git.zerfleddert.de Git - proxmark3-svn/blobdiff

index 72e70662a16f5486bcf6751da25e1574ae86c2c1..4abb1137c41d0baf045f2d5e8fed9109cedb7873 100644 (file)

--- a/client/mifarehost.c

+++ b/client/mifarehost.c

@@ -26,8 +26,6 @@ int compar_int(const void * a, const void * b) {

else return -1;\r

}\r

else return -1;\r

}\r

-\r

// Compare 16 Bits out of cryptostate\r

int Compare16Bits(const void * a, const void * b) {\r

if ((*(uint64_t*)b & 0x00ff000000ff0000) == (*(uint64_t*)a & 0x00ff000000ff0000)) return 0;\r

// Compare 16 Bits out of cryptostate\r

int Compare16Bits(const void * a, const void * b) {\r

if ((*(uint64_t*)b & 0x00ff000000ff0000) == (*(uint64_t*)a & 0x00ff000000ff0000)) return 0;\r

@@ -35,7 +33,6 @@ int Compare16Bits(const void * a, const void * b) {

else return -1;\r

}\r

else return -1;\r

}\r

-\r

typedef \r

struct {\r

union {\r

typedef \r

struct {\r

union {\r

@@ -70,45 +67,39 @@ void* nested_worker_thread(void *arg)

return statelist->head.slhead;\r

}\r

return statelist->head.slhead;\r

}\r

-\r

int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * resultKey, bool calibrate) \r

{\r

int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * resultKey, bool calibrate) \r

{\r

- uint16_t i, len;\r

+ uint16_t i;\r

uint32_t uid;\r

UsbCommand resp;\r

uint32_t uid;\r

UsbCommand resp;\r

- \r

StateList_t statelists[2];\r

struct Crypto1State *p1, *p2, *p3, *p4;\r

// flush queue\r

StateList_t statelists[2];\r

struct Crypto1State *p1, *p2, *p3, *p4;\r

// flush queue\r

- WaitForResponseTimeout(CMD_ACK,NULL,100);\r

+ WaitForResponseTimeout(CMD_ACK, NULL, 100);\r

UsbCommand c = {CMD_MIFARE_NESTED, {blockNo + keyType * 0x100, trgBlockNo + trgKeyType * 0x100, calibrate}};\r

memcpy(c.d.asBytes, key, 6);\r

SendCommand(&c);\r

UsbCommand c = {CMD_MIFARE_NESTED, {blockNo + keyType * 0x100, trgBlockNo + trgKeyType * 0x100, calibrate}};\r

memcpy(c.d.asBytes, key, 6);\r

SendCommand(&c);\r

- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r

- len = resp.arg[1];\r

- if (len == 2) { \r

- memcpy(&uid, resp.d.asBytes, 4);\r

- PrintAndLog("uid:%08x len=%d trgbl=%d trgkey=%x", uid, len, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8);\r

- \r

- for (i = 0; i < 2; i++) {\r

- statelists[i].blockNo = resp.arg[2] & 0xff;\r

- statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;\r

- statelists[i].uid = uid;\r

+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {\r

+ return -1;\r

+ }\r

- memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);\r

- memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);\r

- }\r

- else {\r

- PrintAndLog("Got 0 keys from proxmark."); \r

- return 1;\r

- }\r

+ if (resp.arg[0]) {\r

+ return resp.arg[0]; // error during nested\r

+ }\r

+ \r

+ memcpy(&uid, resp.d.asBytes, 4);\r

+ PrintAndLog("uid:%08x trgbl=%d trgkey=%x", uid, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8);\r

+ \r

+ for (i = 0; i < 2; i++) {\r

+ statelists[i].blockNo = resp.arg[2] & 0xff;\r

+ statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;\r

+ statelists[i].uid = uid;\r

+ memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);\r

+ memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);\r

}\r

// calc keys\r

}\r

// calc keys\r

@@ -190,7 +181,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo

crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);\r

num_to_bytes(key64, 6, keyBlock);\r

key64 = 0;\r

crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);\r

num_to_bytes(key64, 6, keyBlock);\r

key64 = 0;\r

- if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, 1, keyBlock, &key64)) {\r

