]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/mifarehost.c
4abb1137c41d0baf045f2d5e8fed9109cedb7873
2 // people from mifare@nethemba.com, 2010
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
9 //-----------------------------------------------------------------------------
15 #include "mifarehost.h"
16 #include "proxmark3.h"
19 int compar_int(const void * a
, const void * b
) {
20 // didn't work: (the result is truncated to 32 bits)
21 //return (*(uint64_t*)b - *(uint64_t*)a);
24 if (*(uint64_t*)b
== *(uint64_t*)a
) return 0;
25 else if (*(uint64_t*)b
> *(uint64_t*)a
) return 1;
29 // Compare 16 Bits out of cryptostate
30 int Compare16Bits(const void * a
, const void * b
) {
31 if ((*(uint64_t*)b
& 0x00ff000000ff0000) == (*(uint64_t*)a
& 0x00ff000000ff0000)) return 0;
32 else if ((*(uint64_t*)b
& 0x00ff000000ff0000) > (*(uint64_t*)a
& 0x00ff000000ff0000)) return 1;
39 struct Crypto1State
*slhead
;
43 struct Crypto1State
*sltail
;
55 // wrapper function for multi-threaded lfsr_recovery32
56 void* nested_worker_thread(void *arg
)
58 struct Crypto1State
*p1
;
59 StateList_t
*statelist
= arg
;
61 statelist
->head
.slhead
= lfsr_recovery32(statelist
->ks1
, statelist
->nt
^ statelist
->uid
);
62 for (p1
= statelist
->head
.slhead
; *(uint64_t *)p1
!= 0; p1
++);
63 statelist
->len
= p1
- statelist
->head
.slhead
;
64 statelist
->tail
.sltail
= --p1
;
65 qsort(statelist
->head
.slhead
, statelist
->len
, sizeof(uint64_t), Compare16Bits
);
67 return statelist
->head
.slhead
;
70 int mfnested(uint8_t blockNo
, uint8_t keyType
, uint8_t * key
, uint8_t trgBlockNo
, uint8_t trgKeyType
, uint8_t * resultKey
, bool calibrate
)
76 StateList_t statelists
[2];
77 struct Crypto1State
*p1
, *p2
, *p3
, *p4
;
80 WaitForResponseTimeout(CMD_ACK
, NULL
, 100);
82 UsbCommand c
= {CMD_MIFARE_NESTED
, {blockNo
+ keyType
* 0x100, trgBlockNo
+ trgKeyType
* 0x100, calibrate
}};
83 memcpy(c
.d
.asBytes
, key
, 6);
86 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 1500)) {
91 return resp
.arg
[0]; // error during nested
94 memcpy(&uid
, resp
.d
.asBytes
, 4);
95 PrintAndLog("uid:%08x trgbl=%d trgkey=%x", uid
, (uint16_t)resp
.arg
[2] & 0xff, (uint16_t)resp
.arg
[2] >> 8);
97 for (i
= 0; i
< 2; i
++) {
98 statelists
[i
].blockNo
= resp
.arg
[2] & 0xff;
99 statelists
[i
].keyType
= (resp
.arg
[2] >> 8) & 0xff;
100 statelists
[i
].uid
= uid
;
101 memcpy(&statelists
[i
].nt
, (void *)(resp
.d
.asBytes
+ 4 + i
* 8 + 0), 4);
102 memcpy(&statelists
[i
].ks1
, (void *)(resp
.d
.asBytes
+ 4 + i
* 8 + 4), 4);
107 pthread_t thread_id
[2];
109 // create and run worker threads
110 for (i
= 0; i
< 2; i
++) {
111 pthread_create(thread_id
+ i
, NULL
, nested_worker_thread
, &statelists
[i
]);
114 // wait for threads to terminate:
115 for (i
= 0; i
< 2; i
++) {
116 pthread_join(thread_id
[i
], (void*)&statelists
[i
].head
.slhead
);
120 // the first 16 Bits of the cryptostate already contain part of our key.
