812513bf |
1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2016 iceman |
3 | // |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
5 | // at your option, any later version. See the LICENSE.txt file for the text of |
6 | // the license. |
7 | //----------------------------------------------------------------------------- |
8 | // Analyse bytes commands |
9 | //----------------------------------------------------------------------------- |
10 | #include "cmdanalyse.h" |
b403c300 |
11 | #include "nonce2key/nonce2key.h" |
812513bf |
12 | |
13 | static int CmdHelp(const char *Cmd); |
14 | |
15 | int usage_analyse_lcr(void) { |
16 | PrintAndLog("Specifying the bytes of a UID with a known LRC will find the last byte value"); |
17 | PrintAndLog("needed to generate that LRC with a rolling XOR. All bytes should be specified in HEX."); |
18 | PrintAndLog(""); |
19 | PrintAndLog("Usage: analyse lcr [h] <bytes>"); |
20 | PrintAndLog("Options:"); |
21 | PrintAndLog(" h This help"); |
22 | PrintAndLog(" <bytes> bytes to calc missing XOR in a LCR"); |
23 | PrintAndLog(""); |
24 | PrintAndLog("Samples:"); |
25 | PrintAndLog(" analyse lcr 04008064BA"); |
26 | PrintAndLog("expected output: Target (BA) requires final LRC XOR byte value: 5A"); |
27 | return 0; |
28 | } |
53b3c3e8 |
29 | int usage_analyse_checksum(void) { |
30 | PrintAndLog("The bytes will be added with eachother and than limited with the applied mask"); |
31 | PrintAndLog("Finally compute ones' complement of the least significant bytes"); |
32 | PrintAndLog(""); |
026ac759 |
33 | PrintAndLog("Usage: analyse chksum [h] [v] b <bytes> m <mask>"); |
53b3c3e8 |
34 | PrintAndLog("Options:"); |
35 | PrintAndLog(" h This help"); |
026ac759 |
36 | PrintAndLog(" v supress header"); |
53b3c3e8 |
37 | PrintAndLog(" b <bytes> bytes to calc missing XOR in a LCR"); |
38 | PrintAndLog(" m <mask> bit mask to limit the outpuyt"); |
39 | PrintAndLog(""); |
40 | PrintAndLog("Samples:"); |
41 | PrintAndLog(" analyse chksum b 137AF00A0A0D m FF"); |
42 | PrintAndLog("expected output: 0x61"); |
43 | return 0; |
44 | } |
53b3c3e8 |
45 | int usage_analyse_crc(void){ |
46 | PrintAndLog("A stub method to test different crc implementations inside the PM3 sourcecode. Just because you figured out the poly, doesn't mean you get the desired output"); |
47 | PrintAndLog(""); |
48 | PrintAndLog("Usage: analyse crc [h] <bytes>"); |
49 | PrintAndLog("Options:"); |
50 | PrintAndLog(" h This help"); |
51 | PrintAndLog(" <bytes> bytes to calc crc"); |
52 | PrintAndLog(""); |
53 | PrintAndLog("Samples:"); |
54 | PrintAndLog(" analyse crc 137AF00A0A0D"); |
55 | return 0; |
56 | } |
09bb01c7 |
57 | int usage_analyse_hid(void){ |
