]>
git.zerfleddert.de Git - proxmark3-svn/blob - client/mifarehost.c
2bd21077e9b6ba5cd23c276445cccc809f3dbf04
2 // people from mifare@nethemba.com, 2010
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
9 //-----------------------------------------------------------------------------
11 #include "mifarehost.h"
18 #include "crapto1/crapto1.h"
19 #include "proxmark3.h"
24 #include "iso14443crc.h"
28 // mifare tracer flags used in mfTraceDecode()
29 #define TRACE_IDLE 0x00
30 #define TRACE_AUTH1 0x01
31 #define TRACE_AUTH2 0x02
32 #define TRACE_AUTH_OK 0x03
33 #define TRACE_READ_DATA 0x04
34 #define TRACE_WRITE_OK 0x05
35 #define TRACE_WRITE_DATA 0x06
36 #define TRACE_ERROR 0xFF
39 static int compare_uint64 ( const void * a
, const void * b
) {
40 // didn't work: (the result is truncated to 32 bits)
41 //return (*(int64_t*)b - *(int64_t*)a);
44 if (*( uint64_t *) b
== *( uint64_t *) a
) return 0 ;
45 else if (*( uint64_t *) b
< *( uint64_t *) a
) return 1 ;
50 // create the intersection (common members) of two sorted lists. Lists are terminated by -1. Result will be in list1. Number of elements is returned.
51 static uint32_t intersection ( uint64_t * list1
, uint64_t * list2
)
53 if ( list1
== NULL
|| list2
== NULL
) {
56 uint64_t * p1
, * p2
, * p3
;
60 while ( * p1
!= - 1 && * p2
!= - 1 ) {
61 if ( compare_uint64 ( p1
, p2
) == 0 ) {
66 while ( compare_uint64 ( p1
, p2
) < 0 ) ++ p1
;
67 while ( compare_uint64 ( p1
, p2
) > 0 ) ++ p2
;
75 // Darkside attack (hf mf mifare)
76 static uint32_t nonce2key ( uint32_t uid
, uint32_t nt
, uint32_t nr
, uint64_t par_info
, uint64_t ks_info
, uint64_t ** keys
) {
77 struct Crypto1State
* states
;
78 uint32_t i
, pos
, rr
; //nr_diff;
79 uint8_t bt
, ks3x
[ 8 ], par
[ 8 ][ 8 ];
80 uint64_t key_recovered
;
81 static uint64_t * keylist
;
84 // Reset the last three significant bits of the reader nonce
87 for ( pos
= 0 ; pos
< 8 ; pos
++) {
88 ks3x
[ 7 - pos
] = ( ks_info
>> ( pos
* 8 )) & 0x0f ;
89 bt
= ( par_info
>> ( pos
* 8 )) & 0xff ;
91 par
[ 7 - pos
][ i
] = ( bt
>> i
) & 0x01 ;
95 states
= lfsr_common_prefix ( nr
, rr
, ks3x
, par
, ( par_info
== 0 ));
102 keylist
= ( uint64_t *) states
;
104 for ( i
= 0 ; keylist
[ i
]; i
++) {
105 lfsr_rollback_word ( states
+ i
, uid
^ nt
, 0 );
106 crypto1_get_lfsr ( states
+ i
, & key_recovered
);
107 keylist
[ i
] = key_recovered
;
116 int mfDarkside ( uint64_t * key
)
119 uint32_t nt
= 0 , nr
= 0 ;
120 uint64_t par_list
= 0 , ks_list
= 0 ;
121 uint64_t * keylist
= NULL
, * last_keylist
= NULL
;
122 uint32_t keycount
= 0 ;
125 UsbCommand c
= { CMD_READER_MIFARE
, { true , 0 , 0 }};
128 printf ( "------------------------------------------------------------------------- \n " );
129 printf ( "Executing command. Expected execution time: 25sec on average \n " );
130 printf ( "Press button on the proxmark3 device to abort both proxmark3 and client. \n " );
131 printf ( "------------------------------------------------------------------------- \n " );
135 clearCommandBuffer ();
