]>
git.zerfleddert.de Git - proxmark3-svn/blob - client/mifarehost.c
2 // people from mifare@nethemba.com, 2010
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
9 //-----------------------------------------------------------------------------
11 #include "mifarehost.h"
18 #include "crapto1/crapto1.h"
19 #include "proxmark3.h"
24 #include "iso14443crc.h"
28 // mifare tracer flags used in mfTraceDecode()
29 #define TRACE_IDLE 0x00
30 #define TRACE_AUTH1 0x01
31 #define TRACE_AUTH2 0x02
32 #define TRACE_AUTH_OK 0x03
33 #define TRACE_READ_DATA 0x04
34 #define TRACE_WRITE_OK 0x05
35 #define TRACE_WRITE_DATA 0x06
36 #define TRACE_ERROR 0xFF
39 static int compare_uint64 ( const void * a
, const void * b
) {
40 // didn't work: (the result is truncated to 32 bits)
41 //return (*(int64_t*)b - *(int64_t*)a);
44 if (*( uint64_t *) b
== *( uint64_t *) a
) return 0 ;
45 else if (*( uint64_t *) b
< *( uint64_t *) a
) return 1 ;
50 // create the intersection (common members) of two sorted lists. Lists are terminated by -1. Result will be in list1. Number of elements is returned.
51 static uint32_t intersection ( uint64_t * list1
, uint64_t * list2
)
53 if ( list1
== NULL
|| list2
== NULL
) {
56 uint64_t * p1
, * p2
, * p3
;
60 while ( * p1
!= - 1 && * p2
!= - 1 ) {
61 if ( compare_uint64 ( p1
, p2
) == 0 ) {
66 while ( compare_uint64 ( p1
, p2
) < 0 ) ++ p1
;
67 while ( compare_uint64 ( p1
, p2
) > 0 ) ++ p2
;
75 // Darkside attack (hf mf mifare)
76 static uint32_t nonce2key ( uint32_t uid
, uint32_t nt
, uint32_t nr
, uint64_t par_info
, uint64_t ks_info
, uint64_t ** keys
) {
77 struct Crypto1State
* states
;
78 uint32_t i
, pos
, rr
; //nr_diff;
79 uint8_t bt
, ks3x
[ 8 ], par
[ 8 ][ 8 ];
80 uint64_t key_recovered
;
81 static uint64_t * keylist
;
84 // Reset the last three significant bits of the reader nonce
87 for ( pos
= 0 ; pos
< 8 ; pos
++) {
88 ks3x
[ 7 - pos
] = ( ks_info
>> ( pos
* 8 )) & 0x0f ;
89 bt
= ( par_info
>> ( pos
* 8 )) & 0xff ;
91 par
[ 7 - pos
][ i
] = ( bt
>> i
) & 0x01 ;
95 states
= lfsr_common_prefix ( nr
, rr
, ks3x
, par
, ( par_info
== 0 ));
102 keylist
= ( uint64_t *) states
;
104 for ( i
= 0 ; keylist
[ i
]; i
++) {
105 lfsr_rollback_word ( states
+ i
, uid
^ nt
, 0 );
106 crypto1_get_lfsr ( states
+ i
, & key_recovered
);
107 keylist
[ i
] = key_recovered
;
116 int mfDarkside ( uint64_t * key
)
119 uint32_t nt
= 0 , nr
= 0 ;
120 uint64_t par_list
= 0 , ks_list
= 0 ;
121 uint64_t * keylist
= NULL
, * last_keylist
= NULL
;
122 uint32_t keycount
= 0 ;
125 UsbCommand c
= { CMD_READER_MIFARE
, { true , 0 , 0 }};
128 printf ( "------------------------------------------------------------------------- \n " );
129 printf ( "Executing command. Expected execution time: 25sec on average \n " );
130 printf ( "Press button on the proxmark3 device to abort both proxmark3 and client. \n " );
131 printf ( "------------------------------------------------------------------------- \n " );
