// Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on\r
// Computer and Communications Security, 2015\r
//-----------------------------------------------------------------------------\r
-void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)\r
-{\r
+void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain) {\r
uint64_t ui64Key = 0;\r
uint8_t uid[10];\r
uint32_t cuid;\r
bool field_off = flags & 0x0004;\r
\r
LED_A_ON();\r
- LED_C_OFF();\r
\r
if (initialize) {\r
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
set_tracing(true);\r
}\r
\r
- LED_C_ON();\r
-\r
uint16_t num_nonces = 0;\r
bool have_uid = false;\r
for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {\r
\r
}\r
\r
- LED_C_OFF();\r
-\r
crypto1_destroy(pcs);\r
\r
if (field_off) {\r
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
- LEDsoff();\r
+ LED_D_OFF();\r
}\r
\r
- LED_B_ON();\r
- cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));\r
- LED_B_OFF();\r
-\r
if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");\r
\r
+ cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));\r
+\r
+ LED_A_OFF();\r
}\r
\r
\r
uint16_t davg;\r
static uint16_t dmin, dmax;\r
uint8_t uid[10];\r
- uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r
+ uint32_t cuid, nt1, nt2_enc, nttmp, nttest, ks1;\r
uint8_t par[1];\r
uint32_t target_nt[2], target_ks[2];\r
+ uint32_t fixed_nt = 0;\r
uint8_t target_nt_duplicate_count = 0;\r
\r
uint8_t par_array[4];\r
#define NESTED_MAX_TRIES 12\r
uint16_t unsuccessfull_tries = 0;\r
if (calibrate) { // for first call only. Otherwise reuse previous calibration\r
- LED_B_ON();\r
WDT_HIT();\r
\r
davg = dmax = 0;\r
rtr--;\r
continue;\r
};\r
+ fixed_nt = nt1;\r
\r
if (delta_time) {\r
auth2_time = auth1_time + delta_time;\r
} else {\r
auth2_time = 0;\r
}\r
- if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {\r
+ if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2_enc, &auth2_time, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
rtr--;\r
continue;\r
nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r
for (i = 101; i < 1200; i++) {\r
nttmp = prng_successor(nttmp, 1);\r
- if (nttmp == nt2) break;\r
+ if (nttmp == nt2_enc) break;\r
}\r
\r
if (i != 1200) {\r
dmin = davg - 2;\r
dmax = davg + 2;\r
\r
- LED_B_OFF();\r
-\r
}\r
// -------------------------------------------------------------------------------------------------\r
\r
- LED_C_ON();\r
-\r
// get crypted nonces for target sector\r
- for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r
+ for (i = 0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r
\r
target_nt[i] = 0;\r
while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce\r
\r
// prepare next select. No need to power down the card.\r
- if(mifare_classic_halt(pcs, cuid)) {\r
+ if (mifare_classic_halt(pcs, cuid)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
continue;\r
}\r
continue;\r
}\r
\r
- nt2 = bytes_to_num(receivedAnswer, 4);\r
- if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r
+ nt2_enc = bytes_to_num(receivedAnswer, 4);\r
+ if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2_enc, par[0]);\r
\r
// Parity validity check\r
for (j = 0; j < 4; j++) {\r
nttest = prng_successor(nt1, dmin - 1);\r
for (j = dmin; j < dmax + 1; j++) {\r
nttest = prng_successor(nttest, 1);\r
- ks1 = nt2 ^ nttest;\r
+ ks1 = nt2_enc ^ nttest;\r
\r
- if (valid_nonce(nttest, nt2, ks1, par_array)){\r
+ if (valid_nonce(nttest, nt2_enc, ks1, par_array)){\r
if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r
if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r
target_nt[i] = 0;\r
}\r
}\r
\r
- LED_C_OFF();\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ LED_D_OFF();\r
\r
- // ----------------------------- crypto1 destroy\r
crypto1_destroy(pcs);\r
\r
- uint8_t buf[4 + 4 * 4 + 4];\r
+ uint8_t buf[4 + 4 * 4 + 4 + 4];\r
memcpy(buf, &cuid, 4);\r
memcpy(buf+4, &target_nt[0], 4);\r
memcpy(buf+8, &target_ks[0], 4);\r
memcpy(buf+12, &target_nt[1], 4);\r
