]> git.zerfleddert.de Git - proxmark3-svn/blob - client/mifarehost.c
CHG: trying to figure out why I can't get the seconds out..
[proxmark3-svn] / client / mifarehost.c
1 // Merlok, 2011, 2012
2 // people from mifare@nethemba.com, 2010
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // mifare commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <pthread.h>
15 #include "mifarehost.h"
16 #include "proxmark3.h"
17 //#include "radixsort.h"
18 #include <time.h>
19
20 // MIFARE
21 int compar_int(const void * a, const void * b) {
22 // didn't work: (the result is truncated to 32 bits)
23 //return (*(uint64_t*)b - *(uint64_t*)a);
24
25 // better:
26 if (*(uint64_t*)b > *(uint64_t*)a) return 1;
27 if (*(uint64_t*)b < *(uint64_t*)a) return -1;
28 return 0;
29
30 //return (*(uint64_t*)b > *(uint64_t*)a) - (*(uint64_t*)b < *(uint64_t*)a);
31 }
32
33 // Compare 16 Bits out of cryptostate
34 int Compare16Bits(const void * a, const void * b) {
35 if ((*(uint64_t*)b & 0x00ff000000ff0000) > (*(uint64_t*)a & 0x00ff000000ff0000)) return 1;
36 if ((*(uint64_t*)b & 0x00ff000000ff0000) < (*(uint64_t*)a & 0x00ff000000ff0000)) return -1;
37 return 0;
38
39 /* return
40 ((*(uint64_t*)b & 0x00ff000000ff0000) > (*(uint64_t*)a & 0x00ff000000ff0000))
41 -
42 ((*(uint64_t*)b & 0x00ff000000ff0000) < (*(uint64_t*)a & 0x00ff000000ff0000))
43 ;
44 */
45 }
46
47 typedef
48 struct {
49 union {
50 struct Crypto1State *slhead;
51 uint64_t *keyhead;
52 } head;
53 union {
54 struct Crypto1State *sltail;
55 uint64_t *keytail;
56 } tail;
57 uint32_t len;
58 uint32_t uid;
59 uint32_t blockNo;
60 uint32_t keyType;
61 uint32_t nt;
62 uint32_t ks1;
63 } StateList_t;
64
65
66 // wrapper function for multi-threaded lfsr_recovery32
67 void* nested_worker_thread(void *arg)
68 {
69 struct Crypto1State *p1;
70 StateList_t *statelist = arg;
71 statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt ^ statelist->uid);
72
73 for (p1 = statelist->head.slhead; *(uint64_t *)p1 != 0; p1++);
74
75 statelist->len = p1 - statelist->head.slhead;
76 statelist->tail.sltail = --p1;
77 qsort(statelist->head.slhead, statelist->len, sizeof(uint64_t), Compare16Bits);
78 return statelist->head.slhead;
79 }
80
81 int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * resultKey, bool calibrate)
82 {
83 uint16_t i;
84 uint32_t uid;
85 UsbCommand resp;
86 StateList_t statelists[2];
87 struct Crypto1State *p1, *p2, *p3, *p4;
88
89 UsbCommand c = {CMD_MIFARE_NESTED, {blockNo + keyType * 0x100, trgBlockNo + trgKeyType * 0x100, calibrate}};
90 memcpy(c.d.asBytes, key, 6);
91 clearCommandBuffer();
92 SendCommand(&c);
93 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) return -1;
94
95 // error during nested
96 if (resp.arg[0]) return resp.arg[0];
97
98 memcpy(&uid, resp.d.asBytes, 4);
99
100 for (i = 0; i < 2; i++) {
101 statelists[i].blockNo = resp.arg[2] & 0xff;
102 statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;
103 statelists[i].uid = uid;
104 memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
105 memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
106 }
107
108 // calc keys
109 pthread_t thread_id[2];
110
111 // create and run worker threads
112 for (i = 0; i < 2; i++)
113 pthread_create(thread_id + i, NULL, nested_worker_thread, &statelists[i]);
114
115 // wait for threads to terminate:
116 for (i = 0; i < 2; i++)
117 pthread_join(thread_id[i], (void*)&statelists[i].head.slhead);
118
119 // the first 16 Bits of the cryptostate already contain part of our key.
