#include "mifarehost.h"\r
#include "proxmark3.h"\r
\r
+#define llx PRIx64\r
+\r
// MIFARE\r
int compar_int(const void * a, const void * b) {\r
// didn't work: (the result is truncated to 32 bits)\r
\r
int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * resultKey, bool calibrate) \r
{\r
- uint16_t i, len;\r
+ uint16_t i;\r
uint32_t uid;\r
UsbCommand resp;\r
+\r
StateList_t statelists[2];\r
struct Crypto1State *p1, *p2, *p3, *p4;\r
\r
memcpy(c.d.asBytes, key, 6);\r
SendCommand(&c);\r
\r
- if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
- len = resp.arg[1];\r
- if (len == 2) { \r
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {\r
+ return -1;\r
+ }\r
+\r
+ if (resp.arg[0]) {\r
+ return resp.arg[0]; // error during nested\r
+ }\r
+ \r
memcpy(&uid, resp.d.asBytes, 4);\r
- PrintAndLog("uid:%08x len=%d trgbl=%d trgkey=%x", uid, len, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8);\r
+ PrintAndLog("uid:%08x trgbl=%d trgkey=%x", uid, (uint16_t)resp.arg[2] & 0xff, (uint16_t)resp.arg[2] >> 8);\r
\r
for (i = 0; i < 2; i++) {\r
statelists[i].blockNo = resp.arg[2] & 0xff;\r
statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;\r
statelists[i].uid = uid;\r
-\r
memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);\r
memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);\r
}\r
- }\r
- else {\r
- PrintAndLog("Got 0 keys from proxmark."); \r
- return 1;\r
- }\r
- }\r
\r
// calc keys\r
\r
\r
struct Crypto1State *traceCrypto1 = NULL;\r
\r
-struct Crypto1State *revstate;\r
-uint64_t lfsr;\r
-uint32_t ks2;\r
-uint32_t ks3;\r
+struct Crypto1State *revstate = NULL;\r
\r
-uint32_t uid; // serial number\r
-uint32_t nt; // tag challenge\r
-uint32_t nr_enc; // encrypted reader challenge\r
-uint32_t ar_enc; // encrypted reader response\r
-uint32_t at_enc; // encrypted tag response\r
+uint64_t key = 0;\r
+uint32_t ks2 = 0;\r
+uint32_t ks3 = 0;\r
+\r
+uint32_t uid = 0; // serial number\r
+uint32_t nt =0; // tag challenge\r
+uint32_t nr_enc =0; // encrypted reader challenge\r
+uint32_t ar_enc =0; // encrypted reader response\r
+uint32_t at_enc =0; // encrypted tag response\r
\r
int isTraceCardEmpty(void) {\r
return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));\r
FillFileNameByUID(traceFileName, tuid, ".eml", 7);\r
\r
f = fopen(traceFileName, "r");\r
- if (!f) {\r
- fclose(f);\r
- return 1;\r
- }\r
+ if (!f) return 1;\r
\r
blockNum = 0;\r
\r
\r
memset(buf, 0, sizeof(buf));\r
if (fgets(buf, sizeof(buf), f) == NULL) {\r
- PrintAndLog("File reading error.");\r
+ PrintAndLog("File reading error.");\r
fclose(f);\r
return 2;\r
- }\r
+ }\r
\r
if (strlen(buf) < 32){\r
if (feof(f)) break;\r
if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;\r
\r
f = fopen(traceFileName, "w+");\r
- if ( !f ) {\r
- fclose(f);\r
- return 1;\r
- }\r
+ if ( !f ) return 1;\r
\r
for (int i = 0; i < 64; i++) { // blocks\r
for (int j = 0; j < 16; j++) // bytes\r
lfsr_rollback_word(revstate, nr_enc, 1);\r
lfsr_rollback_word(revstate, uid ^ nt, 0);\r
\r
- crypto1_get_lfsr(revstate, &lfsr);\r
- printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r
- AddLogUint64(logHexFileName, "key> ", lfsr); \r
+ crypto1_get_lfsr(revstate, &key);\r
+ printf("Key: %012"llx"\n",key);\r
+ AddLogUint64(logHexFileName, "key: ", key); \r
\r
int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;\r
if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);\r
\r
if (traceCurKey) {\r
- num_to_bytes(lfsr, 6, traceCard + blockShift + 10);\r
+ num_to_bytes(key, 6, traceCard + blockShift + 10);\r
} else {\r
- num_to_bytes(lfsr, 6, traceCard + blockShift);\r
+ num_to_bytes(key, 6, traceCard + blockShift);\r
}\r
if (wantSaveToEmlFile) saveTraceCard();\r
\r
\r
// nt = crypto1_word(traceCrypto1, nt ^ uid, 1) ^ nt;\r
\r
- /* traceCrypto1 = crypto1_create(lfsr); // key in lfsr\r
+ /* traceCrypto1 = crypto1_create(key); // key in lfsr\r
crypto1_word(traceCrypto1, nt ^ uid, 0);\r
crypto1_word(traceCrypto1, ar, 1);\r
crypto1_word(traceCrypto1, 0, 0);\r