memcpy(buf+16, &target_ks[1], 4);\r
memcpy(buf+20, &authentication_timeout, 4);\r
-\r
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ memcpy(buf+24, &fixed_nt, 4);\r
\r
if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r
\r
- LED_B_ON();\r
cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
- LED_B_OFF();\r
\r
- LEDsoff();\r
+ LED_A_OFF();\r
}\r
\r
\r
bool multisectorCheck = arg1 & 0x02;\r
bool init = arg1 & 0x04;\r
bool drop_field = arg1 & 0x08;\r
+ bool fixed_nonce = arg1 & 0x10;\r
uint32_t auth_timeout = arg1 >> 16;\r
uint8_t keyCount = arg2;\r
\r
} else {\r
cmd_send(CMD_ACK, 0, res, 0, NULL, 0);\r
}\r
- } else { \r
+ } else if (fixed_nonce) {\r
+ res = MifareChkBlockKeysFixedNonce(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);\r
+ if (res > 0) {\r
+ cmd_send(CMD_ACK, 1, res, 0, NULL, 0); // key found\r
+ } else {\r
+ cmd_send(CMD_ACK, 0, res, 0, NULL, 0); // no key found or aborted\r
+ }\r
+ } else {\r
res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);\r
if (res > 0) {\r
cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);\r
}\r
\r
// send X byte basic commands\r
-int mifare_sendcmd(uint8_t cmd, uint8_t* data, uint8_t data_size, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing)\r
-{\r
+int mifare_sendcmd(uint8_t cmd, uint8_t* data, uint8_t data_size, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing) {\r
uint8_t dcmd[data_size+3];\r
dcmd[0] = cmd;\r
memcpy(dcmd+1,data,data_size);\r
}\r
\r
// send 2 byte commands\r
-int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)\r
-{\r
+int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing) {\r
uint8_t dcmd[4], ecmd[4];\r
uint16_t pos, res;\r
uint8_t par[1]; // 1 Byte parity is enough here\r
// ar+parity\r
for (pos = 4; pos < 8; pos++) {\r
nt = prng_successor(nt,8);\r
- mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);\r
+ mf_nr_ar[pos] = crypto1_byte(pcs, 0x00, 0) ^ (nt & 0xff);\r
par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos));\r
}\r
\r
//\r
//-----------------------------------------------------------------------------\r
// one key check\r
-int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {\r
+static int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint8_t *key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, bool fixed_nonce) {\r
\r
struct Crypto1State mpcs = {0, 0};\r
struct Crypto1State *pcs;\r
pcs = &mpcs;\r
\r
- // Iceman: use piwi's faster nonce collecting part in hardnested.\r
if (*cascade_levels == 0) { // need a full select cycle to get the uid first\r
iso14a_card_select_t card_info;\r
if (!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {\r
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card");\r
- return 1;\r
+ return -1;\r
}\r
switch (card_info.uidlen) {\r
case 4 : *cascade_levels = 1; break;\r
} else { // no need for anticollision. We can directly select the card\r
if (!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {\r
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card (UID) lvl=%d", *cascade_levels);\r
- return 1;\r
+ return -1;\r
}\r
}\r
\r
- if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed\r
- return 2;\r
+ if (!fixed_nonce) {\r
+ uint64_t ui64Key = bytes_to_num(key, 6);\r
+ if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed\r
+ return -2;\r
+ } else {\r
+ mifare_classic_halt(pcs, *cuid);\r
+ }\r
} else {\r
- mifare_classic_halt(pcs, *cuid);\r
+ uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
+ uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
+ // Transmit MIFARE_CLASSIC_AUTH\r
+ int len = mifare_sendcmd_short(pcs, false, keyType & 0x01 ? MIFARE_AUTH_KEYB : MIFARE_AUTH_KEYA, blockNo, receivedAnswer, receivedAnswerPar, NULL);\r
+ if (len != 4) return -2;\r
+ // Transmit encrypted reader nonce and reader answer\r
+ uint8_t mf_nr_ar[8] = NESTED_FIXED_NR_ENC;\r
+ memcpy(mf_nr_ar + 4, key, 4);\r
+ ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), key + 4, NULL);\r
+ uint32_t save_timeout = iso14a_get_timeout(); // save standard timeout\r
