i = 0; i < 256; i++) {
463 // printf("[%02x]:%c ", i, nonces[i].BitFlip[ODD_STATE]?'o':nonces[i].BitFlip[EVEN_STATE]?'e':' ');
464 // if (i % 8 == 7) {
465 // printf("\n");
466 // }
467 // }
8ce3e4b4 468
cd777a05 469 // printf("\nTests: Sorted First Bytes:\n");
470 // for (uint16_t i = 0; i < 256; i++) {
471 // uint8_t best_byte = best_first_bytes[i];
472 // printf("#%03d Byte: %02x, n = %3d, k = %3d, Sum(a8): %3d, Confidence: %5.1f%%, Bitflip: %c\n",
473 // //printf("#%03d Byte: %02x, n = %3d, k = %3d, Sum(a8): %3d, Confidence: %5.1f%%, Bitflip: %c, score1: %1.5f, score2: %1.0f\n",
474 // i, best_byte,
475 // nonces[best_byte].num,
476 // nonces[best_byte].Sum,
477 // nonces[best_byte].Sum8_guess,
478 // nonces[best_byte].Sum8_prob * 100,
479 // nonces[best_byte].BitFlip[ODD_STATE]?'o':nonces[best_byte].BitFlip[EVEN_STATE]?'e':' '
480 // //nonces[best_byte].score1,
481 // //nonces[best_byte].score2
482 // );
483 // }
f8ada309 484
485 // printf("\nTests: parity performance\n");
486 // time_t time1p = clock();
487 // uint32_t par_sum = 0;
488 // for (uint32_t i = 0; i < 100000000; i++) {
489 // par_sum += parity(i);
490 // }
491 // printf("parsum oldparity = %d, time = %1.5fsec\n", par_sum, (float)(clock() - time1p)/CLOCKS_PER_SEC);
492
493 // time1p = clock();
494 // par_sum = 0;
495 // for (uint32_t i = 0; i < 100000000; i++) {
496 // par_sum += evenparity32(i);
497 // }
498 // printf("parsum newparity = %d, time = %1.5fsec\n", par_sum, (float)(clock() - time1p)/CLOCKS_PER_SEC);
499
8ce3e4b4 500
f8ada309 501}
502
4d812c13 503static uint16_t sort_best_first_bytes(void)
f8ada309 504{
fe8042f2 505 // sort based on probability for correct guess
8ce3e4b4 506 for (uint16_t i = 0; i < 256; i++ ) {
f8ada309 507 uint16_t j = 0;
8ce3e4b4 508 float prob1 = nonces[i].Sum8_prob;
f8ada309 509 float prob2 = nonces[best_first_bytes[0]].Sum8_prob;
fe8042f2 510 while (prob1 < prob2 && j < i) {
8ce3e4b4 511 prob2 = nonces[best_first_bytes[++j]].Sum8_prob;
512 }
fe8042f2 513 if (j < i) {
514 for (uint16_t k = i; k > j; k--) {
8ce3e4b4 515 best_first_bytes[k] = best_first_bytes[k-1];
516 }
fe8042f2 517 }
4d812c13 518 best_first_bytes[j] = i;
7fd676db 519 }
f8ada309 520
fe8042f2 521 // determine how many are above the CONFIDENCE_THRESHOLD
f8ada309 522 uint16_t num_good_nonces = 0;
fe8042f2 523 for (uint16_t i = 0; i < 256; i++) {
4b2e63be 524 if (nonces[best_first_bytes[i]].Sum8_prob >= CONFIDENCE_THRESHOLD) {
f8ada309 525 ++num_good_nonces;
526 }
527 }
528
4d812c13 529 if (num_good_nonces == 0) return 0;
530
f8ada309 531 uint16_t best_first_byte = 0;
532
533 // select the best possible first byte based on number of common bits with all {b'}
534 // uint16_t max_common_bits = 0;
535 // for (uint16_t i = 0; i < num_good_nonces; i++) {
536 // uint16_t sum_common_bits = 0;
537 // for (uint16_t j = 0; j < num_good_nonces; j++) {
538 // if (i != j) {
539 // sum_common_bits += common_bits(best_first_bytes[i],best_first_bytes[j]);
540 // }
541 // }
542 // if (sum_common_bits > max_common_bits) {
543 // max_common_bits = sum_common_bits;
544 // best_first_byte = i;
545 // }
546 // }
547
548 // select best possible first byte {b} based on least likely sum/bitflip property
549 float min_p_K = 1.0;
550 for (uint16_t i = 0; i < num_good_nonces; i++ ) {
551 uint16_t sum8 = nonces[best_first_bytes[i]].Sum8_guess;
552 float bitflip_prob = 1.0;
4d812c13 553
554 if (nonces[best_first_bytes[i]].BitFlip[ODD_STATE] || nonces[best_first_bytes[i]].BitFlip[EVEN_STATE])
f8ada309 555 bitflip_prob = 0.09375;
4d812c13 556
a531720a 557 nonces[best_first_bytes[i]].score1 = p_K[sum8] * bitflip_prob;
4d812c13 558
559 if (p_K[sum8] * bitflip_prob <= min_p_K)
f8ada309 560 min_p_K = p_K[sum8] * bitflip_prob;
4d812c13 561
f8ada309 562 }
563
a531720a 564
f8ada309 565 // use number of commmon bits as a tie breaker
4d812c13 566 uint_fast8_t max_common_bits = 0;
f8ada309 567 for (uint16_t i = 0; i < num_good_nonces; i++) {
4d812c13 568
f8ada309 569 float bitflip_prob = 1.0;
4d812c13 570 if (nonces[best_first_bytes[i]].BitFlip[ODD_STATE] || nonces[best_first_bytes[i]].BitFlip[EVEN_STATE])
f8ada309 571 bitflip_prob = 0.09375;
4d812c13 572
f8ada309 573 if (p_K[nonces[best_first_bytes[i]].Sum8_guess] * bitflip_prob == min_p_K) {
4d812c13 574 uint_fast8_t sum_common_bits = 0;
f8ada309 575 for (uint16_t j = 0; j < num_good_nonces; j++) {
a531720a 576 sum_common_bits += common_bits(best_first_bytes[i] ^ best_first_bytes[j]);
f8ada309 577 }
a531720a 578 nonces[best_first_bytes[i]].score2 = sum_common_bits;
f8ada309 579 if (sum_common_bits > max_common_bits) {
580 max_common_bits = sum_common_bits;
581 best_first_byte = i;
582 }
583 }
584 }
585
a531720a 586 // swap best possible first byte to the pole position
8e4a0b35 587 if (best_first_byte != 0) {
4d812c13 588 uint16_t temp = best_first_bytes[0];
589 best_first_bytes[0] = best_first_bytes[best_first_byte];
590 best_first_bytes[best_first_byte] = temp;
8e4a0b35 591 }
f8ada309 592
4d812c13 593 return num_good_nonces;
8ce3e4b4 594}
595
8ce3e4b4 596static uint16_t estimate_second_byte_sum(void)
4d812c13 597{
8ce3e4b4 598 for (uint16_t first_byte = 0; first_byte < 256; first_byte++) {
599 float Sum8_prob = 0.0;
600 uint16_t Sum8 = 0;
601 if (nonces[first_byte].updated) {
602 for (uint16_t sum = 0; sum <= 256; sum++) {
603 float prob = sum_probability(sum, nonces[first_byte].num, nonces[first_byte].Sum);
604 if (prob > Sum8_prob) {
605 Sum8_prob = prob;
606 Sum8 = sum;
607 }
608 }
609 nonces[first_byte].Sum8_guess = Sum8;
610 nonces[first_byte].Sum8_prob = Sum8_prob;
611 nonces[first_byte].updated = false;
612 }
613 }
4d812c13 614 return sort_best_first_bytes();
8ce3e4b4 615}
616
8ce3e4b4 617static int read_nonce_file(void)
618{
619 FILE *fnonces = NULL;
ddaecc08 620 uint8_t trgBlockNo = 0;
621 uint8_t trgKeyType = 0;
8ce3e4b4 622 uint8_t read_buf[9];
ddaecc08 623 uint32_t nt_enc1 = 0, nt_enc2 = 0;
624 uint8_t par_enc = 0;
8ce3e4b4 625 int total_num_nonces = 0;
626
627 if ((fnonces = fopen("nonces.bin","rb")) == NULL) {
628 PrintAndLog("Could not open file nonces.bin");
629 return 1;
630 }
631
632 PrintAndLog("Reading nonces from file nonces.bin...");
4d812c13 633 memset (read_buf, 0, sizeof (read_buf));
841d7af0 634 size_t bytes_read = fread(read_buf, 1, 6, fnonces);
635 if ( bytes_read == 0) {
8ce3e4b4 636 PrintAndLog("File reading error.");
637 fclose(fnonces);
638 return 1;
639 }
640 cuid = bytes_to_num(read_buf, 4);
641 trgBlockNo = bytes_to_num(read_buf+4, 1);
642 trgKeyType = bytes_to_num(read_buf+5, 1);
4d812c13 643 size_t ret = 0;
644 do {
645 memset (read_buf, 0, sizeof (read_buf));
646 if ((ret = fread(read_buf, 1, 9, fnonces)) == 9) {
8ce3e4b4 647 nt_enc1 = bytes_to_num(read_buf, 4);
