]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/nonce2key/nonce2key.c
d146b7239fe2d778677943207edfe528486ec717
1 //-----------------------------------------------------------------------------
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // MIFARE Darkside hack
11 //-----------------------------------------------------------------------------
13 #include "nonce2key.h"
18 #include "mifarehost.h"
21 #include "crapto1/crapto1.h"
23 int compar_state(const void * a
, const void * b
) {
24 // didn't work: (the result is truncated to 32 bits)
25 //return (*(int64_t*)b - *(int64_t*)a);
28 if (*(int64_t*)b
== *(int64_t*)a
) return 0;
29 else if (*(int64_t*)b
> *(int64_t*)a
) return 1;
33 int nonce2key(uint32_t uid
, uint32_t nt
, uint32_t nr
, uint64_t par_info
, uint64_t ks_info
, uint64_t * key
) {
34 struct Crypto1State
*state
;
35 uint32_t i
, pos
, rr
, nr_diff
, key_count
;//, ks1, ks2;
36 uint8_t bt
, ks3x
[8], par
[8][8];
37 uint64_t key_recovered
;
39 static uint32_t last_uid
;
40 static int64_t *last_keylist
;
43 if (last_uid
!= uid
&& last_keylist
!= NULL
)
50 // Reset the last three significant bits of the reader nonce
53 PrintAndLog("\nuid(%08x) nt(%08x) par(%016" PRIx64
") ks(%016" PRIx64
") nr(%08" PRIx32
")\n\n",uid
,nt
,par_info
,ks_info
,nr
);
55 for (pos
=0; pos
<8; pos
++)
57 ks3x
[7-pos
] = (ks_info
>> (pos
*8)) & 0x0f;
58 bt
= (par_info
>> (pos
*8)) & 0xff;
61 par
[7-pos
][i
] = (bt
>> i
) & 0x01;
65 printf("|diff|{nr} |ks3|ks3^5|parity |\n");
66 printf("+----+--------+---+-----+---------------+\n");
69 nr_diff
= nr
| i
<< 5;
70 printf("| %02x |%08x|",i
<< 5, nr_diff
);
71 printf(" %01x | %01x |",ks3x
[i
], ks3x
[i
]^5);
72 for (pos
=0; pos
<7; pos
++) printf("%01x,", par
[i
][pos
]);
73 printf("%01x|\n", par
[i
][7]);
77 PrintAndLog("Parity is all zero, trying special attack! Just wait for few more seconds...");
79 state
= lfsr_common_prefix(nr
, rr
, ks3x
, par
);
80 state_s
= (int64_t*)state
;
83 //sprintf(filename, "nt_%08x_%d.txt", nt, nr);
84 //printf("name %s\n", filename);
85 //FILE* fp = fopen(filename,"w");
86 for (i
= 0; (state
) && *(state_s
+ i
); i
++)
88 lfsr_rollback_word(state
+i
, uid
^nt
, 0);
89 crypto1_get_lfsr(state
+ i
, &key_recovered
);
90 *(state_s
+ i
) = key_recovered
;
91 //fprintf(fp, "%012" PRIx64 "\n",key_recovered);
98 qsort(state_s
, i
, sizeof(*state_s
), compar_state
);
101 //Create the intersection:
102 if (par_info
== 0 ) {
103 if (last_keylist
!= NULL
) {
104 int64_t *p1
, *p2
, *p3
;
105 p1
= p3
= last_keylist
;
107 while ( *p1
!= -1 && *p2
!= -1 ) {
108 if (compar_state(p1
, p2
) == 0) {
109 printf("p1:%" PRIx64
" p2:%" PRIx64
" p3:%" PRIx64
" key:%012" PRIx64
"\n",(uint64_t)(p1
-last_keylist
),(uint64_t)(p2
-state_s
),(uint64_t)(p3
-last_keylist
),*p1
);
114 while (compar_state(p1
, p2
) == -1) ++p1
;
115 while (compar_state(p1
, p2
) == 1) ++p2
;
118 key_count
= p3
- last_keylist
;
123 last_keylist
= state_s
;
127 printf("key_count:%d\n", key_count
);
129 // The list may still contain several key candidates. Test each of them with mfCheckKeys
130 for (i
= 0; i
< key_count
; i
++) {
133 key64
= *(last_keylist
+ i
);
134 num_to_bytes(key64
, 6, keyBlock
);
136 if (!mfCheckKeys(0, 0, false, 1, keyBlock
, &key64
)) {
148 last_keylist
= state_s
;
153 // 32 bit recover key from 2 nonces
154 bool mfkey32(nonces_t data
, uint64_t *outputkey
) {
155 struct Crypto1State
*s
,*t
;
157 uint64_t key
=0; // recovered key
158 uint32_t uid
= data
.cuid
;
159 uint32_t nt
= data
.nonce
; // first tag challenge (nonce)
160 uint32_t nr0_enc
= data
.nr
; // first encrypted reader challenge
161 uint32_t ar0_enc
= data
.ar
; // first encrypted reader response
162 uint32_t nr1_enc
= data
.nr2
; // second encrypted reader challenge
163 uint32_t ar1_enc
= data
.ar2
; // second encrypted reader response
164 uint64_t t1
= msclock();
165 bool isSuccess
= false;
168 s
= lfsr_recovery32(ar0_enc
^ prng_successor(nt
, 64), 0);
170 for(t
= s
; t
->odd
| t
->even
; ++t
) {
171 lfsr_rollback_word(t