+ iso14a_set_timeout(*auth_timeout); // set timeout for authentication response\r
+ len = ReaderReceive(receivedAnswer, receivedAnswerPar);\r
+ iso14a_set_timeout(save_timeout); // restore standard timeout\r
+ if (!len) return -2;\r
}\r
\r
- return 0;\r
+ return 0; // success\r
}\r
\r
-\r
// multi key check\r
-int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {\r
+static int MifareChkBlockKeysEx(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, bool fixed_nonce) {\r
\r
uint8_t uid[10];\r
uint32_t cuid = 0;\r
uint8_t cascade_levels = 0;\r
- uint64_t ui64Key = 0;\r
\r
int retryCount = 0;\r
for (uint8_t i = 0; i < keyCount; i++) {\r
-\r
- ui64Key = bytes_to_num(keys + i * 6, 6);\r
- int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, auth_timeout, debugLevel);\r
-\r
- // can't select\r
- if (res == 1) {\r
+ uint8_t bytes_per_key = fixed_nonce ? 5 : 6;\r
+ int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, keys + i*bytes_per_key, blockNo, keyType, auth_timeout, debugLevel, fixed_nonce);\r
+ if (res == -1) { // couldn't select\r
retryCount++;\r
if (retryCount >= 5) {\r
- Dbprintf("ChkKeys: block=%d key=%d. Can't select. Exit...", blockNo, keyType);\r
+ Dbprintf("ChkKeys: block=%d key=%d. Couldn't select. Exit...", blockNo, keyType);\r
return -1;\r
+ } else {\r
+ --i; // try the same key once again\r
+ SpinDelay(20);\r
+ // Dbprintf("ChkKeys: block=%d key=%d. Try the same key once again...", blockNo, keyType);\r
+ continue;\r
}\r
- --i; // try the same key once again\r
-\r
- SpinDelay(20);\r
-// Dbprintf("ChkKeys: block=%d key=%d. Try the same key once again...", blockNo, keyType);\r
- continue;\r
}\r
-\r
- // can't authenticate\r
- if (res == 2) {\r
+ if (res == -2) { // couldn't authenticate with this key\r
retryCount = 0;\r
- continue; // can't auth. wrong key.\r
+ continue;\r
}\r
\r
- // successful authentication\r
- return i + 1;\r
+ return i + 1; // successful authentication\r
+\r
}\r
\r
if (BUTTON_PRESS()) {\r
return -2;\r
}\r
\r
- return 0;\r
+ return 0; // couldn't authenticate with any key\r
+}\r
+\r
+\r
+int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {\r
+ return MifareChkBlockKeysEx(keys, keyCount, blockNo, keyType, auth_timeout, debugLevel, false);\r
+}\r
+\r
+\r
+// fixed nonce check\r
+int MifareChkBlockKeysFixedNonce(uint8_t *ar_par, uint8_t ar_par_cnt, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {\r
+ return MifareChkBlockKeysEx(ar_par, ar_par_cnt, blockNo, keyType, auth_timeout, debugLevel, true);\r
}\r
\r
\r
#include "mifare4.h"
// mifare tracer flags used in mfTraceDecode()
-#define TRACE_IDLE 0x00
-#define TRACE_AUTH1 0x01
-#define TRACE_AUTH2 0x02
-#define TRACE_AUTH_OK 0x03
-#define TRACE_READ_DATA 0x04
-#define TRACE_WRITE_OK 0x05
-#define TRACE_WRITE_DATA 0x06
-#define TRACE_ERROR 0xFF
+#define TRACE_IDLE 0x00
+#define TRACE_AUTH1 0x01
+#define TRACE_AUTH2 0x02
+#define TRACE_AUTH_OK 0x03
+#define TRACE_READ_DATA 0x04
+#define TRACE_WRITE_OK 0x05
+#define TRACE_WRITE_DATA 0x06
+#define TRACE_ERROR 0xFF
static int compare_uint64(const void *a, const void *b) {
for (pos=0; pos<8; pos++) {
ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
bt = (par_info >> (pos*8)) & 0xff;
- for (i=0; i<8; i++) {
+ for (i=0; i<8; i++) {
par[7-pos][i] = (bt >> i) & 0x01;
}
}
for (int i = 0; i < keycount; i++) {
num_to_bytes(keylist[i], 6, keys_to_chk+i);
}
-
+
*key = -1;
mfCheckKeys(0, 0, 0, false, keycount, keys_to_chk, key);
}
-int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keys, uint64_t *found_key) {
+static int mfCheckKeysEx(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keys, uint64_t *found_key, bool fixed_nonce) {
bool display_progress = false;
uint64_t start_time = msclock();
uint64_t next_print_time = start_time + 5 * 1000;
if (keycnt > 1000) {
- PrintAndLog("We have %d keys to check. This will take some time!", keycnt);
+ PrintAndLog("We have %d keys to check. This can take some time!", keycnt);