135 clearCommandBuffer ();
140 int c
= getchar (); ( void ) c
;
153 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1000 )) {
158 uid
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 0 , 4 );
159 nt
= ( uint32_t ) bytes_to_num ( resp
. d
. asBytes
+ 4 , 4 );
160 par_list
= bytes_to_num ( resp
. d
. asBytes
+ 8 , 8 );
161 ks_list
= bytes_to_num ( resp
. d
. asBytes
+ 16 , 8 );
162 nr
= bytes_to_num ( resp
. d
. asBytes
+ 24 , 4 );
167 if ( par_list
== 0 && c
. arg
[ 0 ] == true ) {
168 PrintAndLog ( "Parity is all zero. Most likely this card sends NACK on every failed authentication." );
169 PrintAndLog ( "Attack will take a few seconds longer because we need two consecutive successful runs." );
173 keycount
= nonce2key ( uid
, nt
, nr
, par_list
, ks_list
, & keylist
);
176 PrintAndLog ( "Key not found (lfsr_common_prefix list is null). Nt=%08x" , nt
);
177 PrintAndLog ( "This is expected to happen in 25%% of all cases. Trying again with a different reader nonce..." );
182 qsort ( keylist
, keycount
, sizeof (* keylist
), compare_uint64
);
183 keycount
= intersection ( last_keylist
, keylist
);
186 last_keylist
= keylist
;
192 PrintAndLog ( "Found %u possible keys. Trying to authenticate with each of them ... \n " , keycount
);
194 PrintAndLog ( "Found a possible key. Trying to authenticate... \n " );
198 uint8_t keyBlock
[ USB_CMD_DATA_SIZE
];
199 int max_keys
= USB_CMD_DATA_SIZE
/ 6 ;
200 for ( int i
= 0 ; i
< keycount
; i
+= max_keys
) {
201 int size
= keycount
- i
> max_keys
? max_keys
: keycount
- i
;
202 for ( int j
= 0 ; j
< size
; j
++) {
204 num_to_bytes ( last_keylist
[ i
* max_keys
+ j
], 6 , keyBlock
);
206 num_to_bytes ( keylist
[ i
* max_keys
+ j
], 6 , keyBlock
);
209 if (! mfCheckKeys ( 0 , 0 , false , size
, keyBlock
, key
)) {
219 PrintAndLog ( "Authentication failed. Trying again..." );
221 last_keylist
= keylist
;
229 int mfCheckKeys ( uint8_t blockNo
, uint8_t keyType
, bool clear_trace
, uint8_t keycnt
, uint8_t * keyBlock
, uint64_t * key
){
233 UsbCommand c
= { CMD_MIFARE_CHKKEYS
, {(( blockNo
& 0xff ) | (( keyType
& 0xff ) << 8 )), clear_trace
, keycnt
}};
234 memcpy ( c
. d
. asBytes
, keyBlock
, 6 * keycnt
);
238 if (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 3000 )) return 1 ;
239 if (( resp
. arg
[ 0 ] & 0xff ) != 0x01 ) return 2 ;
240 * key
= bytes_to_num ( resp
. d
. asBytes
, 6 );
244 int mfCheckKeysSec ( uint8_t sectorCnt
, uint8_t keyType
, uint8_t timeout14a
, bool clear_trace
, uint8_t keycnt
, uint8_t * keyBlock
, sector_t
* e_sector
){
248 if ( e_sector
== NULL
)
251 UsbCommand c
= { CMD_MIFARE_CHKKEYS
, {(( sectorCnt
& 0xff ) | (( keyType
& 0xff ) << 8 )), ( clear_trace
| 0x02 )|(( timeout14a
& 0xff ) << 8 ), keycnt
}};
252 memcpy ( c
. d
. asBytes
, keyBlock
, 6 * keycnt
);
256 if (! WaitForResponseTimeoutW ( CMD_ACK
, & resp
, MAX ( 3000 , 1000 + 13 * sectorCnt
* keycnt
* ( keyType
== 2 ? 2 : 1 )), false )) return 1 ; // timeout: 13 ms / fail auth
