git.zerfleddert.de Git - proxmark3-svn/blob - client/nonce2key/nonce2key.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011
   3 // Roel - Dec 2009
   4 // Unknown author
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // MIFARE Darkside hack
  11 //-----------------------------------------------------------------------------
  12 #include "nonce2key.h"
  13 #include "mifarehost.h"
  14 #include "ui.h"
  15 #include "proxmark3.h"
  16
  17 int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
  18         struct Crypto1State *state;
  19         uint32_t i, pos, rr = 0, nr_diff;
  20         byte_t bt, ks3x[8], par[8][8];
  21
  22         // Reset the last three significant bits of the reader nonce
  23         nr &= 0xffffff1f;
  24
  25         PrintAndLog("uid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08"llx")\n", uid, nt, par_info, ks_info, nr);
  26
  27         for ( pos = 0; pos < 8; pos++ ) {
  28                 ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
  29                 bt = (par_info >> (pos*8)) & 0xff;
  30
  31                 for ( i = 0; i < 8; i++) {
  32                         par[7-pos][i] = (bt >> i) & 0x01;
  33                 }
  34         }
  35
  36         printf("+----+--------+---+-----+---------------+\n");
  37         printf("|diff|{nr}    |ks3|ks3^5|parity         |\n");
  38         printf("+----+--------+---+-----+---------------+\n");
  39         for ( i = 0; i < 8; i++) {
  40                 nr_diff = nr | i << 5;
  41                 printf("| %02x |%08x| %01x |  %01x  |", i << 5, nr_diff, ks3x[i], ks3x[i]^5);
  42
  43                 for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]);
  44                 printf("%01x|\n", par[i][7]);
  45         }
  46         printf("+----+--------+---+-----+---------------+\n");
  47
  48         clock_t t1 = clock();
  49
  50         state = lfsr_common_prefix(nr, rr, ks3x, par);
  51         lfsr_rollback_word(state, uid^nt, 0);
  52         crypto1_get_lfsr(state, key);
  53         crypto1_destroy(state);
  54
  55         t1 = clock() - t1;
  56         if ( t1 > 0 ) PrintAndLog("Time in nonce2key: %.0f ticks \n", (float)t1);
  57         return 0;
  58 }
  59
  60 // call when PAR == 0,  special attack?
  61 int nonce2key_ex(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) {
  62         struct Crypto1State *state;
  63         uint32_t i, pos, key_count;
  64         byte_t ks3x[8];
  65
  66         uint64_t key_recovered;
  67         int64_t *state_s;
  68         static uint32_t last_uid;
  69         static int64_t *last_keylist;
  70
  71         if (last_uid != uid && last_keylist != NULL) {
  72                 free(last_keylist);
  73                 last_keylist = NULL;
  74         }
  75         last_uid = uid;
  76
  77         // Reset the last three significant bits of the reader nonce
  78         nr &= 0xffffff1f;
  79
  80         PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08"llx")\n", uid, nt, ks_info, nr);
  81
  82         for (pos=0; pos<8; pos++) {
  83                 ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
  84         }
  85
  86         PrintAndLog("parity is all zero,try special attack! just wait for few more seconds");
  87
  88         clock_t t1 = clock();
  89
  90         state = lfsr_common_prefix_ex(nr, ks3x);
  91         state_s = (int64_t*)state;
  92
  93         //char filename[50] ;
  94     //sprintf(filename, "nt_%08x_%d.txt", nt, nr);
  95     //printf("name %s\n", filename);
  96         //FILE* fp = fopen(filename,"w");
  97         for (i = 0; (state) && ((state + i)->odd != -1); i++) {
  98                 lfsr_rollback_word(state+i, uid^nt, 0);
  99                 crypto1_get_lfsr(state + i, &key_recovered);
 100                 *(state_s + i) = key_recovered;
 101                 //fprintf(fp, "%012llx\n",key_recovered);