121 // Create the intersection of the two lists based on these 16 Bits and
122 // roll back the cryptostate
123 p1
= p3
= statelists
[0].head
.slhead
;
124 p2
= p4
= statelists
[1].head
.slhead
;
125 while (p1
<= statelists
[0].tail
.sltail
&& p2
<= statelists
[1].tail
.sltail
) {
126 if (Compare16Bits(p1
, p2
) == 0) {
127 struct Crypto1State savestate
, *savep
= &savestate
;
129 while(Compare16Bits(p1
, savep
) == 0 && p1
<= statelists
[0].tail
.sltail
) {
131 lfsr_rollback_word(p3
, statelists
[0].nt
^ statelists
[0].uid
, 0);
136 while(Compare16Bits(p2
, savep
) == 0 && p2
<= statelists
[1].tail
.sltail
) {
138 lfsr_rollback_word(p4
, statelists
[1].nt
^ statelists
[1].uid
, 0);
144 while (Compare16Bits(p1
, p2
) == -1) p1
++;
145 while (Compare16Bits(p1
, p2
) == 1) p2
++;
148 p3
->even
= 0; p3
->odd
= 0;
149 p4
->even
= 0; p4
->odd
= 0;
150 statelists
[0].len
= p3
- statelists
[0].head
.slhead
;
151 statelists
[1].len
= p4
- statelists
[1].head
.slhead
;
152 statelists
[0].tail
.sltail
=--p3
;
153 statelists
[1].tail
.sltail
=--p4
;
155 // the statelists now contain possible keys. The key we are searching for must be in the
156 // intersection of both lists. Create the intersection:
157 qsort(statelists
[0].head
.keyhead
, statelists
[0].len
, sizeof(uint64_t), compar_int
);
158 qsort(statelists
[1].head
.keyhead
, statelists
[1].len
, sizeof(uint64_t), compar_int
);
160 uint64_t *p5
, *p6
, *p7
;
161 p5
= p7
= statelists
[0].head
.keyhead
;
162 p6
= statelists
[1].head
.keyhead
;
163 while (p5
<= statelists
[0].tail
.keytail
&& p6
<= statelists
[1].tail
.keytail
) {
164 if (compar_int(p5
, p6
) == 0) {
169 while (compar_int(p5
, p6
) == -1) p5
++;
170 while (compar_int(p5
, p6
) == 1) p6
++;
173 statelists
[0].len
= p7
- statelists
[0].head
.keyhead
;
174 statelists
[0].tail
.keytail
=--p7
;
176 memset(resultKey
, 0, 6);
177 // The list may still contain several key candidates. Test each of them with mfCheckKeys
178 for (i
= 0; i
< statelists
[0].len
; i
++) {
181 crypto1_get_lfsr(statelists
[0].head
.slhead
+ i
, &key64
);
182 num_to_bytes(key64
, 6, keyBlock
);
184 if (!mfCheckKeys(statelists
[0].blockNo
, statelists
[0].keyType
, false, 1, keyBlock
, &key64
)) {
185 num_to_bytes(key64
, 6, resultKey
);
190 free(statelists
[0].head
.slhead
);
191 free(statelists
[1].head
.slhead
);
196 int mfCheckKeys (uint8_t blockNo
, uint8_t keyType
, bool clear_trace
, uint8_t keycnt
, uint8_t * keyBlock
, uint64_t * key
){
200 UsbCommand c
= {CMD_MIFARE_CHKKEYS
, {((blockNo
& 0xff) | ((keyType
&0xff)<<8)), clear_trace
, keycnt
}};
201 memcpy(c
.d
.asBytes
, keyBlock
, 6 * keycnt