257 if (( resp
. arg
[ 0 ] & 0xff ) != 0x01 ) return 2 ;
259 bool foundAKey
= false ;
260 for ( int sec
= 0 ; sec
< sectorCnt
; sec
++){
261 for ( int keyAB
= 0 ; keyAB
< 2 ; keyAB
++){
262 keyPtr
= *( resp
. d
. asBytes
+ keyAB
* 40 + sec
);
264 e_sector
[ sec
]. foundKey
[ keyAB
] = true ;
265 e_sector
[ sec
]. Key
[ keyAB
] = bytes_to_num ( keyBlock
+ ( keyPtr
- 1 ) * 6 , 6 );
270 return foundAKey
? 0 : 3 ;
273 // Compare 16 Bits out of cryptostate
274 int Compare16Bits ( const void * a
, const void * b
) {
275 if ((*( uint64_t *) b
& 0x00ff000000ff0000 ) == (*( uint64_t *) a
& 0x00ff000000ff0000 )) return 0 ;
276 else if ((*( uint64_t *) b
& 0x00ff000000ff0000 ) > (*( uint64_t *) a
& 0x00ff000000ff0000 )) return 1 ;
283 struct Crypto1State
* slhead
;
287 struct Crypto1State
* sltail
;
299 // wrapper function for multi-threaded lfsr_recovery32
300 void * nested_worker_thread ( void * arg
)
302 struct Crypto1State
* p1
;
303 StateList_t
* statelist
= arg
;
305 statelist
-> head
. slhead
= lfsr_recovery32 ( statelist
-> ks1
, statelist
-> nt
^ statelist
-> uid
);
306 for ( p1
= statelist
-> head
. slhead
; *( uint64_t *) p1
!= 0 ; p1
++);
307 statelist
-> len
= p1
- statelist
-> head
. slhead
;
308 statelist
-> tail
. sltail
= -- p1
;
309 qsort ( statelist
-> head
. slhead
, statelist
-> len
, sizeof ( uint64_t ), Compare16Bits
);
311 return statelist
-> head
. slhead
;
314 int mfnested ( uint8_t blockNo
, uint8_t keyType
, uint8_t * key
, uint8_t trgBlockNo
, uint8_t trgKeyType
, uint8_t * resultKey
, bool calibrate
)
320 StateList_t statelists
[ 2 ];
321 struct Crypto1State
* p1
, * p2
, * p3
, * p4
;
324 WaitForResponseTimeout ( CMD_ACK
, NULL
, 100 );
326 UsbCommand c
= { CMD_MIFARE_NESTED
, { blockNo
+ keyType
* 0x100 , trgBlockNo
+ trgKeyType
* 0x100 , calibrate
}};
327 memcpy ( c
. d
. asBytes
, key
, 6 );
330 if (! WaitForResponseTimeout ( CMD_ACK
, & resp
, 1500 )) {
335 return resp
. arg
[ 0 ]; // error during nested
338 memcpy (& uid
, resp
. d
. asBytes
, 4 );
339 PrintAndLog ( "uid:%08x trgbl=%d trgkey=%x" , uid
, ( uint16_t ) resp
. arg
[ 2 ] & 0xff , ( uint16_t ) resp
. arg
[ 2 ] >> 8 );
341 for ( i
= 0 ; i
< 2 ; i
++) {
342 statelists
[ i
]. blockNo
= resp
. arg
[ 2 ] & 0xff ;
343 statelists
[ i
]. keyType
= ( resp
. arg
[ 2 ] >> 8 ) & 0xff ;
344 statelists
[ i
]. uid
= uid
;
345 memcpy (& statelists
[ i
]. nt
, ( void *)( resp
. d
. asBytes
+ 4 + i
* 8 + 0 ), 4 );
346 memcpy (& statelists
[ i
]. ks1
, ( void *)( resp
. d
. asBytes
+ 4 + i
* 8 + 4 ), 4 );
351 pthread_t thread_id
[ 2 ];
353 // create and run worker threads
354 for ( i
= 0 ; i
< 2 ; i
++) {
355 pthread_create ( thread_id
+ i
, NULL
, nested_worker_thread
, & statelists
[ i
]);
358 // wait for threads to terminate:
359 for ( i
= 0 ; i
< 2 ; i
++) {
360 pthread_join ( thread_id
[ i
], ( void *)& statelists
[ i
]. head
. slhead
);
364 // the first 16 Bits of the cryptostate already contain part of our key.
