CHG: started to clean up the crapto1 imp in client/nonce2key/ folder.

diff --git a/client/Makefile b/client/Makefile
index f071f85b30b1c54a29f0c90f7931f957912091dc..61afaf599475d1af9bfe1297a92c304b560f420b 100644 (file)
--- a/client/Makefile
+++ b/client/Makefile
@@ -5,9 +5,8 @@
 #-----------------------------------------------------------------------------
 include ../common/Makefile.common
 
 #-----------------------------------------------------------------------------
 include ../common/Makefile.common
 

-
-CC=gcc
-CXX=g++
+CC = gcc
+CXX = g++

 #COMMON_FLAGS = -m32
 VPATH = ../common ../zlib
 OBJDIR = obj
 #COMMON_FLAGS = -m32
 VPATH = ../common ../zlib
 OBJDIR = obj

diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c
index a0260004980e6fee28243875fd2f797a1f0ed690..33a4234c5fad3599b71657fed3aee9a813bba863 100644 (file)
--- a/client/cmdhf14a.c
+++ b/client/cmdhf14a.c
@@ -574,7 +574,7 @@ int CmdHF14ASim(const char *Cmd)
                                int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];
                                memcpy(data, resp.d.asBytes, len);
                                tryMfk32(uid, data, key);
                                int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];
                                memcpy(data, resp.d.asBytes, len);
                                tryMfk32(uid, data, key);

-                               tryMfk32_moebius(uid, data, key);
+                               //tryMfk32_moebius(uid, data, key);

                                //tryMfk64(uid, data, key);
                                PrintAndLog("--");
                        }
                                //tryMfk64(uid, data, key);
                                PrintAndLog("--");
                        }

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 00252661d04360cd1e29ddd93ac825deee377a03..cf0f5c131199aad6eaf59d937377b1e6149de272 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -1218,10 +1218,12 @@ int CmdHF14AMf1kSim(const char *Cmd)
                }\r
                pnr +=2;\r
        }\r
                }\r
                pnr +=2;\r
        }\r

+       \r

        if (param_getchar(Cmd, pnr) == 'n') {\r
                exitAfterNReads = param_get8(Cmd,pnr+1);\r
                pnr += 2;\r
        }\r
        if (param_getchar(Cmd, pnr) == 'n') {\r
                exitAfterNReads = param_get8(Cmd,pnr+1);\r
                pnr += 2;\r
        }\r

+       \r

        if (param_getchar(Cmd, pnr) == 'i' ) {\r
                //Using a flag to signal interactiveness, least significant bit\r
                flags |= FLAG_INTERACTIVE;\r
        if (param_getchar(Cmd, pnr) == 'i' ) {\r
                //Using a flag to signal interactiveness, least significant bit\r
                flags |= FLAG_INTERACTIVE;\r


@@ -1232,10 +1234,13 @@ int CmdHF14AMf1kSim(const char *Cmd)
                //Using a flag to signal interactiveness, least significant bit\r
                flags |= FLAG_NR_AR_ATTACK;\r
        }\r
                //Using a flag to signal interactiveness, least significant bit\r
                flags |= FLAG_NR_AR_ATTACK;\r
        }\r

+       \r

        PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
                                flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
                                                                                          flags & FLAG_7B_UID_IN_DATA   ? sprint_hex(uid,7): "N/A"\r
        PrintAndLog(" uid:%s, numreads:%d, flags:%d (0x%02x) ",\r
                                flags & FLAG_4B_UID_IN_DATA ? sprint_hex(uid,4):\r
                                                                                          flags & FLAG_7B_UID_IN_DATA   ? sprint_hex(uid,7): "N/A"\r

-                               , exitAfterNReads, flags,flags);\r
+                               , exitAfterNReads\r
+                               , flags\r
+                               , flags);\r

 \r
 \r
        UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r
 \r
 \r
        UsbCommand c = {CMD_SIMULATE_MIFARE_CARD, {flags, exitAfterNReads,0}};\r


@@ -1250,40 +1255,39 @@ int CmdHF14AMf1kSim(const char *Cmd)
 \r
                UsbCommand resp;                \r
                PrintAndLog("Press pm3-button or send another cmd to abort simulation");\r
 \r
                UsbCommand resp;                \r
                PrintAndLog("Press pm3-button or send another cmd to abort simulation");\r

-               //while(! WaitForResponseTimeout(CMD_ACK,&resp,1500)) {\r
-                       //We're waiting only 1.5 s at a time, otherwise we get the\r
-                       // annoying message about "Waiting for a response... "\r
-               //}\r
-               while(!ukbhit() ){\r
-                       if (!WaitForResponseTimeout(CMD_ACK,&resp,1500) ) continue;\r
+\r
+               while( !ukbhit() ){\r
+                       if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) continue;\r