PrintAndLog("Press button to abort.");
display_progress = true;
}
- uint32_t max_keys = (keycnt > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : keycnt;
+ uint8_t bytes_per_key = fixed_nonce ? 5 : 6;
+ uint32_t max_keys = keycnt > USB_CMD_DATA_SIZE/bytes_per_key ? USB_CMD_DATA_SIZE/bytes_per_key : keycnt;
*found_key = -1;
bool multisectorCheck = false;
bool init = (i == 0);
bool drop_field = (max_keys == keycnt);
- uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
+ uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3 | fixed_nonce << 4;
- UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, max_keys}};
- memcpy(c.d.asBytes, keys + i * 6, max_keys * 6);
+ UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, max_keys}};
+ memcpy(c.d.asBytes, keys + i * bytes_per_key, max_keys * bytes_per_key);
SendCommand(&c);
UsbCommand resp;
return 1;
if ((resp.arg[0] & 0xff) != 0x01) {
- if (((int)resp.arg[1]) < 0) { // error
+ if ((int)resp.arg[1] < 0) { // error or user aborted
return (int)resp.arg[1];
} else { // nothing found yet
if (display_progress && msclock() >= next_print_time) {
PrintAndLog(" %8d keys left | %5.1f keys/sec | worst case %6.1f seconds remaining", keycnt - i, brute_force_per_second, (keycnt-i)/brute_force_per_second);
}
}
- } else { // success
- *found_key = bytes_to_num(resp.d.asBytes, 6);
+ } else { // success
+ if (fixed_nonce) {
+ *found_key = i + resp.arg[1] - 1;
+ } else {
+ *found_key = bytes_to_num(resp.d.asBytes, 6);
+ }
return 0;
}
}
- return 2; // nothing found
+ return 2; // nothing found
+}
+
+
+int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keys, uint64_t *found_key) {
+ return mfCheckKeysEx(blockNo, keyType, timeout14a, clear_trace, keycnt, keys, found_key, false);
}
-int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector) {
+static int mfCheckKeysFixedNonce(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keys, uint32_t *key_index) {
+ return mfCheckKeysEx(blockNo, keyType, timeout14a, clear_trace, keycnt, keys, (uint64_t*)key_index, true);
+}
+
+
+int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t *keyBlock, sector_t *e_sector) {
uint8_t keyPtr = 0;
bool multisectorCheck = true;
uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
- UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
+ UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
SendCommand(&c);
UsbCommand resp;
if (!WaitForResponseTimeoutW(CMD_ACK, &resp, MAX(3000, 1000 + 13 * sectorCnt * keycnt * (keyType == 2 ? 2 : 1)), false)) return 1; // timeout: 13 ms / fail auth
if ((resp.arg[0] & 0xff) != 0x01) return 2;
-
+
bool foundAKey = false;
for(int sec = 0; sec < sectorCnt; sec++){
for(int keyAB = 0; keyAB < 2; keyAB++){
uint32_t uid;
uint32_t blockNo;
uint32_t keyType;
- uint32_t nt_enc;
+ uint32_t nt;
uint32_t ks1;
} StateList_t;
void
#ifdef __has_attribute
#if __has_attribute(force_align_arg_pointer)
-__attribute__((force_align_arg_pointer))
+__attribute__((force_align_arg_pointer))
#endif
#endif
*nested_worker_thread(void *arg) {
struct Crypto1State *p1;
StateList_t *statelist = arg;
- statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt_enc ^ statelist->uid);
+ statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt ^ statelist->uid);
for (p1 = statelist->head.slhead; *(uint64_t *)p1 != 0; p1++);
statelist->len = p1 - statelist->head.slhead;
statelist->tail.sltail = --p1;
}
-int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) {
- uint32_t i;
- uint32_t uid;
- UsbCommand resp;
-
- int num_unique_nonces;
-
- StateList_t statelists[2];
- struct Crypto1State *p1, *p2, *p3, *p4;
+static int nested_fixed_nonce(StateList_t statelist, uint32_t fixed_nt, uint32_t authentication_timeout, uint8_t *resultKey) {
+ // We have a tag with a fixed nonce (nt) and therefore only one (usually long) list of possible crypto states.
+ // Instead of testing all those keys on the device with a complete authentication cycle, we do all of the crypto operations here.
