fix hf iclass sim

[proxmark3-svn] / client / loclass / elite_crack.c

diff --git a/client/loclass/elite_crack.c b/client/loclass/elite_crack.c
index c824eaa188ed45c56fce156718c4dfeda90f5b19..21a67f54c85ab26b8a604e9b89629f9385b65522 100644 (file)
--- a/client/loclass/elite_crack.c
+++ b/client/loclass/elite_crack.c
@@ -22,7 +22,7 @@
  *
  * This is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as published
  *
  * This is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as published

- * by the Free Software Foundation.
+ * by the Free Software Foundation, or, at your option, any later version. 

  *
  * This file is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  *
  * This file is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of


@@ -33,20 +33,20 @@
  * along with loclass.  If not, see <http://www.gnu.org/licenses/>.
  * 
  * 
  * along with loclass.  If not, see <http://www.gnu.org/licenses/>.
  * 
  * 

- * 

  ****************************************************************************/
 
 #include <stdint.h>
 #include <stdbool.h>
 #include <string.h>
 #include <stdio.h>
  ****************************************************************************/
 
 #include <stdint.h>
 #include <stdbool.h>
 #include <string.h>
 #include <stdio.h>

-#include <time.h>
+#include "util.h"
+#include "util_posix.h"

 #include "cipherutils.h"
 #include "cipher.h"
 #include "ikeys.h"
 #include "elite_crack.h"
 #include "fileutils.h"
 #include "cipherutils.h"
 #include "cipher.h"
 #include "ikeys.h"
 #include "elite_crack.h"
 #include "fileutils.h"

-#include "des.h"
+#include "mbedtls/des.h"

 
 /**
  * @brief Permutes a key from standard NIST format to Iclass specific format
 
 /**
  * @brief Permutes a key from standard NIST format to Iclass specific format


@@ -179,22 +179,22 @@ void rk(uint8_t *key, uint8_t n, uint8_t *outp_key)
     return;
 }
 
     return;
 }
 

-static des_context ctx_enc = {DES_ENCRYPT,{0}};
-static des_context ctx_dec = {DES_DECRYPT,{0}};
+static mbedtls_des_context ctx_enc = { {0} };
+static mbedtls_des_context ctx_dec = { {0} };

 
 void desdecrypt_iclass(uint8_t *iclass_key, uint8_t *input, uint8_t *output)
 {
     uint8_t key_std_format[8] = {0};
     permutekey_rev(iclass_key, key_std_format);
 
 void desdecrypt_iclass(uint8_t *iclass_key, uint8_t *input, uint8_t *output)
 {
     uint8_t key_std_format[8] = {0};
     permutekey_rev(iclass_key, key_std_format);

-    des_setkey_dec( &ctx_dec, key_std_format);
-    des_crypt_ecb(&ctx_dec,input,output);
+    mbedtls_des_setkey_dec( &ctx_dec, key_std_format);
+    mbedtls_des_crypt_ecb(&ctx_dec,input,output);

 }
 void desencrypt_iclass(uint8_t *iclass_key, uint8_t *input, uint8_t *output)
 {
     uint8_t key_std_format[8] = {0};
     permutekey_rev(iclass_key, key_std_format);
 }
 void desencrypt_iclass(uint8_t *iclass_key, uint8_t *input, uint8_t *output)
 {
     uint8_t key_std_format[8] = {0};
     permutekey_rev(iclass_key, key_std_format);

-    des_setkey_enc( &ctx_enc, key_std_format);
-    des_crypt_ecb(&ctx_enc,input,output);
+    mbedtls_des_setkey_enc( &ctx_enc, key_std_format);
+    mbedtls_des_crypt_ecb(&ctx_enc,input,output);

 }
 
 /**
 }
 
 /**


@@ -333,16 +333,14 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
         * Only the lower eight bits correspond to the (hopefully cracked) key-value.
         **/
        uint8_t bytes_to_recover[3] = {0};
         * Only the lower eight bits correspond to the (hopefully cracked) key-value.
         **/
        uint8_t bytes_to_recover[3] = {0};

-       uint8_t numbytes_to_recover = 0 ;
-       int i;
-       for(i =0 ; i < 8 ; i++)
-       {
-               if(keytable[key_index[i]] & (CRACKED | BEING_CRACKED)) continue;
+       uint8_t numbytes_to_recover = 0;
+
+       for(int i = 0; i < 8; i++) {
+               if (keytable[key_index[i]] & (CRACKED | BEING_CRACKED)) continue;

                bytes_to_recover[numbytes_to_recover++] = key_index[i];
                keytable[key_index[i]] |= BEING_CRACKED;
 
                bytes_to_recover[numbytes_to_recover++] = key_index[i];
                keytable[key_index[i]] |= BEING_CRACKED;
 