 \r
                        if ( !(flags & FLAG_NR_AR_ATTACK) ) break;\r
 \r
                        if ( !(flags & FLAG_NR_AR_ATTACK) ) break;\r

+                       \r

                        if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;\r
 \r
                        if ( (resp.arg[0] & 0xffff) != CMD_SIMULATE_MIFARE_CARD ) break;\r
 \r

-                                       memset(data, 0x00, sizeof(data));\r
-                                       memset(key, 0x00, sizeof(key));\r
-                                       int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];\r
-                                       \r
-                                       memcpy(data, resp.d.asBytes, len);\r
-                                       \r
-                                       uint64_t corr_uid = 0;\r
-                                       if ( memcmp(data, "\x00\x00\x00\x00", 4) == 0 ) {\r
-                                               corr_uid = ((uint64_t)(data[3] << 24)) | (data[2] << 16) | (data[1] << 8) | data[0];\r
-                               tryMfk32(corr_uid, data, key);\r
-                       } else {\r
-                                               corr_uid |= (uint64_t)data[2] << 48; \r
-                                               corr_uid |= (uint64_t)data[1] << 40; \r
-                                               corr_uid |= (uint64_t)data[0] << 32;\r
-                                               corr_uid |= (uint64_t)data[7] << 24;\r
-                                               corr_uid |= (uint64_t)data[6] << 16;\r
-                                               corr_uid |= (uint64_t)data[5] << 8;\r
-                                               corr_uid |= (uint64_t)data[4];\r
-                               tryMfk64(corr_uid, data, key);\r
-                                       }\r
-                                       PrintAndLog("--");\r
+                               memset(data, 0x00, sizeof(data));\r
+                               memset(key, 0x00, sizeof(key));\r
+                               int len = (resp.arg[1] > sizeof(data)) ? sizeof(data) : resp.arg[1];\r
+                               \r
+                               memcpy(data, resp.d.asBytes, len);\r
+                               \r
+                               uint64_t corr_uid = 0;\r
+                               \r
+                               // this IF?  what was I thinking of?\r
+                               if ( memcmp(data, "\x00\x00\x00\x00", 4) == 0 ) {\r
+                                       corr_uid = ((uint64_t)(data[3] << 24)) | (data[2] << 16) | (data[1] << 8) | data[0];\r
+                                       tryMfk32(corr_uid, data, key);\r
+                               } else {\r
+                                       corr_uid |= (uint64_t)data[2] << 48; \r
+                                       corr_uid |= (uint64_t)data[1] << 40; \r
+                                       corr_uid |= (uint64_t)data[0] << 32;\r
+                                       corr_uid |= (uint64_t)data[7] << 24;\r
+                                       corr_uid |= (uint64_t)data[6] << 16;\r
+                                       corr_uid |= (uint64_t)data[5] << 8;\r
+                                       corr_uid |= (uint64_t)data[4];\r
+                                       tryMfk64(corr_uid, data, key);\r

                                }\r
                                }\r

-                       }\r
-       \r
+                       PrintAndLog("--");\r
+               }\r
+       }\r

        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

diff --git a/client/nonce2key/crapto1.c b/client/nonce2key/crapto1.c
index dfad1c4048507b67ae2d2c77afcfa8a312f9715c..4ecc594329d6373ca91757cb8c4b35b34bcb918f 100644 (file)
--- a/client/nonce2key/crapto1.c
+++ b/client/nonce2key/crapto1.c
@@ -15,97 +15,49 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor,\r
     Boston, MA  02110-1301, US$\r
 \r
     Foundation, Inc., 51 Franklin Street, Fifth Floor,\r
     Boston, MA  02110-1301, US$\r
 \r

-    Copyright (C) 2008-2008 bla <blapost@gmail.com>\r
+    Copyright (C) 2008-2014 bla <blapost@gmail.com>\r

 */\r
 #include "crapto1.h"\r
 #include <stdlib.h>\r
 \r
 #if !defined LOWMEM && defined __GNUC__\r
 */\r
 #include "crapto1.h"\r
 #include <stdlib.h>\r
 \r
 #if !defined LOWMEM && defined __GNUC__\r

-uint8_t filterlut[1 << 20];\r
+static uint8_t filterlut[1 << 20];\r

 static void __attribute__((constructor)) fill_lut()\r
 {\r
 static void __attribute__((constructor)) fill_lut()\r
 {\r