58 | PrintAndLog("Permute function from 'heart of darkness' paper."); |
59 | PrintAndLog(""); |
60 | PrintAndLog("Usage: analyse hid [h] <r|f> <bytes>"); |
61 | PrintAndLog("Options:"); |
62 | PrintAndLog(" h This help"); |
63 | PrintAndLog(" r reverse permuted key"); |
64 | PrintAndLog(" f permute key"); |
65 | PrintAndLog(" <bytes> input bytes"); |
66 | PrintAndLog(""); |
67 | PrintAndLog("Samples:"); |
68 | PrintAndLog(" analyse hid r 0123456789abcdef"); |
69 | return 0; |
70 | } |
53b3c3e8 |
71 | |
812513bf |
72 | static uint8_t calculateLRC( uint8_t* bytes, uint8_t len) { |
73 | uint8_t LRC = 0; |
74 | for (uint8_t i = 0; i < len; i++) |
75 | LRC ^= bytes[i]; |
76 | return LRC; |
77 | } |
53b3c3e8 |
78 | |
62dc7d4a |
79 | static uint16_t calcSumCrumbAdd( uint8_t* bytes, uint8_t len, uint32_t mask) { |
53b3c3e8 |
80 | uint8_t sum = 0; |
81 | for (uint8_t i = 0; i < len; i++) { |
82 | sum += CRUMB(bytes[i], 0); |
83 | sum += CRUMB(bytes[i], 2); |
84 | sum += CRUMB(bytes[i], 4); |
85 | sum += CRUMB(bytes[i], 6); |
86 | } |
6c283951 |
87 | sum &= mask; |
53b3c3e8 |
88 | return sum; |
89 | } |
62dc7d4a |
90 | static uint16_t calcSumCrumbAddOnes( uint8_t* bytes, uint8_t len, uint32_t mask) { |
f054036a |
91 | return (~calcSumCrumbAdd(bytes, len, mask) & mask); |
53b3c3e8 |
92 | } |
62dc7d4a |
93 | static uint16_t calcSumNibbleAdd( uint8_t* bytes, uint8_t len, uint32_t mask) { |
53b3c3e8 |
94 | uint8_t sum = 0; |
95 | for (uint8_t i = 0; i < len; i++) { |
96 | sum += NIBBLE_LOW(bytes[i]); |
97 | sum += NIBBLE_HIGH(bytes[i]); |
98 | } |
6c283951 |
99 | sum &= mask; |
53b3c3e8 |
100 | return sum; |
101 | } |
62dc7d4a |
102 | static uint16_t calcSumNibbleAddOnes( uint8_t* bytes, uint8_t len, uint32_t mask){ |
f054036a |
103 | return (~calcSumNibbleAdd(bytes, len, mask) & mask); |
53b3c3e8 |
104 | } |
62dc7d4a |
105 | static uint16_t calcSumCrumbXor( uint8_t* bytes, uint8_t len, uint32_t mask) { |
2c601080 |
106 | uint8_t sum = 0; |
107 | for (uint8_t i = 0; i < len; i++) { |
108 | sum ^= CRUMB(bytes[i], 0); |
109 | sum ^= CRUMB(bytes[i], 2); |
110 | sum ^= CRUMB(bytes[i], 4); |
111 | sum ^= CRUMB(bytes[i], 6); |
112 | } |
113 | sum &= mask; |
114 | return sum; |
115 | } |
62dc7d4a |
116 | static uint16_t calcSumNibbleXor( uint8_t* bytes, uint8_t len, uint32_t mask) { |
32da0a46 |
117 | uint8_t sum = 0; |
118 | for (uint8_t i = 0; i < len; i++) { |
119 | sum ^= NIBBLE_LOW(bytes[i]); |
120 | sum ^= NIBBLE_HIGH(bytes[i]); |
121 | } |
2c601080 |
122 | sum &= mask; |
32da0a46 |
123 | return sum; |
124 | } |
62dc7d4a |
125 | static uint16_t calcSumByteXor( uint8_t* bytes, uint8_t len, uint32_t mask) { |
32da0a46 |
126 | uint8_t sum = 0; |
127 | for (uint8_t i = 0; i < len; i++) |
128 | sum ^= bytes[i]; |