+ if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, false, 1, keyBlock, &key64)) {\r

num_to_bytes(key64, 6, resultKey);\r

break;\r

}\r

num_to_bytes(key64, 6, resultKey);\r

break;\r

}\r

@@ -202,11 +193,11 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo

return 0;\r

}\r

return 0;\r

}\r

-int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){\r

+int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){\r

*key = 0;\r

- UsbCommand c = {CMD_MIFARE_CHKKEYS, {blockNo, keyType, keycnt}};\r

+ UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType&0xff)<<8)), clear_trace, keycnt}};\r

memcpy(c.d.asBytes, keyBlock, 6 * keycnt);\r

SendCommand(&c);\r

memcpy(c.d.asBytes, keyBlock, 6 * keycnt);\r

SendCommand(&c);\r

@@ -238,31 +229,48 @@ int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {

// "MAGIC" CARD\r

-int mfCSetUID(uint8_t *uid, uint8_t *oldUID, int wantWipe) {\r

- uint8_t block0[16];\r

- memset(block0, 0, 16);\r

+int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe) {\r

+ uint8_t oldblock0[16] = {0x00};\r

+ uint8_t block0[16] = {0x00};\r

+\r

+ int old = mfCGetBlock(0, oldblock0, CSETBLOCK_SINGLE_OPER);\r

+ if (old == 0) {\r

+ memcpy(block0, oldblock0, 16);\r

+ PrintAndLog("old block 0: %s", sprint_hex(block0,16));\r

+ } else {\r

+ PrintAndLog("Couldn't get old data. Will write over the last bytes of Block 0.");\r

+ }\r

+\r

+ // fill in the new values\r

+ // UID\r

memcpy(block0, uid, 4); \r

- block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // Mifare UID BCC\r

- // mifare classic SAK(byte 5) and ATQA(byte 6 and 7)\r

- block0[5] = 0x88;\r

- block0[6] = 0x04;\r

- block0[7] = 0x00;\r

- \r

+ // Mifare UID BCC\r

+ block0[4] = block0[0]^block0[1]^block0[2]^block0[3];\r

+ // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)\r

+ if (sak!=NULL)\r

+ block0[5]=sak[0];\r

+ if (atqa!=NULL) {\r

+ block0[6]=atqa[1];\r

+ block0[7]=atqa[0];\r

+ }\r

+ PrintAndLog("new block 0: %s", sprint_hex(block0,16));\r

return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER);\r

}\r

return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER);\r

}\r

-int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, int wantWipe, uint8_t params) {\r

- uint8_t isOK = 0;\r

+int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params) {\r

- UsbCommand c = {CMD_MIFARE_EML_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};\r

+ uint8_t isOK = 0;\r

+ UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};\r

memcpy(c.d.asBytes, data, 16); \r

SendCommand(&c);\r

UsbCommand resp;\r

if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r

isOK = resp.arg[0] & 0xff;\r

memcpy(c.d.asBytes, data, 16); \r

SendCommand(&c);\r

UsbCommand resp;\r

if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r

isOK = resp.arg[0] & 0xff;\r

- if (uid != NULL) memcpy(uid, resp.d.asBytes, 4);\r

- if (!isOK) return 2;\r

+ if (uid != NULL) \r

+ memcpy(uid, resp.d.asBytes, 4);\r

+ if (!isOK) \r

+ return 2;\r

} else {\r

PrintAndLog("Command execute timeout");\r

return 1;\r

} else {\r

PrintAndLog("Command execute timeout");\r

return 1;\r

@@ -273,7 +281,7 @@ int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, int wantWipe, uint