-       uint32_t x;\r
-       uint32_t f;\r
-       for(x = 0; x < 1 << 20; ++x) {\r
-               f  = 0xf22c0 >> (x       & 0xf) & 16;\r
-               f |= 0x6c9c0 >> (x >>  4 & 0xf) &  8;\r
-               f |= 0x3c8b0 >> (x >>  8 & 0xf) &  4;\r
-               f |= 0x1e458 >> (x >> 12 & 0xf) &  2;\r
-               f |= 0x0d938 >> (x >> 16 & 0xf) &  1;\r
-               filterlut[x] = BIT(0xEC57E80A, f);\r
-       }\r
+        uint32_t i;\r
+        for(i = 0; i < 1 << 20; ++i)\r
+                filterlut[i] = filter(i);\r

 }\r
 }\r

+#define filter(x) (filterlut[(x) & 0xfffff])\r

 #endif\r
 \r
 #endif\r
 \r

-\r
-\r
-typedef struct bucket {\r
-       uint32_t *head;\r
-       uint32_t *bp;\r
-} bucket_t;\r
-\r
-typedef bucket_t bucket_array_t[2][0x100];\r
-\r
-typedef struct bucket_info {\r
-       struct {\r
-               uint32_t *head, *tail;\r
-               } bucket_info[2][0x100];\r
-               uint32_t numbuckets;\r
-       } bucket_info_t;\r
-\r
-\r
-static void bucket_sort_intersect(uint32_t* const estart, uint32_t* const estop,\r
-                                                                 uint32_t* const ostart, uint32_t* const ostop,\r
-                                                                 bucket_info_t *bucket_info, bucket_array_t bucket)\r
+static void quicksort(uint32_t* const start, uint32_t* const stop)\r

 {\r
 {\r

-       uint32_t *p1, *p2;\r
-       uint32_t *start[2];\r
-       uint32_t *stop[2];\r
-\r
-       start[0] = estart;\r
-       stop[0] = estop;\r
-       start[1] = ostart;\r
-       stop[1] = ostop;\r
-\r
-       // init buckets to be empty\r
-       for (uint32_t i = 0; i < 2; i++) {\r
-               for (uint32_t j = 0x00; j <= 0xff; j++) {\r
-                       bucket[i][j].bp = bucket[i][j].head;\r
-               }\r
-       }\r
+       uint32_t *it = start + 1, *rit = stop, t;\r

 \r
 \r

-       // sort the lists into the buckets based on the MSB (contribution bits)\r
-       for (uint32_t i = 0; i < 2; i++) {\r
-               for (p1 = start[i]; p1 <= stop[i]; p1++) {\r
-                       uint32_t bucket_index = (*p1 & 0xff000000) >> 24;\r
-                       *(bucket[i][bucket_index].bp++) = *p1;\r
-               }\r
-       }\r
+       if(it > rit)\r
+               return;\r

 \r
 \r

+       while(it < rit)\r
+               if(*it <= *start)\r
+                       ++it;\r
+               else if(*rit > *start)\r
+                       --rit;\r
+               else\r
+                       t = *it,  *it = *rit, *rit = t;\r

 \r
 \r

-       // write back intersecting buckets as sorted list.\r
-       // fill in bucket_info with head and tail of the bucket contents in the list and number of non-empty buckets.\r
-       uint32_t nonempty_bucket;\r
-       for (uint32_t i = 0; i < 2; i++) {\r
-               p1 = start[i];\r
-               nonempty_bucket = 0;\r
-               for (uint32_t j = 0x00; j <= 0xff; j++) {\r
-                       if (bucket[0][j].bp != bucket[0][j].head && bucket[1][j].bp != bucket[1][j].head) { // non-empty intersecting buckets only\r
-                               bucket_info->bucket_info[i][nonempty_bucket].head = p1;\r
-                               for (p2 = bucket[i][j].head; p2 < bucket[i][j].bp; *p1++ = *p2++);\r
-                               bucket_info->bucket_info[i][nonempty_bucket].tail = p1 - 1;\r
-                               nonempty_bucket++;\r
-                       }\r
-               }\r
-               bucket_info->numbuckets = nonempty_bucket;\r
-               }\r
-}\r
+       if(*rit >= *start)\r
+               --rit;\r
+       if(rit != start)\r
+               t = *rit,  *rit = *start, *start = t;\r

 \r
 \r

+       quicksort(start, rit - 1);\r
+       quicksort(rit + 1, stop);\r
+}\r

 /** binsearch\r
  * Binary search for the first occurence of *stop's MSB in sorted [start,stop]\r
  */\r
 /** binsearch\r
  * Binary search for the first occurence of *stop's MSB in sorted [start,stop]\r
  */\r

-static inline uint32_t*\r
-binsearch(uint32_t *start, uint32_t *stop)\r
+static inline uint32_t* binsearch(uint32_t *start, uint32_t *stop)\r

 {\r
        uint32_t mid, val = *stop & 0xff000000;\r
        while(start != stop)\r
 {\r
        uint32_t mid, val = *stop & 0xff000000;\r
        while(start != stop)\r