140 int c
= getchar (); ( void ) c
;
153 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1000 )) {
158 uid
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 0 , 4 );
159 nt
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 4 , 4 );
160 par_list
= bytes_to_num ( resp
. d
. asBytes
+ 8 , 8 );
161 ks_list
= bytes_to_num ( resp
. d
. asBytes
+ 16 , 8 );
162 nr
= bytes_to_num ( resp
. d
. asBytes
+ 24 , 4 );
167 if ( par_list
== 0 && c
. arg
[ 0 ] == true ) {
168 PrintAndLog ( "Parity is all zero. Most likely this card sends NACK on every failed authentication." );
169 PrintAndLog ( "Attack will take a few seconds longer because we need two consecutive successful runs." );
173 keycount
= nonce2key ( uid
, nt
, nr
, par_list
, ks_list
, & keylist
);
176 PrintAndLog ( "Key not found (lfsr_common_prefix list is null). Nt=%08x" , nt
);
177 PrintAndLog ( "This is expected to happen in 25%% of all cases. Trying again with a different reader nonce..." );
182 qsort ( keylist
, keycount
, sizeof (* keylist
), compare_uint64
);
183 keycount
= intersection ( last_keylist
, keylist
);
186 last_keylist
= keylist
;
192 PrintAndLog ( "Found %u possible keys. Trying to authenticate with each of them ... \n " , keycount
);
194 PrintAndLog ( "Found a possible key. Trying to authenticate... \n " );
198 uint8_t keyBlock
[ USB_CMD_DATA_SIZE
];
199 int max_keys
= USB_CMD_DATA_SIZE
/ 6 ;
200 for ( int i
= 0 ; i
< keycount
; i
+= max_keys
) {
201 int size
= keycount
- i
> max_keys
? max_keys
: keycount
- i
;
202 for ( int j
= 0 ; j
< size
; j
++) {
204 num_to_bytes ( last_keylist
[ i
* max_keys
+ j
], 6 , keyBlock
+( j
* 6 ));
206 num_to_bytes ( keylist
[ i
* max_keys
+ j
], 6 , keyBlock
+( j
* 6 ));
209 if (! mfCheckKeys ( 0 , 0 , false , size
, keyBlock
, key
)) {
219 PrintAndLog ( "Authentication failed. Trying again..." );
221 last_keylist
= keylist
;
229 int mfCheckKeys ( uint8_t blockNo
, uint8_t keyType
, bool clear_trace
, uint8_t keycnt
, uint8_t * keyBlock
, uint64_t * key
){
233 UsbCommand c
= { CMD_MIFARE_CHKKEYS
, {(( blockNo
& 0xff ) | (( keyType
& 0xff ) << 8 )), clear_trace
, keycnt
}};
234 memcpy ( c
. d
. asBytes
, keyBlock
, 6 * keycnt
);
238 if (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 3000 )) return 1 ;
239 if (( resp
. arg
[ 0 ] & 0xff ) != 0x01 ) return 2 ;
240 * key
= bytes_to_num ( resp
. d
. asBytes
, 6 );
244 int mfCheckKeysSec ( uint8_t sectorCnt
, uint8_t keyType
, uint8_t timeout14a
, bool clear_trace
, uint8_t keycnt
, uint8_t * keyBlock
, sector_t
* e_sector
){
248 if ( e_sector
== NULL
)
251 UsbCommand c
= { CMD_MIFARE_CHKKEYS
, {(( sectorCnt
& 0xff ) | (( keyType
& 0xff ) << 8 )), ( clear_trace
| 0x02 )|(( timeout14a
& 0xff ) << 8 ), keycnt
}};
252 memcpy ( c
. d
. asBytes
, keyBlock
, 6 * keycnt
);
256 if (! WaitForResponseTimeoutW ( CMD_ACK
, & resp
, MAX ( 3000 , 1000 + 13 * sectorCnt
* keycnt
* ( keyType
== 2 ? 2 : 1 )), false )) return 1 ; // timeout: 13 ms / fail auth
257 if (( resp
. arg
[ 0 ] & 0xff ) != 0x01 ) return 2 ;