365 // Create the intersection of the two lists based on these 16 Bits and
366 // roll back the cryptostate
367 p1
= p3
= statelists
[ 0 ]. head
. slhead
;
368 p2
= p4
= statelists
[ 1 ]. head
. slhead
;
369 while ( p1
<= statelists
[ 0 ]. tail
. sltail
&& p2
<= statelists
[ 1 ]. tail
. sltail
) {
370 if ( Compare16Bits ( p1
, p2
) == 0 ) {
371 struct Crypto1State savestate
, * savep
= & savestate
;
373 while ( Compare16Bits ( p1
, savep
) == 0 && p1
<= statelists
[ 0 ]. tail
. sltail
) {
375 lfsr_rollback_word ( p3
, statelists
[ 0 ]. nt
^ statelists
[ 0 ]. uid
, 0 );
380 while ( Compare16Bits ( p2
, savep
) == 0 && p2
<= statelists
[ 1 ]. tail
. sltail
) {
382 lfsr_rollback_word ( p4
, statelists
[ 1 ]. nt
^ statelists
[ 1 ]. uid
, 0 );
388 while ( Compare16Bits ( p1
, p2
) == - 1 ) p1
++;
389 while ( Compare16Bits ( p1
, p2
) == 1 ) p2
++;
394 statelists
[ 0 ]. len
= p3
- statelists
[ 0 ]. head
. slhead
;
395 statelists
[ 1 ]. len
= p4
- statelists
[ 1 ]. head
. slhead
;
396 statelists
[ 0 ]. tail
. sltail
=-- p3
;
397 statelists
[ 1 ]. tail
. sltail
=-- p4
;
399 // the statelists now contain possible keys. The key we are searching for must be in the
400 // intersection of both lists. Create the intersection:
401 qsort ( statelists
[ 0 ]. head
. keyhead
, statelists
[ 0 ]. len
, sizeof ( uint64_t ), compare_uint64
);
402 qsort ( statelists
[ 1 ]. head
. keyhead
, statelists
[ 1 ]. len
, sizeof ( uint64_t ), compare_uint64
);
403 statelists
[ 0 ]. len
= intersection ( statelists
[ 0 ]. head
. keyhead
, statelists
[ 1 ]. head
. keyhead
);
405 memset ( resultKey
, 0 , 6 );
406 // The list may still contain several key candidates. Test each of them with mfCheckKeys
407 for ( i
= 0 ; i
< statelists
[ 0 ]. len
; i
++) {
410 crypto1_get_lfsr ( statelists
[ 0 ]. head
. slhead
+ i
, & key64
);
411 num_to_bytes ( key64
, 6 , keyBlock
);
413 if (! mfCheckKeys ( statelists
[ 0 ]. blockNo
, statelists
[ 0 ]. keyType
, false , 1 , keyBlock
, & key64
)) {
414 num_to_bytes ( key64
, 6 , resultKey
);
419 free ( statelists
[ 0 ]. head
. slhead
);
420 free ( statelists
[ 1 ]. head
. slhead
);
427 int mfEmlGetMem ( uint8_t * data
, int blockNum
, int blocksCount
) {
428 UsbCommand c
= { CMD_MIFARE_EML_MEMGET
, { blockNum
, blocksCount
, 0 }};
432 if (! WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) return 1 ;
433 memcpy ( data
, resp
. d
. asBytes
, blocksCount
* 16 );
437 int mfEmlSetMem ( uint8_t * data
, int blockNum
, int blocksCount
) {
438 UsbCommand c
= { CMD_MIFARE_EML_MEMSET
, { blockNum
, blocksCount
, 0 }};
439 memcpy ( c
. d
. asBytes
, data
, blocksCount
* 16 );
446 int mfCGetBlock ( uint8_t blockNo
, uint8_t * data
, uint8_t params
) {
449 UsbCommand c
= { CMD_MIFARE_CGETBLOCK
, { params
, 0 , blockNo
}};
453 if ( WaitForResponseTimeout ( CMD_ACK
,& resp
, 1500 )) {
454 isOK