129 | sum &= mask; |
130 | return sum; |
131 | } |
62dc7d4a |
132 | static uint16_t calcSumByteAdd( uint8_t* bytes, uint8_t len, uint32_t mask) { |
53b3c3e8 |
133 | uint8_t sum = 0; |
134 | for (uint8_t i = 0; i < len; i++) |
135 | sum += bytes[i]; |
6c283951 |
136 | sum &= mask; |
53b3c3e8 |
137 | return sum; |
138 | } |
139 | // Ones complement |
62dc7d4a |
140 | static uint16_t calcSumByteAddOnes( uint8_t* bytes, uint8_t len, uint32_t mask) { |
f054036a |
141 | return (~calcSumByteAdd(bytes, len, mask) & mask); |
53b3c3e8 |
142 | } |
143 | |
62dc7d4a |
144 | static uint16_t calcSumByteSub( uint8_t* bytes, uint8_t len, uint32_t mask) { |
53b3c3e8 |
145 | uint8_t sum = 0; |
146 | for (uint8_t i = 0; i < len; i++) |
147 | sum -= bytes[i]; |
6c283951 |
148 | sum &= mask; |
53b3c3e8 |
149 | return sum; |
150 | } |
62dc7d4a |
151 | static uint16_t calcSumByteSubOnes( uint8_t* bytes, uint8_t len, uint32_t mask){ |
f054036a |
152 | return (~calcSumByteSub(bytes, len, mask) & mask); |
53b3c3e8 |
153 | } |
62dc7d4a |
154 | static uint16_t calcSumNibbleSub( uint8_t* bytes, uint8_t len, uint32_t mask) { |
53b3c3e8 |
155 | uint8_t sum = 0; |
156 | for (uint8_t i = 0; i < len; i++) { |
157 | sum -= NIBBLE_LOW(bytes[i]); |
158 | sum -= NIBBLE_HIGH(bytes[i]); |
159 | } |
6c283951 |
160 | sum &= mask; |
53b3c3e8 |
161 | return sum; |
162 | } |
62dc7d4a |
163 | static uint16_t calcSumNibbleSubOnes( uint8_t* bytes, uint8_t len, uint32_t mask) { |
f054036a |
164 | return (~calcSumNibbleSub(bytes, len, mask) & mask); |
53b3c3e8 |
165 | } |
166 | |
62dc7d4a |
167 | // BSD shift checksum 8bit version |
168 | static uint16_t calcBSDchecksum8( uint8_t* bytes, uint8_t len, uint32_t mask){ |
169 | uint16_t sum = 0; |
170 | for(uint8_t i = 0; i < len; i++){ |
171 | sum = ((sum & 0xFF) >> 1) | ((sum & 0x1) << 7); // rotate accumulator |
172 | sum += bytes[i]; // add next byte |
173 | sum &= 0xFF; // |
174 | } |
175 | sum &= mask; |
176 | return sum; |
177 | } |
178 | // BSD shift checksum 4bit version |
179 | static uint16_t calcBSDchecksum4( uint8_t* bytes, uint8_t len, uint32_t mask){ |
180 | uint16_t sum = 0; |
181 | for(uint8_t i = 0; i < len; i++){ |
182 | sum = ((sum & 0xF) >> 1) | ((sum & 0x1) << 3); // rotate accumulator |
183 | sum += NIBBLE_HIGH(bytes[i]); // add high nibble |
184 | sum &= 0xF; // |
185 | sum = ((sum & 0xF) >> 1) | ((sum & 0x1) << 3); // rotate accumulator |
186 | sum += NIBBLE_LOW(bytes[i]); // add low nibble |
187 | sum &= 0xF; // |
188 | } |
189 | sum &= mask; |
190 | return sum; |
191 | } |
192 | |
b403c300 |
193 | // measuring LFSR maximum length |
194 | int CmdAnalyseLfsr(const char *Cmd){ |
195 | |
196 | uint16_t start_state = 0; /* Any nonzero start state will work. */ |