+ uint8_t nr_enc[4] = NESTED_FIXED_NR_ENC; // we use a fixed {nr}
+ uint8_t ar[4];
+ num_to_bytes(prng_successor(fixed_nt, 64), 4, ar); // ... and ar is fixed too
- uint8_t *keyBlock = NULL;
- uint64_t key64;
-
- int isOK = 1;
-
- // flush queue
- (void)WaitForResponseTimeout(CMD_ACK,NULL,100);
-
- UsbCommand c = {CMD_MIFARE_NESTED, {blockNo + keyType * 0x100, trgBlockNo + trgKeyType * 0x100, calibrate}};
- memcpy(c.d.asBytes, key, 6);
- SendCommand(&c);
-
- if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
- // some cards can cause it to get stuck in a loop, so break out of it
- UsbCommand c = {CMD_PING};
- SendCommand(&c);
- (void)WaitForResponseTimeout(CMD_ACK,NULL,500);
- return -1;
- }
-
- if (resp.arg[0]) {
- return resp.arg[0]; // error during nested
+ // create an array of possible {ar} and parity bits
+ uint32_t num_ar_par = statelist.len;
+ uint8_t *ar_par = calloc(num_ar_par, 5);
+ if (ar_par == NULL) {
+ free(statelist.head.slhead);
+ return -4;
}
- memcpy(&uid, resp.d.asBytes, 4);
- PrintAndLog("uid:%08x trgbl=%d trgkey=%x", uid, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8);
-
- for (i = 0; i < 2; i++) {
- statelists[i].blockNo = resp.arg[2] & 0xff;
- statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;
- statelists[i].uid = uid;
- memcpy(&statelists[i].nt_enc, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
- memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
+ for (int i = 0; i < num_ar_par; i++) {
+ // roll back to initial state using the nt observed with the nested authentication
+ lfsr_rollback_word(statelist.head.slhead + i, statelist.nt ^ statelist.uid, 0);
+ // instead feed in the fixed_nt for the first authentication
+ struct Crypto1State cs = *(statelist.head.slhead + i);
+ crypto1_word(&cs, fixed_nt ^ statelist.uid, 0);
+ // determine nr such that the resulting {nr} is constant and feed it into the cypher. Calculate the encrypted parity bits
+ uint8_t par_enc = 0;
+ for (int j = 0; j < 4; j++) {
+ uint8_t nr_byte = crypto1_byte(&cs, nr_enc[j], 1) ^ nr_enc[j];
+ par_enc |= (((filter(cs.odd) ^ oddparity8(nr_byte)) & 0x01) << (7-j));
+ }
+ // calculate the encrypted reader response {ar} and its parity bits
+ for (int j = 0; j < 4; j++) {
+ ar_par[5*i + j] = crypto1_byte(&cs, 0, 0) ^ ar[j];
+ par_enc |= ((filter(cs.odd) ^ oddparity8(ar[j])) & 0x01) << (3-j);
+ }
+ ar_par[5*i + 4] = par_enc;
}
- uint32_t authentication_timeout;
- memcpy(&authentication_timeout, resp.d.asBytes + 20, 4);
- PrintAndLog("Setting authentication timeout to %" PRIu32 "us", authentication_timeout * 1000 / 106);
-
- if (statelists[0].nt_enc == statelists[1].nt_enc && statelists[0].ks1 == statelists[1].ks1)
- num_unique_nonces = 1;
- else
- num_unique_nonces = 2;
-
- // calc keys
+ // test each {ar} response
+ uint32_t key_index;
- pthread_t thread_id[2];
+ int isOK = mfCheckKeysFixedNonce(statelist.blockNo, statelist.keyType, authentication_timeout, true, num_ar_par, ar_par, &key_index);
- // create and run worker threads
- for (i = 0; i < 2; i++) {
- pthread_create(thread_id + i, NULL, nested_worker_thread, &statelists[i]);
+ if (isOK == 0) { // success, key found
+ // key_index contains the index into the cypher state list
+ struct Crypto1State *p1 = statelist.head.slhead + key_index;
+ uint64_t key64;
+ crypto1_get_lfsr(p1, &key64);
+ num_to_bytes(key64, 6, resultKey);
}
-
- // wait for threads to terminate:
- for (i = 0; i < 2; i++) {
- pthread_join(thread_id[i], (void*)&statelists[i].head.slhead);
+ if (isOK == 1) { // timeout
+ isOK = -1;
}
+ free(statelist.head.slhead);
+ free(ar_par);
+ return isOK;
+}
- // the first 16 Bits of the cryptostate already contain part of our key.
