X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/d433698311f055d0f804c4009936e7d325ae5815..1c07ca92c3b9338697a0f2fc0e41790164815aeb:/client/nonce2key/nonce2key.c diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c index aeaecbe6..fa734144 100644 --- a/client/nonce2key/nonce2key.c +++ b/client/nonce2key/nonce2key.c @@ -19,7 +19,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_ // Reset the last three significant bits of the reader nonce nr &= 0xffffff1f; - PrintAndLog("uid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08x)\n", uid, nt, par_info, ks_info, nr); + PrintAndLog("uid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08x)", uid, nt, par_info, ks_info, nr); for ( pos = 0; pos < 8; pos++ ) { ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f; @@ -30,17 +30,19 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_ } } - printf("+----+--------+---+-----+---------------+\n"); - printf("|diff|{nr} |ks3|ks3^5|parity |\n"); - printf("+----+--------+---+-----+---------------+\n"); + PrintAndLog("+----+--------+---+-----+---------------+"); + PrintAndLog("|diff|{nr} |ks3|ks3^5|parity |"); + PrintAndLog("+----+--------+---+-----+---------------+"); for ( i = 0; i < 8; i++) { nr_diff = nr | i << 5; - printf("| %02x |%08x| %01x | %01x |", i << 5, nr_diff, ks3x[i], ks3x[i]^5); - for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]); - printf("%01x|\n", par[i][7]); + PrintAndLog("| %02x |%08x| %01x | %01x |%01x,%01x,%01x,%01x,%01x,%01x,%01x,%01x|", + i << 5, nr_diff, ks3x[i], ks3x[i]^5, + par[i][0], par[i][1], par[i][2], par[i][3], + par[i][4], par[i][5], par[i][6], par[i][7]); + } - printf("+----+--------+---+-----+---------------+\n"); + PrintAndLog("+----+--------+---+-----+---------------+"); clock_t t1 = clock(); @@ -50,19 +52,23 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_ crypto1_destroy(state); t1 = clock() - t1; - if ( t1 > 0 ) PrintAndLog("Time in nonce2key: %.0f ticks \n", (float)t1); + if ( t1 > 0 ) PrintAndLog("Time in nonce2key: %.0f ticks", (float)t1); return 0; } +int compar_intA(const void * a, const void * b) { + if (*(int64_t*)b == *(int64_t*)a) return 0; + if (*(int64_t*)b > *(int64_t*)a) return 1; + return -1; +} + // call when PAR == 0, special attack? It seems to need two calls. with same uid, block, keytype int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) { struct Crypto1State *state; uint32_t i, pos, key_count; - byte_t ks3x[8]; - + uint8_t ks3x[8]; uint64_t key_recovered; - int64_t *state_s; static uint8_t last_blockno; static uint8_t last_keytype; @@ -83,58 +89,70 @@ int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, ui // Reset the last three significant bits of the reader nonce nr &= 0xffffff1f; - - PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr); + // split keystream into array for (pos=0; pos<8; pos++) { ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f; } - - PrintAndLog("parity is all zero, try special attack. Just wait for few more seconds..."); - + + // find possible states for this keystream state = lfsr_common_prefix_ex(nr, ks3x); + + if (!state) { + PrintAndLog("Failed getting states"); + return 1; + } + state_s = (int64_t*)state; + uint32_t xored = uid ^ nt; + for (i = 0; (state) && ((state + i)->odd != -1); i++) { - lfsr_rollback_word(state + i, uid ^ nt, 0); + lfsr_rollback_word(state + i, xored, 0); crypto1_get_lfsr(state + i, &key_recovered); *(state_s + i) = key_recovered; } - - if(!state) - return 