= resp
. arg
[ 0 ] & 0xff ;
455 memcpy ( data
, resp
. d
. asBytes
, 16 );
458 PrintAndLog ( "Command execute timeout" );
464 int mfCSetBlock ( uint8_t blockNo
, uint8_t * data
, uint8_t * uid
, bool wantWipe
, uint8_t params
) {
467 UsbCommand c
= { CMD_MIFARE_CSETBLOCK
, { wantWipe
, params
& ( 0xFE | ( uid
== NULL
? 0 : 1 )), blockNo
}};
468 memcpy ( c
. d
. asBytes
, data
, 16 );
472 if ( WaitForResponseTimeout ( CMD_ACK
, & resp
, 1500 )) {
473 isOK
= resp
. arg
[ 0 ] & 0xff ;
475 memcpy ( uid
, resp
. d
. asBytes
, 4 );
479 PrintAndLog ( "Command execute timeout" );
486 int mfCWipe ( uint32_t numSectors
, bool gen1b
, bool wantWipe
, bool wantFill
) {
488 uint8_t cmdParams
= wantWipe
+ wantFill
* 0x02 + gen1b
* 0x04 ;
489 UsbCommand c
= { CMD_MIFARE_CWIPE
, { numSectors
, cmdParams
, 0 }};
493 WaitForResponse ( CMD_ACK
,& resp
);
494 isOK
= resp
. arg
[ 0 ] & 0xff ;
499 int mfCSetUID ( uint8_t * uid
, uint8_t * atqa
, uint8_t * sak
, uint8_t * oldUID
) {
500 uint8_t oldblock0
[ 16 ] = { 0x00 };
501 uint8_t block0
[ 16 ] = { 0x00 };
506 /* generation 1a magic card by default */
507 uint8_t cmdParams
= CSETBLOCK_SINGLE_OPER
;
509 /* generation 1b magic card */
510 cmdParams
= CSETBLOCK_SINGLE_OPER
| CSETBLOCK_MAGIC_1B
;
513 res
= mfCGetBlock ( 0 , oldblock0
, cmdParams
);
516 memcpy ( block0
, oldblock0
, 16 );
517 PrintAndLog ( "old block 0: %s" , sprint_hex ( block0
, 16 ));
519 PrintAndLog ( "Couldn't get old data. Will write over the last bytes of Block 0." );
522 // fill in the new values
524 memcpy ( block0
, uid
, 4 );
526 block0
[ 4 ] = block0
[ 0 ] ^ block0
[ 1 ] ^ block0
[ 2 ] ^ block0
[ 3 ];
527 // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)
534 PrintAndLog ( "new block 0: %s" , sprint_hex ( block0
, 16 ));
536 res
= mfCSetBlock ( 0 , block0
, oldUID
, false , cmdParams
);
538 PrintAndLog ( "Can't set block 0. Error: %d" , res
);
546 UsbCommand c
= { CMD_MIFARE_CIDENT
, { 0 , 0 , 0 }};
549 WaitForResponse ( CMD_ACK
,& resp
);
551 uint8_t isGeneration
= resp
. arg
[ 0 ] & 0xff ;
552 switch ( isGeneration
){
553 case 1 : PrintAndLog ( "Chinese magic backdoor commands (GEN 1a) detected" ); break ;
554 case 2 : PrintAndLog ( "Chinese magic backdoor command (GEN 1b) detected" ); break ;
555 default : PrintAndLog ( "No chinese magic backdoor command detected" ); break ;
558 return ( int ) isGeneration
;
565 static uint8_t trailerAccessBytes
[ 4 ] = { 0x08 , 0x77 , 0x8F , 0x00 };
568 char logHexFileName
[ FILE_PATH_SIZE
] = { 0x00 };
569 static uint8_t traceCard
[ 4096 ] = { 0x00 };
570 static char traceFileName
[ FILE_PATH_SIZE
] = { 0x00 };
571 static int traceState
= TRACE_IDLE
;
572 static uint8_t traceCurBlock
= 0 ;
573 static uint8_t traceCurKey
= 0 ;
575 struct Crypto1State
* traceCrypto1
= NULL
;
577 struct Crypto1State
* revstate
;
582 uint32_t uid