648 nt_enc2 = bytes_to_num(read_buf+4, 4);
649 par_enc = bytes_to_num(read_buf+8, 1);
650 //printf("Encrypted nonce: %08x, encrypted_parity: %02x\n", nt_enc1, par_enc >> 4);
651 //printf("Encrypted nonce: %08x, encrypted_parity: %02x\n", nt_enc2, par_enc & 0x0f);
652 add_nonce(nt_enc1, par_enc >> 4);
653 add_nonce(nt_enc2, par_enc & 0x0f);
654 total_num_nonces += 2;
655 }
4d812c13 656 } while (ret == 9);
657
8ce3e4b4 658 fclose(fnonces);
659 PrintAndLog("Read %d nonces from file. cuid=%08x, Block=%d, Keytype=%c", total_num_nonces, cuid, trgBlockNo, trgKeyType==0?'A':'B');
8ce3e4b4 660 return 0;
661}
662
a531720a 663static void Check_for_FilterFlipProperties(void)
664{
665 printf("Checking for Filter Flip Properties...\n");
0d5ee8e2 666 uint16_t num_bitflips = 0;
667
a531720a 668 for (uint16_t i = 0; i < 256; i++) {
669 nonces[i].BitFlip[ODD_STATE] = false;
670 nonces[i].BitFlip[EVEN_STATE] = false;
671 }
672
673 for (uint16_t i = 0; i < 256; i++) {
4d812c13 674 if (!nonces[i].first || !nonces[i^0x80].first || !nonces[i^0x40].first) continue;
675
a531720a 676 uint8_t parity1 = (nonces[i].first->par_enc) >> 3; // parity of first byte
677 uint8_t parity2_odd = (nonces[i^0x80].first->par_enc) >> 3; // XOR 0x80 = last bit flipped
678 uint8_t parity2_even = (nonces[i^0x40].first->par_enc) >> 3; // XOR 0x40 = second last bit flipped
679
680 if (parity1 == parity2_odd) { // has Bit Flip Property for odd bits
681 nonces[i].BitFlip[ODD_STATE] = true;
0d5ee8e2 682 num_bitflips++;
a531720a 683 } else if (parity1 == parity2_even) { // has Bit Flip Property for even bits
684 nonces[i].BitFlip[EVEN_STATE] = true;
0d5ee8e2 685 num_bitflips++;
a531720a 686 }
687 }
0d5ee8e2 688
4d812c13 689 if (write_stats)
0d5ee8e2 690 fprintf(fstats, "%d;", num_bitflips);
0d5ee8e2 691}
692
0d5ee8e2 693static void simulate_MFplus_RNG(uint32_t test_cuid, uint64_t test_key, uint32_t *nt_enc, uint8_t *par_enc)
694{
1f1929a4 695 struct Crypto1State sim_cs = {0, 0};
0d5ee8e2 696 // init cryptostate with key:
697 for(int8_t i = 47; i > 0; i -= 2) {
698 sim_cs.odd = sim_cs.odd << 1 | BIT(test_key, (i - 1) ^ 7);
699 sim_cs.even = sim_cs.even << 1 | BIT(test_key, i ^ 7);
700 }
701
702 *par_enc = 0;
703 uint32_t nt = (rand() & 0xff) << 24 | (rand() & 0xff) << 16 | (rand() & 0xff) << 8 | (rand() & 0xff);
704 for (int8_t byte_pos = 3; byte_pos >= 0; byte_pos--) {
705 uint8_t nt_byte_dec = (nt >> (8*byte_pos)) & 0xff;
706 uint8_t nt_byte_enc = crypto1_byte(&sim_cs, nt_byte_dec ^ (test_cuid >> (8*byte_pos)), false) ^ nt_byte_dec; // encode the nonce byte
707 *nt_enc = (*nt_enc << 8) | nt_byte_enc;
708 uint8_t ks_par = filter(sim_cs.odd); // the keystream bit to encode/decode the parity bit
709 uint8_t nt_byte_par_enc = ks_par ^ oddparity8(nt_byte_dec); // determine the nt byte's parity and encode it
710 *par_enc = (*par_enc << 1) | nt_byte_par_enc;
711 }
712
713}
714
0d5ee8e2 715static void simulate_acquire_nonces()
716{
717 clock_t time1 = clock();
718 bool filter_flip_checked = false;
719 uint32_t total_num_nonces = 0;
720 uint32_t next_fivehundred = 500;
721 uint32_t total_added_nonces = 0;
722
723 cuid = (rand() & 0xff) << 24 | (rand() & 0xff) << 16 | (rand() & 0xff) << 8 | (rand() & 0xff);
724 known_target_key = ((uint64_t)rand() & 0xfff) << 36 | ((uint64_t)rand() & 0xfff) << 24 | ((uint64_t)rand() & 0xfff) << 12 | ((uint64_t)rand() & 0xfff);
725
726 printf("Simulating nonce acquisition for target key %012"llx", cuid %08x ...\n", known_target_key, cuid);
727 fprintf(fstats, "%012"llx";%08x;", known_target_key, cuid);
728
729 do {
730 uint32_t nt_enc = 0;
731 uint8_t par_enc = 0;
732
733 simulate_MFplus_RNG(cuid, known_target_key, &nt_enc, &par_enc);
734 //printf("Simulated RNG: nt_enc1: %08x, nt_enc2: %08x, par_enc: %02x\n", nt_enc1, nt_enc2, par_enc);
735 total_added_nonces += add_nonce(nt_enc, par_enc);
736 total_num_nonces++;
737
738 if (first_byte_num == 256 ) {
739 // printf("first_byte_num = %d, first_byte_Sum = %d\n", first_byte_num, first_byte_Sum);
740 if (!filter_flip_checked) {
741 Check_for_FilterFlipProperties();
742 filter_flip_checked = true;
743 }
744 num_good_first_bytes = estimate_second_byte_sum();
745 if (total_num_nonces > next_fivehundred) {
746 next_fivehundred = (total_num_nonces/500+1) * 500;
4d812c13 747 printf("Acquired %5d nonces (%5d with distinct bytes 0,1). Bytes with probability for correctly guessed Sum(a8) > %1.1f%%: %d\n",
7fd676db 748 total_num_nonces,
0d5ee8e2 749 total_added_nonces,
750 CONFIDENCE_THRESHOLD * 100.0,
751 num_good_first_bytes);
752 }
753 }
754
755 } while (num_good_first_bytes < GOOD_BYTES_REQUIRED);
756
b112787d 757 time1 = clock() - time1;
758 if ( time1 > 0 ) {
0d5ee8e2 759 PrintAndLog("Acquired a total of %d nonces in %1.1f seconds (%0.0f nonces/minute)",
760 total_num_nonces,
b112787d 761 ((float)time1)/CLOCKS_PER_SEC,
762 total_num_nonces * 60.0 * CLOCKS_PER_SEC/(float)time1);
763 }
0d5ee8e2 764 fprintf(fstats, "%d;%d;%d;%1.2f;", total_num_nonces, total_added_nonces, num_good_first_bytes, CONFIDENCE_THRESHOLD);
765
a531720a 766}
767
f8ada309 768static int acquire_nonces(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, bool nonce_file_write, bool slow)
8ce3e4b4 769{
770 clock_t time1 = clock();
771 bool initialize = true;
8ce3e4b4 772 bool finished = false;
a531720a 773 bool filter_flip_checked = false;
8ce3e4b4 774 uint32_t flags = 0;
775 uint8_t write_buf[9];
776 uint32_t total_num_nonces = 0;
777 uint32_t next_fivehundred = 500;
778 uint32_t total_added_nonces = 0;
057d2e91 779 uint32_t idx = 1;
e108a48a 780 uint32_t timeout = 0;
8ce3e4b4 781 FILE *fnonces = NULL;
383a1fb3 782 field_off = false;
4d812c13 783 UsbCommand resp;
784 UsbCommand c = {CMD_MIFARE_ACQUIRE_ENCRYPTED_NONCES, {0,0,0} };
785 memcpy(c.d.asBytes, key, 6);
786 c.arg[0] = blockNo + (keyType * 0x100);
787 c.arg[1] = trgBlockNo + (trgKeyType * 0x100);
06d09c98 788
8ce3e4b4 789 printf("Acquiring nonces...\n");
8ce3e4b4 790 do {
06d09c98 791
8ce3e4b4 792 flags = 0;
711ae19f 793 flags |= initialize ? 0x0001 : 0;
8ce3e4b4 794 flags |= slow ? 0x0002 : 0;
795 flags |= field_off ? 0x0004 : 0;
360caaba 796 c.arg[2] = flags;
4d812c13 797
7fd676db 798 clearCommandBuffer();
8ce3e4b4 799 SendCommand(&c);
800
87a513aa 801 if (field_off) break;
8ce3e4b4 802
e108a48a 803 while(!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
804 timeout++;
805 printf(".");
d1e197e9 806 if (timeout > 3) {
e108a48a 807 PrintAndLog("\nNo response from Proxmark. Aborting...");
808 if (fnonces) fclose(fnonces);
809 return 1;
810 }
811 }
4d812c13 812
360caaba 813 if (resp.arg[0]) {
814 if (fnonces) fclose(fnonces);
815 return resp.arg[0]; // error during nested_hard
816 }
817