259 bool foundAKey
= false ;
260 for ( int sec
= 0 ; sec
< sectorCnt
; sec
++){
261 for ( int keyAB
= 0 ; keyAB
< 2 ; keyAB
++){
262 keyPtr
= *( resp
. d
. asBytes
+ keyAB
* 40 + sec
);
264 e_sector
[ sec
]. foundKey
[ keyAB
] = true ;
265 e_sector
[ sec
]. Key
[ keyAB
] = bytes_to_num ( keyBlock
+ ( keyPtr
- 1 ) * 6 , 6 );
270 return foundAKey
? 0 : 3 ;
273 // Compare 16 Bits out of cryptostate
274 int Compare16Bits ( const void * a
, const void * b
) {
275 if ((*( uint64_t *) b
& 0x00ff000000ff0000 ) == (*( uint64_t *) a
& 0x00ff000000ff0000 )) return 0 ;
276 else if ((*( uint64_t *) b
& 0x00ff000000ff0000 ) > (*( uint64_t *) a
& 0x00ff000000ff0000 )) return 1 ;
283 struct Crypto1State
* slhead
;
287 struct Crypto1State
* sltail
;
299 // wrapper function for multi-threaded lfsr_recovery32
301 #ifdef __has_attribute
302 #if __has_attribute(force_align_arg_pointer)
303 __attribute__ (( force_align_arg_pointer
))
306 * nested_worker_thread ( void * arg
)
308 struct Crypto1State
* p1
;
309 StateList_t
* statelist
= arg
;
311 statelist
-> head
. slhead
= lfsr_recovery32 ( statelist
-> ks1
, statelist
-> nt
^ statelist
-> uid
);
312 for ( p1
= statelist
-> head
. slhead
; *( uint64_t *) p1
!= 0 ; p1
++);
313 statelist
-> len
= p1
- statelist
-> head
. slhead
;
314 statelist
-> tail
. sltail
= -- p1
;
315 qsort ( statelist
-> head
. slhead
, statelist
-> len
, sizeof ( uint64_t ), Compare16Bits
);
317 return statelist
-> head
. slhead
;
321 int mfnested ( uint8_t blockNo
, uint8_t keyType
, uint8_t * key
, uint8_t trgBlockNo
, uint8_t trgKeyType
, uint8_t * resultKey
, bool calibrate
)
327 StateList_t statelists
[ 2 ];
328 struct Crypto1State
* p1
, * p2
, * p3
, * p4
;
331 WaitForResponseTimeout ( CMD_ACK
, NULL
, 100 );
333 UsbCommand c
= { CMD_MIFARE_NESTED
, { blockNo
+ keyType
* 0x100 , trgBlockNo
+ trgKeyType
* 0x100 , calibrate
}};
334 memcpy ( c
. d
. asBytes
, key
, 6 );
337 if (! WaitForResponseTimeout ( CMD_ACK
, & resp
, 1500 )) {
342 return resp
. arg
[ 0 ]; // error during nested
345 memcpy (& uid
, resp
. d
. asBytes
, 4 );
346 PrintAndLog ( "uid:%08x trgbl=%d trgkey=%x" , uid
, ( uint16_t ) resp
. arg
[ 2 ] & 0xff , ( uint16_t ) resp
. arg
[ 2 ] >> 8 );
348 for ( i
= 0 ; i
< 2 ; i
++) {
349 statelists
[ i
]. blockNo
= resp
. arg
[ 2 ] & 0xff ;
350 statelists
[ i
]. keyType
= ( resp
. arg
[ 2 ] >> 8 ) & 0xff ;
351 statelists
[ i
]. uid
= uid
;
352 memcpy (& statelists
[ i
]. nt
, ( void *)( resp
. d
. asBytes
+ 4 + i
* 8 + 0 ), 4 );
353 memcpy (& statelists
[ i
]. ks1
, ( void *)( resp
. d
. asBytes
+ 4 + i
* 8 + 4 ), 4 );
358 pthread_t thread_id
[ 2 ];
360 // create and run worker threads
361 for ( i
= 0 ; i
< 2 ; i
++) {
362 pthread_create ( thread_id
+ i
, NULL
, nested_worker_thread
, & statelists
[ i
]);
365 // wait for threads to terminate:
366 for ( i
= 0 ; i
< 2 ; i
++) {
367 pthread_join ( thread_id
[ i
], ( void *)& statelists
[ i
]. head
. slhead
);
371 // the first 16 Bits of the cryptostate already contain part of our key.