);
205 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,3000)) return 1;
206 if ((resp
.arg
[0] & 0xff) != 0x01) return 2;
207 *key
= bytes_to_num(resp
.d
.asBytes
, 6);
213 int mfEmlGetMem(uint8_t *data
, int blockNum
, int blocksCount
) {
214 UsbCommand c
= {CMD_MIFARE_EML_MEMGET
, {blockNum
, blocksCount
, 0}};
218 if (!WaitForResponseTimeout(CMD_ACK
,&resp
,1500)) return 1;
219 memcpy(data
, resp
.d
.asBytes
, blocksCount
* 16);
223 int mfEmlSetMem(uint8_t *data
, int blockNum
, int blocksCount
) {
224 UsbCommand c
= {CMD_MIFARE_EML_MEMSET
, {blockNum
, blocksCount
, 0}};
225 memcpy(c
.d
.asBytes
, data
, blocksCount
* 16);
232 int mfCSetUID(uint8_t *uid
, uint8_t *atqa
, uint8_t *sak
, uint8_t *oldUID
, bool wantWipe
) {
233 uint8_t oldblock0
[16] = {0x00};
234 uint8_t block0
[16] = {0x00};
236 int old
= mfCGetBlock(0, oldblock0
, CSETBLOCK_SINGLE_OPER
);
238 memcpy(block0
, oldblock0
, 16);
239 PrintAndLog("old block 0: %s", sprint_hex(block0
,16));
241 PrintAndLog("Couldn't get old data. Will write over the last bytes of Block 0.");
244 // fill in the new values
246 memcpy(block0
, uid
, 4);
248 block0
[4] = block0
[0]^block0
[1]^block0
[2]^block0
[3];
249 // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed)
256 PrintAndLog("new block 0: %s", sprint_hex(block0
,16));
257 return mfCSetBlock(0, block0
, oldUID
, wantWipe
, CSETBLOCK_SINGLE_OPER
);
260 int mfCSetBlock(uint8_t blockNo
, uint8_t *data
, uint8_t *uid
, bool wantWipe
, uint8_t params
) {
263 UsbCommand c
= {CMD_MIFARE_CSETBLOCK
, {wantWipe
, params
& (0xFE | (uid
== NULL
? 0:1)), blockNo
}};
264 memcpy(c
.d
.asBytes
, data
, 16);
268 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1500)) {
269 isOK
= resp
.arg
[0] & 0xff;
271 memcpy(uid
, resp
.d
.asBytes
, 4);
275 PrintAndLog("Command execute timeout");
281 int mfCGetBlock(uint8_t blockNo
, uint8_t *data
, uint8_t params
) {
284 UsbCommand c
= {CMD_MIFARE_CGETBLOCK
, {params
, 0, blockNo
}};
288 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1500)) {
289 isOK
= resp
.arg
[0] & 0xff;
290 memcpy(data
, resp
.d
.asBytes
, 16);
293 PrintAndLog("Command execute timeout");
302 static uint8_t trailerAccessBytes
[4] = {0x08, 0x77, 0x8F, 0x00};
305 char logHexFileName
[FILE_PATH_SIZE
] = {0x00};
306 static uint8_t traceCard
[4096] = {0x00};
307 static char traceFileName
[FILE_PATH_SIZE
] = {0x00};
308 static int traceState
= TRACE_IDLE
;
309 static uint8_t traceCurBlock
= 0;
310 static uint8_t traceCurKey
= 0;
312 struct Crypto1State
*traceCrypto1
= NULL
;
314 struct Crypto1State
*revstate
;
319 uint32_t uid
; // serial number