; // serial number
583 uint32_t nt
; // tag challenge
584 uint32_t nr_enc
; // encrypted reader challenge
585 uint32_t ar_enc
; // encrypted reader response
586 uint32_t at_enc
; // encrypted tag response
588 int isTraceCardEmpty ( void ) {
589 return (( traceCard
[ 0 ] == 0 ) && ( traceCard
[ 1 ] == 0 ) && ( traceCard
[ 2 ] == 0 ) && ( traceCard
[ 3 ] == 0 ));
592 int isBlockEmpty ( int blockN
) {
593 for ( int i
= 0 ; i
< 16 ; i
++)
594 if ( traceCard
[ blockN
* 16 + i
] != 0 ) return 0 ;
599 int isBlockTrailer ( int blockN
) {
600 return (( blockN
& 0x03 ) == 0x03 );
603 int saveTraceCard ( void ) {
606 if ((! strlen ( traceFileName
)) || ( isTraceCardEmpty ())) return 0 ;
608 f
= fopen ( traceFileName
, "w+" );
611 for ( int i
= 0 ; i
< 64 ; i
++) { // blocks
612 for ( int j
= 0 ; j
< 16 ; j
++) // bytes
613 fprintf ( f
, "%02x" , *( traceCard
+ i
* 16 + j
));
621 int loadTraceCard ( uint8_t * tuid
) {
623 char buf
[ 64 ] = { 0x00 };
624 uint8_t buf8
[ 64 ] = { 0x00 };
627 if (! isTraceCardEmpty ())
630 memset ( traceCard
, 0x00 , 4096 );
631 memcpy ( traceCard
, tuid
+ 3 , 4 );
633 FillFileNameByUID ( traceFileName
, tuid
, ".eml" , 7 );
635 f
= fopen ( traceFileName
, "r" );
642 memset ( buf
, 0 , sizeof ( buf
));
643 if ( fgets ( buf
, sizeof ( buf
), f
) == NULL
) {
644 PrintAndLog ( "File reading error." );
649 if ( strlen ( buf
) < 32 ){
651 PrintAndLog ( "File content error. Block data must include 32 HEX symbols" );
655 for ( i
= 0 ; i
< 32 ; i
+= 2 )
656 sscanf (& buf
[ i
], "%02x" , ( unsigned int *)& buf8
[ i
/ 2 ]);
658 memcpy ( traceCard
+ blockNum
* 16 , buf8
, 16 );
667 int mfTraceInit ( uint8_t * tuid
, uint8_t * atqa
, uint8_t sak
, bool wantSaveToEmlFile
) {
670 crypto1_destroy ( traceCrypto1
);
674 if ( wantSaveToEmlFile
)
677 traceCard
[ 4 ] = traceCard
[ 0 ] ^ traceCard
[ 1 ] ^ traceCard
[ 2 ] ^ traceCard
[ 3 ];
679 memcpy (& traceCard
[ 6 ], atqa
, 2 );
681 uid
= bytes_to_num ( tuid
+ 3 , 4 );
683 traceState
= TRACE_IDLE
;
688 void mf_crypto1_decrypt ( struct Crypto1State
* pcs
, uint8_t * data
, int len
, bool isEncrypted
){
693 for ( i
= 0 ; i
< len
; i
++)
694 data
[ i
] = crypto1_byte ( pcs
, 0x00 , isEncrypted
) ^ data
[ i
];
697 for ( i
= 0 ; i
< 4 ; i
++)
698 bt
|= ( crypto1_bit ( pcs
, 0 , isEncrypted
) ^ BIT ( data
[ 0 ], i
)) << i
;
706 int mfTraceDecode ( uint8_t * data_src
, int len
, bool wantSaveToEmlFile
) {
709 if ( traceState
== TRACE_ERROR
) return 1 ;
711 traceState
= TRACE_ERROR
;
715 memcpy ( data
, data_src
, len
);
716 if (( traceCrypto1
) && (( traceState
== TRACE_IDLE
) || ( traceState
> TRACE_AUTH_OK
))) {
717 mf_crypto1_decrypt ( traceCrypto1
, data
, len
, 0 );
718 PrintAndLog ( "dec> %s" , sprint_hex ( data
, len
));
719 AddLogHex ( logHexFileName
, "dec> " , data
, len
);
722 switch ( traceState
) {
724 // check packet crc16!
