]> git.zerfleddert.de Git - proxmark3-svn/blame - client/nonce2key/nonce2key.c
CHG: syntax suger
[proxmark3-svn] / client / nonce2key / nonce2key.c
CommitLineData
f89c7050
M
1//-----------------------------------------------------------------------------
2// Merlok - June 2011
3// Roel - Dec 2009
4// Unknown author
5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// MIFARE Darkside hack
11//-----------------------------------------------------------------------------
12
125a98a1 13#define __STDC_FORMAT_MACROS
14#include <inttypes.h>
15#define llx PRIx64
16
f89c7050 17#include "nonce2key.h"
b19bd5d6 18#include "mifarehost.h"
f89c7050
M
19#include "ui.h"
20
b19bd5d6 21int compar_state(const void * a, const void * b) {
22 // didn't work: (the result is truncated to 32 bits)
23 //return (*(int64_t*)b - *(int64_t*)a);
24
25 // better:
26 if (*(int64_t*)b == *(int64_t*)a) return 0;
27 else if (*(int64_t*)b > *(int64_t*)a) return 1;
28 else return -1;
29}
30
1c611bbd 31int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
0de8e387 32 struct Crypto1State *state;
33 uint32_t i, pos, rr, nr_diff, key_count;//, ks1, ks2;
34 byte_t bt, ks3x[8], par[8][8];
35 uint64_t key_recovered;
36 int64_t *state_s;
37 static uint32_t last_uid;
38 static int64_t *last_keylist;
39 rr = 0;
f89c7050 40
0de8e387 41 if (last_uid != uid && last_keylist != NULL) {
42 free(last_keylist);
43 last_keylist = NULL;
44 }
45 last_uid = uid;
b19bd5d6 46
0de8e387 47 // Reset the last three significant bits of the reader nonce
48 nr &= 0xffffff1f;
f89c7050 49
0de8e387 50 PrintAndLog("\nuid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08"llx")\n\n", uid, nt, par_info, ks_info, nr);
51
52 for (pos=0; pos<8; pos++) {
53 ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
54 bt = (par_info >> (pos*8)) & 0xff;
55 for (i=0; i<8; i++) {
56 par[7-pos][i] = (bt >> i) & 0x01;
57 }
58 }
f89c7050 59
0de8e387 60 printf("|diff|{nr} |ks3|ks3^5|parity |\n");
61 printf("+----+--------+---+-----+---------------+\n");
62 for (i=0; i<8; i++) {
63 nr_diff = nr | i << 5;
64 printf("| %02x |%08x|", i << 5, nr_diff);
65 printf(" %01x | %01x |", ks3x[i], ks3x[i]^5);
66 for (pos=0; pos<7; pos++)
67 printf("%01x,", par[i][pos]);
68 printf("%01x|\n", par[i][7]);
69 }
70 printf("+----+--------+---+-----+---------------+\n");
f89c7050 71
0de8e387 72 if ( par_info == 0 )
73 PrintAndLog("Parity is all zero, try special attack! Wait for few more seconds...");
b19bd5d6 74
75 state = lfsr_common_prefix(nr, rr, ks3x, par, par_info==0);
76 state_s = (int64_t*)state;
77
78 //char filename[50] ;
79 //sprintf(filename, "nt_%08x_%d.txt", nt, nr);
80 //printf("name %s\n", filename);
81 //FILE* fp = fopen(filename,"w");
82 for (i = 0; (state) && ((state + i)->odd != -1); i++)
bfaecce6 83 {
b19bd5d6 84 lfsr_rollback_word(state+i, uid^nt, 0);
85 crypto1_get_lfsr(state + i, &key_recovered);
86 *(state_s + i) = key_recovered;
87 //fprintf(fp, "%012llx\n",key_recovered);
bfaecce6 88 }
b19bd5d6 89 //fclose(fp);
bfaecce6 90
b19bd5d6 91 if(!state)
92 return 1;
f89c7050 93
b19bd5d6 94 qsort(state_s, i, sizeof(*state_s), compar_state);
