UPD: got the latest updates (@badboy) from @zhovner mfdread.

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index d6e394442c4c9cfcb5a95c42d5ae71f7f023d276..6ddf845aa446ab7fbaf00117eb9e7631d694e404 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -213,9 +213,16 @@ start:
        }       \r
        printf("\n");\r
        \r
-       // par == 0\r
-       if (isOK == -1 && par_list == 0) {\r
-               if (!nonce2key_ex(uid, nt, nr, ks_list, &r_key) ){\r
+       // par == 0,  and -4\r
+       if (isOK == -4 && par_list == 0) {\r
+               // this special attack when parities is zero, uses checkkeys. Which now with block/keytype option also needs. \r
+               // but it uses 0|1 instead of 0x60|0x61...\r
+               if (nonce2key_ex(blockNo, keytype - 0x60 , uid, nt, nr, ks_list, &r_key) ){\r
+                       PrintAndLog("Key not found (lfsr_common_prefix list is null).");        \r
+                       PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");\r
+                       c.arg[0] = false;\r
+                       goto start;\r
+               } else {\r
                        PrintAndLog("Found valid key: %012"llx" \n", r_key);\r
                        goto END;\r
                }\r
@@ -232,6 +239,16 @@ start:
                c.arg[0] = false;\r
                goto start;\r
        } else {\r
+               \r
+               // nonce2key found a candidate key.  Lets verify it.\r
+               uint8_t keyblock[] = {0,0,0,0,0,0};\r
+               num_to_bytes(r_key, 6, keyblock);\r
+               uint64_t key64 = 0;\r
+               int res = mfCheckKeys(blockNo, keytype - 0x60 , false, 1, keyblock, &key64);\r
+               if ( res > 0 ) {\r
+                       PrintAndLog("Candidate Key found (%012"llx") - Test authentication failed. Starting over darkside attack", r_key);      \r
+                       goto start;\r
+               }\r
                PrintAndLog("Found valid key: %012"llx" \n", r_key);\r
        }\r
 END:\r
@@ -1033,7 +1050,7 @@ int CmdHF14AMfNestedHard(const char *Cmd) {
                        slow ? "Yes" : "No",\r
                        tests);\r
 \r
-       int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow, tests);\r
+       int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests);\r
 \r
        if (isOK) {\r
                switch (isOK) {\r
@@ -2431,9 +2448,9 @@ static command_t CommandTable[] = {
        {"dump",                CmdHF14AMfDump,                 0, "Dump MIFARE classic tag to binary file"},\r
        {"restore",             CmdHF14AMfRestore,              0, "Restore MIFARE classic binary file to BLANK tag"},\r
        {"wrbl",                CmdHF14AMfWrBl,                 0, "Write MIFARE classic block"},\r
-       {"chk",                 CmdHF14AMfChk,                  0, "Test block keys"},\r
-       {"mifare",              CmdHF14AMifare,                 0, "Read parity error messages."},\r
-       {"nested",              CmdHF14AMfNested,               0, "Test nested authentication"},\r
+       {"chk",                 CmdHF14AMfChk,                  0, "Check keys"},\r
+       {"mifare",              CmdHF14AMifare,                 0, "Darkside attack. read parity error messages."},\r
+       {"nested",              CmdHF14AMfNested,               0, "Nested attack. Test nested authentication"},\r
        {"hardnested",  CmdHF14AMfNestedHard,   0, "Nested attack for hardened Mifare cards"},\r
        {"keybrute",    CmdHF14AMfKeyBrute,             0, "J_Run's 2nd phase of multiple sector nested authentication key recovery"},\r
        {"sniff",               CmdHF14AMfSniff,                0, "Sniff card-reader communication"},\r