372 // Create the intersection of the two lists based on these 16 Bits and
373 // roll back the cryptostate
374 p1
= p3
= statelists
[ 0 ]. head
. slhead
;
375 p2
= p4
= statelists
[ 1 ]. head
. slhead
;
376 while ( p1
<= statelists
[ 0 ]. tail
. sltail
&& p2
<= statelists
[ 1 ]. tail
. sltail
) {
377 if ( Compare16Bits ( p1
, p2
) == 0 ) {
378 struct Crypto1State savestate
, * savep
= & savestate
;
380 while ( Compare16Bits ( p1
, savep
) == 0 && p1
<= statelists
[ 0 ]. tail
. sltail
) {
382 lfsr_rollback_word ( p3
, statelists
[ 0 ]. nt
^ statelists
[ 0 ]. uid
, 0 );
387 while ( Compare16Bits ( p2
, savep
) == 0 && p2
<= statelists
[ 1 ]. tail
. sltail
) {
389 lfsr_rollback_word ( p4
, statelists
[ 1 ]. nt
^ statelists
[ 1 ]. uid
, 0 );
395 while ( Compare16Bits ( p1
, p2
) == - 1 ) p1
++;
396 while ( Compare16Bits ( p1
, p2
) == 1 ) p2
++;
401 statelists
[ 0 ]. len
= p3
- statelists
[ 0 ]. head
. slhead
;
402 statelists
[ 1 ]. len
= p4
- statelists
[ 1 ]. head
. slhead
;
403 statelists
[ 0 ]. tail
. sltail
=-- p3
;
404 statelists
[ 1 ]. tail
. sltail
=-- p4
;
406 // the statelists now contain possible keys. The key we are searching for must be in the
407 // intersection of both lists. Create the intersection:
408 qsort ( statelists
[ 0 ]. head
. keyhead
, statelists
[ 0 ]. len
, sizeof ( uint64_t ), compare_uint64
);
409 qsort ( statelists
[ 1 ]. head
. keyhead
, statelists
[ 1 ]. len
, sizeof ( uint64_t ), compare_uint64
);
410 statelists
[ 0 ]. len
= intersection ( statelists
[ 0 ]. head
. keyhead
, statelists
[ 1 ]. head
. keyhead
);
412 memset ( resultKey
, 0 , 6 );
413 // The list may still contain several key candidates. Test each of them with mfCheckKeys
414 for ( i
= 0 ; i
< statelists
[ 0 ]. len
; i
++) {
417 crypto1_get_lfsr ( statelists
[ 0 ]. head
. slhead
+ i
, & key64
);
418 num_to_bytes ( key64
, 6 , keyBlock
);
420 if (! mfCheckKeys ( statelists
[ 0 ]. blockNo
, statelists
[ 0 ]. keyType
, false , 1 , keyBlock
, & key64
)) {
421 num_to_bytes ( key64
, 6 , resultKey
);
426 free ( statelists
[ 0 ]. head
. slhead
);
427 free ( statelists
[ 1 ]. head
. slhead
);
434 int mfEmlGetMem ( uint8_t * data
, int blockNum
, int blocksCount
) {
435 UsbCommand c
= { CMD_MIFARE_EML_MEMGET
, { blockNum
, blocksCount
, 0 }};
439 if (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) return 1 ;
440 memcpy ( data
, resp
. d
. asBytes
, blocksCount
* 16 );
444 int mfEmlSetMem ( uint8_t * data
, int blockNum
, int blocksCount
) {
445 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, { blockNum
, blocksCount
, 0 }};
446 memcpy ( c
. d
. asBytes
, data
, blocksCount
* 16 );
453 int mfCGetBlock ( uint8_t blockNo
, uint8_t * data
, uint8_t params
) {
456 UsbCommand c
= { CMD_MIFARE_CGETBLOCK
, { params
, 0 , blockNo
}};
460 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