@@ -137,33 +89,25 @@ static inline void
 extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)\r
 {\r
        in <<= 24;\r
 extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)\r
 {\r
        in <<= 24;\r

-\r
-       for(uint32_t *p = tbl; p <= *end; p++) {\r
-               *p <<= 1;\r
-               if(filter(*p) != filter(*p | 1)) {                              // replace\r
-                       *p |= filter(*p) ^ bit;\r
-                       update_contribution(p, m1, m2);\r
-                       *p ^= in;\r
-               } else if(filter(*p) == bit) {                                  // insert\r
-                       *++*end = p[1];\r
-                       p[1] = p[0] | 1;\r
-                       update_contribution(p, m1, m2);\r
-                       *p++ ^= in;\r
-                       update_contribution(p, m1, m2);\r
-                       *p ^= in;\r
-               } else {                                                                                // drop\r
-                       *p-- = *(*end)--;\r
-       }\r
-       }\r
-\r
+       for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)\r
+               if(filter(*tbl) ^ filter(*tbl | 1)) {\r
+                       *tbl |= filter(*tbl) ^ bit;\r
+                       update_contribution(tbl, m1, m2);\r
+                       *tbl ^= in;\r
+               } else if(filter(*tbl) == bit) {\r
+                       *++*end = tbl[1];\r
+                       tbl[1] = tbl[0] | 1;\r
+                       update_contribution(tbl, m1, m2);\r
+                       *tbl++ ^= in;\r
+                       update_contribution(tbl, m1, m2);\r
+                       *tbl ^= in;\r
+               } else\r
+                       *tbl-- = *(*end)--;\r

 }\r
 }\r

-\r
-\r

 /** extend_table_simple\r
  * using a bit of the keystream extend the table of possible lfsr states\r
  */\r
 /** extend_table_simple\r
  * using a bit of the keystream extend the table of possible lfsr states\r
  */\r

-static inline void\r
-extend_table_simple(uint32_t *tbl, uint32_t **end, int bit)\r
+static inline void extend_table_simple(uint32_t *tbl, uint32_t **end, int bit)\r

 {\r
        for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)\r
                if(filter(*tbl) ^ filter(*tbl | 1)) {   // replace\r
 {\r
        for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)\r
                if(filter(*tbl) ^ filter(*tbl | 1)) {   // replace\r


@@ -182,10 +126,9 @@ extend_table_simple(uint32_t *tbl, uint32_t **end, int bit)
 static struct Crypto1State*\r
 recover(uint32_t *o_head, uint32_t *o_tail, uint32_t oks,\r
        uint32_t *e_head, uint32_t *e_tail, uint32_t eks, int rem,\r
 static struct Crypto1State*\r
 recover(uint32_t *o_head, uint32_t *o_tail, uint32_t oks,\r
        uint32_t *e_head, uint32_t *e_tail, uint32_t eks, int rem,\r

-       struct Crypto1State *sl, uint32_t in, bucket_array_t bucket)\r
+       struct Crypto1State *sl, uint32_t in)\r

 {\r
 {\r

-       uint32_t *o, *e;\r
-       bucket_info_t bucket_info;\r
+       uint32_t *o, *e, i;\r

 \r
        if(rem == -1) {\r
                for(e = e_head; e <= e_tail; ++e) {\r
 \r
        if(rem == -1) {\r
                for(e = e_head; e <= e_tail; ++e) {\r


@@ -193,31 +136,41 @@ recover(uint32_t *o_head, uint32_t *o_tail, uint32_t oks,
                        for(o = o_head; o <= o_tail; ++o, ++sl) {\r
                                sl->even = *o;\r
                                sl->odd = *e ^ parity(*o & LF_POLY_ODD);\r
                        for(o = o_head; o <= o_tail; ++o, ++sl) {\r
                                sl->even = *o;\r
                                sl->odd = *e ^ parity(*o & LF_POLY_ODD);\r

+                               sl[1].odd = sl[1].even = 0;\r

                        }\r
                }\r
                        }\r
                }\r

-               sl->odd = sl->even = 0;\r

                return sl;\r
        }\r
 \r
                return sl;\r
        }\r
 \r

-       for(uint32_t i = 0; i < 4 && rem--; i++) {\r
-               extend_table(o_head, &o_tail, (oks >>= 1) & 1,\r
-                       LF_POLY_EVEN << 1 | 1, LF_POLY_ODD << 1, 0);\r
+       for(i = 0; i < 4 && rem--; i++) {\r
+               oks >>= 1;\r
+               eks >>= 1;\r
+               in >>= 2;\r
+               extend_table(o_head, &o_tail, oks & 1, LF_POLY_EVEN << 1 | 1,\r
+                            LF_POLY_ODD << 1, 0);\r

                if(o_head > o_tail)\r
                        return sl;\r
 \r
                if(o_head > o_tail)\r
                        return sl;\r
 \r