197 | uint16_t lfsr = start_state; |
198 | //uint32_t period = 0; |
199 | |
200 | uint8_t iv = param_get8ex(Cmd, 0, 0, 16); |
201 | uint8_t find = param_get8ex(Cmd, 1, 0, 16); |
202 | |
203 | printf("LEGIC LFSR IV 0x%02X: \n", iv); |
204 | printf(" bit# | lfsr | ^0x40 | 0x%02X ^ lfsr \n",find); |
205 | |
206 | for (uint8_t i = 0x01; i < 0x30; i += 1) { |
207 | //period = 0; |
208 | legic_prng_init(iv); |
209 | legic_prng_forward(i); |
210 | lfsr = legic_prng_get_bits(12); |
211 | |
212 | printf(" %02X | %03X | %03X | %03X \n",i, lfsr, 0x40 ^ lfsr, find ^ lfsr); |
213 | } |
214 | return 0; |
215 | } |
812513bf |
216 | int CmdAnalyseLCR(const char *Cmd) { |
217 | uint8_t data[50]; |
218 | char cmdp = param_getchar(Cmd, 0); |
219 | if (strlen(Cmd) == 0|| cmdp == 'h' || cmdp == 'H') return usage_analyse_lcr(); |
220 | |
221 | int len = 0; |
222 | param_gethex_ex(Cmd, 0, data, &len); |
223 | if ( len%2 ) return usage_analyse_lcr(); |
224 | len >>= 1; |
225 | uint8_t finalXor = calculateLRC(data, len); |
226 | PrintAndLog("Target [%02X] requires final LRC XOR byte value: 0x%02X",data[len-1] ,finalXor); |
227 | return 0; |
228 | } |
53b3c3e8 |
229 | int CmdAnalyseCRC(const char *Cmd) { |
230 | |
231 | char cmdp = param_getchar(Cmd, 0); |
232 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_analyse_crc(); |
233 | |
234 | int len = strlen(Cmd); |
235 | if ( len & 1 ) return usage_analyse_crc(); |
236 | |
237 | // add 1 for null terminator. |
238 | uint8_t *data = malloc(len+1); |
239 | if ( data == NULL ) return 1; |
240 | |
241 | if ( param_gethex(Cmd, 0, data, len)) { |
242 | free(data); |
243 | return usage_analyse_crc(); |
244 | } |
245 | len >>= 1; |
246 | |
6c283951 |
247 | //PrintAndLog("\nTests with '%s' hex bytes", sprint_hex(data, len)); |
53b3c3e8 |
248 | |
249 | PrintAndLog("\nTests of reflection. Two current methods in source code"); |
250 | PrintAndLog(" reflect(0x3e23L,3) is %04X == 0x3e26", reflect(0x3e23L,3) ); |
251 | PrintAndLog(" SwapBits(0x3e23L,3) is %04X == 0x3e26", SwapBits(0x3e23L,3) ); |
252 | PrintAndLog(" 0xB400 == %04X", reflect( (1 << 16 | 0xb400),16) ); |
253 | |
254 | // |
255 | // Test of CRC16, '123456789' string. |
256 | // |
257 | PrintAndLog("\nTests with '123456789' string"); |
258 | uint8_t dataStr[] = { 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39 }; |
259 | uint8_t legic8 = CRC8Legic(dataStr, sizeof(dataStr)); |
260 | |
53b3c3e8 |
261 | PrintAndLog("LEGIC: CRC16: %X", CRC16Legic(dataStr, sizeof(dataStr), legic8)); |
262 | |
263 | //these below has been tested OK. |
264 | PrintAndLog("Confirmed CRC Implementations"); |
265 | PrintAndLog("LEGIC: CRC8 : %X (0xC6 expected)", legic8); |