461 isOK
= resp
. arg
[ 0 ] & 0xff ;
462 memcpy ( data
, resp
. d
. asBytes
, 16 );
465 PrintAndLog ( "Command execute timeout" );
471 int mfCSetBlock ( uint8_t blockNo
, uint8_t * data
, uint8_t * uid
, bool wantWipe
, uint8_t params
) {
474 UsbCommand c
= { CMD_MIFARE_CSETBLOCK
, { wantWipe
, params
& ( 0xFE | ( uid
== NULL
? 0 : 1 )), blockNo
}};
475 memcpy ( c
. d
. asBytes
, data
, 16 );
479 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1500 )) {
480 isOK
= resp
. arg
[ 0 ] & 0xff ;
482 memcpy ( uid
, resp
. d
. asBytes
, 4 );
486 PrintAndLog ( "Command execute timeout" );
493 int mfCWipe ( uint32_t numSectors
, bool gen1b
, bool wantWipe
, bool wantFill
) {
495 uint8_t cmdParams
= wantWipe
+ wantFill
* 0x02 + gen1b
* 0x04 ;
496 UsbCommand c
= { CMD_MIFARE_CWIPE
, { numSectors
, cmdParams
, 0 }};
500 WaitForResponse ( CMD_ACK
,& resp
);
501 isOK
= resp
. arg
[ 0 ] & 0xff ;
506 int mfCSetUID ( uint8_t * uid
, uint8_t * atqa
, uint8_t * sak
, uint8_t * oldUID
) {
507 uint8_t oldblock0
[ 16 ] = { 0x00 };
508 uint8_t block0
[ 16 ] = { 0x00 };
513 /* generation 1a magic card by default */
514 uint8_t cmdParams
= CSETBLOCK_SINGLE_OPER
;
516 /* generation 1b magic card */
517 cmdParams
= CSETBLOCK_SINGLE_OPER
| CSETBLOCK_MAGIC_1B
;
520 res
= mfCGetBlock ( 0 , oldblock0
, cmdParams
);
523 memcpy ( block0
, oldblock0
, 16 );
524 PrintAndLog ( "old block 0: %s" , sprint_hex ( block0
, 16 ));
526 PrintAndLog ( "Couldn't get old data. Will write over the last bytes of Block 0." );
529 // fill in the new values
531 memcpy ( block0
, uid
, 4 );
533 block0
[ 4 ] = block0
[ 0 ] ^ block0
[ 1 ] ^ block0
[ 2 ] ^ block0
[ 3 ];
534 // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)
541 PrintAndLog ( "new block 0: %s" , sprint_hex ( block0
, 16 ));
543 res
= mfCSetBlock ( 0 , block0
, oldUID
, false , cmdParams
);
545 PrintAndLog ( "Can't set block 0. Error: %d" , res
);
553 UsbCommand c
= { CMD_MIFARE_CIDENT
, { 0 , 0 , 0 }};
556 WaitForResponse ( CMD_ACK
,& resp
);
558 uint8_t isGeneration
= resp
. arg
[ 0 ] & 0xff ;
559 switch ( isGeneration
){
560 case 1 : PrintAndLog ( "Chinese magic backdoor commands (GEN 1a) detected" ); break ;
561 case 2 : PrintAndLog ( "Chinese magic backdoor command (GEN 1b) detected" ); break ;
562 default : PrintAndLog ( "No chinese magic backdoor command detected" ); break ;
565 return ( int ) isGeneration
;
572 static uint8_t trailerAccessBytes
[ 4 ] = { 0x08 , 0x77 , 0x8F , 0x00 };
575 char logHexFileName
[ FILE_PATH_SIZE
] = { 0x00 };
576 static uint8_t traceCard
[ 4096 ] = { 0x00 };
577 static char traceFileName
[ FILE_PATH_SIZE
] = { 0x00 };
578 static int traceState
= TRACE_IDLE
;
579 static uint8_t traceCurBlock
= 0 ;
580 static uint8_t traceCurKey
= 0 ;
582 struct Crypto1State
* traceCrypto1
= NULL
;
584 struct Crypto1State
* revstate