+static int nested_standard(StateList_t statelists[2], uint32_t authentication_timeout, uint8_t *resultKey) {
+
+ // the first 16 Bits of the crypto states already contain part of our key.
// Create the intersection of the two lists based on these 16 Bits and
- // roll back the cryptostate
+ // roll back the crypto state for the remaining states
+ struct Crypto1State *p1, *p2, *p3, *p4;
p1 = p3 = statelists[0].head.slhead;
p2 = p4 = statelists[1].head.slhead;
while (p1 <= statelists[0].tail.sltail && p2 <= statelists[1].tail.sltail) {
if (Compare16Bits(p1, p2) == 0) {
struct Crypto1State savestate, *savep = &savestate;
savestate = *p1;
- while(Compare16Bits(p1, savep) == 0 && p1 <= statelists[0].tail.sltail) {
+ while (Compare16Bits(p1, savep) == 0 && p1 <= statelists[0].tail.sltail) {
*p3 = *p1;
- lfsr_rollback_word(p3, statelists[0].nt_enc ^ statelists[0].uid, 0);
+ lfsr_rollback_word(p3, statelists[0].nt ^ statelists[0].uid, 0);
p3++;
p1++;
}
savestate = *p2;
- while(Compare16Bits(p2, savep) == 0 && p2 <= statelists[1].tail.sltail) {
+ while (Compare16Bits(p2, savep) == 0 && p2 <= statelists[1].tail.sltail) {
*p4 = *p2;
- lfsr_rollback_word(p4, statelists[1].nt_enc ^ statelists[1].uid, 0);
+ lfsr_rollback_word(p4, statelists[1].nt ^ statelists[1].uid, 0);
p4++;
p2++;
}
statelists[0].tail.sltail=--p3;
statelists[1].tail.sltail=--p4;
- for (i = 0; i < 2; i++) {
- PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt_enc:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt_enc, statelists[i].ks1);
- }
-
- // the statelists now contain possible keys. The key we are searching for must be in the
- // intersection of both lists. Create the intersection:
+ // the statelists now contain possible crypto states initialized with the key. The key we are searching for
+ // must be in the intersection of both lists. Sort the lists and create the intersection:
qsort(statelists[0].head.keyhead, statelists[0].len, sizeof(uint64_t), compare_uint64);
+ qsort(statelists[1].head.keyhead, statelists[1].len, sizeof(uint64_t), compare_uint64);
+ statelists[0].len = intersection(statelists[0].head.keyhead, statelists[1].head.keyhead);
- if (num_unique_nonces > 1) {
- qsort(statelists[1].head.keyhead, statelists[1].len, sizeof(uint64_t), compare_uint64);
- statelists[0].len = intersection(statelists[0].head.keyhead, statelists[1].head.keyhead);
- }
- else {
- PrintAndLog("Nonce 1 and 2 are the same!");
- }
-
+ // create an array of the possible keys
uint32_t num_keys = statelists[0].len;
- keyBlock = calloc(num_keys, 6);
- if (keyBlock == NULL) {
+ uint8_t *keys = calloc(num_keys, 6);
+ if (keys == NULL) {
free(statelists[0].head.slhead);
free(statelists[1].head.slhead);
return -4;
}
- for (i = 0; i < num_keys; i++) {
+ uint64_t key64 = 0;
+ for (int i = 0; i < num_keys; i++) {
crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);
- num_to_bytes(key64, 6, keyBlock + i*6);
+ num_to_bytes(key64, 6, keys + i*6);
}
- // The list may still contain several key candidates. Test each of them with mfCheckKeys
- isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, authentication_timeout, true, num_keys, keyBlock, &key64);
+ // and test each key with mfCheckKeys
+ int isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, authentication_timeout, true, num_keys, keys, &key64);
if (isOK == 0) { // success, key found
num_to_bytes(key64, 6, resultKey);
}
-
if (isOK == 1) { // timeout
isOK = -1;
}
-
free(statelists[0].head.slhead);
free(statelists[1].head.slhead);
- free(keyBlock);
-
+ free(keys);
return isOK;
}
+