725 if (( len
>= 4 ) && (! CheckCrc14443 ( CRC_14443_A
, data
, len
))) {
726 PrintAndLog ( "dec> CRC ERROR!!!" );
727 AddLogLine ( logHexFileName
, "dec> " , "CRC ERROR!!!" );
728 traceState
= TRACE_ERROR
; // do not decrypt the next commands
733 if (( len
== 4 ) && (( data
[ 0 ] == 0x60 ) || ( data
[ 0 ] == 0x61 ))) {
734 traceState
= TRACE_AUTH1
;
735 traceCurBlock
= data
[ 1 ];
736 traceCurKey
= data
[ 0 ] == 60 ? 1 : 0 ;
741 if (( len
== 4 ) && (( data
[ 0 ] == 0x30 ))) {
742 traceState
= TRACE_READ_DATA
;
743 traceCurBlock
= data
[ 1 ];
748 if (( len
== 4 ) && (( data
[ 0 ] == 0xA0 ))) {
749 traceState
= TRACE_WRITE_OK
;
750 traceCurBlock
= data
[ 1 ];
755 if (( len
== 4 ) && (( data
[ 0 ] == 0x50 ) && ( data
[ 1 ] == 0x00 ))) {
756 traceState
= TRACE_ERROR
; // do not decrypt the next commands
763 case TRACE_READ_DATA
:
765 traceState
= TRACE_IDLE
;
767 if ( isBlockTrailer ( traceCurBlock
)) {
768 memcpy ( traceCard
+ traceCurBlock
* 16 + 6 , data
+ 6 , 4 );
770 memcpy ( traceCard
+ traceCurBlock
* 16 , data
, 16 );
772 if ( wantSaveToEmlFile
) saveTraceCard ();
775 traceState
= TRACE_ERROR
;
781 if (( len
== 1 ) && ( data
[ 0 ] == 0x0a )) {
782 traceState
= TRACE_WRITE_DATA
;
786 traceState
= TRACE_ERROR
;
791 case TRACE_WRITE_DATA
:
793 traceState
= TRACE_IDLE
;
795 memcpy ( traceCard
+ traceCurBlock
* 16 , data
, 16 );
796 if ( wantSaveToEmlFile
) saveTraceCard ();
799 traceState
= TRACE_ERROR
;
806 traceState
= TRACE_AUTH2
;
807 nt
= bytes_to_num ( data
, 4 );
810 traceState
= TRACE_ERROR
;
817 traceState
= TRACE_AUTH_OK
;
819 nr_enc
= bytes_to_num ( data
, 4 );
820 ar_enc
= bytes_to_num ( data
+ 4 , 4 );
823 traceState
= TRACE_ERROR
;
830 traceState
= TRACE_IDLE
;
833 at_enc
= bytes_to_num ( data
, 4 );
836 ks2
= ar_enc
^ prng_successor ( nt
, 64 );
837 ks3
= at_enc
^ prng_successor ( nt
, 96 );
838 revstate
= lfsr_recovery64 ( ks2
, ks3
);
839 lfsr_rollback_word ( revstate
, 0 , 0 );
840 lfsr_rollback_word ( revstate
, 0 , 0 );
841 lfsr_rollback_word ( revstate
, nr_enc
, 1 );
842 lfsr_rollback_word ( revstate
, uid
^ nt
, 0 );
844 crypto1_get_lfsr ( revstate
, & lfsr
);
845 printf ( "key> %x%x \n " , ( unsigned int )(( lfsr
& 0xFFFFFFFF00000000 ) >> 32 ), ( unsigned int )( lfsr
& 0xFFFFFFFF ));
846 AddLogUint64 ( logHexFileName
, "key> " , lfsr
);
848 printf ( "key> nested not implemented! \n " );
849 at_enc
= bytes_to_num ( data
, 4 );
851 crypto1_destroy ( traceCrypto1
);
854 traceState
= TRACE_ERROR
;
857 int blockShift
= (( traceCurBlock
& 0xFC ) + 3 ) * 16 ;
858 if ( isBlockEmpty (( traceCurBlock
& 0xFC ) + 3 )) memcpy ( traceCard
+ blockShift
+ 6 , trailerAccessBytes
, 4 );
861 num_to_bytes ( lfsr
, 6 , traceCard