;
589 uint32_t uid
; // serial number
590 uint32_t nt
; // tag challenge
591 uint32_t nr_enc
; // encrypted reader challenge
592 uint32_t ar_enc
; // encrypted reader response
593 uint32_t at_enc
; // encrypted tag response
595 int isTraceCardEmpty ( void ) {
596 return (( traceCard
[ 0 ] == 0 ) && ( traceCard
[ 1 ] == 0 ) && ( traceCard
[ 2 ] == 0 ) && ( traceCard
[ 3 ] == 0 ));
599 int isBlockEmpty ( int blockN
) {
600 for ( int i
= 0 ; i
< 16 ; i
++)
601 if ( traceCard
[ blockN
* 16 + i
] != 0 ) return 0 ;
606 int isBlockTrailer ( int blockN
) {
607 return (( blockN
& 0x03 ) == 0x03 );
610 int saveTraceCard ( void ) {
613 if ((! strlen ( traceFileName
)) || ( isTraceCardEmpty ())) return 0 ;
615 f
= fopen ( traceFileName
, "w+" );
618 for ( int i
= 0 ; i
< 64 ; i
++) { // blocks
619 for ( int j
= 0 ; j
< 16 ; j
++) // bytes
620 fprintf ( f
, "%02x" , *( traceCard
+ i
* 16 + j
));
628 int loadTraceCard ( uint8_t * tuid
) {
630 char buf
[ 64 ] = { 0x00 };
631 uint8_t buf8
[ 64 ] = { 0x00 };
634 if (! isTraceCardEmpty ())
637 memset ( traceCard
, 0x00 , 4096 );
638 memcpy ( traceCard
, tuid
+ 3 , 4 );
640 FillFileNameByUID ( traceFileName
, tuid
, ".eml" , 7 );
642 f
= fopen ( traceFileName
, "r" );
649 memset ( buf
, 0 , sizeof ( buf
));
650 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
651 PrintAndLog ( "File reading error." );
656 if ( strlen ( buf
) < 32 ){
658 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
662 for ( i
= 0 ; i
< 32 ; i
+= 2 )
663 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
665 memcpy ( traceCard
+ blockNum
* 16 , buf8
, 16 );
674 int mfTraceInit ( uint8_t * tuid
, uint8_t * atqa
, uint8_t sak
, bool wantSaveToEmlFile
) {
677 crypto1_destroy ( traceCrypto1
);
681 if ( wantSaveToEmlFile
)
684 traceCard
[ 4 ] = traceCard
[ 0 ] ^ traceCard
[ 1 ] ^ traceCard
[ 2 ] ^ traceCard
[ 3 ];
686 memcpy (& traceCard
[ 6 ], atqa
, 2 );
688 uid
= bytes_to_num ( tuid
+ 3 , 4 );
690 traceState
= TRACE_IDLE
;
695 void mf_crypto1_decrypt ( struct Crypto1State
* pcs
, uint8_t * data
, int len
, bool isEncrypted
){
700 for ( i
= 0 ; i
< len
; i
++)
701 data
[ i
] = crypto1_byte ( pcs
, 0x00 , isEncrypted
) ^ data
[ i
];
704 for ( i
= 0 ; i
< 4 ; i
++)
705 bt
|= ( crypto1_bit ( pcs
, 0 , isEncrypted
) ^ BIT ( data
[ 0 ], i
)) << i
;
713 int mfTraceDecode ( uint8_t * data_src
, int len
, bool wantSaveToEmlFile
) {
716 if ( traceState
== TRACE_ERROR
) return 1 ;
718 traceState
= TRACE_ERROR
;
722 memcpy ( data
, data_src
, len
);
723 if (( traceCrypto1
) && (( traceState
== TRACE_IDLE
) || ( traceState
> TRACE_AUTH_OK
))) {
724 mf_crypto1_decrypt ( traceCrypto1
, data
, len
, 0 );
725 PrintAndLog ( "dec> %s" , sprint_hex ( data
, len
));
726 AddLogHex ( logHexFileName
, "dec> " , data
, len
);
729 switch ( traceState
) {
731 // check packet crc16!