266 | PrintAndLog("MAXIM: CRC8 : %X (0xA1 expected)", CRC8Maxim(dataStr, sizeof(dataStr))); |
267 | PrintAndLog("DNP : CRC16: %X (0x82EA expected)", CRC16_DNP(dataStr, sizeof(dataStr))); |
df007486 |
268 | PrintAndLog("CCITT: CRC16: %X (0xE5CC expected)", CRC16_CCITT(dataStr, sizeof(dataStr))); |
269 | |
270 | PrintAndLog("ICLASS org: CRC16: %X (0x expected)",iclass_crc16( (char*)dataStr, sizeof(dataStr))); |
271 | PrintAndLog("ICLASS ice: CRC16: %X (0x expected)",CRC16_ICLASS(dataStr, sizeof(dataStr))); |
272 | |
273 | |
274 | |
275 | uint8_t dataStr1234[] = { 0x1,0x2,0x3,0x4}; |
276 | PrintAndLog("ISO15693 org: : CRC16: %X (0xF0B8 expected)", Iso15693Crc(dataStr1234, sizeof(dataStr1234))); |
277 | PrintAndLog("ISO15693 ice: : CRC16: %X (0xF0B8 expected)", CRC16_Iso15693(dataStr1234, sizeof(dataStr1234))); |
53b3c3e8 |
278 | |
279 | free(data); |
280 | return 0; |
281 | } |
282 | int CmdAnalyseCHKSUM(const char *Cmd){ |
283 | |
284 | uint8_t data[50]; |
285 | uint8_t cmdp = 0; |
2c601080 |
286 | uint32_t mask = 0xFFFF; |
53b3c3e8 |
287 | bool errors = false; |
62dc7d4a |
288 | bool useHeader = false; |
53b3c3e8 |
289 | int len = 0; |
5f7e30f8 |
290 | memset(data, 0x0, sizeof(data)); |
53b3c3e8 |
291 | |
292 | while(param_getchar(Cmd, cmdp) != 0x00) { |
293 | switch(param_getchar(Cmd, cmdp)) { |
294 | case 'b': |
295 | case 'B': |
296 | param_gethex_ex(Cmd, cmdp+1, data, &len); |
297 | if ( len%2 ) errors = true; |
298 | len >>= 1; |
299 | cmdp += 2; |
300 | break; |
301 | case 'm': |
302 | case 'M': |
303 | mask = param_get32ex(Cmd, cmdp+1, 0, 16); |
304 | cmdp += 2; |
305 | break; |
62dc7d4a |
306 | case 'v': |
307 | case 'V': |
308 | useHeader = true; |
309 | cmdp++; |
310 | break; |
53b3c3e8 |
311 | case 'h': |
312 | case 'H': |
313 | return usage_analyse_checksum(); |
314 | default: |
315 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp)); |
316 | errors = true; |
317 | break; |
318 | } |
319 | if(errors) break; |
320 | } |
321 | //Validations |
322 | if(errors) return usage_analyse_checksum(); |
323 | |
62dc7d4a |
324 | if (useHeader) { |
325 | PrintAndLog(" add | sub | add 1's compl | sub 1's compl | xor"); |
f054036a |
326 | PrintAndLog("byte nibble crumb | byte nibble | byte nibble cumb | byte nibble | byte nibble cumb | BSD |"); |
62dc7d4a |
327 | PrintAndLog("------------------+-------------+------------------+-----------------+--------------------"); |
328 | } |
f054036a |
329 | PrintAndLog("0x%X 0x%X 0x%X | 0x%X 0x%X | 0x%X 0x%X 0x%X | 0x%X 0x%X | 0x%X 0x%X 0x%X | 0x%X 0x%X |\n", |
2c601080 |
330 | calcSumByteAdd(data, len, mask) |
331 | , calcSumNibbleAdd(data, len, mask) |
332 | , calcSumCrumbAdd(data, len, mask) |
333 | , calcSumByteSub(data, len, mask) |
334 | , calcSumNibbleSub(data, len, mask) |