320 uint32_t nt
; // tag challenge
321 uint32_t nr_enc
; // encrypted reader challenge
322 uint32_t ar_enc
; // encrypted reader response
323 uint32_t at_enc
; // encrypted tag response
325 int isTraceCardEmpty(void) {
326 return ((traceCard
[0] == 0) && (traceCard
[1] == 0) && (traceCard
[2] == 0) && (traceCard
[3] == 0));
329 int isBlockEmpty(int blockN
) {
330 for (int i
= 0; i
< 16; i
++)
331 if (traceCard
[blockN
* 16 + i
] != 0) return 0;
336 int isBlockTrailer(int blockN
) {
337 return ((blockN
& 0x03) == 0x03);
340 int loadTraceCard(uint8_t *tuid
) {
342 char buf
[64] = {0x00};
343 uint8_t buf8
[64] = {0x00};
346 if (!isTraceCardEmpty())
349 memset(traceCard
, 0x00, 4096);
350 memcpy(traceCard
, tuid
+ 3, 4);
352 FillFileNameByUID(traceFileName
, tuid
, ".eml", 7);
354 f
= fopen(traceFileName
, "r");
361 memset(buf
, 0, sizeof(buf
));
362 if (fgets(buf
, sizeof(buf
), f
) == NULL
) {
363 PrintAndLog("File reading error.");
368 if (strlen(buf
) < 32){
370 PrintAndLog("File content error. Block data must include 32 HEX symbols");
374 for (i
= 0; i
< 32; i
+= 2)
375 sscanf(&buf
[i
], "%02x", (unsigned int *)&buf8
[i
/ 2]);
377 memcpy(traceCard
+ blockNum
* 16, buf8
, 16);
386 int saveTraceCard(void) {
389 if ((!strlen(traceFileName
)) || (isTraceCardEmpty())) return 0;
391 f
= fopen(traceFileName
, "w+");
394 for (int i
= 0; i
< 64; i
++) { // blocks
395 for (int j
= 0; j
< 16; j
++) // bytes
396 fprintf(f
, "%02x", *(traceCard
+ i
* 16 + j
));
403 int mfTraceInit(uint8_t *tuid
, uint8_t *atqa
, uint8_t sak
, bool wantSaveToEmlFile
) {
406 crypto1_destroy(traceCrypto1
);
410 if (wantSaveToEmlFile
)
413 traceCard
[4] = traceCard
[0] ^ traceCard
[1] ^ traceCard
[2] ^ traceCard
[3];
415 memcpy(&traceCard
[6], atqa
, 2);
417 uid
= bytes_to_num(tuid
+ 3, 4);
419 traceState
= TRACE_IDLE
;
424 void mf_crypto1_decrypt(struct Crypto1State
*pcs
, uint8_t *data
, int len
, bool isEncrypted
){
429 for (i
= 0; i
< len
; i
++)
430 data
[i
] = crypto1_byte(pcs
, 0x00, isEncrypted
) ^ data
[i
];
433 for (i
= 0; i
< 4; i
++)
434 bt
|= (crypto1_bit(pcs
, 0, isEncrypted
) ^ BIT(data
[0], i
)) << i
;
442 int mfTraceDecode(uint8_t *data_src
, int len
, bool wantSaveToEmlFile
) {
445 if (traceState
== TRACE_ERROR
) return 1;
447 traceState
= TRACE_ERROR
;
451 memcpy(data
, data_src
, len
);
452 if ((traceCrypto1
) && ((traceState
== TRACE_IDLE
) || (traceState
> TRACE_AUTH_OK
))) {
453 mf_crypto1_decrypt(traceCrypto1
, data
, len
, 0);
454 PrintAndLog("dec> %s", sprint_hex(data
, len
));
455 AddLogHex(logHexFileName
, "dec> ", data
, len
);
458 switch (traceState
) {
460 // check packet crc16!