int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {\r

uint8_t isOK = 0;\r

int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {\r

uint8_t isOK = 0;\r

- UsbCommand c = {CMD_MIFARE_EML_CGETBLOCK, {params, 0, blockNo}};\r

+ UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}};\r

SendCommand(&c);\r

UsbCommand resp;\r

SendCommand(&c);\r

UsbCommand resp;\r

@@ -294,9 +302,9 @@ int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {

static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};\r

// variables\r

static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};\r

// variables\r

-char logHexFileName[200] = {0x00};\r

+char logHexFileName[FILE_PATH_SIZE] = {0x00};\r

static uint8_t traceCard[4096] = {0x00};\r

-static char traceFileName[200] = {0};\r

+static char traceFileName[FILE_PATH_SIZE] = {0x00};\r

static int traceState = TRACE_IDLE;\r

static uint8_t traceCurBlock = 0;\r

static uint8_t traceCurKey = 0;\r

static int traceState = TRACE_IDLE;\r

static uint8_t traceCurBlock = 0;\r

static uint8_t traceCurKey = 0;\r

@@ -310,12 +318,9 @@ uint32_t ks3;

uint32_t uid; // serial number\r

uint32_t nt; // tag challenge\r

uint32_t uid; // serial number\r

uint32_t nt; // tag challenge\r

-uint32_t nt_par; \r

uint32_t nr_enc; // encrypted reader challenge\r

uint32_t ar_enc; // encrypted reader response\r

uint32_t nr_enc; // encrypted reader challenge\r

uint32_t ar_enc; // encrypted reader response\r

-uint32_t nr_ar_par; \r

uint32_t at_enc; // encrypted tag response\r

-uint32_t at_par; \r

int isTraceCardEmpty(void) {\r

return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));\r

int isTraceCardEmpty(void) {\r

return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));\r

@@ -334,29 +339,36 @@ int isBlockTrailer(int blockN) {

int loadTraceCard(uint8_t *tuid) {\r

FILE * f;\r

int loadTraceCard(uint8_t *tuid) {\r

FILE * f;\r

- char buf[64];\r

- uint8_t buf8[64];\r

+ char buf[64] = {0x00};\r

+ uint8_t buf8[64] = {0x00};\r

int i, blockNum;\r

- if (!isTraceCardEmpty()) saveTraceCard();\r

+ if (!isTraceCardEmpty()) \r

+ saveTraceCard();\r

+ \r

memset(traceCard, 0x00, 4096);\r

memcpy(traceCard, tuid + 3, 4);\r

memset(traceCard, 0x00, 4096);\r

memcpy(traceCard, tuid + 3, 4);\r

+\r

FillFileNameByUID(traceFileName, tuid, ".eml", 7);\r

f = fopen(traceFileName, "r");\r

if (!f) return 1;\r

blockNum = 0;\r

FillFileNameByUID(traceFileName, tuid, ".eml", 7);\r

f = fopen(traceFileName, "r");\r

if (!f) return 1;\r

blockNum = 0;\r

+ \r

while(!feof(f)){\r

+ \r

memset(buf, 0, sizeof(buf));\r

if (fgets(buf, sizeof(buf), f) == NULL) {\r

memset(buf, 0, sizeof(buf));\r

if (fgets(buf, sizeof(buf), f) == NULL) {\r

- PrintAndLog("File reading error.");\r

+ PrintAndLog("File reading error.");\r

+ fclose(f);\r

return 2;\r

- }\r

+ }\r

if (strlen(buf) < 32){\r

if (feof(f)) break;\r

PrintAndLog("File content error. Block data must include 32 HEX symbols");\r

if (strlen(buf) < 32){\r

if (feof(f)) break;\r

PrintAndLog("File content error. Block data must include 32 HEX symbols");\r

+ fclose(f);\r

return 2;\r

}\r

for (i = 0; i < 32; i += 2)\r

return 2;\r

}\r

for (i = 0; i < 32; i += 2)\r

@@ -377,22 +389,27 @@ int saveTraceCard(void) {

if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;\r

f = fopen(traceFileName, "w+");\r

if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;\r

f = fopen(traceFileName, "w+");\r

+ if ( !f ) return 1;\r

+ \r

for (int i = 0; i < 64; i++) { // blocks\r

for (int j = 0; j < 16; j++) // bytes\r

fprintf(f, "%02x", *(traceCard + i * 16 + j)); \r

fprintf(f,"\n");\r

