[proxmark3-svn] / client / nonce2key / nonce2key.c

//-----------------------------------------------------------------------------
// Merlok - June 2011
// Roel - Dec 2009
// Unknown author
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// MIFARE Darkside hack
//-----------------------------------------------------------------------------
#include "nonce2key.h"
#include "mifarehost.h"
#include "ui.h"
#include "proxmark3.h"

int compar_state(const void * a, const void * b) {
	// didn't work: (the result is truncated to 32 bits)
	//return (*(int64_t*)b - *(int64_t*)a);

	// better:
	if (*(int64_t*)b == *(int64_t*)a) return 0;
	else if (*(int64_t*)b > *(int64_t*)a) return 1;
	else return -1;
}

int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {

	struct Crypto1State *state;
	uint32_t i, pos, rr = 0, nr_diff;
	byte_t bt, ks3x[8], par[8][8];

	// Reset the last three significant bits of the reader nonce
	nr &= 0xffffff1f;
  
	PrintAndLog("\nuid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08"llx")\n\n", uid, nt, par_info, ks_info, nr);

	for ( pos = 0; pos < 8; pos++ ) {
		ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
		bt = (par_info >> (pos*8)) & 0xff;

		for ( i = 0; i < 8; i++) {
			par[7-pos][i] = (bt >> i) & 0x01;
		}
	}

	printf("|diff|{nr}    |ks3|ks3^5|parity         |\n");
	printf("+----+--------+---+-----+---------------+\n");

	for ( i = 0; i < 8; i++) {
		nr_diff = nr | i << 5;
		printf("| %02x |%08x|", i << 5, nr_diff);
		printf(" %01x |  %01x  |", ks3x[i], ks3x[i]^5);
		for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]);
		printf("%01x|\n", par[i][7]);
	}
	printf("+----+--------+---+-----+---------------+\n");

	state = lfsr_common_prefix(nr, rr, ks3x, par);
	lfsr_rollback_word(state, uid^nt, 0);
	crypto1_get_lfsr(state, key);
	crypto1_destroy(state);
	return 0;
}

// *outputkey is not used...
int tryMfk32(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){

	struct Crypto1State *s,*t;
	uint64_t key;     // recovered key
	uint32_t uid;     // serial number
	uint32_t nt;      // tag challenge
	uint32_t nr0_enc; // first encrypted reader challenge
	uint32_t ar0_enc; // first encrypted reader response
	uint32_t nr1_enc; // second encrypted reader challenge
	uint32_t ar1_enc; // second encrypted reader response	
	bool isSuccess = FALSE;
	int counter = 0;
	
	uid 	= myuid;//(uint32_t)bytes_to_num(data +  0, 4);
	nt 		= *(uint32_t*)(data+8);
	nr0_enc = *(uint32_t*)(data+12);
	ar0_enc = *(uint32_t*)(data+16);
	nr1_enc = *(uint32_t*)(data+32);
	ar1_enc = *(uint32_t*)(data+36);

	// PrintAndLog("recovering key for:");
	// PrintAndLog("    uid: %08x   %08x",uid, myuid);
	// PrintAndLog("     nt: %08x",nt);
	// PrintAndLog(" {nr_0}: %08x",nr0_enc);
	// PrintAndLog(" {ar_0}: %08x",ar0_enc);
	// PrintAndLog(" {nr_1}: %08x",nr1_enc);
	// PrintAndLog(" {ar_1}: %08x",ar1_enc);

	s = lfsr_recovery32(ar0_enc ^ prng_successor(nt, 64), 0);
  
	for(t = s; t->odd | t->even; ++t) {
		lfsr_rollback_word(t, 0, 0);
		lfsr_rollback_word(t, nr0_enc, 1);
		lfsr_rollback_word(t, uid ^ nt, 0);
		crypto1_get_lfsr(t, &key);
		crypto1_word(t, uid ^ nt, 0);
		crypto1_word(t, nr1_enc, 1);
		if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt, 64))) {
			PrintAndLog("Found Key: [%012"llx"]", key);
			isSuccess = TRUE;
			++counter;
			if (counter==20)
				break;
		}
	}
	
	num_to_bytes(key, 6, outputkey);
	crypto1_destroy(t);
	return isSuccess;
}

int tryMfk32_moebius(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){

	struct Crypto1State *s, *t;
	uint64_t key;     // recovered key
	uint32_t uid;     // serial number
	uint32_t nt0;     // tag challenge first
	uint32_t nt1;     // tag challenge second
	uint32_t nr0_enc; // first encrypted reader challenge
	uint32_t ar0_enc; // first encrypted reader response
	uint32_t nr1_enc; // second encrypted reader challenge
	uint32_t ar1_enc; // second encrypted reader response	
	bool isSuccess = FALSE;
	int counter = 0;
	