818 if (initialize) {
819 // global var CUID
8ce3e4b4 820 cuid = resp.arg[1];
8ce3e4b4 821 if (nonce_file_write && fnonces == NULL) {
822 if ((fnonces = fopen("nonces.bin","wb")) == NULL) {
823 PrintAndLog("Could not create file nonces.bin");
824 return 3;
825 }
826 PrintAndLog("Writing acquired nonces to binary file nonces.bin");
4d812c13 827 memset (write_buf, 0, sizeof (write_buf));
8ce3e4b4 828 num_to_bytes(cuid, 4, write_buf);
829 fwrite(write_buf, 1, 4, fnonces);
830 fwrite(&trgBlockNo, 1, 1, fnonces);
831 fwrite(&trgKeyType, 1, 1, fnonces);
7fd676db 832 fflush(fnonces);
8ce3e4b4 833 }
360caaba 834 initialize = false;
8ce3e4b4 835 }
360caaba 836
837 uint32_t nt_enc1, nt_enc2;
838 uint8_t par_enc;
839 uint16_t num_acquired_nonces = resp.arg[2];
840 uint8_t *bufp = resp.d.asBytes;
4d812c13 841 for (uint16_t i = 0; i < num_acquired_nonces; i += 2) {
360caaba 842 nt_enc1 = bytes_to_num(bufp, 4);
843 nt_enc2 = bytes_to_num(bufp+4, 4);
844 par_enc = bytes_to_num(bufp+8, 1);
845
360caaba 846 total_added_nonces += add_nonce(nt_enc1, par_enc >> 4);
360caaba 847 total_added_nonces += add_nonce(nt_enc2, par_enc & 0x0f);
848
849 if (nonce_file_write && fnonces) {
850 fwrite(bufp, 1, 9, fnonces);
851 fflush(fnonces);
8ce3e4b4 852 }
360caaba 853 bufp += 9;
8ce3e4b4 854 }
360caaba 855 total_num_nonces += num_acquired_nonces;
856
857 if (first_byte_num == 256) {
7fd676db 858
a531720a 859 if (!filter_flip_checked) {
860 Check_for_FilterFlipProperties();
861 filter_flip_checked = true;
862 }
383a1fb3 863
8ce3e4b4 864 num_good_first_bytes = estimate_second_byte_sum();
360caaba 865
8ce3e4b4 866 if (total_num_nonces > next_fivehundred) {
867 next_fivehundred = (total_num_nonces/500+1) * 500;
4d812c13 868 printf("Acquired %5d nonces (%5d/%5d with distinct bytes 0,1). Bytes with probability for correctly guessed Sum(a8) > %1.1f%%: %d\n",
7fd676db 869 total_num_nonces,
8ce3e4b4 870 total_added_nonces,
8e4a0b35 871 NONCES_THRESHOLD * idx,
8ce3e4b4 872 CONFIDENCE_THRESHOLD * 100.0,
06d09c98 873 num_good_first_bytes
f07ffa76 874 );
383a1fb3 875 }
4d812c13 876
711ae19f 877 if (total_added_nonces >= (NONCES_THRESHOLD * idx)) {
878 if (num_good_first_bytes > 0) {
879 if (generate_candidates(first_byte_Sum, nonces[best_first_bytes[0]].Sum8_guess) || known_target_key != -1) {
880 field_off = brute_force(); // switch off field with next SendCommand and then finish
4d812c13 881 }
bbcd41a6 882 }
711ae19f 883 idx++;
1a4b6738 884 }
8ce3e4b4 885 }
8ce3e4b4 886 } while (!finished);
887
7fd676db 888 if (nonce_file_write && fnonces)
8ce3e4b4 889 fclose(fnonces);
8ce3e4b4 890
b112787d 891 time1 = clock() - time1;
892 if ( time1 > 0 ) {
81ba7ee8 893 PrintAndLog("Acquired a total of %d nonces in %1.1f seconds (%0.0f nonces/minute)",
894 total_num_nonces,
895 ((float)time1)/CLOCKS_PER_SEC,
896 total_num_nonces * 60.0 * CLOCKS_PER_SEC/(float)time1
b112787d 897 );
898 }
8ce3e4b4 899 return 0;
900}
901
8ce3e4b4 902static int init_partial_statelists(void)
903{
f8ada309 904 const uint32_t sizes_odd[17] = { 126757, 0, 18387, 0, 74241, 0, 181737, 0, 248801, 0, 182033, 0, 73421, 0, 17607, 0, 125601 };
0325c12f
GG
905// const uint32_t sizes_even[17] = { 125723, 0, 17867, 0, 74305, 0, 178707, 0, 248801, 0, 185063, 0, 73356, 0, 18127, 0, 126634 };
906 const uint32_t sizes_even[17] = { 125723, 0, 17867, 0, 74305, 0, 178707, 0, 248801, 0, 185063, 0, 73357, 0, 18127, 0, 126635 };
8ce3e4b4 907
908 printf("Allocating memory for partial statelists...\n");
909 for (odd_even_t odd_even = EVEN_STATE; odd_even <= ODD_STATE; odd_even++) {
910 for (uint16_t i = 0; i <= 16; i+=2) {
911 partial_statelist[i].len[odd_even] = 0;
912 uint32_t num_of_states = odd_even == ODD_STATE ? sizes_odd[i] : sizes_even[i];
913 partial_statelist[i].states[odd_even] = malloc(sizeof(uint32_t) * num_of_states);
914 if (partial_statelist[i].states[odd_even] == NULL) {
915 PrintAndLog("Cannot allocate enough memory. Aborting");
916 return 4;
917 }
918 for (uint32_t j = 0; j < STATELIST_INDEX_SIZE; j++) {
919 partial_statelist[i].index[odd_even][j] = NULL;
920 }
921 }
922 }
923
924 printf("Generating partial statelists...\n");
925 for (odd_even_t odd_even = EVEN_STATE; odd_even <= ODD_STATE; odd_even++) {
926 uint32_t index = -1;
927 uint32_t num_of_states = 1<<20;
928 for (uint32_t state = 0; state < num_of_states; state++) {
929 uint16_t sum_property = PartialSumProperty(state, odd_even);
930 uint32_t *p = partial_statelist[sum_property].states[odd_even];
931 p += partial_statelist[sum_property].len[odd_even];
932 *p = state;
933 partial_statelist[sum_property].len[odd_even]++;
934 uint32_t index_mask = (STATELIST_INDEX_SIZE-1) << (20-STATELIST_INDEX_WIDTH);
935 if ((state & index_mask) != index) {
936 index = state & index_mask;
937 }
938 if (partial_statelist[sum_property].index[odd_even][index >> (20-STATELIST_INDEX_WIDTH)] == NULL) {
939 partial_statelist[sum_property].index[odd_even][index >> (20-STATELIST_INDEX_WIDTH)] = p;
940 }
941 }
942 // add End Of List markers
943 for (uint16_t i = 0; i <= 16; i += 2) {
944 uint32_t *p = partial_statelist[i].states[odd_even];
945 p += partial_statelist[i].len[odd_even];
81ba7ee8 946 *p = END_OF_LIST_MARKER;
8ce3e4b4 947 }
948 }
949
950 return 0;
951}
8ce3e4b4 952
953static void init_BitFlip_statelist(void)
954{
955 printf("Generating bitflip statelist...\n");
956 uint32_t *p = statelist_bitflip.states[0] = malloc(sizeof(uint32_t) * 1<<20);
957 uint32_t index = -1;
958 uint32_t index_mask = (STATELIST_INDEX_SIZE-1) << (20-STATELIST_INDEX_WIDTH);
959 for (uint32_t state = 0; state < (1 << 20); state++) {
960 if (filter(state) != filter(state^1)) {
961 if ((state & index_mask) != index) {
962 index = state & index_mask;
963 }
964 if (statelist_bitflip.index[0][index >> (20-STATELIST_INDEX_WIDTH)] == NULL) {
965 statelist_bitflip.index[0][index >> (20-STATELIST_INDEX_WIDTH)] = p;
966 }
967 *p++ = state;
968 }
969 }
970 // set len and add End Of List marker
971 statelist_bitflip.len[0] = p - statelist_bitflip.states[0];
81ba7ee8 972 *p = END_OF_LIST_MARKER;
4d812c13 973 //statelist_bitflip.states[0] = realloc(statelist_bitflip.states[0], sizeof(uint32_t) * (statelist_bitflip.len[0] + 1));
8ce3e4b4 974}
8ce3e4b4 975
a531720a 976static inline uint32_t *find_first_state(uint32_t state, uint32_t mask, partial_indexed_statelist_t *sl, odd_even_t odd_even)
8ce3e4b4 977{
978 uint32_t *p = sl->index[odd_even][(state & mask) >> (20-STATELIST_INDEX_WIDTH)]; // first Bits as index
979
980 if (p == NULL) return NULL;
a531720a 981 while (*p < (state & mask)) p++;
81ba7ee8 982 if (*p == END_OF_LIST_MARKER) return NULL; // reached end of list, no match
8ce3e4b4 983 if ((*p & mask) == (state & mask)) return p; // found a match.
