fix: crapto3.3 sometimes crashing with hf mf mifare on Fudan clones (no par, all...

added readme.txt again in tools/nonce2key

diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c
index d146b7239fe2d778677943207edfe528486ec717..6573b39da72a100a0c22c3fa9191c628ab59cf95 100644 (file)
--- a/client/nonce2key/nonce2key.c
+++ b/client/nonce2key/nonce2key.c
@@ -76,7 +76,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
        if (par_info == 0)
                PrintAndLog("Parity is all zero, trying special attack! Just wait for few more seconds...");
   
        if (par_info == 0)
                PrintAndLog("Parity is all zero, trying special attack! Just wait for few more seconds...");
   

-       state = lfsr_common_prefix(nr, rr, ks3x, par);
+       state = lfsr_common_prefix(nr, rr, ks3x, par, (par_info == 0));

        state_s = (int64_t*)state;
        
        //char filename[50] ;
        state_s = (int64_t*)state;
        
        //char filename[50] ;

diff --git a/common/crapto1/crapto1.c b/common/crapto1/crapto1.c
index 82c5b65bc2a8e32ca5e38e117192cefa24a0f59c..50ff6e1a86c2143deb52039aba8b9ab90c9dea22 100644 (file)
--- a/common/crapto1/crapto1.c
+++ b/common/crapto1/crapto1.c
@@ -465,18 +465,9 @@ uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
  */
 static struct Crypto1State*
 check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
  */
 static struct Crypto1State*
 check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],

-               uint32_t odd, uint32_t even, struct Crypto1State* sl)
+               uint32_t odd, uint32_t even, struct Crypto1State* sl, uint32_t no_par)

 {
 {

-       uint32_t ks1, nr, ks2, rr, ks3, c, good = 1, no_par = 1;
-
-       for (int i = 0; i < 8; i++) {
-               for (int j = 0; j < 8; j++) {
-                       if (parities[i][j] != 0) {
-                               no_par = 0;
-                               break;
-                       }
-               }
-       }
+       uint32_t ks1, nr, ks2, rr, ks3, c, good = 1;

 
        for(c = 0; good && c < 8; ++c) {
                sl->odd = odd ^ fastfwd[1][c];
 
        for(c = 0; good && c < 8; ++c) {
                sl->odd = odd ^ fastfwd[1][c];


@@ -510,7 +501,7 @@ check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
  * Implentation of the common prefix attack.
  */
 struct Crypto1State*
  * Implentation of the common prefix attack.
  */
 struct Crypto1State*

-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
+lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint32_t no_par)

 {
        struct Crypto1State *statelist, *s;
        uint32_t *odd, *even, *o, *e, top;
 {
        struct Crypto1State *statelist, *s;
        uint32_t *odd, *even, *o, *e, top;


@@ -518,7 +509,7 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
        odd = lfsr_prefix_ks(ks, 1);
        even = lfsr_prefix_ks(ks, 0);
 
        odd = lfsr_prefix_ks(ks, 1);
        even = lfsr_prefix_ks(ks, 0);
 

-       s = statelist = malloc((sizeof *statelist) << 20);
+       s = statelist = malloc((sizeof *statelist) << 21); // need more for no_par special attack. Enough???

        if(!s || !odd || !even) {
                free(statelist);
                statelist = 0;
        if(!s || !odd || !even) {
                free(statelist);
                statelist = 0;


@@ -530,7 +521,7 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
                        for(top = 0; top < 64; ++top) {
                                *o += 1 << 21;
                                *e += (!(top & 7) + 1) << 21;
                        for(top = 0; top < 64; ++top) {
                                *o += 1 << 21;
                                *e += (!(top & 7) + 1) << 21;

-                               s = check_pfx_parity(pfx, rr, par, *o, *e, s);
+                               s = check_pfx_parity(pfx, rr, par, *o, *e, s, no_par);

                        }
 
        s->odd = s->even = 0;
                        }
 
        s->odd = s->even = 0;

diff --git a/common/crapto1/crapto1.h b/common/crapto1/crapto1.h
index aef59b03d8215747cd044eeb2e59b141301b3716..e718b1f2f278d9f8cc7adfd7693021724524c6ac 100644 (file)
--- a/common/crapto1/crapto1.h
+++ b/common/crapto1/crapto1.h
@@ -41,7 +41,7 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
 struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
 uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
 struct Crypto1State*
 struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
 uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
 struct Crypto1State*

-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
+lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint32_t no_par);

 
 
 uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
 
 
 uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);

diff --git a/tools/nonce2key/Makefile b/tools/nonce2key/Makefile
index 11e019de0657b7f4d8c8470412f80f8dc04d489a..9772e13d4f62b3e3207a4fc0ecc30a225cc5563f 100644 (file)
--- a/tools/nonce2key/Makefile
+++ b/tools/nonce2key/Makefile
@@ -14,7 +14,7 @@ all: $(OBJS) $(EXES)
 %.o : %.c
        $(CC) $(CFLAGS) -c -o $@ $<
 
 %.o : %.c
        $(CC) $(CFLAGS) -c -o $@ $<
 

-% : %.c
+% : %.c $(OBJS)

        $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS) $<
 
 clean: 
        $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS) $<
 
 clean: 

diff --git a/tools/nonce2key/nonce2key.c b/tools/nonce2key/nonce2key.c
index b789dca4c748bf22b97c9ea78deb46ca96a8fb1f..9cee06d67767c47652716f5f40ecb1cb737d41d3 100644 (file)
--- a/tools/nonce2key/nonce2key.c
+++ b/tools/nonce2key/nonce2key.c
@@ -47,7 +47,7 @@ int main(const int argc, const char* argv[]) {
     printf("%01x|\n",par[i][7]);
   }
   
     printf("%01x|\n",par[i][7]);
   }
   

-  state = lfsr_common_prefix(nr,rr,ks3x,par);
+  state = lfsr_common_prefix(nr,rr,ks3x,par,0);

   lfsr_rollback_word(state,uid^nt,0);
   crypto1_get_lfsr(state,&key_recovered);
   printf("\nkey recovered: %012" PRIx64 "\n\n",key_recovered);
   lfsr_rollback_word(state,uid^nt,0);
   crypto1_get_lfsr(state,&key_recovered);
   printf("\nkey recovered: %012" PRIx64 "\n\n",key_recovered);

diff --git a/tools/nonce2key/readme.txt b/tools/nonce2key/readme.txt
new file mode 100644 (file)
index 0000000..d9f0862
--- /dev/null
+++ b/tools/nonce2key/readme.txt
@@ -0,0 +1,7 @@
+To test the nonce2key tool.
+
+:: tip
+You can use the output from "hf mf mifare"  to use with this tool. 
+
+:: sample
+./nonce2key e9cadd9c a8bf4a12 a020a8285858b090 050f010607060e07