-               extend_table(e_head, &e_tail, (eks >>= 1) & 1,\r
-                       LF_POLY_ODD, LF_POLY_EVEN << 1 | 1, (in >>= 2) & 3);\r
+               extend_table(e_head, &e_tail, eks & 1, LF_POLY_ODD,\r
+                            LF_POLY_EVEN << 1 | 1, in & 3);\r

                if(e_head > e_tail)\r
                        return sl;\r
        }\r
 \r
                if(e_head > e_tail)\r
                        return sl;\r
        }\r
 \r

-       bucket_sort_intersect(e_head, e_tail, o_head, o_tail, &bucket_info, bucket);\r
+       quicksort(o_head, o_tail);\r
+       quicksort(e_head, e_tail);\r

 \r
 \r

-       for (int i = bucket_info.numbuckets - 1; i >= 0; i--) {\r
-               sl = recover(bucket_info.bucket_info[1][i].head, bucket_info.bucket_info[1][i].tail, oks,\r
-                                    bucket_info.bucket_info[0][i].head, bucket_info.bucket_info[0][i].tail, eks,\r
-                                        rem, sl, in, bucket);\r
+       while(o_tail >= o_head && e_tail >= e_head)\r
+               if(((*o_tail ^ *e_tail) >> 24) == 0) {\r
+                       o_tail = binsearch(o_head, o = o_tail);\r
+                       e_tail = binsearch(e_head, e = e_tail);\r
+                       sl = recover(o_tail--, o, oks,\r
+                                    e_tail--, e, eks, rem, sl, in);\r

        }\r
        }\r

+               else if(*o_tail > *e_tail)\r
+                       o_tail = binsearch(o_head, o_tail) - 1;\r
+               else\r
+                       e_tail = binsearch(e_head, e_tail) - 1;\r

 \r
        return sl;\r
 }\r
 \r
        return sl;\r
 }\r


@@ -243,19 +196,12 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
        even_head = even_tail = malloc(sizeof(uint32_t) << 21);\r
        statelist =  malloc(sizeof(struct Crypto1State) << 18);\r
        if(!odd_tail-- || !even_tail-- || !statelist) {\r
        even_head = even_tail = malloc(sizeof(uint32_t) << 21);\r
        statelist =  malloc(sizeof(struct Crypto1State) << 18);\r
        if(!odd_tail-- || !even_tail-- || !statelist) {\r

+               free(statelist);\r
+               statelist = 0;\r

                goto out;\r
        }\r
                goto out;\r
        }\r

-       statelist->odd = statelist->even = 0;\r

 \r
 \r

-       // allocate memory for out of place bucket_sort\r
-       bucket_array_t bucket;\r
-       for (uint32_t i = 0; i < 2; i++)\r
-               for (uint32_t j = 0; j <= 0xff; j++) {\r
-                       bucket[i][j].head = malloc(sizeof(uint32_t)<<14);\r
-                       if (!bucket[i][j].head) {\r
-                               goto out;\r
-                       }\r
-               }\r
+       statelist->odd = statelist->even = 0;\r

 \r
        // initialize statelists: add all possible states which would result into the rightmost 2 bits of the keystream\r
        for(i = 1 << 20; i >= 0; --i) {\r
 \r
        // initialize statelists: add all possible states which would result into the rightmost 2 bits of the keystream\r
        for(i = 1 << 20; i >= 0; --i) {\r


@@ -274,18 +220,13 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
        // the statelists now contain all states which could have generated the last 10 Bits of the keystream.\r
        // 22 bits to go to recover 32 bits in total. From now on, we need to take the "in"\r
        // parameter into account.\r
        // the statelists now contain all states which could have generated the last 10 Bits of the keystream.\r
        // 22 bits to go to recover 32 bits in total. From now on, we need to take the "in"\r
        // parameter into account.\r

-\r
-       in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);            // Byte swapping\r
-\r
-       recover(odd_head, odd_tail, oks, even_head, even_tail, eks, 11, statelist, in << 1, bucket);\r
+       in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);\r
+       recover(odd_head, odd_tail, oks,\r
+               even_head, even_tail, eks, 11, statelist, in << 1);\r

 \r
 out:\r
        free(odd_head);\r
        free(even_head);\r
 \r
 out:\r
        free(odd_head);\r
        free(even_head);\r