984 return NULL; // no match
985}
986
a531720a 987static inline bool /*__attribute__((always_inline))*/ invariant_holds(uint_fast8_t byte_diff, uint_fast32_t state1, uint_fast32_t state2, uint_fast8_t bit, uint_fast8_t state_bit)
8ce3e4b4 988{
a531720a 989 uint_fast8_t j_1_bit_mask = 0x01 << (bit-1);
990 uint_fast8_t bit_diff = byte_diff & j_1_bit_mask; // difference of (j-1)th bit
991 uint_fast8_t filter_diff = filter(state1 >> (4-state_bit)) ^ filter(state2 >> (4-state_bit)); // difference in filter function
992 uint_fast8_t mask_y12_y13 = 0xc0 >> state_bit;
993 uint_fast8_t state_bits_diff = (state1 ^ state2) & mask_y12_y13; // difference in state bits 12 and 13
994 uint_fast8_t all_diff = evenparity8(bit_diff ^ state_bits_diff ^ filter_diff); // use parity function to XOR all bits
995 return !all_diff;
996}
997
a531720a 998static inline bool /*__attribute__((always_inline))*/ invalid_state(uint_fast8_t byte_diff, uint_fast32_t state1, uint_fast32_t state2, uint_fast8_t bit, uint_fast8_t state_bit)
999{
1000 uint_fast8_t j_bit_mask = 0x01 << bit;
1001 uint_fast8_t bit_diff = byte_diff & j_bit_mask; // difference of jth bit
1002 uint_fast8_t mask_y13_y16 = 0x48 >> state_bit;
1003 uint_fast8_t state_bits_diff = (state1 ^ state2) & mask_y13_y16; // difference in state bits 13 and 16
1004 uint_fast8_t all_diff = evenparity8(bit_diff ^ state_bits_diff); // use parity function to XOR all bits
1005 return all_diff;
1006}
1007
a531720a 1008static inline bool remaining_bits_match(uint_fast8_t num_common_bits, uint_fast8_t byte_diff, uint_fast32_t state1, uint_fast32_t state2, odd_even_t odd_even)
1009{
1010 if (odd_even) {
1011 // odd bits
1012 switch (num_common_bits) {
1013 case 0: if (!invariant_holds(byte_diff, state1, state2, 1, 0)) return true;
1014 case 1: if (invalid_state(byte_diff, state1, state2, 1, 0)) return false;
1015 case 2: if (!invariant_holds(byte_diff, state1, state2, 3, 1)) return true;
1016 case 3: if (invalid_state(byte_diff, state1, state2, 3, 1)) return false;
1017 case 4: if (!invariant_holds(byte_diff, state1, state2, 5, 2)) return true;
1018 case 5: if (invalid_state(byte_diff, state1, state2, 5, 2)) return false;
1019 case 6: if (!invariant_holds(byte_diff, state1, state2, 7, 3)) return true;
1020 case 7: if (invalid_state(byte_diff, state1, state2, 7, 3)) return false;
8ce3e4b4 1021 }
a531720a 1022 } else {
1023 // even bits
1024 switch (num_common_bits) {
1025 case 0: if (invalid_state(byte_diff, state1, state2, 0, 0)) return false;
1026 case 1: if (!invariant_holds(byte_diff, state1, state2, 2, 1)) return true;
1027 case 2: if (invalid_state(byte_diff, state1, state2, 2, 1)) return false;
1028 case 3: if (!invariant_holds(byte_diff, state1, state2, 4, 2)) return true;
1029 case 4: if (invalid_state(byte_diff, state1, state2, 4, 2)) return false;
1030 case 5: if (!invariant_holds(byte_diff, state1, state2, 6, 3)) return true;
1031 case 6: if (invalid_state(byte_diff, state1, state2, 6, 3)) return false;
8ce3e4b4 1032 }
8ce3e4b4 1033 }
1034
1035 return true; // valid state
1036}
1037
8ce3e4b4 1038static bool all_other_first_bytes_match(uint32_t state, odd_even_t odd_even)
1039{
1040 for (uint16_t i = 1; i < num_good_first_bytes; i++) {
1041 uint16_t sum_a8 = nonces[best_first_bytes[i]].Sum8_guess;
a531720a 1042 uint_fast8_t bytes_diff = best_first_bytes[0] ^ best_first_bytes[i];
1043 uint_fast8_t j = common_bits(bytes_diff);
8ce3e4b4 1044 uint32_t mask = 0xfffffff0;
1045 if (odd_even == ODD_STATE) {
a531720a 1046 mask >>= j/2;
8ce3e4b4 1047 } else {
a531720a 1048 mask >>= (j+1)/2;
8ce3e4b4 1049 }
1050 mask &= 0x000fffff;
1051 //printf("bytes 0x%02x and 0x%02x: %d common bits, mask = 0x%08x, state = 0x%08x, sum_a8 = %d", best_first_bytes[0], best_first_bytes[i], j, mask, state, sum_a8);
1052 bool found_match = false;
1053 for (uint16_t r = 0; r <= 16 && !found_match; r += 2) {
1054 for (uint16_t s = 0; s <= 16 && !found_match; s += 2) {
1055 if (r*(16-s) + (16-r)*s == sum_a8) {
1056 //printf("Checking byte 0x%02x for partial sum (%s) %d\n", best_first_bytes[i], odd_even==ODD_STATE?"odd":"even", odd_even==ODD_STATE?r:s);
1057 uint16_t part_sum_a8 = (odd_even == ODD_STATE) ? r : s;
1058 uint32_t *p = find_first_state(state, mask, &partial_statelist[part_sum_a8], odd_even);
1059 if (p != NULL) {
81ba7ee8 1060 while ((state & mask) == (*p & mask) && (*p != END_OF_LIST_MARKER)) {
a531720a 1061 if (remaining_bits_match(j, bytes_diff, state, (state&0x00fffff0) | *p, odd_even)) {
8ce3e4b4 1062 found_match = true;
1063 // if ((odd_even == ODD_STATE && state == test_state_odd)
1064 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1065 // printf("all_other_first_bytes_match(): %s test state: remaining bits matched. Bytes = %02x, %02x, Common Bits=%d, mask=0x%08x, PartSum(a8)=%d\n",
1066 // odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j, mask, part_sum_a8);
1067 // }
1068 break;
1069 } else {
1070 // if ((odd_even == ODD_STATE && state == test_state_odd)
1071 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1072 // printf("all_other_first_bytes_match(): %s test state: remaining bits didn't match. Bytes = %02x, %02x, Common Bits=%d, mask=0x%08x, PartSum(a8)=%d\n",
1073 // odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j, mask, part_sum_a8);
1074 // }
1075 }
1076 p++;
1077 }
1078 } else {
1079 // if ((odd_even == ODD_STATE && state == test_state_odd)
1080 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1081 // printf("all_other_first_bytes_match(): %s test state: couldn't find a matching state. Bytes = %02x, %02x, Common Bits=%d, mask=0x%08x, PartSum(a8)=%d\n",
1082 // odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j, mask, part_sum_a8);
1083 // }
1084 }
1085 }
1086 }
1087 }
1088
1089 if (!found_match) {
1090 // if ((odd_even == ODD_STATE && state == test_state_odd)
1091 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1092 // printf("all_other_first_bytes_match(): %s test state: Eliminated. Bytes = %02x, %02x, Common Bits = %d\n", odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j);
1093 // }
1094 return false;
1095 }
1096 }
1097
1098 return true;
1099}
1100
f8ada309 1101static bool all_bit_flips_match(uint32_t state, odd_even_t odd_even)
1102{
1103 for (uint16_t i = 0; i < 256; i++) {
1104 if (nonces[i].BitFlip[odd_even] && i != best_first_bytes[0]) {
a531720a 1105 uint_fast8_t bytes_diff = best_first_bytes[0] ^ i;
1106 uint_fast8_t j = common_bits(bytes_diff);
f8ada309 1107 uint32_t mask = 0xfffffff0;
1108 if (odd_even == ODD_STATE) {
a531720a 1109 mask >>= j/2;
f8ada309 1110 } else {
a531720a 1111 mask >>= (j+1)/2;
f8ada309 1112 }
1113 mask &= 0x000fffff;
1114 //printf("bytes 0x%02x and 0x%02x: %d common bits, mask = 0x%08x, state = 0x%08x, sum_a8 = %d", best_first_bytes[0], best_first_bytes[i], j, mask, state, sum_a8);