-               if(numbytes_to_recover > 3)
-               {
+               if(numbytes_to_recover > 3) {

                        prnlog("The CSN requires > 3 byte bruteforce, not supported");
                        printvar("CSN", item.csn,8);
                        printvar("HASH1", key_index,8);
                        prnlog("The CSN requires > 3 byte bruteforce, not supported");
                        printvar("CSN", item.csn,8);
                        printvar("HASH1", key_index,8);


@@ -370,15 +368,14 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
 
        uint32_t endmask =  1 << 8*numbytes_to_recover;
 
 
        uint32_t endmask =  1 << 8*numbytes_to_recover;
 

-       for(i =0 ; i < numbytes_to_recover && numbytes_to_recover > 1; i++)
+       for (int i = 0; i < numbytes_to_recover && numbytes_to_recover > 1; i++) {

                prnlog("Bruteforcing byte %d", bytes_to_recover[i]);
                prnlog("Bruteforcing byte %d", bytes_to_recover[i]);

+       }

 
 

-       while(!found && !(brute & endmask))
-       {
+       while(!found && !(brute & endmask)) {

 
                //Update the keytable with the brute-values
 
                //Update the keytable with the brute-values

-               for(i =0 ; i < numbytes_to_recover; i++)
-               {
+               for (int i = 0; i < numbytes_to_recover; i++) {

                        keytable[bytes_to_recover[i]] &= 0xFF00;
                        keytable[bytes_to_recover[i]] |= (brute >> (i*8) & 0xFF);
                }
                        keytable[bytes_to_recover[i]] &= 0xFF00;
                        keytable[bytes_to_recover[i]] |= (brute >> (i*8) & 0xFF);
                }


@@ -394,42 +391,34 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
                //Diversify
                diversifyKey(item.csn, key_sel_p, div_key);
                //Calc mac
                //Diversify
                diversifyKey(item.csn, key_sel_p, div_key);
                //Calc mac

-               doMAC(item.cc_nr, div_key,calculated_MAC);
+               doMAC(item.cc_nr, div_key, calculated_MAC);

 
 

-               if(memcmp(calculated_MAC, item.mac, 4) == 0)
-               {
-                       for(i =0 ; i < numbytes_to_recover; i++)
-                               prnlog("=> %d: 0x%02x", bytes_to_recover[i],0xFF & keytable[bytes_to_recover[i]]);
+               if (memcmp(calculated_MAC, item.mac, 4) == 0) {
+                       for (int i =0 ; i < numbytes_to_recover; i++)
+                               prnlog("=> %d: 0x%02x", bytes_to_recover[i], 0xFF & keytable[bytes_to_recover[i]]);

                        found = true;
                        break;
                }
                brute++;
                        found = true;
                        break;
                }
                brute++;

-               if((brute & 0xFFFF) == 0)
-               {
+               if ((brute & 0xFFFF) == 0) {

                        printf("%d",(brute >> 16) & 0xFF);
                        fflush(stdout);
                }
        }
                        printf("%d",(brute >> 16) & 0xFF);
                        fflush(stdout);
                }
        }

-       if(! found)
-       {
+       if (! found) {

                prnlog("Failed to recover %d bytes using the following CSN",numbytes_to_recover);
                printvar("CSN",item.csn,8);
                errors++;
                //Before we exit, reset the 'BEING_CRACKED' to zero
                prnlog("Failed to recover %d bytes using the following CSN",numbytes_to_recover);
                printvar("CSN",item.csn,8);
                errors++;
                //Before we exit, reset the 'BEING_CRACKED' to zero

-               for(i =0 ; i < numbytes_to_recover; i++)
-               {
+               for (int i = 0; i < numbytes_to_recover; i++) {

                        keytable[bytes_to_recover[i]]  &= 0xFF;
                        keytable[bytes_to_recover[i]]  |= CRACK_FAILED;
                }
                        keytable[bytes_to_recover[i]]  &= 0xFF;
                        keytable[bytes_to_recover[i]]  |= CRACK_FAILED;
                }

-
-       }else
-       {
-               for(i =0 ; i < numbytes_to_recover; i++)
-               {
+       } else {
+               for (int i = 0 ;i < numbytes_to_recover; i++) {

                        keytable[bytes_to_recover[i]]  &= 0xFF;
                        keytable[bytes_to_recover[i]]  |= CRACKED;
                }
                        keytable[bytes_to_recover[i]]  &= 0xFF;
                        keytable[bytes_to_recover[i]]  |= CRACKED;
                }

-

        }
        return errors;
 }
        }
        return errors;
 }


@@ -449,7 +438,7 @@ int bruteforceItem(dumpdata item, uint16_t keytable[])
  */
 int calculateMasterKey(uint8_t first16bytes[], uint64_t master_key[] )
 {
  */
 int calculateMasterKey(uint8_t first16bytes[], uint64_t master_key[] )
 {