 102         }
 103         //fclose(fp);
 104
 105         if(!state)
 106                 return 1;
 107
 108         qsort(state_s, i, sizeof(*state_s), compar_int);
 109         *(state_s + i) = -1;
 110
 111         //Create the intersection:
 112         if ( last_keylist != NULL) {
 113                 int64_t *p1, *p2, *p3;
 114                 p1 = p3 = last_keylist;
 115                 p2 = state_s;
 116                 while ( *p1 != -1 && *p2 != -1 ) {
 117                         if (compar_int(p1, p2) == 0) {
 118                                 printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1);
 119                                 *p3++ = *p1++;
 120                                 p2++;
 121                         }
 122                         else {
 123                                 while (compar_int(p1, p2) == -1) ++p1;
 124                                 while (compar_int(p1, p2) == 1) ++p2;
 125                         }
 126                 }
 127                 key_count = p3 - last_keylist;;
 128         } else {
 129                 key_count = 0;
 130         }
 131
 132         printf("key_count:%d\n", key_count);
 133
 134         // The list may still contain several key candidates. Test each of them with mfCheckKeys
 135         uint8_t keyBlock[6];
 136         uint64_t key64;
 137         for (i = 0; i < key_count; i++) {
 138                 key64 = *(last_keylist + i);
 139                 num_to_bytes(key64, 6, keyBlock);
 140                 key64 = 0;
 141                 if (!mfCheckKeys(0, 0, TRUE, 1, keyBlock, &key64)) {  //block 0,A,
 142                         *key = key64;
 143                         free(last_keylist);
 144                         last_keylist = NULL;
 145                         free(state);
 146                         return 0;
 147                 }
 148         }
 149
 150         t1 = clock() - t1;
 151         if ( t1 > 0 ) PrintAndLog("Time in nonce2key_special: %.0f ticks \n", (float)t1);
 152
 153         free(last_keylist);
 154         last_keylist = state_s;
 155         return 1;
 156 }
 157
 158 int tryMfk32(uint8_t *data, uint64_t *outputkey ){
 159         struct Crypto1State *s,*t;
 160         uint64_t key;                                            // recovered key
 161         uint32_t uid     = le32toh(data);
 162         uint32_t nt      = le32toh(data+4);  // tag challenge
 163         uint32_t nr0_enc = le32toh(data+8);  // first encrypted reader challenge
 164         uint32_t ar0_enc = le32toh(data+12); // first encrypted reader response
 165         //+16 uid2
 166         //+20 nt2
 167         uint32_t nr1_enc = le32toh(data+24); // second encrypted reader challenge
 168         uint32_t ar1_enc = le32toh(data+28); // second encrypted reader response
 169         bool isSuccess = FALSE;
 170         int counter = 0;
 171
 172         PrintAndLog("Enter mfkey32");
 173         clock_t t1 = clock();
 174         s = lfsr_recovery32(ar0_enc ^ prng_successor(nt, 64), 0);
 175
 176         for(t = s; t->odd | t->even; ++t) {
 177                 lfsr_rollback_word(t, 0, 0);
 178                 lfsr_rollback_word(t, nr0_enc, 1);
 179                 lfsr_rollback_word(t, uid ^ nt, 0);
 180                 crypto1_get_lfsr(t, &key);
 181                 crypto1_word(t, uid ^ nt, 0);
 182                 crypto1_word(t, nr1_enc, 1);
 183                 if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt, 64))) {
 184                         PrintAndLog("Found Key: [%012"llx"]", key);
 185                         isSuccess = TRUE;
 186                         ++counter;
 187                         if (counter==100)
 188                                 break;
 189                 }
 190         }
 191         t1 = clock() - t1;
 192         if ( t1 > 0 ) PrintAndLog("Time in mf32key: %.0f ticks \n", (float)t1);