335 | , calcSumByteAddOnes(data, len, mask) |
336 | , calcSumNibbleAddOnes(data, len, mask) |
337 | , calcSumCrumbAddOnes(data, len, mask) |
338 | , calcSumByteSubOnes(data, len, mask) |
339 | , calcSumNibbleSubOnes(data, len, mask) |
340 | , calcSumByteXor(data, len, mask) |
341 | , calcSumNibbleXor(data, len, mask) |
342 | , calcSumCrumbXor(data, len, mask) |
62dc7d4a |
343 | , calcBSDchecksum8(data, len, mask) |
f054036a |
344 | , calcBSDchecksum4(data, len, mask) |
2c601080 |
345 | ); |
53b3c3e8 |
346 | return 0; |
347 | } |
812513bf |
348 | |
5558d935 |
349 | int CmdAnalyseDates(const char *Cmd){ |
350 | // look for datestamps in a given array of bytes |
53b3c3e8 |
351 | PrintAndLog("To be implemented. Feel free to contribute!"); |
5558d935 |
352 | return 0; |
353 | } |
16658b1f |
354 | int CmdAnalyseTEASelfTest(const char *Cmd){ |
355 | |
356 | uint8_t v[8], v_le[8]; |
357 | memset(v, 0x00, sizeof(v)); |
358 | memset(v_le, 0x00, sizeof(v_le)); |
359 | uint8_t* v_ptr = v_le; |
360 | |
361 | uint8_t cmdlen = strlen(Cmd); |
362 | cmdlen = ( sizeof(v)<<2 < cmdlen ) ? sizeof(v)<<2 : cmdlen; |
363 | |
364 | if ( param_gethex(Cmd, 0, v, cmdlen) > 0 ){ |
365 | PrintAndLog("can't read hex chars, uneven? :: %u", cmdlen); |
366 | return 1; |
367 | } |
368 | |
369 | SwapEndian64ex(v , 8, 4, v_ptr); |
370 | |
371 | // ENCRYPTION KEY: |
372 | uint8_t key[16] = {0x55,0xFE,0xF6,0x30,0x62,0xBF,0x0B,0xC1,0xC9,0xB3,0x7C,0x34,0x97,0x3E,0x29,0xFB }; |
373 | uint8_t keyle[16]; |
374 | uint8_t* key_ptr = keyle; |
375 | SwapEndian64ex(key , sizeof(key), 4, key_ptr); |
376 | |
377 | PrintAndLog("TEST LE enc| %s", sprint_hex(v_ptr, 8)); |
378 | |
379 | tea_decrypt(v_ptr, key_ptr); |
380 | PrintAndLog("TEST LE dec | %s", sprint_hex_ascii(v_ptr, 8)); |
381 | |
382 | tea_encrypt(v_ptr, key_ptr); |
383 | tea_encrypt(v_ptr, key_ptr); |
384 | PrintAndLog("TEST enc2 | %s", sprint_hex_ascii(v_ptr, 8)); |
385 | |
386 | return 0; |
387 | } |
5558d935 |
388 | |
b403c300 |
389 | int CmdAnalyseA(const char *Cmd){ |
09bb01c7 |
390 | /* |
391 | piwi |
392 | // uid(2e086b1a) nt(230736f6) ks(0b0008000804000e) nr(000000000) |
393 | // uid(2e086b1a) nt(230736f6) ks(0e0b0e0b090c0d02) nr(000000001) |
394 | // uid(2e086b1a) nt(230736f6) ks(0e05060e01080b08) nr(000000002) |
395 | uint64_t d1[] = {0x2e086b1a, 0x230736f6, 0x0000001, 0x0e0b0e0b090c0d02}; |
396 | uint64_t d2[] = {0x2e086b1a, 0x230736f6, 0x0000002, 0x0e05060e01080b08}; |
b403c300 |
397 | |
09bb01c7 |
398 | // uid(17758822) nt(c0c69e59) ks(080105020705040e) nr(00000001) |
399 | // uid(17758822) nt(c0c69e59) ks(01070a05050c0705) nr(00000002) |
400 | uint64_t d1[] = {0x17758822, 0xc0c69e59, 0x0000001, 0x080105020705040e}; |