	uid 	= myuid;//(uint32_t)bytes_to_num(data +  0, 4);
	nt0 	= *(uint32_t*)(data+8);
	nr0_enc = *(uint32_t*)(data+12);
	ar0_enc = *(uint32_t*)(data+16);
	nt1 	= *(uint32_t*)(data+8);
	nr1_enc = *(uint32_t*)(data+32);
	ar1_enc = *(uint32_t*)(data+36);

	s = lfsr_recovery32(ar0_enc ^ prng_successor(nt0, 64), 0);
  
	for(t = s; t->odd | t->even; ++t) {
		lfsr_rollback_word(t, 0, 0);
		lfsr_rollback_word(t, nr0_enc, 1);
		lfsr_rollback_word(t, uid ^ nt0, 0);
		crypto1_get_lfsr(t, &key);
		
		crypto1_word(t, uid ^ nt1, 0);
		crypto1_word(t, nr1_enc, 1);
		if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt1, 64))) {
			PrintAndLog("Found Key: [%012"llx"]",key);
			isSuccess = TRUE;
			++counter;
			if (counter==20)
				break;
		}
	}
	num_to_bytes(key, 6, outputkey);
	crypto1_destroy(t);
	return isSuccess;
}

int tryMfk64(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){

	struct Crypto1State *revstate;
	uint64_t key;     // recovered key
	uint32_t uid;     // serial number
	uint32_t nt;      // tag challenge
	uint32_t nr_enc;  // encrypted reader challenge
	uint32_t ar_enc;  // encrypted reader response
	uint32_t at_enc;  // encrypted tag response
	uint32_t ks2;     // keystream used to encrypt reader response
	uint32_t ks3;     // keystream used to encrypt tag response

	struct Crypto1State mpcs = {0, 0};
	struct Crypto1State *pcs;
	pcs = &mpcs;
	
	uid 	= myuid;//(uint32_t)bytes_to_num(data +  0, 4);
	nt 		= *(uint32_t*)(data+8);
	nr_enc = *(uint32_t*)(data+12);
	ar_enc = *(uint32_t*)(data+16);
	
	crypto1_word(pcs, nr_enc , 1);
	at_enc = prng_successor(nt, 96) ^ crypto1_word(pcs, 0, 0);

	// printf("Recovering key for:\n");
	// printf("  uid: %08x\n",uid);
	// printf("   nt: %08x\n",nt);
	// printf(" {nr}: %08x\n",nr_enc);
	// printf(" {ar}: %08x\n",ar_enc);
	// printf(" {at}: %08x\n",at_enc);

	// Extract the keystream from the messages
	ks2 = ar_enc ^ prng_successor(nt, 64);
	ks3 = at_enc ^ prng_successor(nt, 96);