 193         *outputkey = ( isSuccess ) ? key : 0;
 194         crypto1_destroy(s);
 195         return isSuccess;
 196 }
 197
 198 int tryMfk32_moebius(uint8_t *data, uint64_t *outputkey ){
 199         struct Crypto1State *s, *t;
 200         uint64_t key     = 0;                        // recovered key
 201         uint32_t uid     = le32toh(data);
 202         uint32_t nt0     = le32toh(data+4);  // first tag challenge (nonce)
 203         uint32_t nr0_enc = le32toh(data+8);  // first encrypted reader challenge
 204         uint32_t ar0_enc = le32toh(data+12); // first encrypted reader response
 205         //uint32_t uid1    = le32toh(data+16);
 206         uint32_t nt1     = le32toh(data+20); // second tag challenge (nonce)
 207         uint32_t nr1_enc = le32toh(data+24); // second encrypted reader challenge
 208         uint32_t ar1_enc = le32toh(data+28); // second encrypted reader response
 209         bool isSuccess = FALSE;
 210         int counter = 0;
 211
 212         PrintAndLog("Enter mfkey32_moebius");
 213         clock_t t1 = clock();
 214
 215         s = lfsr_recovery32(ar0_enc ^ prng_successor(nt0, 64), 0);
 216
 217         for(t = s; t->odd | t->even; ++t) {
 218                 lfsr_rollback_word(t, 0, 0);
 219                 lfsr_rollback_word(t, nr0_enc, 1);
 220                 lfsr_rollback_word(t, uid ^ nt0, 0);
 221                 crypto1_get_lfsr(t, &key);
 222
 223                 crypto1_word(t, uid ^ nt1, 0);
 224                 crypto1_word(t, nr1_enc, 1);
 225                 if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt1, 64))) {
 226                         PrintAndLog("Found Key: [%012"llx"]",key);
 227                         isSuccess = TRUE;
 228                         ++counter;
 229                         if (counter==20)
 230                                 break;
 231                 }
 232         }
 233         t1 = clock() - t1;
 234         if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks \n", (float)t1);
 235         *outputkey = ( isSuccess ) ? key : 0;
 236         crypto1_destroy(s);
 237         return isSuccess;
 238 }
 239
 240 int tryMfk64_ex(uint8_t *data, uint64_t *outputkey){
 241         uint32_t uid    = le32toh(data);
 242         uint32_t nt     = le32toh(data+4);  // tag challenge
 243         uint32_t nr_enc = le32toh(data+8);  // encrypted reader challenge
 244         uint32_t ar_enc = le32toh(data+12); // encrypted reader response
 245         uint32_t at_enc = le32toh(data+16);     // encrypted tag response
 246         return tryMfk64(uid, nt, nr_enc, ar_enc, at_enc, outputkey);
 247 }
 248
 249 int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32_t at_enc, uint64_t *outputkey){
 250         uint64_t key    = 0;                            // recovered key
 251         uint32_t ks2;                                           // keystream used to encrypt reader response
 252         uint32_t ks3;                                           // keystream used to encrypt tag response
 253         struct Crypto1State *revstate;
 254
 255         PrintAndLog("Enter mfkey64");
 256         clock_t t1 = clock();
 257
 258         // Extract the keystream from the messages
 259         ks2 = ar_enc ^ prng_successor(nt, 64);
 260         ks3 = at_enc ^ prng_successor(nt, 96);
 261         revstate = lfsr_recovery64(ks2, ks3);
 262         lfsr_rollback_word(revstate, 0, 0);
 263         lfsr_rollback_word(revstate, 0, 0);
 264         lfsr_rollback_word(revstate, nr_enc, 1);
 265         lfsr_rollback_word(revstate, uid ^ nt, 0);
 266         crypto1_get_lfsr(revstate, &key);
 267         PrintAndLog("Found Key: [%012"llx"]", key);
 268         crypto1_destroy(revstate);
 269         *outputkey = key;
 270
 271         t1 = clock() - t1;
 272         if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks \n", (float)t1);
 273         return 0;
 274 }