120 // Create the intersection of the two lists based on these 16 Bits and
121 // roll back the cryptostate
122 p1 = p3 = statelists[0].head.slhead;
123 p2 = p4 = statelists[1].head.slhead;
124
125 while (p1 <= statelists[0].tail.sltail && p2 <= statelists[1].tail.sltail) {
126 if (Compare16Bits(p1, p2) == 0) {
127
128 struct Crypto1State savestate, *savep = &savestate;
129 savestate = *p1;
130 while(Compare16Bits(p1, savep) == 0 && p1 <= statelists[0].tail.sltail) {
131 *p3 = *p1;
132 lfsr_rollback_word(p3, statelists[0].nt ^ statelists[0].uid, 0);
133 p3++;
134 p1++;
135 }
136 savestate = *p2;
137 while(Compare16Bits(p2, savep) == 0 && p2 <= statelists[1].tail.sltail) {
138 *p4 = *p2;
139 lfsr_rollback_word(p4, statelists[1].nt ^ statelists[1].uid, 0);
140 p4++;
141 p2++;
142 }
143 }
144 else {
145 while (Compare16Bits(p1, p2) == -1) p1++;
146 while (Compare16Bits(p1, p2) == 1) p2++;
147 }
148 }
149
150 p3->even = 0; p3->odd = 0;
151 p4->even = 0; p4->odd = 0;
152 statelists[0].len = p3 - statelists[0].head.slhead;
153 statelists[1].len = p4 - statelists[1].head.slhead;
154 statelists[0].tail.sltail=--p3;
155 statelists[1].tail.sltail=--p4;
156
157 // the statelists now contain possible keys. The key we are searching for must be in the
158 // intersection of both lists. Create the intersection:
159 qsort(statelists[0].head.keyhead, statelists[0].len, sizeof(uint64_t), compar_int);
160 qsort(statelists[1].head.keyhead, statelists[1].len, sizeof(uint64_t), compar_int);
161
162 uint64_t *p5, *p6, *p7;
163 p5 = p7 = statelists[0].head.keyhead;
164 p6 = statelists[1].head.keyhead;
165
166 while (p5 <= statelists[0].tail.keytail && p6 <= statelists[1].tail.keytail) {
167 if (compar_int(p5, p6) == 0) {
168 *p7++ = *p5++;
169 p6++;
170 }
171 else {
172 while (compar_int(p5, p6) == -1) p5++;
173 while (compar_int(p5, p6) == 1) p6++;
174 }
175 }
176 statelists[0].len = p7 - statelists[0].head.keyhead;
177 statelists[0].tail.keytail = --p7;
178
179 uint32_t numOfCandidates = statelists[0].len;
180 if ( numOfCandidates == 0 ) goto out;
181
182 memset(resultKey, 0, 6);
183 uint64_t key64 = 0;
184
185 // The list may still contain several key candidates. Test each of them with mfCheckKeys
186 // uint32_t max_keys = keycnt > (USB_CMD_DATA_SIZE/6) ? (USB_CMD_DATA_SIZE/6) : keycnt;
187 uint8_t keyBlock[USB_CMD_DATA_SIZE] = {0x00};
188
189 for (i = 0; i < numOfCandidates; ++i){
190 crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);
191 num_to_bytes(key64, 6, keyBlock + i * 6);
192 }
193
194 if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, false, numOfCandidates, keyBlock, &key64)) {
195 free(statelists[0].head.slhead);
196 free(statelists[1].head.slhead);
197 num_to_bytes(key64, 6, resultKey);
198
199 PrintAndLog("UID: %08x target block:%3u key type: %c -- Found key [%012"llx"]",
200 uid,
201 (uint16_t)resp.arg[2] & 0xff,
202 (resp.arg[2] >> 8) ? 'B' : 'A',
203 key64
204 );
205 return -5;
206 }
207
208 out:
209 PrintAndLog("UID: %08x target block:%3u key type: %c",
210 uid,
211 (uint16_t)resp.arg[2] & 0xff,
212 (resp.arg[2] >> 8) ? 'B' : 'A'
213 );
214
215 free(statelists[0].head.slhead);
216 free(statelists[1].head.slhead);
217 return -4;
218 }
219
220 int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){
221 *key = 0;
222 UsbCommand c = {CMD_MIFARE_CHKKEYS, { (blockNo | (keyType<<8)), clear_trace, keycnt}};
223 memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
224 clearCommandBuffer();
225 SendCommand(&c);
226 UsbCommand resp;
227 if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) return 1;