	revstate = lfsr_recovery64(ks2, ks3);
	lfsr_rollback_word(revstate, 0, 0);
	lfsr_rollback_word(revstate, 0, 0);
	lfsr_rollback_word(revstate, nr_enc, 1);
	lfsr_rollback_word(revstate, uid ^ nt, 0);
	crypto1_get_lfsr(revstate, &key);
	PrintAndLog("Found Key: [%012"llx"]",key);
	num_to_bytes(key, 6, outputkey);
	crypto1_destroy(revstate);
	return 0;
}
Commit	Line	Data
f89c7050 M	1	//-----------------------------------------------------------------------------
	2	// Merlok - June 2011
	3	// Roel - Dec 2009
	4	// Unknown author
	5	//
	6	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	7	// at your option, any later version. See the LICENSE.txt file for the text of
	8	// the license.
	9	//-----------------------------------------------------------------------------
	10	// MIFARE Darkside hack
	11	//-----------------------------------------------------------------------------
f89c7050	12	#include "nonce2key.h"
b19bd5d6	13	#include "mifarehost.h"
f89c7050	14	#include "ui.h"
a0f33b66	15	#include "proxmark3.h"
f89c7050	16
b19bd5d6	17	int compar_state(const void * a, const void * b) {
	18	// didn't work: (the result is truncated to 32 bits)
	19	//return ((int64_t)b - (int64_t)a);
	20
	21	// better:
	22	if ((int64_t)b == (int64_t)a) return 0;
	23	else if ((int64_t)b > (int64_t)a) return 1;
	24	else return -1;
	25	}
	26
1c611bbd	27	int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
738eeccd	28
0de8e387	29	struct Crypto1State *state;
a0f33b66	30	uint32_t i, pos, rr = 0, nr_diff;
0de8e387	31	byte_t bt, ks3x[8], par[8][8];
b19bd5d6	32
0de8e387	33	// Reset the last three significant bits of the reader nonce
0de8e387	34	nr &= 0xffffff1f;
f89c7050	35
0de8e387	36	PrintAndLog("\nuid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08"llx")\n\n", uid, nt, par_info, ks_info, nr);
0de8e387	37
738eeccd	38	for ( pos = 0; pos < 8; pos++ ) {
0de8e387	39	ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
0de8e387	40	bt = (par_info >> (pos*8)) & 0xff;
738eeccd	41
738eeccd	42	for ( i = 0; i < 8; i++) {
0de8e387	43	par[7-pos][i] = (bt >> i) & 0x01;
	44	}
	45	}
f89c7050	46
0de8e387	47	printf("\|diff\|{nr} \|ks3\|ks3^5\|parity \|\n");
0de8e387	48	printf("+----+--------+---+-----+---------------+\n");
738eeccd	49
738eeccd	50	for ( i = 0; i < 8; i++) {
0de8e387	51	nr_diff = nr \| i << 5;
	52	printf("\| %02x \|%08x\|", i << 5, nr_diff);
	53	printf(" %01x \| %01x \|", ks3x[i], ks3x[i]^5);
a0f33b66	54	for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]);
0de8e387	55	printf("%01x\|\n", par[i][7]);
	56	}
	57	printf("+----+--------+---+-----+---------------+\n");
f89c7050	58
a0f33b66	59	state = lfsr_common_prefix(nr, rr, ks3x, par);
	60	lfsr_rollback_word(state, uid^nt, 0);
	61	crypto1_get_lfsr(state, key);
	62	crypto1_destroy(state);
	63	return 0;
f89c7050	64	}
46cd801c	65
738eeccd	66	// *outputkey is not used...
46cd801c	67	int tryMfk32(uint64_t myuid, uint8_t data, uint8_t outputkey ){
	68
	69	struct Crypto1State s,t;
	70	uint64_t key; // recovered key
	71	uint32_t uid; // serial number
	72	uint32_t nt; // tag challenge
	73	uint32_t nr0_enc; // first encrypted reader challenge
	74	uint32_t ar0_enc; // first encrypted reader response
	75	uint32_t nr1_enc; // second encrypted reader challenge
	76	uint32_t ar1_enc; // second encrypted reader response
	77	bool isSuccess = FALSE;
	78	int counter = 0;
	79
	80	uid = myuid;//(uint32_t)bytes_to_num(data + 0, 4);
	81	nt = (uint32_t)(data+8);
	82	nr0_enc = (uint32_t)(data+12);
	83	ar0_enc = (uint32_t)(data+16);
	84	nr1_enc = (uint32_t)(data+32);
	85	ar1_enc = (uint32_t)(data+36);
	86
b69947c2	87	// PrintAndLog("recovering key for:");
b69947c2	88	// PrintAndLog(" uid: %08x %08x",uid, myuid);
46cd801c	89	// PrintAndLog(" nt: %08x",nt);
	90	// PrintAndLog(" {nr_0}: %08x",nr0_enc);
	91	// PrintAndLog(" {ar_0}: %08x",ar0_enc);
	92	// PrintAndLog(" {nr_1}: %08x",nr1_enc);
	93	// PrintAndLog(" {ar_1}: %08x",ar1_enc);
	94