-       for (uint32_t i = 0; i < 2; i++)\r
-               for (uint32_t j = 0; j <= 0xff; j++)\r
-                       free(bucket[i][j].head);\r
-\r

        return statelist;\r
 }\r
 \r
        return statelist;\r
 }\r
 \r


@@ -326,12 +267,12 @@ struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3)
        sl->odd = sl->even = 0;\r
 \r
        for(i = 30; i >= 0; i -= 2) {\r
        sl->odd = sl->even = 0;\r
 \r
        for(i = 30; i >= 0; i -= 2) {\r

-               oks[i >> 1] = BIT(ks2, i ^ 24);\r
-               oks[16 + (i >> 1)] = BIT(ks3, i ^ 24);\r
+               oks[i >> 1] = BEBIT(ks2, i);\r
+               oks[16 + (i >> 1)] = BEBIT(ks3, i);\r

        }\r
        for(i = 31; i >= 0; i -= 2) {\r
        }\r
        for(i = 31; i >= 0; i -= 2) {\r

-               eks[i >> 1] = BIT(ks2, i ^ 24);\r
-               eks[16 + (i >> 1)] = BIT(ks3, i ^ 24);\r
+               eks[i >> 1] = BEBIT(ks2, i);\r
+               eks[16 + (i >> 1)] = BEBIT(ks3, i);\r

        }\r
 \r
        for(i = 0xfffff; i >= 0; --i) {\r
        }\r
 \r
        for(i = 0xfffff; i >= 0; --i) {\r


@@ -382,89 +323,95 @@ struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3)
 /** lfsr_rollback_bit\r
  * Rollback the shift register in order to get previous states\r
  */\r
 /** lfsr_rollback_bit\r
  * Rollback the shift register in order to get previous states\r
  */\r

-void lfsr_rollback_bit(struct Crypto1State *s, uint32_t in, int fb)\r
+uint8_t lfsr_rollback_bit(struct Crypto1State *s, uint32_t in, int fb)\r

 {\r
        int out;\r
 {\r
        int out;\r

-       uint32_t tmp;\r
+       uint8_t ret;\r
+       uint32_t t;\r

 \r
        s->odd &= 0xffffff;\r
 \r
        s->odd &= 0xffffff;\r

-       tmp = s->odd;\r
-       s->odd = s->even;\r
-       s->even = tmp;\r
+       t = s->odd, s->odd = s->even, s->even = t;\r

 \r
        out = s->even & 1;\r
        out ^= LF_POLY_EVEN & (s->even >>= 1);\r
        out ^= LF_POLY_ODD & s->odd;\r
        out ^= !!in;\r
 \r
        out = s->even & 1;\r
        out ^= LF_POLY_EVEN & (s->even >>= 1);\r
        out ^= LF_POLY_ODD & s->odd;\r
        out ^= !!in;\r

-       out ^= filter(s->odd) & !!fb;\r
+       out ^= (ret = filter(s->odd)) & !!fb;\r

 \r
        s->even |= parity(out) << 23;\r
 \r
        s->even |= parity(out) << 23;\r

+       return ret;\r

 }\r
 /** lfsr_rollback_byte\r
  * Rollback the shift register in order to get previous states\r
  */\r
 }\r
 /** lfsr_rollback_byte\r
  * Rollback the shift register in order to get previous states\r
  */\r

-void lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)\r
+uint8_t lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)\r

 {\r
 {\r

-/*     int i;\r
+       /*\r
+       int i, ret = 0;\r

        for (i = 7; i >= 0; --i)\r
        for (i = 7; i >= 0; --i)\r

-               lfsr_rollback_bit(s, BEBIT(in, i), fb);\r
+               ret |= lfsr_rollback_bit(s, BIT(in, i), fb) << i;\r

 */\r
 // unfold loop 20160112\r
 */\r
 // unfold loop 20160112\r

-       lfsr_rollback_bit(s, BEBIT(in, 7), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 6), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 5), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 4), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 3), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 2), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 1), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 0), fb);\r
+       uint8_t ret = 0;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 7), fb) << 7;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 6), fb) << 6;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 5), fb) << 5;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 4), fb) << 4;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 3), fb) << 3;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 2), fb) << 2;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 1), fb) << 1;\r
+       ret |= lfsr_rollback_bit(s, BIT(in, 0), fb) << 0;\r
+       return ret;\r

 }\r
 /** lfsr_rollback_word\r
  * Rollback the shift register in order to get previous states\r
  */\r
 }\r
 /** lfsr_rollback_word\r
  * Rollback the shift register in order to get previous states\r
  */\r

-void lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)\r
+uint32_t lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)\r

 {\r
 {\r

-/*\r
+       /*\r

        int i;\r
        int i;\r

+       uint32_t ret = 0;\r

        for (i = 31; i >= 0; --i)\r
        for (i = 31; i >= 0; --i)\r

-               lfsr_rollback_bit(s, BEBIT(in, i), fb);\r
+               ret |= lfsr_rollback_bit(s, BEBIT(in, i), fb) << (i ^ 24);\r