+ blockShift
+ 10 );
863 num_to_bytes ( lfsr
, 6 , traceCard
+ blockShift
);
865 if ( wantSaveToEmlFile
) saveTraceCard ();
868 crypto1_destroy ( traceCrypto1
);
871 // set cryptosystem state
872 traceCrypto1
= lfsr_recovery64 ( ks2
, ks3
);
875 traceState
= TRACE_ERROR
;
881 traceState
= TRACE_ERROR
;
890 int tryDecryptWord ( uint32_t nt
, uint32_t ar_enc
, uint32_t at_enc
, uint8_t * data
, int len
){
892 uint32_t nt; // tag challenge
893 uint32_t ar_enc; // encrypted reader response
894 uint32_t at_enc; // encrypted tag response
897 crypto1_destroy ( traceCrypto1
);
899 ks2
= ar_enc
^ prng_successor ( nt
, 64 );
900 ks3
= at_enc
^ prng_successor ( nt
, 96 );
901 traceCrypto1
= lfsr_recovery64 ( ks2
, ks3
);
903 mf_crypto1_decrypt ( traceCrypto1
, data
, len
, 0 );
905 PrintAndLog ( "Decrypted data: [%s]" , sprint_hex ( data
, len
) );
906 crypto1_destroy ( traceCrypto1
);
910 /** validate_prng_nonce
911 * Determine if nonce is deterministic. ie: Suspectable to Darkside attack.
914 * false = hardend prng
916 bool validate_prng_nonce ( uint32_t nonce
) {
920 dist
= malloc ( 2 << 16 );
925 for ( x
= i
= 1 ; i
; ++ i
) {
926 dist
[( x
& 0xff ) << 8 | x
>> 8 ] = i
;
927 x
= x
>> 1 | ( x
^ x
>> 2 ^ x
>> 3 ^ x
>> 5 ) << 15 ;
930 uint32_t res
= ( 65535 - dist
[ nonce
>> 16 ] + dist
[ nonce
& 0xffff ]) % 65535 ;
937 * function performs a partial AUTH, where it tries to authenticate against block0, key A, but only collects tag nonce.
938 * the tag nonce is check to see if it has a predictable PRNG.
940 * TRUE if tag uses WEAK prng (ie Now the NACK bug also needs to be present for Darkside attack)
941 * FALSE is tag uses HARDEND prng (ie hardnested attack possible, with known key)
943 int DetectClassicPrng ( void ){
945 UsbCommand resp
, respA
;
946 uint8_t cmd
[] = { 0x60 , 0x00 }; // MIFARE_AUTH_KEYA
947 uint32_t flags
= ISO14A_CONNECT
| ISO14A_RAW
| ISO14A_APPEND_CRC
| ISO14A_NO_RATS
;
949 UsbCommand c
= { CMD_READER_ISO_14443a
, { flags
, sizeof ( cmd
), 0 }};
950 memcpy ( c
. d
. asBytes
, cmd
, sizeof ( cmd
));
952 clearCommandBuffer ();
954 if (! WaitForResponseTimeout ( CMD_ACK
, & resp
, 2000 )) {
955 PrintAndLog ( "PRNG UID: Reply timeout." );
959 // if select tag failed.
960 if ( resp
. arg
[ 0 ] == 0 ) {
961 PrintAndLog ( "PRNG error: selecting tag failed, can't detect prng." );
965 if (! WaitForResponseTimeout ( CMD_ACK
, & respA
, 5000 )) {
966 PrintAndLog ( "PRNG data: Reply timeout." );
971 if ( respA
. arg
[ 0 ] != 4 ) {
972 PrintAndLog ( "PRNG data error: Wrong length: %d" , respA
. arg
[ 0 ]);
976 uint32_t nonce
= bytes_to_num ( respA
. d
. asBytes
, respA
. arg
[ 0 ]);
977 return validate_prng_nonce ( nonce
);