228 if ((resp.arg[0] & 0xff) != 0x01) return 2;
229 *key = bytes_to_num(resp.d.asBytes, 6);
230 return 0;
231 }
232
233 // EMULATOR
234
235 int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount) {
236 UsbCommand c = {CMD_MIFARE_EML_MEMGET, {blockNum, blocksCount, 0}};
237 clearCommandBuffer();
238 SendCommand(&c);
239 UsbCommand resp;
240 if (!WaitForResponseTimeout(CMD_ACK,&resp,1500)) return 1;
241 memcpy(data, resp.d.asBytes, blocksCount * 16);
242 return 0;
243 }
244
245 int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
246 return mfEmlSetMem_xt(data, blockNum, blocksCount, 16);
247 }
248
249 int mfEmlSetMem_xt(uint8_t *data, int blockNum, int blocksCount, int blockBtWidth) {
250 UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, blockBtWidth}};
251 memcpy(c.d.asBytes, data, blocksCount * blockBtWidth);
252 clearCommandBuffer();
253 SendCommand(&c);
254 return 0;
255 }
256
257 // "MAGIC" CARD
258 int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, uint8_t wipecard) {
259
260 uint8_t params = MAGIC_SINGLE;
261 uint8_t block0[16];
262 memset(block0, 0x00, sizeof(block0));
263
264 int old = mfCGetBlock(0, block0, params);
265 if (old == 0)
266 PrintAndLog("old block 0: %s", sprint_hex(block0, sizeof(block0)));
267 else
268 PrintAndLog("Couldn't get old data. Will write over the last bytes of Block 0.");
269
270 // fill in the new values
271 // UID
272 memcpy(block0, uid, 4);
273 // Mifare UID BCC
274 block0[4] = block0[0]^block0[1]^block0[2]^block0[3];
275 // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)
276 if ( sak != NULL )
277 block0[5]=sak[0];
278
279 if ( atqa != NULL ) {
280 block0[6]=atqa[1];
281 block0[7]=atqa[0];
282 }
283 PrintAndLog("new block 0: %s", sprint_hex(block0,16));
284
285 if ( wipecard ) params |= MAGIC_WIPE;
286 if ( oldUID == NULL) params |= MAGIC_UID;
287
288 return mfCSetBlock(0, block0, oldUID, params);
289 }
290
291 int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, uint8_t params) {
292
293 uint8_t isOK = 0;
294 UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params, blockNo, 0}};
295 memcpy(c.d.asBytes, data, 16);
296 clearCommandBuffer();
297 SendCommand(&c);
298 UsbCommand resp;
299 if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
300 isOK = resp.arg[0] & 0xff;
301 if (uid != NULL)
302 memcpy(uid, resp.d.asBytes, 4);
303 if (!isOK)
304 return 2;
305 } else {
306 PrintAndLog("Command execute timeout");
307 return 1;
308 }
309 return 0;
310 }
311
312 int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {
313 uint8_t isOK = 0;
314 UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}};
315 clearCommandBuffer();
316 SendCommand(&c);
317 UsbCommand resp;
318 if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
319 isOK = resp.arg[0] & 0xff;
320 memcpy(data, resp.d.asBytes, 16);
321 if (!isOK) return 2;
322 } else {
323 PrintAndLog("Command execute timeout");
324 return 1;
325 }
326 return 0;
327 }
328
329 // SNIFFER
330 // [iceman] so many global variables....
331
332 // constants
333 static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};
334
335 // variables
336 char logHexFileName[FILE_PATH_SIZE] = {0x00};
337 static uint8_t traceCard[4096] = {0x00};
338 static char traceFileName[FILE_PATH_SIZE] = {0x00};
339 static int traceState = TRACE_IDLE;
340 static uint8_t traceCurBlock = 0;
341 static uint8_t traceCurKey = 0;
342
343 struct Crypto1State *traceCrypto1 = NULL;
344 struct Crypto1State *revstate = NULL;
345 uint64_t key = 0;
346 uint32_t ks2 = 0;
347 uint32_t ks3 = 0;
348
349 uint32_t cuid = 0; // serial number
350 uint32_t nt =0; // tag challenge