 */\r
 // unfold loop 20160112\r
 */\r
 // unfold loop 20160112\r

-       lfsr_rollback_bit(s, BEBIT(in, 31), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 30), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 29), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 28), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 27), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 26), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 25), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 24), fb);\r
-\r
-       lfsr_rollback_bit(s, BEBIT(in, 23), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 22), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 21), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 20), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 19), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 18), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 17), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 16), fb);\r
-\r
-       lfsr_rollback_bit(s, BEBIT(in, 15), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 14), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 13), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 12), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 11), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 10), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 9), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 8), fb);\r
-\r
-       lfsr_rollback_bit(s, BEBIT(in, 7), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 6), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 5), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 4), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 3), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 2), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 1), fb);\r
-       lfsr_rollback_bit(s, BEBIT(in, 0), fb);\r
+       uint32_t ret = 0;\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 31), fb) << (31 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 30), fb) << (30 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 29), fb) << (29 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 28), fb) << (28 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 27), fb) << (27 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 26), fb) << (26 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 25), fb) << (25 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 24), fb) << (24 ^ 24);\r
+\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 23), fb) << (23 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 22), fb) << (22 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 21), fb) << (21 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 20), fb) << (20 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 19), fb) << (19 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 18), fb) << (18 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 17), fb) << (17 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 16), fb) << (16 ^ 24);\r
+       \r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 15), fb) << (15 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 14), fb) << (14 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 13), fb) << (13 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 12), fb) << (12 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 11), fb) << (11 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 10), fb) << (10 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 9), fb) << (9 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 8), fb) << (8 ^ 24);\r
+       \r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 7), fb) << (7 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 6), fb) << (6 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 5), fb) << (5 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 4), fb) << (4 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 3), fb) << (3 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 2), fb) << (2 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 1), fb) << (1 ^ 24);\r
+       ret |= lfsr_rollback_bit(s, BEBIT(in, 0), fb) << (0 ^ 24);\r
+       return ret;\r

 }\r
 \r
 /** nonce_distance\r
 }\r
 \r
 /** nonce_distance\r


@@ -498,86 +445,63 @@ static uint32_t fastfwd[2][8] = {
  * Described in the "dark side" paper. It returns an -1 terminated array\r
  * of possible partial(21 bit) secret state.\r
  * The required keystream(ks) needs to contain the keystream that was used to\r
  * Described in the "dark side" paper. It returns an -1 terminated array\r
  * of possible partial(21 bit) secret state.\r
  * The required keystream(ks) needs to contain the keystream that was used to\r

- * encrypt the NACK which is observed when varying only the 4 last bits of Nr\r
+ * encrypt the NACK which is observed when varying only the 3 last bits of Nr\r

  * only correct iff [NR_3] ^ NR_3 does not depend on Nr_3\r
  */\r
 uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)\r
 {\r
  * only correct iff [NR_3] ^ NR_3 does not depend on Nr_3\r
  */\r
 uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)\r
 {\r

-       uint32_t *candidates = malloc(4 << 21);\r
+       uint32_t *candidates = malloc(4 << 10);\r
+       if(!candidates) return 0;\r
+       \r

        uint32_t c,  entry;\r
        uint32_t c,  entry;\r

-       int size, i;\r
-\r
-       if(!candidates)\r
-               return 0;\r
-\r
-       size = (1 << 21) - 1;\r
-       for(i = 0; i <= size; ++i)\r
-               candidates[i] = i;\r
+       int size = 0, i, good;\r

 \r
 \r

-       for(c = 0;  c < 8; ++c)\r
-               for(i = 0;i <= size; ++i) {\r
-                       entry = candidates[i] ^ fastfwd[isodd][c];\r
-\r
-                       if(filter(entry >> 1) == BIT(ks[c], isodd))\r
-                               if(filter(entry) == BIT(ks[c], isodd + 2))\r
-                                       continue;\r
-\r
-                       candidates[i--] = candidates[size--];\r
+       for(i = 0; i < 1 << 21; ++i) {\r
+               for(c = 0, good = 1; good && c < 8; ++c) {\r
+                       entry = i ^ fastfwd[isodd][c];\r
+                       good &= (BIT(ks[c], isodd) == filter(entry >> 1));\r
+                       good &= (BIT(ks[c], isodd + 2) == filter(entry));\r

                }\r
                }\r

+               if(good)\r
+                       candidates[size++] = i;\r
+       }\r

 \r
 \r

-       candidates[size + 1] = -1;\r
+       candidates[size] = -1;\r

 \r
        return candidates;\r
 }\r
 \r
 \r
        return candidates;\r
 }\r
 \r