1115 bool found_match = false;
1116 uint32_t *p = find_first_state(state, mask, &statelist_bitflip, 0);
1117 if (p != NULL) {
81ba7ee8 1118 while ((state & mask) == (*p & mask) && (*p != END_OF_LIST_MARKER)) {
a531720a 1119 if (remaining_bits_match(j, bytes_diff, state, (state&0x00fffff0) | *p, odd_even)) {
f8ada309 1120 found_match = true;
1121 // if ((odd_even == ODD_STATE && state == test_state_odd)
1122 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1123 // printf("all_other_first_bytes_match(): %s test state: remaining bits matched. Bytes = %02x, %02x, Common Bits=%d, mask=0x%08x, PartSum(a8)=%d\n",
1124 // odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j, mask, part_sum_a8);
1125 // }
1126 break;
1127 } else {
1128 // if ((odd_even == ODD_STATE && state == test_state_odd)
1129 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1130 // printf("all_other_first_bytes_match(): %s test state: remaining bits didn't match. Bytes = %02x, %02x, Common Bits=%d, mask=0x%08x, PartSum(a8)=%d\n",
1131 // odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j, mask, part_sum_a8);
1132 // }
1133 }
1134 p++;
1135 }
1136 } else {
1137 // if ((odd_even == ODD_STATE && state == test_state_odd)
1138 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1139 // printf("all_other_first_bytes_match(): %s test state: couldn't find a matching state. Bytes = %02x, %02x, Common Bits=%d, mask=0x%08x, PartSum(a8)=%d\n",
1140 // odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j, mask, part_sum_a8);
1141 // }
1142 }
1143 if (!found_match) {
1144 // if ((odd_even == ODD_STATE && state == test_state_odd)
1145 // || (odd_even == EVEN_STATE && state == test_state_even)) {
1146 // printf("all_other_first_bytes_match(): %s test state: Eliminated. Bytes = %02x, %02x, Common Bits = %d\n", odd_even==ODD_STATE?"odd":"even", best_first_bytes[0], best_first_bytes[i], j);
1147 // }
1148 return false;
1149 }
1150 }
1151
1152 }
1153
1154 return true;
1155}
1156
a531720a 1157static struct sl_cache_entry {
1158 uint32_t *sl;
1159 uint32_t len;
1160 } sl_cache[17][17][2];
1161
a531720a 1162static void init_statelist_cache(void)
1163{
a531720a 1164 for (uint16_t i = 0; i < 17; i+=2) {
1165 for (uint16_t j = 0; j < 17; j+=2) {
1166 for (uint16_t k = 0; k < 2; k++) {
1167 sl_cache[i][j][k].sl = NULL;
1168 sl_cache[i][j][k].len = 0;
1169 }
1170 }
1171 }
1172}
1173
8ce3e4b4 1174static int add_matching_states(statelist_t *candidates, uint16_t part_sum_a0, uint16_t part_sum_a8, odd_even_t odd_even)
1175{
1176 uint32_t worstcase_size = 1<<20;
1177
a531720a 1178 // check cache for existing results
1179 if (sl_cache[part_sum_a0][part_sum_a8][odd_even].sl != NULL) {
1180 candidates->states[odd_even] = sl_cache[part_sum_a0][part_sum_a8][odd_even].sl;
1181 candidates->len[odd_even] = sl_cache[part_sum_a0][part_sum_a8][odd_even].len;
1182 return 0;
1183 }
1184
8ce3e4b4 1185 candidates->states[odd_even] = (uint32_t *)malloc(sizeof(uint32_t) * worstcase_size);
1186 if (candidates->states[odd_even] == NULL) {
1187 PrintAndLog("Out of memory error.\n");
1188 return 4;
1189 }
a531720a 1190 uint32_t *add_p = candidates->states[odd_even];
81ba7ee8 1191 for (uint32_t *p1 = partial_statelist[part_sum_a0].states[odd_even]; *p1 != END_OF_LIST_MARKER; p1++) {
8ce3e4b4 1192 uint32_t search_mask = 0x000ffff0;
1193 uint32_t *p2 = find_first_state((*p1 << 4), search_mask, &partial_statelist[part_sum_a8], odd_even);
71ac327b 1194 if (p1 != NULL && p2 != NULL) {
81ba7ee8 1195 while (((*p1 << 4) & search_mask) == (*p2 & search_mask) && *p2 != END_OF_LIST_MARKER) {
a531720a 1196 if ((nonces[best_first_bytes[0]].BitFlip[odd_even] && find_first_state((*p1 << 4) | *p2, 0x000fffff, &statelist_bitflip, 0))
1197 || !nonces[best_first_bytes[0]].BitFlip[odd_even]) {
8ce3e4b4 1198 if (all_other_first_bytes_match((*p1 << 4) | *p2, odd_even)) {
f8ada309 1199 if (all_bit_flips_match((*p1 << 4) | *p2, odd_even)) {
a531720a 1200 *add_p++ = (*p1 << 4) | *p2;
1201 }
8ce3e4b4 1202 }
f8ada309 1203 }
8ce3e4b4 1204 p2++;
1205 }
1206 }
8ce3e4b4 1207 }
f8ada309 1208
a531720a 1209 // set end of list marker and len
81ba7ee8 1210 *add_p = END_OF_LIST_MARKER;
a531720a 1211 candidates->len[odd_even] = add_p - candidates->states[odd_even];
f8ada309 1212
8ce3e4b4 1213 candidates->states[odd_even] = realloc(candidates->states[odd_even], sizeof(uint32_t) * (candidates->len[odd_even] + 1));
1214
a531720a 1215 sl_cache[part_sum_a0][part_sum_a8][odd_even].sl = candidates->states[odd_even];
1216 sl_cache[part_sum_a0][part_sum_a8][odd_even].len = candidates->len[odd_even];
1217
8ce3e4b4 1218 return 0;
1219}
1220
8ce3e4b4 1221static statelist_t *add_more_candidates(statelist_t *current_candidates)
1222{
1223 statelist_t *new_candidates = NULL;
1224 if (current_candidates == NULL) {
1225 if (candidates == NULL) {
1226 candidates = (statelist_t *)malloc(sizeof(statelist_t));
1227 }
1228 new_candidates = candidates;
1229 } else {
1230 new_candidates = current_candidates->next = (statelist_t *)malloc(sizeof(statelist_t));
1231 }
71ac327b 1232 if (!new_candidates) return NULL;
1233
8ce3e4b4 1234 new_candidates->next = NULL;
1235 new_candidates->len[ODD_STATE] = 0;
1236 new_candidates->len[EVEN_STATE] = 0;
1237 new_candidates->states[ODD_STATE] = NULL;
1238 new_candidates->states[EVEN_STATE] = NULL;
1239 return new_candidates;
1240}
1241
057d2e91 1242static bool TestIfKeyExists(uint64_t key)
8ce3e4b4 1243{
1244 struct Crypto1State *pcs;
1245 pcs = crypto1_create(key);
1246 crypto1_byte(pcs, (cuid >> 24) ^ best_first_bytes[0], true);
1247
1248 uint32_t state_odd = pcs->odd & 0x00ffffff;
1249 uint32_t state_even = pcs->even & 0x00ffffff;
f8ada309 1250 //printf("Tests: searching for key %llx after first byte 0x%02x (state_odd = 0x%06x, state_even = 0x%06x) ...\n", key, best_first_bytes[0], state_odd, state_even);
fa5974bb 1251 printf("Validating key search space\n");
f8ada309 1252 uint64_t count = 0;
8ce3e4b4 1253 for (statelist_t *p = candidates; p != NULL; p = p->next) {
f8ada309 1254 bool found_odd = false;
1255 bool found_even = false;
8ce3e4b4 1256 uint32_t *p_odd = p->states[ODD_STATE];
1257 uint32_t *p_even = p->states[EVEN_STATE];
81ba7ee8 1258 while (*p_odd != END_OF_LIST_MARKER) {
f8ada309 1259 if ((*p_odd & 0x00ffffff) == state_odd) {
1260 found_odd = true;
1261 break;
1262 }
8ce3e4b4 1263 p_odd++;
1264 }
81ba7ee8 1265 while (*p_even != END_OF_LIST_MARKER) {
06d09c98 1266 if ((*p_even & 0x00ffffff) == state_even)
f8ada309 1267 found_even = true;
06d09c98 1268
8ce3e4b4 1269 p_even++;
1270 }
f8ada309 1271 count += (p_odd - p->states[ODD_STATE]) * (p_even - p->states[EVEN_STATE]);
1272 if (found_odd && found_even) {