, 0, 0);
172 lfsr_rollback_word(t
, nr0_enc
, 1);
173 lfsr_rollback_word(t
, uid
^ nt
, 0);
174 crypto1_get_lfsr(t
, &key
);
175 crypto1_word(t
, uid
^ nt
, 0);
176 crypto1_word(t
, nr1_enc
, 1);
177 if (ar1_enc
== (crypto1_word(t
, 0, 0) ^ prng_successor(nt
, 64))) {
178 //PrintAndLog("Found Key: [%012" PRIx64 "]",key);
181 if (counter
==20) break;
184 isSuccess
= (counter
== 1);
186 //if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.1f seconds \nFound %d possible keys", (float)t1/1000.0, counter);
187 *outputkey
= ( isSuccess
) ? outkey
: 0;
189 /* //un-comment to save all keys to a stats.txt file
191 if ((fout = fopen("stats.txt","ab")) == NULL) {
192 PrintAndLog("Could not create file name stats.txt");
195 fprintf(fout, "mfkey32,%d,%08x,%d,%s,%04x%08x,%.0Lf\r\n", counter, data.cuid, data.sector, (data.keytype) ? "B" : "A", (uint32_t)(outkey>>32) & 0xFFFF,(uint32_t)(outkey&0xFFFFFFFF),(long double)t1);
201 bool tryMfk32_moebius(nonces_t data
, uint64_t *outputkey
) {
202 struct Crypto1State
*s
, *t
;
204 uint64_t key
= 0; // recovered key
205 uint32_t uid
= data
.cuid
;
206 uint32_t nt0
= data
.nonce
; // first tag challenge (nonce)
207 uint32_t nr0_enc
= data
.nr
; // first encrypted reader challenge
208 uint32_t ar0_enc
= data
.ar
; // first encrypted reader response
209 uint32_t nt1
= data
.nonce2
; // second tag challenge (nonce)
210 uint32_t nr1_enc
= data
.nr2
; // second encrypted reader challenge
211 uint32_t ar1_enc
= data
.ar2
; // second encrypted reader response
212 bool isSuccess
= false;
215 //PrintAndLog("Enter mfkey32_moebius");
216 uint64_t t1
= msclock();
218 s
= lfsr_recovery32(ar0_enc
^ prng_successor(nt0
, 64), 0);
220 for(t
= s
; t
->odd
| t
->even
; ++t
) {
221 lfsr_rollback_word(t
, 0, 0);
222 lfsr_rollback_word(t
, nr0_enc
, 1);
223 lfsr_rollback_word(t
, uid
^ nt0
, 0);
224 crypto1_get_lfsr(t
, &key
);
226 crypto1_word(t
, uid
^ nt1
, 0);
227 crypto1_word(t
, nr1_enc
, 1);
228 if (ar1_enc
== (crypto1_word(t
, 0, 0) ^ prng_successor(nt1
, 64))) {
229 //PrintAndLog("Found Key: [%012" PRIx64 "]",key);
236 isSuccess
= (counter
== 1);
238 //if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.1f seconds \nFound %d possible keys", (float)t1/1000.0, counter);
239 *outputkey
= ( isSuccess
) ? outkey
: 0;
241 /* // un-comment to output all keys to stats.txt
243 if ((fout = fopen("stats.txt","ab")) == NULL) {
244 PrintAndLog("Could not create file name stats.txt");
247 fprintf(fout, "moebius,%d,%08x,%d,%s,%04x%08x,%0.Lf\r\n", counter, data.cuid, data.sector, (data.keytype) ? "B" : "A", (uint32_t) (outkey>>32),(uint32_t)(outkey&0xFFFFFFFF),(long double)t1);
253 int tryMfk64_ex(uint8_t *data
, uint64_t *outputkey
){
254 uint32_t uid
= le32toh(data
);
255 uint32_t nt
= le32toh(data
+4); // tag challenge
256 uint32_t nr_enc
= le32toh(data
+8); // encrypted reader challenge
257 uint32_t ar_enc
= le32toh(data
+12); // encrypted reader response
258 uint32_t at_enc
= le32toh(data
+16); // encrypted tag response
259 return tryMfk64(uid
, nt
, nr_enc
, ar_enc
, at_enc
, outputkey
);
262 int tryMfk64(uint32_t uid
, uint32_t nt
, uint32_t nr_enc
, uint32_t ar_enc
, uint32_t at_enc
, uint64_t *outputkey
){
263 uint64_t key
= 0; // recovered key
264 uint32_t ks2
; // keystream used to encrypt reader response
265 uint32_t ks3
; // keystream used to encrypt tag response
266 struct Crypto1State
*revstate
;
268 PrintAndLog("Enter mfkey64");
269 uint64_t t1
= msclock();
271 // Extract the keystream from the messages
272 ks2
= ar_enc
^ prng_successor(nt
, 64);
273 ks3
= at_enc
^ prng_successor(nt
, 96);
274 revstate
= lfsr_recovery64(ks2
, ks3
);
275 lfsr_rollback_word(revstate
, 0, 0);
276 lfsr_rollback_word(revstate
, 0, 0);
277 lfsr_rollback_word(revstate
, nr_enc
, 1);
278 lfsr_rollback_word(revstate
, uid
^ nt
, 0);
279 crypto1_get_lfsr(revstate
, &key
);
280 PrintAndLog("Found Key: [%012" PRIx64
"]", key
);
281 crypto1_destroy(revstate
);
285 if ( t1
> 0 ) PrintAndLog("Time in mfkey64: %.1f seconds \n", (float)t1
/1000.0);