1; - - qsort(state_s, i, sizeof(*state_s), compar_int); + + qsort(state_s, i, sizeof(int64_t), compar_intA); *(state_s + i) = -1; - //Create the intersection: - if ( last_keylist != NULL) { + // first call to this function. clear all other stuff and set new found states. + if (last_keylist == NULL) { + free(last_keylist); + last_keylist = state_s; + PrintAndLog("parity is all zero, testing special attack. First call, this attack needs at least two calls. Hold on..."); + PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)", uid, nt, ks_info, nr); + return 1; + } - int64_t *p1, *p2, *p3; - p1 = p3 = last_keylist; - p2 = state_s; + PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)", uid, nt, ks_info, nr); + + //Create the intersection: + int64_t *p1, *p2, *p3; + p1 = p3 = last_keylist; + p2 = state_s; - while ( *p1 != -1 && *p2 != -1 ) { - if (compar_int(p1, p2) == 0) { - printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1); - *p3++ = *p1++; - p2++; - } - else { - while (compar_int(p1, p2) == -1) ++p1; - while (compar_int(p1, p2) == 1) ++p2; - } + while ( *p1 != -1 && *p2 != -1 ) { + if (compar_intA(p1, p2) == 0) { + PrintAndLog("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx,(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1); + *p3++ = *p1++; + p2++; + } + else { + while (compar_intA(p1, p2) == -1) ++p1; + while (compar_intA(p1, p2) == 1) ++p2; } - key_count = p3 - last_keylist; - PrintAndLog("one A"); - } else { - key_count = 0; - PrintAndLog("one B"); } - - printf("key_count:%d\n", key_count); + key_count = p3 - last_keylist; + PrintAndLog("key_count: %d", key_count); + if ( key_count == 0 ){ + free(state); + state = NULL; + return 0; + } - // The list may still contain several key candidates. Test each of them with mfCheckKeys + uint8_t retval = 1; + // Validate all key candidates with testing each of them with mfCheckKeys uint8_t keyBlock[6] = {0,0,0,0,0,0}; uint64_t key64; for (i = 0; i < key_count; i++) { @@ -143,20 +161,21 @@ int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, ui key64 = 0; if (!mfCheckKeys(blockno, keytype, false, 1, keyBlock, &key64)) { *key = key64; - free(last_keylist); - last_keylist = NULL; - free(state); - return 0; + retval = 0; + goto out; } - } + } +out: free(last_keylist); - last_keylist = state_s; - return 1; + last_keylist = NULL; + free(state); + state = NULL; + return retval; } // 32 bit recover key from 2 nonces -bool tryMfk32(nonces_t data, uint64_t *outputkey) { +bool tryMfk32(nonces_t data, uint64_t *outputkey, bool verbose) { struct Crypto1State *s,*t; uint64_t outkey = 0; uint64_t key=0; // recovered key @@ -166,22 +185,24 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) { uint32_t ar0_enc = data.ar; // first encrypted reader response uint32_t nr1_enc = data.nr2; // second encrypted reader challenge uint32_t ar1_enc = data.ar2; // second encrypted reader response - clock_t t1 = clock(); bool isSuccess = FALSE; uint8_t counter = 0; - - printf("Recovering key for:\n"); - printf(" uid: %08x\n",uid); - printf(" nt: %08x\n",nt); - printf(" {nr_0}: %08x\n",nr0_enc); - printf(" {ar_0}: %08x\n",ar0_enc); - printf(" {nr_1}: %08x\n",nr1_enc); - printf(" {ar_1}: %08x\n",ar1_enc); - - printf("\nLFSR succesors of the tag challenge:\n"); + + clock_t t1 = clock(); uint32_t p64 = prng_successor(nt, 64); - printf(" nt': %08x\n", p64); - printf(" nt'': %08x\n", prng_successor(p64, 32)); + + if ( verbose ) { + PrintAndLog("Recovering key for:"); + PrintAndLog(" uid: %08x",uid); + PrintAndLog(" nt: %08x",nt); + PrintAndLog(" {nr_0}: %08x",nr0_enc); + PrintAndLog(" {ar_0}: %08x",ar0_enc); + PrintAndLog(" {nr_1}: %08x",nr1_enc); + PrintAndLog(" {ar_1}: %08x",ar1_enc); + PrintAndLog("\nLFSR succesors of the tag challenge:"); + PrintAndLog(" nt': %08x", p64); + PrintAndLog(" nt'': %08x", prng_successor(p64, 32)); + } s = lfsr_recovery32(ar0_enc ^ p64, 0); @@ -193,7 +214,6 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) { crypto1_word(t, uid ^ nt, 0); crypto1_word(t, nr1_enc, 1); if (ar1_enc == (crypto1_word(t, 0, 0) ^ p64)) { - //PrintAndLog("Found Key: [%012"llx"]", key); outkey = key; ++counter; if (counter==20) break; @@ -201,14 +221,14 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) { } isSuccess = (counter > 0); t1 = clock() - t1; - if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.0f ticks - possible keys %d\n", (float)t1, counter); + if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.0f ticks - possible keys %d", (float)t1, counter); *outputkey = ( isSuccess ) ? outkey : 0; crypto1_destroy(s); return isSuccess; } -bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { +bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool verbose) { struct Crypto1State *s, *t; uint64_t outkey = 0; uint64_t key = 0; // recovered key @@ -222,28 +242,24 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { uint32_t ar1_enc = data.ar2; // second encrypted reader response bool isSuccess = FALSE; int counter = 0; - - if (showMaths) { - printf("Recovering key for:\n"); - printf(" uid: %08x\n", uid); - printf(" nt_0: %08x\n", nt0); - printf(" {nr_0}: %08x\n", nr0_enc); - printf(" {ar_0}: %08x\n", ar0_enc); - printf(" nt_1: %08x\n", nt1); - printf(" {nr_1}: %08x\n", nr1_enc); - printf(" {ar_1}: %08x\n", ar1_enc); - } - //PrintAndLog("Enter mfkey32_moebius"); clock_t t1 = clock(); uint32_t p640 = prng_successor(nt0, 64); uint32_t p641 = prng_successor(nt1, 64); - if (showMaths) { - printf("\nLFSR succesors of the tag challenge:\n"); - printf(" nt': %08x\n", p640); - printf(" nt'': %08x\n", prng_successor(p640, 32)); + if (verbose) { + PrintAndLog("Recovering key for:"); + PrintAndLog(" uid: %08x", uid); + PrintAndLog(" nt_0: %08x", nt0); + PrintAndLog(" {nr_0}: %08x", nr0_enc); + PrintAndLog(" {ar_0}: %08x", ar0_enc); + PrintAndLog(" nt_1: %08x", nt1); + PrintAndLog(" {nr_1}: %08x", nr1_enc); + PrintAndLog(" {ar_1}: %08x", ar1_enc); + PrintAndLog("\nLFSR succesors of the tag challenge:"); + PrintAndLog(" nt': %08x", p640); + PrintAndLog(" nt'': %08x", prng_successor(p640, 32)); } s = lfsr_recovery32(ar0_enc ^ p640, 0); @@ -257,7 +273,6 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { crypto1_word(t, uid ^ nt1, 0); crypto1_word(t, nr1_enc, 1); if (ar1_enc == (crypto1_word(t, 0, 0) ^ p641)) { - //PrintAndLog("Found Key: [%012"llx"]",key); outkey=key; ++counter; if (counter==20) break; @@ -265,7 +280,7 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { } isSuccess = (counter > 0); t1 = clock() - t1; - if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks - possible keys %d\n", (float)t1, counter); + if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks - possible keys %d", (float)t1, counter); *outputkey = ( isSuccess ) ? outkey : 0; crypto1_destroy(s); @@ -302,7 +317,7 @@ int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32 PrintAndLog("Found Key: [%012"llx"]", key); t1 = clock() - t1; - if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks \n", (float)t1); + if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks", (float)t1); *outputkey = key; crypto1_destroy(revstate);