X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/d9ed4e191445d342d11e35fbe4886980e40771a8..77a689dbeb6ea4adb93ba068825a5fff1fe2a802:/client/cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index d6e39444..6ddf845a 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -213,9 +213,16 @@ start:
 	}	
 	printf("\n");
 	
-	// par == 0
-	if (isOK == -1 && par_list == 0) {
-		if (!nonce2key_ex(uid, nt, nr, ks_list, &r_key) ){
+	// par == 0,  and -4
+	if (isOK == -4 && par_list == 0) {
+		// this special attack when parities is zero, uses checkkeys. Which now with block/keytype option also needs. 
+		// but it uses 0|1 instead of 0x60|0x61...
+		if (nonce2key_ex(blockNo, keytype - 0x60 , uid, nt, nr, ks_list, &r_key) ){
+			PrintAndLog("Key not found (lfsr_common_prefix list is null).");	
+			PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");
+			c.arg[0] = false;
+			goto start;
+		} else {
 			PrintAndLog("Found valid key: %012"llx" \n", r_key);
 			goto END;
 		}
@@ -232,6 +239,16 @@ start:
 		c.arg[0] = false;
 		goto start;
 	} else {
+		
+		// nonce2key found a candidate key.  Lets verify it.
+		uint8_t keyblock[] = {0,0,0,0,0,0};
+		num_to_bytes(r_key, 6, keyblock);
+		uint64_t key64 = 0;
+		int res = mfCheckKeys(blockNo, keytype - 0x60 , false, 1, keyblock, &key64);
+		if ( res > 0 ) {
+			PrintAndLog("Candidate Key found (%012"llx") - Test authentication failed. Starting over darkside attack", r_key);	
+			goto start;
+		}
 		PrintAndLog("Found valid key: %012"llx" \n", r_key);
 	}
 END:
@@ -1033,7 +1050,7 @@ int CmdHF14AMfNestedHard(const char *Cmd) {
 			slow ? "Yes" : "No",
 			tests);
 
-	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key?trgkey:NULL, nonce_file_read, nonce_file_write, slow, tests);
+	int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests);
 
 	if (isOK) {
 		switch (isOK) {
@@ -2431,9 +2448,9 @@ static command_t CommandTable[] = {
 	{"dump",		CmdHF14AMfDump,			0, "Dump MIFARE classic tag to binary file"},
 	{"restore",		CmdHF14AMfRestore,		0, "Restore MIFARE classic binary file to BLANK tag"},
 	{"wrbl",		CmdHF14AMfWrBl,			0, "Write MIFARE classic block"},
-	{"chk",			CmdHF14AMfChk,			0, "Test block keys"},
-	{"mifare",		CmdHF14AMifare,			0, "Read parity error messages."},
-	{"nested",		CmdHF14AMfNested,		0, "Test nested authentication"},
+	{"chk",			CmdHF14AMfChk,			0, "Check keys"},
+	{"mifare",		CmdHF14AMifare,			0, "Darkside attack. read parity error messages."},
+	{"nested",		CmdHF14AMfNested,		0, "Nested attack. Test nested authentication"},
 	{"hardnested", 	CmdHF14AMfNestedHard, 	0, "Nested attack for hardened Mifare cards"},
 	{"keybrute",	CmdHF14AMfKeyBrute,		0, "J_Run's 2nd phase of multiple sector nested authentication key recovery"},
 	{"sniff",		CmdHF14AMfSniff,		0, "Sniff card-reader communication"},