732 if (( len
>= 4 ) && (! CheckCrc14443 ( CRC_14443_A
, data
, len
))) {
733 PrintAndLog ( "dec> CRC ERROR!!!" );
734 AddLogLine ( logHexFileName
, "dec> " , "CRC ERROR!!!" );
735 traceState
= TRACE_ERROR
; // do not decrypt the next commands
740 if (( len
== 4 ) && (( data
[ 0 ] == 0x60 ) || ( data
[ 0 ] == 0x61 ))) {
741 traceState
= TRACE_AUTH1
;
742 traceCurBlock
= data
[ 1 ];
743 traceCurKey
= data
[ 0 ] == 60 ? 1 : 0 ;
748 if (( len
== 4 ) && (( data
[ 0 ] == 0x30 ))) {
749 traceState
= TRACE_READ_DATA
;
750 traceCurBlock
= data
[ 1 ];
755 if (( len
== 4 ) && (( data
[ 0 ] == 0xA0 ))) {
756 traceState
= TRACE_WRITE_OK
;
757 traceCurBlock
= data
[ 1 ];
762 if (( len
== 4 ) && (( data
[ 0 ] == 0x50 ) && ( data
[ 1 ] == 0x00 ))) {
763 traceState
= TRACE_ERROR
; // do not decrypt the next commands
770 case TRACE_READ_DATA
:
772 traceState
= TRACE_IDLE
;
774 if ( isBlockTrailer ( traceCurBlock
)) {
775 memcpy ( traceCard
+ traceCurBlock
* 16 + 6 , data
+ 6 , 4 );
777 memcpy ( traceCard
+ traceCurBlock
* 16 , data
, 16 );
779 if ( wantSaveToEmlFile
) saveTraceCard ();
782 traceState
= TRACE_ERROR
;
788 if (( len
== 1 ) && ( data
[ 0 ] == 0x0a )) {
789 traceState
= TRACE_WRITE_DATA
;
793 traceState
= TRACE_ERROR
;
798 case TRACE_WRITE_DATA
:
800 traceState
= TRACE_IDLE
;
802 memcpy ( traceCard
+ traceCurBlock
* 16 , data
, 16 );
803 if ( wantSaveToEmlFile
) saveTraceCard ();
806 traceState
= TRACE_ERROR
;
813 traceState
= TRACE_AUTH2
;
814 nt
= bytes_to_num ( data
, 4 );
817 traceState
= TRACE_ERROR
;
824 traceState
= TRACE_AUTH_OK
;
826 nr_enc
= bytes_to_num ( data
, 4 );
827 ar_enc
= bytes_to_num ( data
+ 4 , 4 );
830 traceState
= TRACE_ERROR
;
837 traceState
= TRACE_IDLE
;
840 at_enc
= bytes_to_num ( data
, 4 );
843 ks2
= ar_enc
^ prng_successor ( nt
, 64 );
844 ks3
= at_enc
^ prng_successor ( nt
, 96 );
845 revstate
= lfsr_recovery64 ( ks2
, ks3
);
846 lfsr_rollback_word ( revstate
, 0 , 0 );
847 lfsr_rollback_word ( revstate
, 0 , 0 );
848 lfsr_rollback_word ( revstate
, nr_enc
, 1 );
849 lfsr_rollback_word ( revstate
, uid
^ nt
, 0 );
851 crypto1_get_lfsr ( revstate
, & lfsr
);
852 printf ( "key> %x%x \n " , ( unsigned int )(( lfsr
& 0xFFFFFFFF00000000 ) >> 32 ), ( unsigned int )( lfsr
& 0xFFFFFFFF ));
853 AddLogUint64 ( logHexFileName
, "key> " , lfsr
);
855 printf ( "key> nested not implemented! \n " );
856 at_enc
= bytes_to_num ( data
, 4 );
858 crypto1_destroy ( traceCrypto1
);
861 traceState
= TRACE_ERROR
;
864 int blockShift
= (( traceCurBlock
& 0xFC ) + 3 ) * 16 ;
865 if ( isBlockEmpty (( traceCurBlock
& 0xFC ) + 3 )) memcpy ( traceCard
+ blockShift
+ 6 , trailerAccessBytes
, 4 );
868 num_to_bytes ( lfsr
, 6 , traceCard