401 | uint64_t d2[] = {0x17758822, 0xc0c69e59, 0x0000002, 0x01070a05050c0705}; |
402 | |
403 | // uid(6e442129) nt(8f699195) ks(090d0b0305020f02) nr(00000001) |
404 | // uid(6e442129) nt(8f699195) ks(03030508030b0c0e) nr(00000002) |
405 | // uid(6e442129) nt(8f699195) ks(02010f030c0d050d) nr(00000003) |
406 | // uid(6e442129) nt(8f699195) ks(00040f0f0305030e) nr(00000004) |
407 | uint64_t d1[] = {0x6e442129, 0x8f699195, 0x0000001, 0x090d0b0305020f02}; |
408 | uint64_t d2[] = {0x6e442129, 0x8f699195, 0x0000004, 0x00040f0f0305030e}; |
409 | |
410 | uid(3e172b29) nt(039b7bd2) ks(0c0e0f0505080800) nr(00000001) |
411 | uid(3e172b29) nt(039b7bd2) ks(0e06090d03000b0f) nr(00000002) |
412 | */ |
413 | uint64_t key = 0; |
414 | uint64_t d1[] = {0x3e172b29, 0x039b7bd2, 0x0000001, 0x0c0e0f0505080800}; |
415 | uint64_t d2[] = {0x3e172b29, 0x039b7bd2, 0x0000002, 0x0e06090d03000b0f}; |
416 | |
417 | nonce2key_ex(0, 0 , d1[0], d1[1], d1[2], d1[3], &key); |
418 | nonce2key_ex(0, 0 , d2[0], d2[1], d2[2], d2[3], &key); |
419 | return 0; |
420 | } |
b403c300 |
421 | |
09bb01c7 |
422 | static void permute(uint8_t *data, uint8_t len, uint8_t *output){ |
423 | #define KEY_SIZE 8 |
b403c300 |
424 | |
09bb01c7 |
425 | if ( len > KEY_SIZE ) { |
426 | for(uint8_t m = 0; m < len; m += KEY_SIZE){ |
427 | permute(data+m, KEY_SIZE, output+m); |
428 | } |
429 | return; |
430 | } |
431 | if ( len != KEY_SIZE ) { |
432 | printf("wrong key size\n"); |
433 | return; |
434 | } |
435 | uint8_t i,j,p, mask; |
436 | for( i=0; i < KEY_SIZE; ++i){ |
437 | p = 0; |
438 | mask = 0x80 >> i; |
439 | for( j=0; j < KEY_SIZE; ++j){ |
440 | p >>= 1; |
441 | if (data[j] & mask) |
442 | p |= 0x80; |
443 | } |
444 | output[i] = p; |
445 | } |
446 | } |
447 | static void permute_rev(uint8_t *data, uint8_t len, uint8_t *output){ |
448 | permute(data, len, output); |
449 | permute(output, len, data); |
450 | permute(data, len, output); |
451 | } |
452 | static void simple_crc(uint8_t *data, uint8_t len, uint8_t *output){ |
453 | uint8_t crc = 0; |
454 | for( uint8_t i=0; i < len; ++i){ |
455 | // seventh byte contains the crc. |
456 | if ( (i & 0x7) == 0x7 ) { |
457 | output[i] = crc ^ 0xFF; |
458 | crc = 0; |
459 | } else { |
460 | output[i] = data[i]; |
461 | crc ^= data[i]; |
462 | } |
463 | } |
464 | } |
465 | // DES doesn't use the MSB. |
466 | static void shave(uint8_t *data, uint8_t len){ |
467 | for (uint8_t i=0; i<len; ++i) |
468 | data[i] &= 0xFE; |
469 | } |
470 | static void generate_rev(uint8_t *data, uint8_t len) { |
471 | uint8_t *key = calloc(len,1); |
472 | printf("input permuted key | %s \n", sprint_hex(data, len)); |
473 | permute_rev(data, len, key); |
474 | printf(" unpermuted key | %s \n", sprint_hex(key, len)); |