4d812c13 1273 if (known_target_key != -1) {
06d09c98 1274 PrintAndLog("Key Found after testing %llu (2^%1.1f) out of %lld (2^%1.1f) keys.",
1275 count,
1276 log(count)/log(2),
1277 maximum_states,
1278 log(maximum_states)/log(2)
1279 );
1280 if (write_stats)
1281 fprintf(fstats, "1\n");
4d812c13 1282 }
f8ada309 1283 crypto1_destroy(pcs);
057d2e91 1284 return true;
f8ada309 1285 }
8ce3e4b4 1286 }
f8ada309 1287
4d812c13 1288 if (known_target_key != -1) {
06d09c98 1289 printf("Key NOT found!\n");
1290 if (write_stats)
1291 fprintf(fstats, "0\n");
4d812c13 1292 }
8ce3e4b4 1293 crypto1_destroy(pcs);
057d2e91 1294 return false;
8ce3e4b4 1295}
1296
057d2e91 1297static bool generate_candidates(uint16_t sum_a0, uint16_t sum_a8)
8ce3e4b4 1298{
1299 printf("Generating crypto1 state candidates... \n");
1300
1301 statelist_t *current_candidates = NULL;
1302 // estimate maximum candidate states
f8ada309 1303 maximum_states = 0;
8ce3e4b4 1304 for (uint16_t sum_odd = 0; sum_odd <= 16; sum_odd += 2) {
1305 for (uint16_t sum_even = 0; sum_even <= 16; sum_even += 2) {
1306 if (sum_odd*(16-sum_even) + (16-sum_odd)*sum_even == sum_a0) {
1307 maximum_states += (uint64_t)partial_statelist[sum_odd].len[ODD_STATE] * partial_statelist[sum_even].len[EVEN_STATE] * (1<<8);
1308 }
1309 }
1310 }
057d2e91 1311
0325c12f 1312 if (maximum_states == 0) return false; // prevent keyspace reduction error (2^-inf)
383a1fb3 1313
ba39db37 1314 printf("Number of possible keys with Sum(a0) = %d: %"PRIu64" (2^%1.1f)\n", sum_a0, maximum_states, log(maximum_states)/log(2));
8ce3e4b4 1315
a531720a 1316 init_statelist_cache();
1317
8ce3e4b4 1318 for (uint16_t p = 0; p <= 16; p += 2) {
1319 for (uint16_t q = 0; q <= 16; q += 2) {
1320 if (p*(16-q) + (16-p)*q == sum_a0) {
2dcf60f3 1321 // printf("Reducing Partial Statelists (p,q) = (%d,%d) with lengths %d, %d\n",
1322 // p, q, partial_statelist[p].len[ODD_STATE], partial_statelist[q].len[EVEN_STATE]);
8ce3e4b4 1323 for (uint16_t r = 0; r <= 16; r += 2) {
1324 for (uint16_t s = 0; s <= 16; s += 2) {
1325 if (r*(16-s) + (16-r)*s == sum_a8) {
1326 current_candidates = add_more_candidates(current_candidates);
71ac327b 1327 if (current_candidates != NULL) {
a531720a 1328 // check for the smallest partial statelist. Try this first - it might give 0 candidates
1329 // and eliminate the need to calculate the other part
1330 if (MIN(partial_statelist[p].len[ODD_STATE], partial_statelist[r].len[ODD_STATE])
1331 < MIN(partial_statelist[q].len[EVEN_STATE], partial_statelist[s].len[EVEN_STATE])) {
ba39db37 1332 add_matching_states(current_candidates, p, r, ODD_STATE);
a531720a 1333 if(current_candidates->len[ODD_STATE]) {
ba39db37 1334 add_matching_states(current_candidates, q, s, EVEN_STATE);
a531720a 1335 } else {
1336 current_candidates->len[EVEN_STATE] = 0;
1337 uint32_t *p = current_candidates->states[EVEN_STATE] = malloc(sizeof(uint32_t));
81ba7ee8 1338 *p = END_OF_LIST_MARKER;
a531720a 1339 }
1340 } else {
1341 add_matching_states(current_candidates, q, s, EVEN_STATE);
1342 if(current_candidates->len[EVEN_STATE]) {
1343 add_matching_states(current_candidates, p, r, ODD_STATE);
1344 } else {
1345 current_candidates->len[ODD_STATE] = 0;
1346 uint32_t *p = current_candidates->states[ODD_STATE] = malloc(sizeof(uint32_t));
81ba7ee8 1347 *p = END_OF_LIST_MARKER;
a531720a 1348 }
1349 }
1c38049b 1350 //printf("Odd state candidates: %6d (2^%0.1f)\n", current_candidates->len[ODD_STATE], log(current_candidates->len[ODD_STATE])/log(2));
1351 //printf("Even state candidates: %6d (2^%0.1f)\n", current_candidates->len[EVEN_STATE], log(current_candidates->len[EVEN_STATE])/log(2));
8ce3e4b4 1352 }
1353 }
1354 }
1355 }
1356 }
1357 }
8e4a0b35 1358 }
8ce3e4b4 1359
8ce3e4b4 1360 maximum_states = 0;
8e4a0b35 1361 unsigned int n = 0;
4d812c13 1362 for (statelist_t *sl = candidates; sl != NULL && n < MAX_BUCKETS; sl = sl->next, n++) {
8ce3e4b4 1363 maximum_states += (uint64_t)sl->len[ODD_STATE] * sl->len[EVEN_STATE];
1364 }
0325c12f
GG
1365
1366 if (maximum_states == 0) return false; // prevent keyspace reduction error (2^-inf)
1367
ba39db37 1368 float kcalc = log(maximum_states)/log(2);
057d2e91 1369 printf("Number of remaining possible keys: %"PRIu64" (2^%1.1f)\n", maximum_states, kcalc);
0d5ee8e2 1370 if (write_stats) {
4d812c13 1371 fprintf(fstats, "%1.1f;", (kcalc != 0) ? kcalc : 0.0);
0d5ee8e2 1372 }
236e8f7c 1373 if (kcalc < CRACKING_THRESHOLD) return true;
057d2e91
GG
1374
1375 return false;
0d5ee8e2 1376}
1377
fa5974bb 1378static void free_candidates_memory(statelist_t *sl)
1379{
1380 if (sl == NULL) {
1381 return;
1382 } else {
1383 free_candidates_memory(sl->next);
1384 free(sl);
1385 }
1386}
1387
0d5ee8e2 1388static void free_statelist_cache(void)
1389{
1390 for (uint16_t i = 0; i < 17; i+=2) {
1391 for (uint16_t j = 0; j < 17; j+=2) {
1392 for (uint16_t k = 0; k < 2; k++) {
1393 free(sl_cache[i][j][k].sl);
1394 }
1395 }
1396 }
8ce3e4b4 1397}
1398
3130ba4b 1399static const uint64_t crack_states_bitsliced(statelist_t *p){
1400 // the idea to roll back the half-states before combining them was suggested/explained to me by bla
1401 // first we pre-bitslice all the even state bits and roll them back, then bitslice the odd bits and combine the two in the inner loop
1402 uint64_t key = -1;
1403 uint8_t bSize = sizeof(bitslice_t);
1404
1405#ifdef EXACT_COUNT
1406 size_t bucket_states_tested = 0;
1407 size_t bucket_size[p->len[EVEN_STATE]/MAX_BITSLICES];
1408#else
1409 const size_t bucket_states_tested = (p->len[EVEN_STATE])*(p->len[ODD_STATE]);
1410#endif
1411
1412 bitslice_t *bitsliced_even_states[p->len[EVEN_STATE]/MAX_BITSLICES];
1413 size_t bitsliced_blocks = 0;
1414 uint32_t const * restrict even_end = p->states[EVEN_STATE]+p->len[EVEN_STATE];
1415
1416 // bitslice all the even states
1417 for(uint32_t * restrict p_even = p->states[EVEN_STATE]; p_even < even_end; p_even += MAX_BITSLICES){
1418
1419#ifdef __WIN32
1420 #ifdef __MINGW32__
1421 bitslice_t * restrict lstate_p = __mingw_aligned_malloc((STATE_SIZE+ROLLBACK_SIZE) * bSize, bSize);
1422 #else
1423 bitslice_t * restrict lstate_p = _aligned_malloc((STATE_SIZE+ROLLBACK_SIZE) * bSize, bSize);
1424 #endif
1425#else
b01e7d20 1426 #ifdef __APPLE__
9d590832 1427 bitslice_t * restrict lstate_p = malloc((STATE_SIZE+ROLLBACK_SIZE) * bSize);
1428 #else
3130ba4b 1429 bitslice_t * restrict lstate_p = memalign(bSize, (STATE_SIZE+ROLLBACK_SIZE) * bSize);
9d590832 1430 #endif
3130ba4b 1431#endif
1432
1433 if ( !lstate_p ) {
1434 __sync_fetch_and_add(&total_states_tested, bucket_states_tested);
1435 return key;
1436 }
1437
1438 memset(lstate_p+1, 0x0, (STATE_SIZE-1)*sizeof(bitslice_t)); // zero even bits
1439
1440 // bitslice even half-states
