From c830303d7efc90879cf2124a484991f38c58654d Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 25 Jun 2015 12:41:39 +0200 Subject: [PATCH] FIX: @pwpiwi 's fixes for darkside / nested attack about the NACK/PRNG bugs. --- armsrc/iso14443a.c | 70 +++++++++++++++++++++++++-------------------- armsrc/mifarecmd.c | 23 +++++++++++---- client/cmdhfmf.c | 37 +++++++++++++++++------- client/mifarehost.c | 23 +++++++-------- 4 files changed, 94 insertions(+), 59 deletions(-) diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index 027703ec..354b829c 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -2175,11 +2175,13 @@ void ReaderIso14443a(UsbCommand *c) // Therefore try in alternating directions. int32_t dist_nt(uint32_t nt1, uint32_t nt2) { + uint16_t i; + uint32_t nttmp1, nttmp2; + if (nt1 == nt2) return 0; - uint16_t i; - uint32_t nttmp1 = nt1; - uint32_t nttmp2 = nt2; + nttmp1 = nt1; + nttmp2 = nt2; for (i = 1; i < 32768; i++) { nttmp1 = prng_successor(nttmp1, 1); @@ -2198,27 +2200,28 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) { // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime" // (article by Nicolas T. Courtois, 2009) //----------------------------------------------------------------------------- -void ReaderMifare(bool first_try) { +void ReaderMifare(bool first_try) +{ + // Mifare AUTH + uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b }; + uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; + static uint8_t mf_nr_ar3; + + uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; + uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE]; + // free eventually allocated BigBuf memory. We want all for tracing. BigBuf_free(); clear_trace(); set_tracing(TRUE); - // Mifare AUTH - uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b }; - uint8_t mf_nr_ar[8] = { 0x00 }; //{ 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 }; - static uint8_t mf_nr_ar3 = 0; - - uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = { 0x00 }; - uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = { 0x00 }; - byte_t nt_diff = 0; uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough static byte_t par_low = 0; bool led_on = TRUE; - uint8_t uid[10] = {0x00}; - //uint32_t cuid = 0x00; + uint8_t uid[10] ={0}; + uint32_t cuid; uint32_t nt = 0; uint32_t previous_nt = 0; @@ -2233,8 +2236,6 @@ void ReaderMifare(bool first_try) { uint16_t consecutive_resyncs = 0; int isOK = 0; - int numWrongDistance = 0; - if (first_try) { mf_nr_ar3 = 0; iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD); @@ -2254,22 +2255,23 @@ void ReaderMifare(bool first_try) { LED_A_ON(); LED_B_OFF(); LED_C_OFF(); - LED_C_ON(); + + + #define DARKSIDE_MAX_TRIES 32 // number of tries to sync on PRNG cycle. Then give up. + uint16_t unsuccessfull_tries = 0; for(uint16_t i = 0; TRUE; i++) { + LED_C_ON(); WDT_HIT(); // Test if the action was cancelled - if(BUTTON_PRESS()) break; - - if (numWrongDistance > 1000) { - isOK = 0; + if(BUTTON_PRESS()) { + isOK = -1; break; } - //if(!iso14443a_select_card(uid, NULL, &cuid)) { - if(!iso14443a_select_card(uid, NULL, NULL)) { + if(!iso14443a_select_card(uid, NULL, &cuid)) { if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card"); continue; } @@ -2303,14 +2305,15 @@ void ReaderMifare(bool first_try) { nt_attacked = nt; } else { - - // invalid nonce received, try again - if (nt_distance == -99999) { - numWrongDistance++; - if (MF_DBGLEVEL >= 3) Dbprintf("The two nonces has invalid distance, tag could have good PRNG\n"); - continue; + if (nt_distance == -99999) { // invalid nonce received + unsuccessfull_tries++; + if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) { + isOK = -3; // Card has an unpredictable PRNG. Give up + break; + } else { + continue; // continue trying... + } } - sync_cycles = (sync_cycles - nt_distance); if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles); continue; @@ -2319,7 +2322,7 @@ void ReaderMifare(bool first_try) { if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again... catch_up_cycles = -dist_nt(nt_attacked, nt); - if (catch_up_cycles >= 99999) { // invalid nonce received. Don't resync on that one. + if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one. catch_up_cycles = 0; continue; } @@ -2371,12 +2374,17 @@ void ReaderMifare(bool first_try) { if (nt_diff == 0 && first_try) { par[0]++; + if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK. + isOK = -2; + break; + } } else { par[0] = ((par[0] & 0x1F) + 1) | par_low; } } } + mf_nr_ar[3] &= 0x1F; byte_t buf[28] = {0x00}; diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index 5d10ad81..b9f8e81e 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -16,7 +16,6 @@ #include "mifarecmd.h" #include "apps.h" #include "util.h" - #include "crc.h" //----------------------------------------------------------------------------- @@ -641,6 +640,9 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat // statistics on nonce distance + int16_t isOK = 0; + #define NESTED_MAX_TRIES 12 + uint16_t unsuccessfull_tries = 0; if (calibrate) { // for first call only. Otherwise reuse previous calibration LED_B_ON(); WDT_HIT(); @@ -651,6 +653,12 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat for (rtr = 0; rtr < 17; rtr++) { + // Test if the action was cancelled + if(BUTTON_PRESS()) { + isOK = -2; + break; + } + // prepare next select. No need to power down the card. if(mifare_classic_halt(pcs, cuid)) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error"); @@ -698,14 +706,17 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing } if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i); + } else { + unsuccessfull_tries++; + if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable) + isOK = -3; + } } } - - if (rtr <= 1) return; davg = (davg + (rtr - 1)/2) / (rtr - 1); - if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time); + if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time); dmin = davg - 2; dmax = davg + 2; @@ -718,7 +729,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat LED_C_ON(); // get crypted nonces for target sector - for(i=0; i < 2; i++) { // look for exactly two different nonces + for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces target_nt[i] = 0; while(target_nt[i] == 0) { // continue until we have an unambiguous nonce @@ -796,7 +807,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat memcpy(buf+16, &target_ks[1], 4); LED_B_ON(); - cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf)); + cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf)); LED_B_OFF(); if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED"); diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 809c623a..58d2061a 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -18,7 +18,7 @@ int CmdHF14AMifare(const char *Cmd) uint32_t uid = 0; uint32_t nt = 0, nr = 0; uint64_t par_list = 0, ks_list = 0, r_key = 0; - uint8_t isOK = 0; + int16_t isOK = 0; uint8_t keyBlock[8] = {0}; UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}}; @@ -26,7 +26,7 @@ int CmdHF14AMifare(const char *Cmd) // message printf("-------------------------------------------------------------------------\n"); printf("Executing command. Expected execution time: 25sec on average :-)\n"); - printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n"); + printf("Press button on the proxmark3 device to abort both proxmark3 and client.\n"); printf("-------------------------------------------------------------------------\n"); @@ -49,14 +49,19 @@ start: UsbCommand resp; if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { - isOK = resp.arg[0] & 0xff; + isOK = resp.arg[0]; uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4); nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4); par_list = bytes_to_num(resp.d.asBytes + 8, 8); ks_list = bytes_to_num(resp.d.asBytes + 16, 8); nr = bytes_to_num(resp.d.asBytes + 24, 4); printf("\n\n"); - if (!isOK) PrintAndLog("Proxmark can't get statistic info. Execution aborted.\n"); + switch (isOK) { + case -1 : PrintAndLog("Button pressed. Aborted.\n"); break; + case -2 : PrintAndLog("Card is not vulnerable to Darkside attack (doesn't send NACK on authentication requests).\n"); break; + case -3 : PrintAndLog("Card is not vulnerable to Darkside attack (its random number generator is not predictable).\n"); break; + default: ; + } break; } } @@ -623,8 +628,14 @@ int CmdHF14AMfNested(const char *Cmd) if (cmdp == 'o') { PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A'); - if (mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true)) { - PrintAndLog("Nested error."); + int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true); + if (isOK) { + switch (isOK) { + case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; + case -2 : PrintAndLog("Button pressed. Aborted.\n"); break; + case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break; + default : PrintAndLog("Unknown Error.\n"); + } return 2; } key64 = bytes_to_num(keyBlock, 6); @@ -697,11 +708,17 @@ int CmdHF14AMfNested(const char *Cmd) for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) { if (e_sector[sectorNo].foundKey[trgKeyType]) continue; PrintAndLog("-----------------------------------------------"); - if(mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate)) { - PrintAndLog("Nested error.\n"); + int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate); + if(isOK) { + switch (isOK) { + case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; + case -2 : PrintAndLog("Button pressed. Aborted.\n"); break; + case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break; + default : PrintAndLog("Unknown Error.\n"); + } free(e_sector); - return 2; } - else { + return 2; + } else { calibrate = false; } diff --git a/client/mifarehost.c b/client/mifarehost.c index d754b06b..b18450cf 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -71,9 +71,10 @@ void* nested_worker_thread(void *arg) int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * resultKey, bool calibrate) { - uint16_t i, len; + uint16_t i; uint32_t uid; UsbCommand resp; + StateList_t statelists[2]; struct Crypto1State *p1, *p2, *p3, *p4; @@ -84,26 +85,24 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo memcpy(c.d.asBytes, key, 6); SendCommand(&c); - if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) { - len = resp.arg[1]; - if (len == 2) { + if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { + return -1; + } + + if (resp.arg[0]) { + return resp.arg[0]; // error during nested + } + memcpy(&uid, resp.d.asBytes, 4); - PrintAndLog("uid:%08x len=%d trgbl=%d trgkey=%x", uid, len, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8); + PrintAndLog("uid:%08x trgbl=%d trgkey=%x", uid, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8); for (i = 0; i < 2; i++) { statelists[i].blockNo = resp.arg[2] & 0xff; statelists[i].keyType = (resp.arg[2] >> 8) & 0xff; statelists[i].uid = uid; - memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4); memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4); } - } - else { - PrintAndLog("Got 0 keys from proxmark."); - return 1; - } - } // calc keys -- 2.39.2