Add mifare crypto trace decryption utility

allows manual decryption of hf 14a snoop traces of a mf card.
someday we should fix hf mf sniff...

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 16612cba3b86e7f07d0360085f0fa773c8dfb33f..c4a0aeebd615a60eb978942d5db30930798a4171 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -1949,6 +1949,13 @@ int CmdHF14AMfSniff(const char *Cmd){
        return 0;\r
 }\r
 \r
+//needs nt, ar, at, Data to decrypt\r
+int CmdDecryptTraceCmds(const char *Cmd){\r
+       uint8_t data[50];\r
+       int len = 0;\r
+       param_gethex_ex(Cmd,3,data,&len);\r
+       return tryDecryptWord(param_get32ex(Cmd,0,0,16),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),data,len/2);\r
+}\r
 \r
 static command_t CommandTable[] =\r
 {\r
@@ -1977,6 +1984,7 @@ static command_t CommandTable[] =
   {"cgetsc",   CmdHF14AMfCGetSc,               0, "Read sector - Magic Chinese card"},\r
   {"cload",            CmdHF14AMfCLoad,                0, "Load dump into magic Chinese card"},\r
   {"csave",            CmdHF14AMfCSave,                0, "Save dump from magic Chinese card into file or emulator"},\r
+  {"decrypt", CmdDecryptTraceCmds,1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},\r
   {NULL, NULL, 0, NULL}\r
 };\r
 \r

diff --git a/client/mifarehost.c b/client/mifarehost.c
index eb145123801d7f227ef150be27fb576303991336..4abb1137c41d0baf045f2d5e8fed9109cedb7873 100644 (file)
--- a/client/mifarehost.c
+++ b/client/mifarehost.c
@@ -619,3 +619,23 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
 \r
        return 0;\r
 }\r
+\r
+int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){\r
+       /*\r
+       uint32_t nt;      // tag challenge\r
+       uint32_t ar_enc;  // encrypted reader response\r
+       uint32_t at_enc;  // encrypted tag response\r
+       */\r
+       if (traceCrypto1) {\r
+               crypto1_destroy(traceCrypto1);\r
+       }\r
+       ks2 = ar_enc ^ prng_successor(nt, 64);\r
+       ks3 = at_enc ^ prng_successor(nt, 96);\r
+       traceCrypto1 = lfsr_recovery64(ks2, ks3);\r
+\r
+       mf_crypto1_decrypt(traceCrypto1, data, len, 0);\r
+\r
+       PrintAndLog("Decrypted data: [%s]", sprint_hex(data,len) );\r
+       crypto1_destroy(traceCrypto1);\r
+       return 0;\r
+}\r

diff --git a/client/mifarehost.h b/client/mifarehost.h
index f6ffab3f219896c93aaa9ca1e4f6162fd475bdad..9ccb8960ffb0cfb353caa6998ef376010739f108 100644 (file)
--- a/client/mifarehost.h
+++ b/client/mifarehost.h
@@ -67,3 +67,4 @@ int isBlockEmpty(int blockN);
 int isBlockTrailer(int blockN);\r
 int loadTraceCard(uint8_t *tuid);\r
 int saveTraceCard(void);\r
+int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len);\r

diff --git a/client/util.c b/client/util.c
index 9f2142c6a4114d7c2e6f50f6ac97fca70c709522..5e9fce858fe9606da93830da0eb9b4c4970883b9 100644 (file)
--- a/client/util.c
+++ b/client/util.c
@@ -333,7 +333,28 @@ int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt)
 
        return 0;
 }
+int param_gethex_ex(const char *line, int paramnum, uint8_t * data, int *hexcnt)
+{
+       int bg, en, temp, i;
+
+       //if (hexcnt % 2)
+       //      return 1;
+       
+       if (param_getptr(line, &bg, &en, paramnum)) return 1;
+
+       *hexcnt = en - bg + 1;
+       if (*hexcnt % 2) //error if not complete hex bytes
+               return 1;
 
+       for(i = 0; i < *hexcnt; i += 2) {
+               if (!(isxdigit(line[bg + i]) && isxdigit(line[bg + i + 1])) )   return 1;
+               
+               sscanf((char[]){line[bg + i], line[bg + i + 1], 0}, "%X", &temp);
+               data[i / 2] = temp & 0xff;
+       }       
+
+       return 0;
+}
 int param_getstr(const char *line, int paramnum, char * str)
 {
        int bg, en;

diff --git a/client/util.h b/client/util.h
index 2d2beaf42cd12169babe5b12c603ef7680a4c3b4..19c346044eab61e4b4890d9e51fb83aef41d6d1a 100644 (file)
--- a/client/util.h
+++ b/client/util.h
@@ -54,6 +54,7 @@ uint64_t param_get64ex(const char *line, int paramnum, int deflt, int base);
 uint8_t param_getdec(const char *line, int paramnum, uint8_t *destination);
 uint8_t param_isdec(const char *line, int paramnum);
 int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt);
+int param_gethex_ex(const char *line, int paramnum, uint8_t * data, int *hexcnt);
 int param_getstr(const char *line, int paramnum, char * str);
 
  int hextobinarray( char *target,  char *source);