-       des_context ctx_e = {DES_ENCRYPT,{0}};
+       mbedtls_des_context ctx_e = { {0} };

 
        uint8_t z_0[8] = {0};
        uint8_t y_0[8] = {0};
 
        uint8_t z_0[8] = {0};
        uint8_t y_0[8] = {0};


@@ -468,8 +457,8 @@ int calculateMasterKey(uint8_t first16bytes[], uint64_t master_key[] )
        permutekey_rev(z_0, z_0_rev);
 
        // ~K_cus = DESenc(z[0], y[0])
        permutekey_rev(z_0, z_0_rev);
 
        // ~K_cus = DESenc(z[0], y[0])

-       des_setkey_enc( &ctx_e, z_0_rev );
-       des_crypt_ecb(&ctx_e, y_0, key64_negated);
+       mbedtls_des_setkey_enc( &ctx_e, z_0_rev );
+       mbedtls_des_crypt_ecb(&ctx_e, y_0, key64_negated);

 
        int i;
        for(i = 0; i < 8 ; i++)
 
        int i;
        for(i = 0; i < 8 ; i++)


@@ -482,8 +471,8 @@ int calculateMasterKey(uint8_t first16bytes[], uint64_t master_key[] )
        uint8_t key64_stdformat[8] = {0};
        permutekey_rev(key64, key64_stdformat);
 
        uint8_t key64_stdformat[8] = {0};
        permutekey_rev(key64, key64_stdformat);
 

-       des_setkey_enc( &ctx_e, key64_stdformat );
-       des_crypt_ecb(&ctx_e, key64_negated, result);
+       mbedtls_des_setkey_enc( &ctx_e, key64_stdformat );
+       mbedtls_des_crypt_ecb(&ctx_e, key64_negated, result);

        prnlog("\nHigh security custom key (Kcus):");
        printvar("Std format   ", key64_stdformat,8);
        printvar("Iclass format", key64,8);
        prnlog("\nHigh security custom key (Kcus):");
        printvar("Std format   ", key64_stdformat,8);
        printvar("Iclass format", key64,8);


@@ -512,19 +501,19 @@ int bruteforceDump(uint8_t dump[], size_t dumpsize, uint16_t keytable[])
        uint8_t i;
        int errors = 0;
        size_t itemsize = sizeof(dumpdata);
        uint8_t i;
        int errors = 0;
        size_t itemsize = sizeof(dumpdata);

-       clock_t t1 = clock();
+       uint64_t t1 = msclock();

 
        dumpdata* attack = (dumpdata* ) malloc(itemsize);
 
 
        dumpdata* attack = (dumpdata* ) malloc(itemsize);
 

-       for(i = 0 ; i * itemsize < dumpsize ; i++ )
+       for (i = 0 ; i * itemsize < dumpsize ; i++ )

        {
                memcpy(attack,dump+i*itemsize, itemsize);
                errors += bruteforceItem(*attack, keytable);
        }
        free(attack);
        {
                memcpy(attack,dump+i*itemsize, itemsize);
                errors += bruteforceItem(*attack, keytable);
        }
        free(attack);

-       clock_t t2 = clock();
-       float diff = (((float)t2 - (float)t1) / CLOCKS_PER_SEC );
-       prnlog("\nPerformed full crack in %f seconds",diff);
+       t1 = msclock() - t1;
+       float diff = (float)t1 / 1000.0;
+       prnlog("\nPerformed full crack in %f seconds", diff);

 
        // Pick out the first 16 bytes of the keytable.
        // The keytable is now in 16-bit ints, where the upper 8 bits
 
        // Pick out the first 16 bytes of the keytable.
        // The keytable is now in 16-bit ints, where the upper 8 bits


@@ -563,15 +552,23 @@ int bruteforceFile(const char *filename, uint16_t keytable[])
        long fsize = ftell(f);
        fseek(f, 0, SEEK_SET);
 
        long fsize = ftell(f);
        fseek(f, 0, SEEK_SET);
 

+       if (fsize < 0) {
+               prnlog("Error, when getting fsize");
+               fclose(f);
+               return 1;
+       }
+

        uint8_t *dump = malloc(fsize);
        size_t bytes_read = fread(dump, 1, fsize, f);
 
        fclose(f);
        uint8_t *dump = malloc(fsize);
        size_t bytes_read = fread(dump, 1, fsize, f);
 
        fclose(f);

-    if (bytes_read < fsize)
-    {
-        prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
-    }
-       return bruteforceDump(dump,fsize,keytable);
+       if (bytes_read < fsize) {
+               prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
+       }
+
+       uint8_t res = bruteforceDump(dump,fsize,keytable);
+       free(dump);
+       return res;

 }
 /**
  *
 }
 /**
  *