+ blockShift
+ 10 );
870 num_to_bytes ( lfsr
, 6 , traceCard
+ blockShift
);
872 if ( wantSaveToEmlFile
) saveTraceCard ();
875 crypto1_destroy ( traceCrypto1
);
878 // set cryptosystem state
879 traceCrypto1
= lfsr_recovery64 ( ks2
, ks3
);
882 traceState
= TRACE_ERROR
;
888 traceState
= TRACE_ERROR
;
897 int tryDecryptWord ( uint32_t nt
, uint32_t ar_enc
, uint32_t at_enc
, uint8_t * data
, int len
){
899 uint32_t nt; // tag challenge
900 uint32_t ar_enc; // encrypted reader response
901 uint32_t at_enc; // encrypted tag response
904 crypto1_destroy ( traceCrypto1
);
906 ks2
= ar_enc
^ prng_successor ( nt
, 64 );
907 ks3
= at_enc
^ prng_successor ( nt
, 96 );
908 traceCrypto1
= lfsr_recovery64 ( ks2
, ks3
);
910 mf_crypto1_decrypt ( traceCrypto1
, data
, len
, 0 );
912 PrintAndLog ( "Decrypted data: [%s]" , sprint_hex ( data
, len
) );
913 crypto1_destroy ( traceCrypto1
);
917 /** validate_prng_nonce
918 * Determine if nonce is deterministic. ie: Suspectable to Darkside attack.
921 * false = hardend prng
923 bool validate_prng_nonce ( uint32_t nonce
) {
927 dist
= malloc ( 2 << 16 );
932 for ( x
= i
= 1 ; i
; ++ i
) {
933 dist
[( x
& 0xff ) << 8 | x
>> 8 ] = i
;
934 x
= x
>> 1 | ( x
^ x
>> 2 ^ x
>> 3 ^ x
>> 5 ) << 15 ;
937 uint32_t res
= ( 65535 - dist
[ nonce
>> 16 ] + dist
[ nonce
& 0xffff ]) % 65535 ;
944 * function performs a partial AUTH, where it tries to authenticate against block0, key A, but only collects tag nonce.
945 * the tag nonce is check to see if it has a predictable PRNG.
947 * TRUE if tag uses WEAK prng (ie Now the NACK bug also needs to be present for Darkside attack)
948 * FALSE is tag uses HARDEND prng (ie hardnested attack possible, with known key)
950 int DetectClassicPrng ( void ){
952 UsbCommand resp
, respA
;
953 uint8_t cmd
[] = { 0x60 , 0x00 }; // MIFARE_AUTH_KEYA
954 uint32_t flags
= ISO14A_CONNECT
| ISO14A_RAW
| ISO14A_APPEND_CRC
| ISO14A_NO_RATS
;
956 UsbCommand c
= { CMD_READER_ISO_14443a
, { flags
, sizeof ( cmd
), 0 }};
957 memcpy ( c
. d
. asBytes
, cmd
, sizeof ( cmd
));
959 clearCommandBuffer ();
961 if (! WaitForResponseTimeout ( CMD_ACK
, & resp
, 2000 )) {
962 PrintAndLog ( "PRNG UID: Reply timeout." );
966 // if select tag failed.
967 if ( resp
. arg
[ 0 ] == 0 ) {
968 PrintAndLog ( "PRNG error: selecting tag failed, can't detect prng." );
972 if (! WaitForResponseTimeout ( CMD_ACK
, & respA
, 5000 )) {
973 PrintAndLog ( "PRNG data: Reply timeout." );
978 if ( respA
. arg
[ 0 ] != 4 ) {
979 PrintAndLog ( "PRNG data error: Wrong length: %d" , respA
. arg
[ 0 ]);
983 uint32_t nonce
= bytes_to_num ( respA
. d
. asBytes
, respA
. arg
[ 0 ]);
984 return validate_prng_nonce ( nonce
);