1441 const size_t max_slices = (even_end-p_even) < MAX_BITSLICES ? even_end-p_even : MAX_BITSLICES;
1442#ifdef EXACT_COUNT
1443 bucket_size[bitsliced_blocks] = max_slices;
1444#endif
1445 for(size_t slice_idx = 0; slice_idx < max_slices; ++slice_idx){
1446 uint32_t e = *(p_even+slice_idx);
1447 for(size_t bit_idx = 1; bit_idx < STATE_SIZE; bit_idx+=2, e >>= 1){
1448 // set even bits
1449 if(e&1){
1450 lstate_p[bit_idx].bytes64[slice_idx>>6] |= 1ull << (slice_idx&63);
1451 }
1452 }
1453 }
1454 // compute the rollback bits
1455 for(size_t rollback = 0; rollback < ROLLBACK_SIZE; ++rollback){
1456 // inlined crypto1_bs_lfsr_rollback
1457 const bitslice_value_t feedout = lstate_p[0].value;
1458 ++lstate_p;
1459 const bitslice_value_t ks_bits = crypto1_bs_f20(lstate_p);
1460 const bitslice_value_t feedback = (feedout ^ ks_bits ^ lstate_p[47- 5].value ^ lstate_p[47- 9].value ^
1461 lstate_p[47-10].value ^ lstate_p[47-12].value ^ lstate_p[47-14].value ^
1462 lstate_p[47-15].value ^ lstate_p[47-17].value ^ lstate_p[47-19].value ^
1463 lstate_p[47-24].value ^ lstate_p[47-25].value ^ lstate_p[47-27].value ^
1464 lstate_p[47-29].value ^ lstate_p[47-35].value ^ lstate_p[47-39].value ^
1465 lstate_p[47-41].value ^ lstate_p[47-42].value ^ lstate_p[47-43].value);
1466 lstate_p[47].value = feedback ^ bitsliced_rollback_byte[rollback].value;
1467 }
1468 bitsliced_even_states[bitsliced_blocks++] = lstate_p;
1469 }
1470
1471 // bitslice every odd state to every block of even half-states with half-finished rollback
1472 for(uint32_t const * restrict p_odd = p->states[ODD_STATE]; p_odd < p->states[ODD_STATE]+p->len[ODD_STATE]; ++p_odd){
1473 // early abort
1474 if(keys_found){
1475 goto out;
1476 }
1477
1478 // set the odd bits and compute rollback
1479 uint64_t o = (uint64_t) *p_odd;
1480 lfsr_rollback_byte((struct Crypto1State*) &o, 0, 1);
1481 // pre-compute part of the odd feedback bits (minus rollback)
1482 bool odd_feedback_bit = parity(o&0x9ce5c);
1483
1484 crypto1_bs_rewind_a0();
1485 // set odd bits
1486 for(size_t state_idx = 0; state_idx < STATE_SIZE-ROLLBACK_SIZE; o >>= 1, state_idx+=2){
4d812c13 1487 state_p[state_idx] = (o & 1) ? bs_ones : bs_zeroes;
3130ba4b 1488 }
1489 const bitslice_value_t odd_feedback = odd_feedback_bit ? bs_ones.value : bs_zeroes.value;
1490
1491 for(size_t block_idx = 0; block_idx < bitsliced_blocks; ++block_idx){
383a1fb3 1492 const bitslice_t * const restrict bitsliced_even_state = bitsliced_even_states[block_idx];
3130ba4b 1493 size_t state_idx;
1494 // set even bits
1495 for(state_idx = 0; state_idx < STATE_SIZE-ROLLBACK_SIZE; state_idx+=2){
1496 state_p[1+state_idx] = bitsliced_even_state[1+state_idx];
1497 }
1498 // set rollback bits
1499 uint64_t lo = o;
1500 for(; state_idx < STATE_SIZE; lo >>= 1, state_idx+=2){
1501 // set the odd bits and take in the odd rollback bits from the even states
1502 if(lo & 1){
1503 state_p[state_idx].value = ~bitsliced_even_state[state_idx].value;
1504 } else {
1505 state_p[state_idx] = bitsliced_even_state[state_idx];
1506 }
1507
1508 // set the even bits and take in the even rollback bits from the odd states
1509 if((lo >> 32) & 1){
1510 state_p[1+state_idx].value = ~bitsliced_even_state[1+state_idx].value;
1511 } else {
1512 state_p[1+state_idx] = bitsliced_even_state[1+state_idx];
1513 }
1514 }
1515
1516#ifdef EXACT_COUNT
4d812c13 1517 bucket_states_tested += (bucket_size[block_idx] > MAX_BITSLICES) ? MAX_BITSLICES : bucket_size[block_idx];
3130ba4b 1518#endif
1519 // pre-compute first keystream and feedback bit vectors
1520 const bitslice_value_t ksb = crypto1_bs_f20(state_p);
1521 const bitslice_value_t fbb = (odd_feedback ^ state_p[47- 0].value ^ state_p[47- 5].value ^ // take in the even and rollback bits
1522 state_p[47-10].value ^ state_p[47-12].value ^ state_p[47-14].value ^
1523 state_p[47-24].value ^ state_p[47-42].value);
1524
1525 // vector to contain test results (1 = passed, 0 = failed)
1526 bitslice_t results = bs_ones;
1527
1528 for(size_t tests = 0; tests < NONCE_TESTS; ++tests){
1529 size_t parity_bit_idx = 0;
1530 bitslice_value_t fb_bits = fbb;
1531 bitslice_value_t ks_bits = ksb;
1532 state_p = &states[KEYSTREAM_SIZE-1];
1533 bitslice_value_t parity_bit_vector = bs_zeroes.value;
1534
1535 // highest bit is transmitted/received first
1536 for(int32_t ks_idx = KEYSTREAM_SIZE-1; ks_idx >= 0; --ks_idx, --state_p){
1537 // decrypt nonce bits
1538 const bitslice_value_t encrypted_nonce_bit_vector = bitsliced_encrypted_nonces[tests][ks_idx].value;
1539 const bitslice_value_t decrypted_nonce_bit_vector = (encrypted_nonce_bit_vector ^ ks_bits);
1540
1541 // compute real parity bits on the fly
1542 parity_bit_vector ^= decrypted_nonce_bit_vector;
1543
1544 // update state
1545 state_p[0].value = (fb_bits ^ decrypted_nonce_bit_vector);
1546
1547 // compute next keystream bit
1548 ks_bits = crypto1_bs_f20(state_p);
1549
1550 // for each byte:
1551 if((ks_idx&7) == 0){
1552 // get encrypted parity bits
1553 const bitslice_value_t encrypted_parity_bit_vector = bitsliced_encrypted_parity_bits[tests][parity_bit_idx++].value;
1554
1555 // decrypt parity bits
1556 const bitslice_value_t decrypted_parity_bit_vector = (encrypted_parity_bit_vector ^ ks_bits);
1557
1558 // compare actual parity bits with decrypted parity bits and take count in results vector
1559 results.value &= (parity_bit_vector ^ decrypted_parity_bit_vector);
1560
1561 // make sure we still have a match in our set
1562 // if(memcmp(&results, &bs_zeroes, sizeof(bitslice_t)) == 0){
1563
1564 // this is much faster on my gcc, because somehow a memcmp needlessly spills/fills all the xmm registers to/from the stack - ???
1565 // the short-circuiting also helps
1566 if(results.bytes64[0] == 0
1567#if MAX_BITSLICES > 64
1568 && results.bytes64[1] == 0
1569#endif
1570#if MAX_BITSLICES > 128
1571 && results.bytes64[2] == 0
1572 && results.bytes64[3] == 0
1573#endif
1574 ){
1575 goto stop_tests;
1576 }
1577 // this is about as fast but less portable (requires -std=gnu99)
1578 // asm goto ("ptest %1, %0\n\t"
1579 // "jz %l2" :: "xm" (results.value), "xm" (bs_ones.value) : "cc" : stop_tests);
1580 parity_bit_vector = bs_zeroes.value;
1581 }
1582 // compute next feedback bit vector
1583 fb_bits = (state_p[47- 0].value ^ state_p[47- 5].value ^ state_p[47- 9].value ^
1584 state_p[47-10].value ^ state_p[47-12].value ^ state_p[47-14].value ^
1585 state_p[47-15].value ^ state_p[47-17].value ^ state_p[47-19].value ^
1586 state_p[47-24].value ^ state_p[47-25].value ^ state_p[47-27].value ^
1587 state_p[47-29].value ^ state_p[47-35].value ^ state_p[47-39].value ^
1588 state_p[47-41].value ^ state_p[47-42].value ^ state_p[47-43].value);
1589 }
1590 }
1591 // all nonce tests were successful: we've found the key in this block!