475 | shave(key, len); |
476 | printf(" key | %s \n", sprint_hex(key, len)); |
477 | free(key); |
478 | } |
479 | static void generate(uint8_t *data, uint8_t len) { |
480 | uint8_t *key = calloc(len,1); |
481 | uint8_t *pkey = calloc(len,1); |
482 | printf(" input key | %s \n", sprint_hex(data, len)); |
483 | permute(data, len, pkey); |
484 | printf(" permuted key | %s \n", sprint_hex(pkey, len)); |
485 | simple_crc(pkey, len, key ); |
486 | printf(" CRC'ed key | %s \n", sprint_hex(key, len)); |
487 | free(key); |
488 | free(pkey); |
489 | } |
490 | int CmdAnalyseHid(const char *Cmd){ |
b403c300 |
491 | |
ea1c1ca6 |
492 | uint8_t key[8] = {0}; |
493 | uint8_t key_std_format[8] = {0}; |
494 | uint8_t key_iclass_format[8] = {0}; |
09bb01c7 |
495 | uint8_t data[16] = {0}; |
496 | bool isReverse = FALSE; |
497 | int len = 0; |
498 | char cmdp = param_getchar(Cmd, 0); |
499 | if (strlen(Cmd) == 0|| cmdp == 'h' || cmdp == 'H') return usage_analyse_hid(); |
500 | |
501 | if ( cmdp == 'r' || cmdp == 'R' ) |
502 | isReverse = TRUE; |
503 | |
504 | param_gethex_ex(Cmd, 1, data, &len); |
505 | if ( len%2 ) return usage_analyse_hid(); |
506 | |
ea1c1ca6 |
507 | len >>= 1; |
508 | |
509 | memcpy(key, data, 8); |
510 | |
511 | if ( isReverse ) { |
09bb01c7 |
512 | generate_rev(data, len); |
ea1c1ca6 |
513 | permutekey_rev(key, key_std_format); |
514 | printf(" holiman iclass key | %s \n", sprint_hex(key_std_format, 8)); |
515 | } |
516 | else { |
09bb01c7 |
517 | generate(data, len); |
ea1c1ca6 |
518 | permutekey(key, key_iclass_format); |
519 | printf(" holiman std key | %s \n", sprint_hex(key_iclass_format, 8)); |
520 | } |
b403c300 |
521 | return 0; |
522 | } |
523 | |
812513bf |
524 | static command_t CommandTable[] = { |
5558d935 |
525 | {"help", CmdHelp, 1, "This help"}, |
53b3c3e8 |
526 | {"lcr", CmdAnalyseLCR, 1, "Generate final byte for XOR LRC"}, |
527 | {"crc", CmdAnalyseCRC, 1, "Stub method for CRC evaluations"}, |
528 | {"chksum", CmdAnalyseCHKSUM, 1, "Checksum with adding, masking and one's complement"}, |
529 | {"dates", CmdAnalyseDates, 1, "Look for datestamps in a given array of bytes"}, |
16658b1f |
530 | {"tea", CmdAnalyseTEASelfTest, 1, "Crypto TEA test"}, |
b403c300 |
531 | {"lfsr", CmdAnalyseLfsr, 1, "LFSR tests"}, |
532 | {"a", CmdAnalyseA, 1, "num bits test"}, |
09bb01c7 |
533 | {"hid", CmdAnalyseHid, 1, "Permute function from 'heart of darkness' paper"}, |
812513bf |
534 | {NULL, NULL, 0, NULL} |
535 | }; |
536 | |
537 | int CmdAnalyse(const char *Cmd) { |
538 | clearCommandBuffer(); |
539 | CmdsParse(CommandTable, Cmd); |
540 | return 0; |
541 | } |
542 | |
543 | int CmdHelp(const char *Cmd) { |
544 | CmdsHelp(CommandTable); |
545 | return 0; |
546 | } |