+int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) {
+
+ // flush queue
+ clearCommandBuffer();
+
+ UsbCommand c = {CMD_MIFARE_NESTED, {blockNo + keyType * 0x100, trgBlockNo + trgKeyType * 0x100, calibrate}};
+ memcpy(c.d.asBytes, key, 6);
+ SendCommand(&c);
+
+ UsbCommand resp;
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+ return -1;
+ }
+
+ if ((int)resp.arg[0]) {
+ return (int)resp.arg[0]; // error during nested
+ }
+
+ uint32_t uid;
+ memcpy(&uid, resp.d.asBytes, 4);
+ PrintAndLog("uid:%08x trgbl=%d trgkey=%x", uid, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8);
+
+ StateList_t statelists[2];
+ for (int i = 0; i < 2; i++) {
+ statelists[i].blockNo = resp.arg[2] & 0xff;
+ statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;
+ statelists[i].uid = uid;
+ memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
+ memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
+ }
+
+ uint32_t authentication_timeout;
+ memcpy(&authentication_timeout, resp.d.asBytes + 20, 4);
+ PrintAndLog("Setting authentication timeout to %" PRIu32 "us", authentication_timeout * 1000 / 106);
+
+ uint8_t num_unique_nonces;
+ uint32_t fixed_nt = 0;
+ if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1) {
+ num_unique_nonces = 1;
+ memcpy(&fixed_nt, resp.d.asBytes + 24, 4);
+ PrintAndLog("Fixed nt detected: %08" PRIx32 " on first authentication, %08" PRIx32 " on nested authentication", fixed_nt, statelists[0].nt);
+ } else {
+ num_unique_nonces = 2;
+ }
+
+ // create and run worker threads to calculate possible crypto states
+ pthread_t thread_id[2];
+ for (int i = 0; i < num_unique_nonces; i++) {
+ pthread_create(thread_id + i, NULL, nested_worker_thread, &statelists[i]);
+ }
+ // wait for threads to terminate:
+ for (int i = 0; i < num_unique_nonces; i++) {
+ pthread_join(thread_id[i], (void*)&statelists[i].head.slhead);
+ }
+
+ if (num_unique_nonces == 2) {
+ return nested_standard(statelists, authentication_timeout, resultKey);
+ } else {
+ return nested_fixed_nonce(statelists[0], fixed_nt, authentication_timeout, resultKey);
+ }
+}
+
+
// MIFARE
int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data) {
- UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};
- memcpy(c.d.asBytes, key, 6);
- clearCommandBuffer();
- SendCommand(&c);
-
- UsbCommand resp;
- if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
- uint8_t isOK = resp.arg[0] & 0xff;
-
- if (isOK) {
- memcpy(data, resp.d.asBytes, mfNumBlocksPerSector(sectorNo) * 16);
- return 0;
- } else {
- return 1;
- }
- } else {
- PrintAndLogEx(ERR, "Command execute timeout");
- return 2;
- }
-
- return 0;
+ UsbCommand c = {CMD_MIFARE_READSC, {sectorNo, keyType, 0}};
+ memcpy(c.d.asBytes, key, 6);
+ clearCommandBuffer();
+ SendCommand(&c);
+
+ UsbCommand resp;
+ if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+ uint8_t isOK = resp.arg[0] & 0xff;
+
+ if (isOK) {
+ memcpy(data, resp.d.asBytes, mfNumBlocksPerSector(sectorNo) * 16);
+ return 0;
+ } else {
+ return 1;
+ }
+ } else {
+ PrintAndLogEx(ERR, "Command execute timeout");
+ return 2;
+ }
+
+ return 0;
}
// EMULATOR
int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount) {
UsbCommand c = {CMD_MIFARE_EML_MEMGET, {blockNum, blocksCount, 0}};
- SendCommand(&c);
+ SendCommand(&c);
UsbCommand resp;
if (!WaitForResponseTimeout(CMD_ACK,&resp,1500)) return 1;
UsbCommand resp;
WaitForResponse(CMD_ACK,&resp);
isOK = resp.arg[0] & 0xff;
-
+
return isOK;
}
/* generation 1b magic card */
cmdParams = CSETBLOCK_SINGLE_OPER | CSETBLOCK_MAGIC_1B;
}
-
+
res = mfCGetBlock(0, oldblock0, cmdParams);
if (res == 0) {