1592 state_t keys[MAX_BITSLICES];
1593 crypto1_bs_convert_states(&states[KEYSTREAM_SIZE], keys);
1594 for(size_t results_idx = 0; results_idx < MAX_BITSLICES; ++results_idx){
1595 if(get_vector_bit(results_idx, results)){
1596 key = keys[results_idx].value;
1597 goto out;
1598 }
1599 }
1600stop_tests:
1601 // prepare to set new states
1602 crypto1_bs_rewind_a0();
1603 continue;
1604 }
1605 }
1606
1607out:
1608 for(size_t block_idx = 0; block_idx < bitsliced_blocks; ++block_idx){
1609
1610#ifdef __WIN32
1611 #ifdef __MINGW32__
1612 __mingw_aligned_free(bitsliced_even_states[block_idx]-ROLLBACK_SIZE);
1613 #else
1614 _aligned_free(bitsliced_even_states[block_idx]-ROLLBACK_SIZE);
1615 #endif
1616#else
2e350b19 1617 free(bitsliced_even_states[block_idx]-ROLLBACK_SIZE);
3130ba4b 1618#endif
1619
1620 }
1621 __sync_fetch_and_add(&total_states_tested, bucket_states_tested);
1622 return key;
1623}
8ce3e4b4 1624
3130ba4b 1625static void* crack_states_thread(void* x){
1626 const size_t thread_id = (size_t)x;
1627 size_t current_bucket = thread_id;
4d812c13 1628 statelist_t *bucket = NULL;
1629
3130ba4b 1630 while(current_bucket < bucket_count){
4d812c13 1631 if (keys_found) break;
1632
1633 if ((bucket = buckets[current_bucket])) {
3130ba4b 1634 const uint64_t key = crack_states_bitsliced(bucket);
4d812c13 1635
1636 if (keys_found) break;
fa5974bb 1637 else if(key != -1) {
1638 if (TestIfKeyExists(key)) {
3130ba4b 1639 __sync_fetch_and_add(&keys_found, 1);
45c0c48c 1640 __sync_fetch_and_add(&foundkey, key);
fa5974bb 1641 printf("*");
1642 fflush(stdout);
3130ba4b 1643 break;
fa5974bb 1644 }
1645 printf("!");
1646 fflush(stdout);
3130ba4b 1647 } else {
1648 printf(".");
1649 fflush(stdout);
1650 }
1651 }
1652 current_bucket += thread_count;
1653 }
1654 return NULL;
1655}
cd777a05 1656
360caaba 1657static bool brute_force(void) {
057d2e91 1658 bool ret = false;
f8ada309 1659 if (known_target_key != -1) {
1660 PrintAndLog("Looking for known target key in remaining key space...");
057d2e91 1661 ret = TestIfKeyExists(known_target_key);
f8ada309 1662 } else {
4d812c13 1663 if (maximum_states == 0) return false; // prevent keyspace reduction error (2^-inf)
1664
057d2e91 1665 PrintAndLog("Brute force phase starting.");
b403c300 1666
7fd676db 1667 clock_t time1 = clock();
057d2e91 1668 keys_found = 0;
ddaecc08 1669 foundkey = 0;
3130ba4b 1670
057d2e91 1671 crypto1_bs_init();
4d812c13 1672 memset (bitsliced_rollback_byte, 0, sizeof (bitsliced_rollback_byte));
1673 memset (bitsliced_encrypted_nonces, 0, sizeof (bitsliced_encrypted_nonces));
1674 memset (bitsliced_encrypted_parity_bits, 0, sizeof (bitsliced_encrypted_parity_bits));
057d2e91
GG
1675
1676 PrintAndLog("Using %u-bit bitslices", MAX_BITSLICES);
ba39db37 1677 PrintAndLog("Bitslicing best_first_byte^uid[3] (rollback byte): %02X ...", best_first_bytes[0]^(cuid>>24));
057d2e91 1678 // convert to 32 bit little-endian
ed69e099 1679 crypto1_bs_bitslice_value32((best_first_bytes[0]<<24)^cuid, bitsliced_rollback_byte, 8);
057d2e91
GG
1680
1681 PrintAndLog("Bitslicing nonces...");
1682 for(size_t tests = 0; tests < NONCE_TESTS; tests++){
1683 uint32_t test_nonce = brute_force_nonces[tests]->nonce_enc;
1684 uint8_t test_parity = brute_force_nonces[tests]->par_enc;
1685 // pre-xor the uid into the decrypted nonces, and also pre-xor the cuid parity into the encrypted parity bits - otherwise an exta xor is required in the decryption routine
1686 crypto1_bs_bitslice_value32(cuid^test_nonce, bitsliced_encrypted_nonces[tests], 32);
1687 // convert to 32 bit little-endian
1688 crypto1_bs_bitslice_value32(rev32( ~(test_parity ^ ~(parity(cuid>>24 & 0xff)<<3 | parity(cuid>>16 & 0xff)<<2 | parity(cuid>>8 & 0xff)<<1 | parity(cuid&0xff)))), bitsliced_encrypted_parity_bits[tests], 4);
ed69e099 1689 }
057d2e91 1690 total_states_tested = 0;
3130ba4b 1691
057d2e91
GG
1692 // count number of states to go
1693 bucket_count = 0;
4d812c13 1694 buckets[MAX_BUCKETS-1] = NULL;
87a513aa 1695 for (statelist_t *p = candidates; p != NULL && bucket_count < MAX_BUCKETS; p = p->next) {
057d2e91
GG
1696 buckets[bucket_count] = p;
1697 bucket_count++;
1698 }
4d812c13 1699 if (bucket_count < MAX_BUCKETS) buckets[bucket_count] = NULL;
3130ba4b 1700
1701#ifndef __WIN32
057d2e91 1702 thread_count = sysconf(_SC_NPROCESSORS_CONF);
cd777a05 1703 if ( thread_count < 1)
1704 thread_count = 1;
3130ba4b 1705#endif /* _WIN32 */
fd3be901 1706
057d2e91 1707 pthread_t threads[thread_count];
3130ba4b 1708
057d2e91
GG
1709 // enumerate states using all hardware threads, each thread handles one bucket
1710 PrintAndLog("Starting %u cracking threads to search %u buckets containing a total of %"PRIu64" states...", thread_count, bucket_count, maximum_states);
56d0fb8e 1711
057d2e91
GG
1712 for(size_t i = 0; i < thread_count; i++){
1713 pthread_create(&threads[i], NULL, crack_states_thread, (void*) i);
1714 }
1715 for(size_t i = 0; i < thread_count; i++){
1716 pthread_join(threads[i], 0);
1717 }
1718
7fd676db 1719 time1 = clock() - time1;
360caaba 1720 PrintAndLog("\nTime for bruteforce %0.1f seconds.",((float)time1)/CLOCKS_PER_SEC);
7fd676db 1721
4d812c13 1722 if (keys_found) {
45c0c48c 1723 PrintAndLog("\nFound key: %012"PRIx64"\n", foundkey);
057d2e91 1724 ret = true;
360caaba 1725 }
057d2e91
GG
1726 // reset this counter for the next call
1727 nonces_to_bruteforce = 0;
f8ada309 1728 }
057d2e91 1729 return ret;
f8ada309 1730}
1731
e108a48a 1732int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *trgkey, bool nonce_file_read, bool nonce_file_write, bool slow, int tests, uint64_t *found_key)
f8ada309 1733{
0d5ee8e2 1734 // initialize Random number generator
1735 time_t t;
1736 srand((unsigned) time(&t));
1737
e108a48a 1738 *found_key = 0;
1739
f8ada309 1740 if (trgkey != NULL) {
1741 known_target_key = bytes_to_num(trgkey, 6);
1742 } else {
1743 known_target_key = -1;
1744 }
8ce3e4b4 1745
8ce3e4b4 1746 init_partial_statelists();
1747 init_BitFlip_statelist();
0d5ee8e2 1748 write_stats = false;
8ce3e4b4 1749
0d5ee8e2 1750 if (tests) {
1751 // set the correct locale for the stats printing
1752 setlocale(LC_ALL, "");
1753 write_stats = true;
1754 if ((fstats = fopen("hardnested_stats.txt","a")) == NULL) {
1755 PrintAndLog("Could not create/open file hardnested_stats.txt");
1756 return 3;
1757 }
1758 for (uint32_t i = 0; i < tests; i++) {
1759 init_nonce_memory();
1760 simulate_acquire_nonces();
1761 Tests();
1762 printf("Sum(a0) = %d\n", first_byte_Sum);
1763 fprintf(fstats, "%d;", first_byte_Sum);
1764 generate_candidates(first_byte_Sum, nonces[best_first_bytes[0]].Sum8_guess);
1765 brute_force();
1766 free_nonces_memory();
1767 free_statelist_cache();
1768 free_candidates_memory(candidates);
1769 candidates = NULL;
1770 }
1771 fclose(fstats);
0325c12f 1772 fstats = NULL;
0d5ee8e2 1773 } else {
1774 init_nonce_memory();
236e8f7c 1775 if (nonce_file_read) { // use pre-acquired data from file nonces.bin
b112787d 1776 if (read_nonce_file() != 0) {
1777 return 3;
1778 }
1779 Check_for_FilterFlipProperties();
1780 num_good_first_bytes = MIN(estimate_second_byte_sum(), GOOD_BYTES_REQUIRED);
236e8f7c
GG
1781 PrintAndLog("Number of first bytes with confidence > %2.1f%%: %d", CONFIDENCE_THRESHOLD*100.0, num_good_first_bytes);
1782
236e8f7c 1783 bool cracking = generate_candidates(first_byte_Sum, nonces[best_first_bytes[0]].Sum8_guess);
8e4a0b35 1784 if (cracking || known_target_key != -1) {
236e8f7c 1785 brute_force();
8e4a0b35 1786 }
1787
236e8f7c 1788 } else { // acquire nonces.
b112787d 1789 uint16_t is_OK = acquire_nonces(blockNo, keyType, key, trgBlockNo, trgKeyType, nonce_file_write, slow);
1790 if (is_OK != 0) {
d1e197e9 1791 free_nonces_memory();
1792 //free_statelist_cache();
1793 free_candidates_memory(candidates);
1794 candidates = NULL;
b112787d 1795 return is_OK;
1796 }
8ce3e4b4 1797 }
8ce3e4b4 1798
45c0c48c 1799 //Tests();
b112787d 1800 free_nonces_memory();
1801 free_statelist_cache();
1802 free_candidates_memory(candidates);
1803 candidates = NULL;
057d2e91 1804 }
e108a48a 1805 *found_key = foundkey;
8ce3e4b4 1806 return 0;
e108a48a 1807}
Impressum, Datenschutz