351 uint32_t nr_enc =0; // encrypted reader challenge
352 uint32_t ar_enc =0; // encrypted reader response
353 uint32_t at_enc =0; // encrypted tag response
354
355 int isTraceCardEmpty(void) {
356 return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));
357 }
358
359 int isBlockEmpty(int blockN) {
360 for (int i = 0; i < 16; i++)
361 if (traceCard[blockN * 16 + i] != 0) return 0;
362
363 return 1;
364 }
365
366 int isBlockTrailer(int blockN) {
367 return ((blockN & 0x03) == 0x03);
368 }
369
370 int loadTraceCard(uint8_t *tuid, uint8_t uidlen) {
371 FILE * f;
372 char buf[64] = {0x00};
373 uint8_t buf8[64] = {0x00};
374 int i, blockNum;
375
376 if (!isTraceCardEmpty())
377 saveTraceCard();
378
379 memset(traceCard, 0x00, 4096);
380 memcpy(traceCard, tuid, uidlen);
381
382 FillFileNameByUID(traceFileName, tuid, ".eml", uidlen);
383
384 f = fopen(traceFileName, "r");
385 if (!f) return 1;
386
387 blockNum = 0;
388
389 while(!feof(f)){
390
391 memset(buf, 0, sizeof(buf));
392 if (fgets(buf, sizeof(buf), f) == NULL) {
393 PrintAndLog("No trace file found or reading error.");
394 fclose(f);
395 return 2;
396 }
397
398 if (strlen(buf) < 32){
399 if (feof(f)) break;
400 PrintAndLog("File content error. Block data must include 32 HEX symbols");
401 fclose(f);
402 return 2;
403 }
404 for (i = 0; i < 32; i += 2)
405 sscanf(&buf[i], "%02X", (unsigned int *)&buf8[i / 2]);
406
407 memcpy(traceCard + blockNum * 16, buf8, 16);
408
409 blockNum++;
410 }
411 fclose(f);
412 return 0;
413 }
414
415 int saveTraceCard(void) {
416
417 if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;
418
419 FILE * f;
420 f = fopen(traceFileName, "w+");
421 if ( !f ) return 1;
422
423 for (int i = 0; i < 64; i++) { // blocks
424 for (int j = 0; j < 16; j++) // bytes
425 fprintf(f, "%02X", *(traceCard + i * 16 + j));
426 fprintf(f,"\n");
427 }
428 fflush(f);
429 fclose(f);
430 return 0;
431 }
432
433 int mfTraceInit(uint8_t *tuid, uint8_t uidlen, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {
434
435 if (traceCrypto1)
436 crypto1_destroy(traceCrypto1);
437
438 traceCrypto1 = NULL;
439
440 if (wantSaveToEmlFile)
441 loadTraceCard(tuid, uidlen);
442
443 traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];
444 traceCard[5] = sak;
445 memcpy(&traceCard[6], atqa, 2);
446 traceCurBlock = 0;
447 cuid = bytes_to_num(tuid+(uidlen-4), 4);
448 traceState = TRACE_IDLE;
449 return 0;
450 }
451
452 void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool isEncrypted){
453 uint8_t bt = 0;
454 int i;
455
456 if (len != 1) {
457 for (i = 0; i < len; i++)
458 data[i] = crypto1_byte(pcs, 0x00, isEncrypted) ^ data[i];
459 } else {
460 bt = 0;
461 bt |= (crypto1_bit(pcs, 0, isEncrypted) ^ BIT(data[0], 0)) << 0;
462 bt |= (crypto1_bit(pcs, 0, isEncrypted) ^ BIT(data[0], 1)) << 1;
463 bt |= (crypto1_bit(pcs, 0, isEncrypted) ^ BIT(data[0], 2)) << 2;
464 bt |= (crypto1_bit(pcs, 0, isEncrypted) ^ BIT(data[0], 3)) << 3;
465 data[0] = bt;
466 }
467 return;
468 }
469
470 int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
471
472 if (traceState == TRACE_ERROR) return 1;
473
474 if (len > 64) {
475 traceState = TRACE_ERROR;
476 return 1;
477 }
478
479 uint8_t data[64];
480 memset(data, 0x00, sizeof(data));
481
482 memcpy(data, data_src, len);
483
484 if ((traceCrypto1) && ((traceState == TRACE_IDLE) || (traceState > TRACE_AUTH_OK))) {
485 mf_crypto1_decrypt(traceCrypto1, data, len, 0);
486 PrintAndLog("DEC| %s", sprint_hex(data, len));
487 AddLogHex(logHexFileName, "DEC| ", data, len);
488 }
489
490 switch (traceState) {
491 case TRACE_IDLE:
492 // check packet crc16!