	95	s = lfsr_recovery32(ar0_enc ^ prng_successor(nt, 64), 0);
	96
	97	for(t = s; t->odd \| t->even; ++t) {
	98	lfsr_rollback_word(t, 0, 0);
	99	lfsr_rollback_word(t, nr0_enc, 1);
	100	lfsr_rollback_word(t, uid ^ nt, 0);
	101	crypto1_get_lfsr(t, &key);
	102	crypto1_word(t, uid ^ nt, 0);
	103	crypto1_word(t, nr1_enc, 1);
	104	if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt, 64))) {
738eeccd	105	PrintAndLog("Found Key: [%012"llx"]", key);
46cd801c	106	isSuccess = TRUE;
46cd801c	107	++counter;
b69947c2	108	if (counter==20)
46cd801c	109	break;
	110	}
	111	}
a0f33b66	112
a0f33b66	113	num_to_bytes(key, 6, outputkey);
738eeccd	114	crypto1_destroy(t);
46cd801c	115	return isSuccess;
	116	}
	117
d8af608f	118	int tryMfk32_moebius(uint64_t myuid, uint8_t data, uint8_t outputkey ){
d8af608f	119
738eeccd	120	struct Crypto1State s, t;
d8af608f	121	uint64_t key; // recovered key
d8af608f	122	uint32_t uid; // serial number
738eeccd	123	uint32_t nt0; // tag challenge first
738eeccd	124	uint32_t nt1; // tag challenge second
d8af608f	125	uint32_t nr0_enc; // first encrypted reader challenge
	126	uint32_t ar0_enc; // first encrypted reader response
	127	uint32_t nr1_enc; // second encrypted reader challenge
	128	uint32_t ar1_enc; // second encrypted reader response
	129	bool isSuccess = FALSE;
	130	int counter = 0;
	131
	132	uid = myuid;//(uint32_t)bytes_to_num(data + 0, 4);
	133	nt0 = (uint32_t)(data+8);
	134	nr0_enc = (uint32_t)(data+12);
	135	ar0_enc = (uint32_t)(data+16);
	136	nt1 = (uint32_t)(data+8);
	137	nr1_enc = (uint32_t)(data+32);
	138	ar1_enc = (uint32_t)(data+36);
	139
	140	s = lfsr_recovery32(ar0_enc ^ prng_successor(nt0, 64), 0);
	141
	142	for(t = s; t->odd \| t->even; ++t) {
	143	lfsr_rollback_word(t, 0, 0);
	144	lfsr_rollback_word(t, nr0_enc, 1);
	145	lfsr_rollback_word(t, uid ^ nt0, 0);
	146	crypto1_get_lfsr(t, &key);
	147
	148	crypto1_word(t, uid ^ nt1, 0);
	149	crypto1_word(t, nr1_enc, 1);
	150	if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt1, 64))) {
	151	PrintAndLog("Found Key: [%012"llx"]",key);
	152	isSuccess = TRUE;
	153	++counter;
	154	if (counter==20)
	155	break;
	156	}
	157	}
a0f33b66	158	num_to_bytes(key, 6, outputkey);
738eeccd	159	crypto1_destroy(t);
d8af608f	160	return isSuccess;
	161	}
	162
46cd801c	163	int tryMfk64(uint64_t myuid, uint8_t data, uint8_t outputkey ){
	164
	165	struct Crypto1State *revstate;
	166	uint64_t key; // recovered key
	167	uint32_t uid; // serial number
	168	uint32_t nt; // tag challenge
	169	uint32_t nr_enc; // encrypted reader challenge
	170	uint32_t ar_enc; // encrypted reader response
	171	uint32_t at_enc; // encrypted tag response
	172	uint32_t ks2; // keystream used to encrypt reader response
	173	uint32_t ks3; // keystream used to encrypt tag response
	174
	175	struct Crypto1State mpcs = {0, 0};
	176	struct Crypto1State *pcs;
	177	pcs = &mpcs;
	178
	179	uid = myuid;//(uint32_t)bytes_to_num(data + 0, 4);
	180	nt = (uint32_t)(data+8);
	181	nr_enc = (uint32_t)(data+12);
	182	ar_enc = (uint32_t)(data+16);
	183
	184	crypto1_word(pcs, nr_enc , 1);
	185	at_enc = prng_successor(nt, 96) ^ crypto1_word(pcs, 0, 0);
	186
	187	// printf("Recovering key for:\n");
	188	// printf(" uid: %08x\n",uid);
	189	// printf(" nt: %08x\n",nt);
	190	// printf(" {nr}: %08x\n",nr_enc);
	191	// printf(" {ar}: %08x\n",ar_enc);
	192	// printf(" {at}: %08x\n",at_enc);
	193
	194	// Extract the keystream from the messages
	195	ks2 = ar_enc ^ prng_successor(nt, 64);
	196	ks3 = at_enc ^ prng_successor(nt, 96);
	197
	198	revstate = lfsr_recovery64(ks2, ks3);
	199	lfsr_rollback_word(revstate, 0, 0);
	200	lfsr_rollback_word(revstate, 0, 0);
	201	lfsr_rollback_word(revstate, nr_enc, 1);
	202	lfsr_rollback_word(revstate, uid ^ nt, 0);
	203	crypto1_get_lfsr(revstate, &key);
	204	PrintAndLog("Found Key: [%012"llx"]",key);
a0f33b66	205	num_to_bytes(key, 6, outputkey);
46cd801c	206	crypto1_destroy(revstate);
46cd801c	207	return 0;
e98572a1	208	}