FIX: how to break a working thing by being blind...

[proxmark3-svn] / armsrc / mifareutil.c

diff --git a/armsrc/mifareutil.c b/armsrc/mifareutil.c
index 1bc5454552aaf58d6bf5580426ce78520979be0a..0a057d6541250b1fd38d9209255afc9715d7313e 100644 (file)
--- a/armsrc/mifareutil.c
+++ b/armsrc/mifareutil.c
@@ -139,18 +139,17 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
        // variables\r
        int len;        \r
        uint32_t pos;\r
        // variables\r
        int len;        \r
        uint32_t pos;\r

-       uint8_t tmp4[4] = {0x00};\r

        uint8_t par[1] = {0x00};\r
 \r
        // "random" reader nonce:\r
        uint8_t par[1] = {0x00};\r
 \r
        // "random" reader nonce:\r

-       byte_t nr[4] = {0x55, 0x41, 0x49, 0x92};\r
-       //byte_t nr[4] = {0x01, 0x01, 0x01, 0x01};\r
+       //byte_t nr[4] = {0x55, 0x41, 0x49, 0x92};\r
+       byte_t nr[4] = {0x01, 0x01, 0x01, 0x01};\r

        \r
        uint32_t nt, ntpp; // Supplied tag nonce\r
        \r
        uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r
        \r
        uint32_t nt, ntpp; // Supplied tag nonce\r
        \r
        uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r

-       uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
-       uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
+       uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r
+       uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};\r

        \r
        // Transmit MIFARE_CLASSIC_AUTH\r
        len = mifare_sendcmd_short(pcs, isNested, 0x60 + (keyType & 0x01), blockNo, receivedAnswer, receivedAnswerPar, timing);\r
        \r
        // Transmit MIFARE_CLASSIC_AUTH\r
        len = mifare_sendcmd_short(pcs, isNested, 0x60 + (keyType & 0x01), blockNo, receivedAnswer, receivedAnswerPar, timing);\r


@@ -185,8 +184,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
 \r
        // Generate (encrypted) nr+parity by loading it into the cipher (Nr)\r
        par[0] = 0;\r
 \r
        // Generate (encrypted) nr+parity by loading it into the cipher (Nr)\r
        par[0] = 0;\r

-       for (pos = 0; pos < 4; pos++)\r
-       {\r
+       for (pos = 0; pos < 4; pos++) {\r

                mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];\r
                par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));\r
        }       \r
                mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];\r
                par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));\r
        }       \r


@@ -195,8 +193,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
        nt = prng_successor(nt,32);\r
 \r
        //  ar+parity\r
        nt = prng_successor(nt,32);\r
 \r
        //  ar+parity\r

-       for (pos = 4; pos < 8; pos++)\r
-       {\r
+       for (pos = 4; pos < 8; pos++) {\r

                nt = prng_successor(nt,8);\r
                mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);\r
                par[0] |= (((filter(pcs->odd) ^ oddparity8(nt & 0xff)) & 0x01) << (7-pos));\r
                nt = prng_successor(nt,8);\r
                mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);\r
                par[0] |= (((filter(pcs->odd) ^ oddparity8(nt & 0xff)) & 0x01) << (7-pos));\r


@@ -207,20 +204,17 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
 \r
        // Receive 4 byte tag answer\r
        len = ReaderReceive(receivedAnswer, receivedAnswerPar);\r
 \r
        // Receive 4 byte tag answer\r
        len = ReaderReceive(receivedAnswer, receivedAnswerPar);\r

-       if (!len)\r
-       {\r
+       if (!len) {\r

                if (MF_DBGLEVEL >= 1)   Dbprintf("Authentication failed. Card timeout.");\r
                return 2;\r
        }\r
        \r
                if (MF_DBGLEVEL >= 1)   Dbprintf("Authentication failed. Card timeout.");\r
                return 2;\r
        }\r
        \r

-       memcpy(tmp4, receivedAnswer, 4);\r

        ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);\r
        ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);\r

-       \r
-       if (ntpp != bytes_to_num(tmp4, 4)) {\r
+\r
+       if (ntpp != bytes_to_num(receivedAnswer, 4)) {\r

                if (MF_DBGLEVEL >= 1)   Dbprintf("Authentication failed. Error card response.");\r
                return 3;\r
        }\r
                if (MF_DBGLEVEL >= 1)   Dbprintf("Authentication failed. Error card response.");\r
                return 3;\r
        }\r