461 if ((len
>= 4) && (!CheckCrc14443(CRC_14443_A
, data
, len
))) {
462 PrintAndLog("dec> CRC ERROR!!!");
463 AddLogLine(logHexFileName
, "dec> ", "CRC ERROR!!!");
464 traceState
= TRACE_ERROR
; // do not decrypt the next commands
469 if ((len
==4) && ((data
[0] == 0x60) || (data
[0] == 0x61))) {
470 traceState
= TRACE_AUTH1
;
471 traceCurBlock
= data
[1];
472 traceCurKey
= data
[0] == 60 ? 1:0;
477 if ((len
==4) && ((data
[0] == 0x30))) {
478 traceState
= TRACE_READ_DATA
;
479 traceCurBlock
= data
[1];
484 if ((len
==4) && ((data
[0] == 0xA0))) {
485 traceState
= TRACE_WRITE_OK
;
486 traceCurBlock
= data
[1];
491 if ((len
==4) && ((data
[0] == 0x50) && (data
[1] == 0x00))) {
492 traceState
= TRACE_ERROR
; // do not decrypt the next commands
499 case TRACE_READ_DATA
:
501 traceState
= TRACE_IDLE
;
503 if (isBlockTrailer(traceCurBlock
)) {
504 memcpy(traceCard
+ traceCurBlock
* 16 + 6, data
+ 6, 4);
506 memcpy(traceCard
+ traceCurBlock
* 16, data
, 16);
508 if (wantSaveToEmlFile
) saveTraceCard();
511 traceState
= TRACE_ERROR
;
517 if ((len
== 1) && (data
[0] == 0x0a)) {
518 traceState
= TRACE_WRITE_DATA
;
522 traceState
= TRACE_ERROR
;
527 case TRACE_WRITE_DATA
:
529 traceState
= TRACE_IDLE
;
531 memcpy(traceCard
+ traceCurBlock
* 16, data
, 16);
532 if (wantSaveToEmlFile
) saveTraceCard();
535 traceState
= TRACE_ERROR
;
542 traceState
= TRACE_AUTH2
;
543 nt
= bytes_to_num(data
, 4);
546 traceState
= TRACE_ERROR
;
553 traceState
= TRACE_AUTH_OK
;
555 nr_enc
= bytes_to_num(data
, 4);
556 ar_enc
= bytes_to_num(data
+ 4, 4);
559 traceState
= TRACE_ERROR
;
566 traceState
= TRACE_IDLE
;
568 at_enc
= bytes_to_num(data
, 4);
571 ks2
= ar_enc
^ prng_successor(nt
, 64);
572 ks3
= at_enc
^ prng_successor(nt
, 96);
573 revstate
= lfsr_recovery64(ks2
, ks3
);
574 lfsr_rollback_word(revstate
, 0, 0);
575 lfsr_rollback_word(revstate
, 0, 0);
576 lfsr_rollback_word(revstate
, nr_enc
, 1);
577 lfsr_rollback_word(revstate
, uid
^ nt
, 0);
579 crypto1_get_lfsr(revstate
, &lfsr
);
580 printf("key> %x%x\n", (unsigned int)((lfsr
& 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr
& 0xFFFFFFFF));
581 AddLogUint64(logHexFileName
, "key> ", lfsr
);
583 int blockShift
= ((traceCurBlock
& 0xFC) + 3) * 16;
584 if (isBlockEmpty((traceCurBlock
& 0xFC) + 3)) memcpy(traceCard
+ blockShift
+ 6, trailerAccessBytes
, 4);
587 num_to_bytes(lfsr
, 6, traceCard
+ blockShift
+ 10);
589 num_to_bytes(lfsr
, 6, traceCard
+ blockShift
);
591 if (wantSaveToEmlFile
) saveTraceCard();
594 crypto1_destroy(traceCrypto1
);
597 // set cryptosystem state
598 traceCrypto1
= lfsr_recovery64(ks2
, ks3
);
600 // nt = crypto1_word(traceCrypto1, nt ^ uid, 1) ^ nt;
602 /* traceCrypto1 = crypto1_create(lfsr); // key in lfsr
603 crypto1_word(traceCrypto1, nt ^ uid, 0);
604 crypto1_word(traceCrypto1, ar, 1);
605 crypto1_word(traceCrypto1, 0, 0);
606 crypto1_word(traceCrypto1, 0, 0);*/
610 traceState
= TRACE_ERROR
;
616 traceState
= TRACE_ERROR
;
623 int tryDecryptWord(uint32_t nt
, uint32_t ar_enc
, uint32_t at_enc
, uint8_t *data
, int len
){
625 uint32_t nt; // tag challenge
626 uint32_t ar_enc; // encrypted reader response
627 uint32_t at_enc; // encrypted tag response
630 crypto1_destroy(traceCrypto1
);
632 ks2
= ar_enc
^ prng_successor(nt
, 64);
633 ks3
= at_enc
^ prng_successor(nt
, 96);
634 traceCrypto1
= lfsr_recovery64(ks2
, ks3
);
636 mf_crypto1_decrypt(traceCrypto1
, data
, len
, 0);
638 PrintAndLog("Decrypted data: [%s]", sprint_hex(data
,len
) );
639 crypto1_destroy(traceCrypto1
);