95 *(state_s + i) = -1;
96
97 //Create the intersection:
0de8e387 98 if (par_info == 0 ) {
99 if ( last_keylist != NULL) {
b19bd5d6 100 int64_t *p1, *p2, *p3;
101 p1 = p3 = last_keylist;
102 p2 = state_s;
103 while ( *p1 != -1 && *p2 != -1 ) {
104 if (compar_state(p1, p2) == 0) {
0de8e387 105 printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",
106 (uint64_t)(p1-last_keylist),
107 (uint64_t)(p2-state_s),
108 (uint64_t)(p3-last_keylist),
109 *p1);
b19bd5d6 110 *p3++ = *p1++;
111 p2++;
0de8e387 112 } else {
b19bd5d6 113 while (compar_state(p1, p2) == -1) ++p1;
114 while (compar_state(p1, p2) == 1) ++p2;
115 }
116 }
0de8e387 117 key_count = p3 - last_keylist;
118 } else {
b19bd5d6 119 key_count = 0;
0de8e387 120 }
121 } else {
b19bd5d6 122 last_keylist = state_s;
123 key_count = i;
124 }
125
0de8e387 126 printf("key candidates count: %d\n", key_count);
7d231391 127
b19bd5d6 128 // The list may still contain several key candidates. Test each of them with mfCheckKeys
0de8e387 129 int res;
130 uint8_t keyBlock[6];
131 uint64_t key64;
b19bd5d6 132 for (i = 0; i < key_count; i++) {
0de8e387 133
b19bd5d6 134 key64 = *(last_keylist + i);
135 num_to_bytes(key64, 6, keyBlock);
136 key64 = 0;
0de8e387 137 res = mfCheckKeys(0, 0, false, 1, keyBlock, &key64);
138 if (!res) {
b19bd5d6 139 *key = key64;
140 free(last_keylist);
141 last_keylist = NULL;
0de8e387 142 if (par_info == 0)
b19bd5d6 143 free(state);
144 return 0;
145 }
146 }
b19bd5d6 147
148 free(last_keylist);
149 last_keylist = state_s;
b19bd5d6 150 return 1;
f89c7050 151}
46cd801c 152
153int tryMfk32(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){
154
155 struct Crypto1State *s,*t;
156 uint64_t key; // recovered key
157 uint32_t uid; // serial number
158 uint32_t nt; // tag challenge
159 uint32_t nr0_enc; // first encrypted reader challenge
160 uint32_t ar0_enc; // first encrypted reader response
161 uint32_t nr1_enc; // second encrypted reader challenge
162 uint32_t ar1_enc; // second encrypted reader response
163 bool isSuccess = FALSE;
164 int counter = 0;
165
166 uid = myuid;//(uint32_t)bytes_to_num(data + 0, 4);
167 nt = *(uint32_t*)(data+8);
168 nr0_enc = *(uint32_t*)(data+12);
169 ar0_enc = *(uint32_t*)(data+16);
170 nr1_enc = *(uint32_t*)(data+32);
171 ar1_enc = *(uint32_t*)(data+36);
172
b69947c2 173 // PrintAndLog("recovering key for:");
174 // PrintAndLog(" uid: %08x %08x",uid, myuid);
46cd801c 175 // PrintAndLog(" nt: %08x",nt);
176 // PrintAndLog(" {nr_0}: %08x",nr0_enc);
177 // PrintAndLog(" {ar_0}: %08x",ar0_enc);
178 // PrintAndLog(" {nr_1}: %08x",nr1_enc);
179 // PrintAndLog(" {ar_1}: %08x",ar1_enc);
180
181 s = lfsr_recovery32(ar0_enc ^ prng_successor(nt, 64), 0);
182
183 for(t = s; t->odd | t->even; ++t) {
184 lfsr_rollback_word(t, 0, 0);
185 lfsr_rollback_word(t, nr0_enc, 1);
186 lfsr_rollback_word(t, uid ^ nt, 0);
187 crypto1_get_lfsr(t, &key);
188 crypto1_word(t, uid ^ nt, 0);
189 crypto1_word(t, nr1_enc, 1);
190 if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt, 64))) {
191 PrintAndLog("Found Key: [%012"llx"]",key);
192 isSuccess = TRUE;
193 ++counter;
b69947c2 194 if (counter==20)