-\r

        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r


@@ -370,7 +364,7 @@ int mifare_ultra_auth(uint8_t *keybytes){
 int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData)\r
 {\r
        uint16_t len;\r
 int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData)\r
 {\r
        uint16_t len;\r

-       uint8_t bt[2];\r
+       uint8_t bt[2] = {0x00};\r

        uint8_t receivedAnswer[MAX_FRAME_SIZE] = {0x00};\r
        uint8_t receivedAnswerPar[MAX_PARITY_SIZE] = {0x00};\r
        \r
        uint8_t receivedAnswer[MAX_FRAME_SIZE] = {0x00};\r
        uint8_t receivedAnswerPar[MAX_PARITY_SIZE] = {0x00};\r
        \r


@@ -398,7 +392,7 @@ int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData)
 int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) \r
 {\r
        // variables\r
 int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) \r
 {\r
        // variables\r

-       uint16_t len, i;        \r
+       uint16_t len;   \r

        uint32_t pos = 0;\r
        uint8_t par[3] = {0x00};                // enough for 18 Bytes to send\r
        byte_t res = 0;\r
        uint32_t pos = 0;\r
        uint8_t par[3] = {0x00};                // enough for 18 Bytes to send\r
        byte_t res = 0;\r


@@ -419,8 +413,7 @@ int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t bl
        AppendCrc14443a(d_block, 16);\r
        \r
        // crypto\r
        AppendCrc14443a(d_block, 16);\r
        \r
        // crypto\r

-       for (pos = 0; pos < 18; pos++)\r
-       {\r
+       for (pos = 0; pos < 18; pos++) {\r

                d_block_enc[pos] = crypto1_byte(pcs, 0x00, 0) ^ d_block[pos];\r
                par[pos>>3] |= (((filter(pcs->odd) ^ oddparity8(d_block[pos])) & 0x01) << (7 - (pos&0x0007)));\r
        }       \r
                d_block_enc[pos] = crypto1_byte(pcs, 0x00, 0) ^ d_block[pos];\r
                par[pos>>3] |= (((filter(pcs->odd) ^ oddparity8(d_block[pos])) & 0x01) << (7 - (pos&0x0007)));\r
        }       \r


@@ -431,8 +424,10 @@ int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t bl
        len = ReaderReceive(receivedAnswer, receivedAnswerPar); \r
 \r
        res = 0;\r
        len = ReaderReceive(receivedAnswer, receivedAnswerPar); \r
 \r
        res = 0;\r

-       for (i = 0; i < 4; i++)\r
-               res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], i)) << i;\r
+       res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 0)) << 0;\r
+       res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 1)) << 1;\r
+       res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 2)) << 2;\r
+       res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 3)) << 3;\r

 \r
        if ((len != 1) || (res != 0x0A)) {\r
                if (MF_DBGLEVEL >= 1)   Dbprintf("Cmd send data2 Error: %02x", res);  \r
 \r
        if ((len != 1) || (res != 0x0A)) {\r
                if (MF_DBGLEVEL >= 1)   Dbprintf("Cmd send data2 Error: %02x", res);  \r


@@ -546,7 +541,6 @@ uint8_t FirstBlockOfSector(uint8_t sectorNo)
                \r
 }\r
 \r
                \r
 }\r
 \r

-\r

 // work with emulator memory\r
 void emlSetMem(uint8_t *data, int blockNum, int blocksCount) {\r
        emlSetMem_xt(data, blockNum, blocksCount, 16);\r
 // work with emulator memory\r
 void emlSetMem(uint8_t *data, int blockNum, int blocksCount) {\r
        emlSetMem_xt(data, blockNum, blocksCount, 16);\r


@@ -629,9 +623,8 @@ void emlClearMem(void) {
        memset(emCARD, 0, CARD_MEMORY_SIZE);\r
        \r
        // fill sectors trailer data\r
        memset(emCARD, 0, CARD_MEMORY_SIZE);\r
        \r
        // fill sectors trailer data\r

-       for(b = 3; b < 256; b<127?(b+=4):(b+=16)) {\r
+       for(b = 3; b < 256; b<127?(b+=4):(b+=16))\r

                emlSetMem((uint8_t *)trailer, b , 1);\r
                emlSetMem((uint8_t *)trailer, b , 1);\r

-       }       \r

 \r
        // uid\r
        emlSetMem((uint8_t *)uid, 0, 1);\r
 \r
        // uid\r
        emlSetMem((uint8_t *)uid, 0, 1);\r