From: pwpiwi <pwpiwi@users.noreply.github.com>
Date: Mon, 20 Mar 2017 20:05:26 +0000 (+0100)
Subject: fix: crapto3.3 sometimes crashing with hf mf mifare on Fudan clones (no par, all... 
X-Git-Tag: v3.0.0~48
X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/de867f502fd3611678d3ed26f69eb6b141f542fc

fix: crapto3.3 sometimes crashing with hf mf mifare on Fudan clones (no par, all NACK) (#233)

added readme.txt again in tools/nonce2key
---

diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c
index d146b723..6573b39d 100644
--- a/client/nonce2key/nonce2key.c
+++ b/client/nonce2key/nonce2key.c
@@ -76,7 +76,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
 	if (par_info == 0)
 		PrintAndLog("Parity is all zero, trying special attack! Just wait for few more seconds...");
   
-	state = lfsr_common_prefix(nr, rr, ks3x, par);
+	state = lfsr_common_prefix(nr, rr, ks3x, par, (par_info == 0));
 	state_s = (int64_t*)state;
 	
 	//char filename[50] ;
diff --git a/common/crapto1/crapto1.c b/common/crapto1/crapto1.c
index 82c5b65b..50ff6e1a 100644
--- a/common/crapto1/crapto1.c
+++ b/common/crapto1/crapto1.c
@@ -465,18 +465,9 @@ uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
  */
 static struct Crypto1State*
 check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
-          	uint32_t odd, uint32_t even, struct Crypto1State* sl)
+          	uint32_t odd, uint32_t even, struct Crypto1State* sl, uint32_t no_par)
 {
-	uint32_t ks1, nr, ks2, rr, ks3, c, good = 1, no_par = 1;
-
-	for (int i = 0; i < 8; i++) {
-		for (int j = 0; j < 8; j++) {
-			if (parities[i][j] != 0) {
-				no_par = 0;
-				break;
-			}
-		}
-	}
+	uint32_t ks1, nr, ks2, rr, ks3, c, good = 1;
 
 	for(c = 0; good && c < 8; ++c) {
 		sl->odd = odd ^ fastfwd[1][c];
@@ -510,7 +501,7 @@ check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
  * Implentation of the common prefix attack.
  */
 struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
+lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint32_t no_par)
 {
 	struct Crypto1State *statelist, *s;
 	uint32_t *odd, *even, *o, *e, top;
@@ -518,7 +509,7 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
 	odd = lfsr_prefix_ks(ks, 1);
 	even = lfsr_prefix_ks(ks, 0);
 
-	s = statelist = malloc((sizeof *statelist) << 20);
+	s = statelist = malloc((sizeof *statelist) << 21); // need more for no_par special attack. Enough???
 	if(!s || !odd || !even) {
 		free(statelist);
 		statelist = 0;
@@ -530,7 +521,7 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
 			for(top = 0; top < 64; ++top) {
 				*o += 1 << 21;
 				*e += (!(top & 7) + 1) << 21;
-				s = check_pfx_parity(pfx, rr, par, *o, *e, s);
+				s = check_pfx_parity(pfx, rr, par, *o, *e, s, no_par);
 			}
 
 	s->odd = s->even = 0;
diff --git a/common/crapto1/crapto1.h b/common/crapto1/crapto1.h
index aef59b03..e718b1f2 100644
--- a/common/crapto1/crapto1.h
+++ b/common/crapto1/crapto1.h
@@ -41,7 +41,7 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
 struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
 uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
 struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
+lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint32_t no_par);
 
 
 uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
diff --git a/tools/nonce2key/Makefile b/tools/nonce2key/Makefile
index 11e019de..9772e13d 100644
--- a/tools/nonce2key/Makefile
+++ b/tools/nonce2key/Makefile
@@ -14,7 +14,7 @@ all: $(OBJS) $(EXES)
 %.o : %.c
 	$(CC) $(CFLAGS) -c -o $@ $<
 
-% : %.c
+% : %.c $(OBJS)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS) $<
 
 clean: 
diff --git a/tools/nonce2key/nonce2key.c b/tools/nonce2key/nonce2key.c
index b789dca4..9cee06d6 100644
--- a/tools/nonce2key/nonce2key.c
+++ b/tools/nonce2key/nonce2key.c
@@ -47,7 +47,7 @@ int main(const int argc, const char* argv[]) {
     printf("%01x|\n",par[i][7]);
   }
   
-  state = lfsr_common_prefix(nr,rr,ks3x,par);
+  state = lfsr_common_prefix(nr,rr,ks3x,par,0);
   lfsr_rollback_word(state,uid^nt,0);
   crypto1_get_lfsr(state,&key_recovered);
   printf("\nkey recovered: %012" PRIx64 "\n\n",key_recovered);
diff --git a/tools/nonce2key/readme.txt b/tools/nonce2key/readme.txt
new file mode 100644
index 00000000..d9f0862f
--- /dev/null
+++ b/tools/nonce2key/readme.txt
@@ -0,0 +1,7 @@
+To test the nonce2key tool.
+
+:: tip
+You can use the output from "hf mf mifare"  to use with this tool. 
+
+:: sample
+./nonce2key e9cadd9c a8bf4a12 a020a8285858b090 050f010607060e07