46cd801c 195 break;
196 }
197 }
198 free(s);
199 return isSuccess;
200}
201
d8af608f 202int tryMfk32_moebius(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){
203
204 struct Crypto1State *s,*t;
205 uint64_t key; // recovered key
206 uint32_t uid; // serial number
207 uint32_t nt0; // tag challenge first
208 uint32_t nt1; // tag challenge second
209 uint32_t nr0_enc; // first encrypted reader challenge
210 uint32_t ar0_enc; // first encrypted reader response
211 uint32_t nr1_enc; // second encrypted reader challenge
212 uint32_t ar1_enc; // second encrypted reader response
213 bool isSuccess = FALSE;
214 int counter = 0;
215
216 uid = myuid;//(uint32_t)bytes_to_num(data + 0, 4);
217 nt0 = *(uint32_t*)(data+8);
218 nr0_enc = *(uint32_t*)(data+12);
219 ar0_enc = *(uint32_t*)(data+16);
220 nt1 = *(uint32_t*)(data+8);
221 nr1_enc = *(uint32_t*)(data+32);
222 ar1_enc = *(uint32_t*)(data+36);
223
224 s = lfsr_recovery32(ar0_enc ^ prng_successor(nt0, 64), 0);
225
226 for(t = s; t->odd | t->even; ++t) {
227 lfsr_rollback_word(t, 0, 0);
228 lfsr_rollback_word(t, nr0_enc, 1);
229 lfsr_rollback_word(t, uid ^ nt0, 0);
230 crypto1_get_lfsr(t, &key);
231
232 crypto1_word(t, uid ^ nt1, 0);
233 crypto1_word(t, nr1_enc, 1);
234 if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt1, 64))) {
235 PrintAndLog("Found Key: [%012"llx"]",key);
236 isSuccess = TRUE;
237 ++counter;
238 if (counter==20)
239 break;
240 }
241 }
242 free(s);
243 return isSuccess;
244}
245
46cd801c 246int tryMfk64(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){
247
248 struct Crypto1State *revstate;
249 uint64_t key; // recovered key
250 uint32_t uid; // serial number
251 uint32_t nt; // tag challenge
252 uint32_t nr_enc; // encrypted reader challenge
253 uint32_t ar_enc; // encrypted reader response
254 uint32_t at_enc; // encrypted tag response
255 uint32_t ks2; // keystream used to encrypt reader response
256 uint32_t ks3; // keystream used to encrypt tag response
257
258 struct Crypto1State mpcs = {0, 0};
259 struct Crypto1State *pcs;
260 pcs = &mpcs;
261
262 uid = myuid;//(uint32_t)bytes_to_num(data + 0, 4);
263 nt = *(uint32_t*)(data+8);
264 nr_enc = *(uint32_t*)(data+12);
265 ar_enc = *(uint32_t*)(data+16);
266
267 crypto1_word(pcs, nr_enc , 1);
268 at_enc = prng_successor(nt, 96) ^ crypto1_word(pcs, 0, 0);
269
270 // printf("Recovering key for:\n");
271 // printf(" uid: %08x\n",uid);
272 // printf(" nt: %08x\n",nt);
273 // printf(" {nr}: %08x\n",nr_enc);
274 // printf(" {ar}: %08x\n",ar_enc);
275 // printf(" {at}: %08x\n",at_enc);
276
277 // Extract the keystream from the messages
278 ks2 = ar_enc ^ prng_successor(nt, 64);
279 ks3 = at_enc ^ prng_successor(nt, 96);
280
281 revstate = lfsr_recovery64(ks2, ks3);
282 lfsr_rollback_word(revstate, 0, 0);
283 lfsr_rollback_word(revstate, 0, 0);
284 lfsr_rollback_word(revstate, nr_enc, 1);
285 lfsr_rollback_word(revstate, uid ^ nt, 0);
286 crypto1_get_lfsr(revstate, &key);
287 PrintAndLog("Found Key: [%012"llx"]",key);
288 crypto1_destroy(revstate);
289 crypto1_destroy(pcs);
290 return 0;
e98572a1 291}
Impressum, Datenschutz