}\r

fclose(f);\r

for (int i = 0; i < 64; i++) { // blocks\r

for (int j = 0; j < 16; j++) // bytes\r

fprintf(f, "%02x", *(traceCard + i * 16 + j)); \r

fprintf(f,"\n");\r

}\r

fclose(f);\r

-\r

return 0;\r

}\r

int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {\r

return 0;\r

}\r

int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {\r

- if (traceCrypto1) crypto1_destroy(traceCrypto1);\r

+ if (traceCrypto1) \r

+ crypto1_destroy(traceCrypto1);\r

+\r

traceCrypto1 = NULL;\r

- if (wantSaveToEmlFile) loadTraceCard(tuid);\r

+ if (wantSaveToEmlFile) \r

+ loadTraceCard(tuid);\r

+ \r

traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];\r

traceCard[5] = sak;\r

memcpy(&traceCard[6], atqa, 2);\r

traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];\r

traceCard[5] = sak;\r

memcpy(&traceCard[6], atqa, 2);\r

@@ -422,7 +439,7 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool i

}\r

-int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEmlFile) {\r

+int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {\r

uint8_t data[64];\r

if (traceState == TRACE_ERROR) return 1;\r

uint8_t data[64];\r

if (traceState == TRACE_ERROR) return 1;\r

@@ -523,9 +540,7 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm

case TRACE_AUTH1: \r

if (len == 4) {\r

traceState = TRACE_AUTH2;\r

case TRACE_AUTH1: \r

if (len == 4) {\r

traceState = TRACE_AUTH2;\r

-\r

nt = bytes_to_num(data, 4);\r

- nt_par = parity;\r

return 0;\r

} else {\r

traceState = TRACE_ERROR;\r

return 0;\r

} else {\r

traceState = TRACE_ERROR;\r

@@ -539,7 +554,6 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm

nr_enc = bytes_to_num(data, 4);\r

ar_enc = bytes_to_num(data + 4, 4);\r

nr_enc = bytes_to_num(data, 4);\r

ar_enc = bytes_to_num(data + 4, 4);\r

- nr_ar_par = parity;\r

return 0;\r

} else {\r

traceState = TRACE_ERROR;\r

return 0;\r

} else {\r

traceState = TRACE_ERROR;\r

@@ -552,7 +566,6 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm

traceState = TRACE_IDLE;\r

at_enc = bytes_to_num(data, 4);\r

traceState = TRACE_IDLE;\r

at_enc = bytes_to_num(data, 4);\r

- at_par = parity;\r

// decode key here)\r

ks2 = ar_enc ^ prng_successor(nt, 64);\r

// decode key here)\r

ks2 = ar_enc ^ prng_successor(nt, 64);\r

@@ -562,6 +575,7 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm

lfsr_rollback_word(revstate, 0, 0);\r

lfsr_rollback_word(revstate, nr_enc, 1);\r

lfsr_rollback_word(revstate, uid ^ nt, 0);\r

lfsr_rollback_word(revstate, 0, 0);\r

lfsr_rollback_word(revstate, nr_enc, 1);\r

lfsr_rollback_word(revstate, uid ^ nt, 0);\r

+\r

crypto1_get_lfsr(revstate, &lfsr);\r

printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r

AddLogUint64(logHexFileName, "key> ", lfsr); \r

crypto1_get_lfsr(revstate, &lfsr);\r

printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r

AddLogUint64(logHexFileName, "key> ", lfsr); \r

@@ -605,3 +619,23 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm

return 0;\r

}\r

return 0;\r

}\r

+\r

+int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){\r

+ /*\r

+ uint32_t nt; // tag challenge\r

+ uint32_t ar_enc; // encrypted reader response\r

+ uint32_t at_enc; // encrypted tag response\r

+ */\r

+ if (traceCrypto1) {\r

+ crypto1_destroy(traceCrypto1);\r

+ }\r

+ ks2 = ar_enc ^ prng_successor(nt, 64);\r

+ ks3 = at_enc ^ prng_successor(nt, 96);\r

+ traceCrypto1 = lfsr_recovery64(ks2, ks3);\r

+\r

+ mf_crypto1_decrypt(traceCrypto1, data, len, 0);\r

+\r

+ PrintAndLog("Decrypted data: [%s]", sprint_hex(data,len) );\r

+ crypto1_destroy(traceCrypto1);\r

+ return 0;\r

+}\r