PrintAndLog("Can't set block 0. Error: %d", res);
return res;
}
-
+
return 0;
}
PrintAndLog("File reading error.");
fclose(f);
return 2;
- }
+ }
if (strlen(buf) < 32){
if (feof(f)) break;
}
void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool isEncrypted){
- uint8_t bt = 0;
+ uint8_t bt = 0;
int i;
if (len != 1) {
(oddparity8(ntx >> 24 & 0xff) ^ (ntx >> 16 & 0x01) ^ ((nt_enc_par >> 7) & 0x01) ^ (nt_enc >> 16 & 0x01))
)
return false;
-
+
uint32_t ar = prng_successor(ntx, 64);
if (
(oddparity8(ar >> 8 & 0xff) ^ (ar & 0x01) ^ ((ar_enc_par >> 5) & 0x01) ^ (ar_enc & 0x01)) ||
(oddparity8(at >> 24 & 0xff) ^ (at >> 16 & 0x01) ^ ((at_enc_par >> 7) & 0x01) ^ (at_enc >> 16 & 0x01))
)
return false;
-
+
return true;
}
crypto1_get_lfsr(revstate, &lfsr);
crypto1_destroy(revstate);
ui64Key = lfsr;
- printf("key> probable key:%x%x Prng:%s ks2:%08x ks3:%08x\n",
- (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF),
+ printf("key> probable key:%x%x Prng:%s ks2:%08x ks3:%08x\n",
+ (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF),
validate_prng_nonce(nt) ? "WEAK": "HARDEND",
ks2,
ks3);
printf("key> the same key test OK. key=%x%x\n", (unsigned int)((ui64Key & 0xFFFFFFFF00000000) >> 32), (unsigned int)(ui64Key & 0xFFFFFFFF));
else
printf("key> the same key test. check nt parity error.\n");
-
+
uint32_t ntc = prng_successor(nt, 90);
uint32_t ntx = 0;
int ntcnt = 0;
if (!ntcnt)
ntx = ntc;
ntcnt++;
- }
+ }
}
if (ntcnt)
printf("key> nt candidate=%08x nonce distance=%d candidates count=%d\n", ntx, nonce_distance(nt, ntx), ntcnt);
crypto1_get_lfsr(revstate, &lfsr);
crypto1_destroy(revstate);
ui64Key = lfsr;
- printf("key> probable key:%x%x ks2:%08x ks3:%08x\n",
+ printf("key> probable key:%x%x ks2:%08x ks3:%08x\n",
(unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF),
ks2,
ks3);
AddLogUint64(logHexFileName, "key> ", lfsr);
- } else {
+ } else {
printf("key> hardnested not implemented!\n");
-
+
crypto1_destroy(traceCrypto1);
// not implemented
dist[(x & 0xff) << 8 | x >> 8] = i;
x = x >> 1 | (x ^ x >> 2 ^ x >> 3 ^ x >> 5) << 15;
}
-
+
uint32_t res = (65535 - dist[nonce >> 16] + dist[nonce & 0xffff]) % 65535;
-
- free(dist);
+
+ free(dist);
return (res == 16);
}
-/* Detect Tag Prng,
+/* Detect Tag Prng,
* function performs a partial AUTH, where it tries to authenticate against block0, key A, but only collects tag nonce.
* the tag nonce is check to see if it has a predictable PRNG.
-* @returns
-* TRUE if tag uses WEAK prng (ie Now the NACK bug also needs to be present for Darkside attack)
+* @returns
+* TRUE if tag uses WEAK prng (ie Now the NACK bug also needs to be present for Darkside attack)
* FALSE is tag uses HARDEND prng (ie hardnested attack possible, with known key)
*/
int DetectClassicPrng(void){
- UsbCommand resp, respA;
+ UsbCommand resp, respA;
uint8_t cmd[] = {0x60, 0x00}; // MIFARE_AUTH_KEYA
uint32_t flags = ISO14A_CONNECT | ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_RATS;
-
+
UsbCommand c = {CMD_READER_ISO_14443a, {flags, sizeof(cmd), 0}};
memcpy(c.d.asBytes, cmd, sizeof(cmd));
clearCommandBuffer();
SendCommand(&c);
if (!WaitForResponseTimeout(CMD_NACK, &resp, 2000)) {
- PrintAndLog("PRNG UID: Reply timeout.");
+ PrintAndLog("PRNG UID: Reply timeout.");
return -1;
}
-
+
// if select tag failed.
if (resp.arg[0] == 0) {
PrintAndLog("PRNG error: selecting tag failed, can't detect prng.");
return -1;
}
-
+
if (!WaitForResponseTimeout(CMD_ACK, &respA, 5000)) {
- PrintAndLog("PRNG data: Reply timeout.");
+ PrintAndLog("PRNG data: Reply timeout.");
return -1;
}
projects / proxmark3-svn / commitdiff