493 if ((len >= 4) && (!CheckCrc14443(CRC_14443_A, data, len))) {
494 PrintAndLog("DEC| CRC ERROR!!!");
495 AddLogLine(logHexFileName, "DEC| ", "CRC ERROR!!!");
496 traceState = TRACE_ERROR; // do not decrypt the next commands
497 return 1;
498 }
499
500 // AUTHENTICATION
501 if ((len == 4) && ((data[0] == MIFARE_AUTH_KEYA) || (data[0] == MIFARE_AUTH_KEYB))) {
502 traceState = TRACE_AUTH1;
503 traceCurBlock = data[1];
504 traceCurKey = data[0] == 60 ? 1:0;
505 return 0;
506 }
507
508 // READ
509 if ((len ==4) && ((data[0] == ISO14443A_CMD_READBLOCK))) {
510 traceState = TRACE_READ_DATA;
511 traceCurBlock = data[1];
512 return 0;
513 }
514
515 // WRITE
516 if ((len ==4) && ((data[0] == ISO14443A_CMD_WRITEBLOCK))) {
517 traceState = TRACE_WRITE_OK;
518 traceCurBlock = data[1];
519 return 0;
520 }
521
522 // HALT
523 if ((len ==4) && ((data[0] == ISO14443A_CMD_HALT) && (data[1] == 0x00))) {
524 traceState = TRACE_ERROR; // do not decrypt the next commands
525 return 0;
526 }
527 return 0;
528 case TRACE_READ_DATA:
529 if (len == 18) {
530 traceState = TRACE_IDLE;
531
532 if (isBlockTrailer(traceCurBlock)) {
533 memcpy(traceCard + traceCurBlock * 16 + 6, data + 6, 4);
534 } else {
535 memcpy(traceCard + traceCurBlock * 16, data, 16);
536 }
537 if (wantSaveToEmlFile) saveTraceCard();
538 return 0;
539 } else {
540 traceState = TRACE_ERROR;
541 return 1;
542 }
543 break;
544 case TRACE_WRITE_OK:
545 if ((len == 1) && (data[0] == 0x0a)) {
546 traceState = TRACE_WRITE_DATA;
547 return 0;
548 } else {
549 traceState = TRACE_ERROR;
550 return 1;
551 }
552 break;
553 case TRACE_WRITE_DATA:
554 if (len == 18) {
555 traceState = TRACE_IDLE;
556 memcpy(traceCard + traceCurBlock * 16, data, 16);
557 if (wantSaveToEmlFile) saveTraceCard();
558 return 0;
559 } else {
560 traceState = TRACE_ERROR;
561 return 1;
562 }
563 break;
564 case TRACE_AUTH1:
565 if (len == 4) {
566 traceState = TRACE_AUTH2;
567 nt = bytes_to_num(data, 4);
568 return 0;
569 } else {
570 traceState = TRACE_ERROR;
571 return 1;
572 }
573 break;
574 case TRACE_AUTH2:
575 if (len == 8) {
576 traceState = TRACE_AUTH_OK;
577 nr_enc = bytes_to_num(data, 4);
578 ar_enc = bytes_to_num(data + 4, 4);
579 return 0;
580 } else {
581 traceState = TRACE_ERROR;
582 return 1;
583 }
584 break;
585 case TRACE_AUTH_OK:
586 if (len == 4) {
587 traceState = TRACE_IDLE;
588 at_enc = bytes_to_num(data, 4);
589
590 // decode key here)
591 ks2 = ar_enc ^ prng_successor(nt, 64);
592 ks3 = at_enc ^ prng_successor(nt, 96);
593 revstate = lfsr_recovery64(ks2, ks3);
594 lfsr_rollback_word(revstate, 0, 0);
595 lfsr_rollback_word(revstate, 0, 0);
596 lfsr_rollback_word(revstate, nr_enc, 1);
597 lfsr_rollback_word(revstate, cuid ^ nt, 0);
598 crypto1_get_lfsr(revstate, &key);
599 PrintAndLog("Found Key: [%012"llx"]", key);
600
601 //if ( tryMfk64(cuid, nt, nr_enc, ar_enc, at_enc, &key) )
602 AddLogUint64(logHexFileName, "Found Key: ", key);
603
604 int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;
605 if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);
606
607 if (traceCurKey)
608 num_to_bytes(key, 6, traceCard + blockShift + 10);
609 else
610 num_to_bytes(key, 6, traceCard + blockShift);
611
612 if (wantSaveToEmlFile)
613 saveTraceCard();
614
615 if (traceCrypto1)
616 crypto1_destroy(traceCrypto1);
617
618 // set cryptosystem state
619 traceCrypto1 = lfsr_recovery64(ks2, ks3);
620
621 return 0;
622 } else {
623 traceState = TRACE_ERROR;
624 return 1;
625 }
626 break;
627 default:
628 traceState = TRACE_ERROR;
629 return 1;
630 }
631 return 0;
632 }
633
634 int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){
635 PrintAndLog("\nEncrypted data: [%s]", sprint_hex(data, len) );
636 struct Crypto1State *pcs = NULL;
637 ks2 = ar_enc ^ prng_successor(nt, 64);
638 ks3 = at_enc ^ prng_successor(nt, 96);
639 pcs = lfsr_recovery64(ks2, ks3);
640 mf_crypto1_decrypt(pcs, data, len, FALSE);
641 PrintAndLog("Decrypted data: [%s]", sprint_hex(data, len) );
642 crypto1_destroy(pcs);
643 return 0;
644 }
Impressum, Datenschutz