-/** brute_top\r
+/** check_pfx_parity\r

  * helper function which eliminates possible secret states using parity bits\r
  */\r
  * helper function which eliminates possible secret states using parity bits\r
  */\r

-static struct Crypto1State*\r
-brute_top(uint32_t prefix, uint32_t rresp, unsigned char parities[8][8],\r
-          uint32_t odd, uint32_t even, struct Crypto1State* sl, uint8_t no_chk)\r
+static struct Crypto1State* check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8], uint32_t odd, uint32_t even, struct Crypto1State* sl)\r

 {\r
 {\r

-       struct Crypto1State s;\r
-       uint32_t ks1, nr, ks2, rr, ks3, good, c;\r
+       uint32_t ks1, nr, ks2, rr, ks3, c, good = 1;\r

 \r
 \r

-       for(c = 0; c < 8; ++c) {\r
-               s.odd = odd ^ fastfwd[1][c];\r
-               s.even = even ^ fastfwd[0][c];\r
+       for(c = 0; good && c < 8; ++c) {\r
+               sl->odd = odd ^ fastfwd[1][c];\r
+               sl->even = even ^ fastfwd[0][c];\r

 \r
 \r

-               lfsr_rollback_bit(&s, 0, 0);\r
-               lfsr_rollback_bit(&s, 0, 0);\r
-               lfsr_rollback_bit(&s, 0, 0);\r
+               lfsr_rollback_bit(sl, 0, 0);\r
+               lfsr_rollback_bit(sl, 0, 0);\r

 \r
 \r

-               lfsr_rollback_word(&s, 0, 0);\r
-               lfsr_rollback_word(&s, prefix | c << 5, 1);\r
+               ks3 = lfsr_rollback_bit(sl, 0, 0);\r
+               ks2 = lfsr_rollback_word(sl, 0, 0);\r
+               ks1 = lfsr_rollback_word(sl, prefix | c << 5, 1);\r

 \r
 \r

-               sl->odd = s.odd;\r
-               sl->even = s.even;\r
-\r
-               if (no_chk)\r
-                       break;\r
-\r
-               ks1 = crypto1_word(&s, prefix | c << 5, 1);\r
-               ks2 = crypto1_word(&s,0,0);\r
-               ks3 = crypto1_word(&s, 0,0);\r

                nr = ks1 ^ (prefix | c << 5);\r
                rr = ks2 ^ rresp;\r
 \r
                nr = ks1 ^ (prefix | c << 5);\r
                rr = ks2 ^ rresp;\r
 \r

-               good = 1;\r

                good &= parity(nr & 0x000000ff) ^ parities[c][3] ^ BIT(ks2, 24);\r
                good &= parity(rr & 0xff000000) ^ parities[c][4] ^ BIT(ks2, 16);\r
                good &= parity(rr & 0x00ff0000) ^ parities[c][5] ^ BIT(ks2,  8);\r
                good &= parity(rr & 0x0000ff00) ^ parities[c][6] ^ BIT(ks2,  0);\r
                good &= parity(nr & 0x000000ff) ^ parities[c][3] ^ BIT(ks2, 24);\r
                good &= parity(rr & 0xff000000) ^ parities[c][4] ^ BIT(ks2, 16);\r
                good &= parity(rr & 0x00ff0000) ^ parities[c][5] ^ BIT(ks2,  8);\r
                good &= parity(rr & 0x0000ff00) ^ parities[c][6] ^ BIT(ks2,  0);\r

-               good &= parity(rr & 0x000000ff) ^ parities[c][7] ^ BIT(ks3, 24);\r
-\r
-               if(!good)\r
-                       return sl;\r
+               good &= parity(rr & 0x000000ff) ^ parities[c][7] ^ ks3;\r

        }\r
 \r
        }\r
 \r

-       return ++sl;\r
+       return sl + good;\r

 }\r
 \r
 }\r
 \r

-\r

 /** lfsr_common_prefix\r
  * Implentation of the common prefix attack.\r
  * Requires the 28 bit constant prefix used as reader nonce (pfx)\r
 /** lfsr_common_prefix\r
  * Implentation of the common prefix attack.\r
  * Requires the 28 bit constant prefix used as reader nonce (pfx)\r


@@ -587,7 +511,8 @@ brute_top(uint32_t prefix, uint32_t rresp, unsigned char parities[8][8],
  * It returns a zero terminated list of possible cipher states after the\r
  * tag nonce was fed in\r
  */\r
  * It returns a zero terminated list of possible cipher states after the\r
  * tag nonce was fed in\r
  */\r

-struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par)\r
+\r
+struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])\r

 {\r
        struct Crypto1State *statelist, *s;\r
        uint32_t *odd, *even, *o, *e, top;\r
 {\r
        struct Crypto1State *statelist, *s;\r
        uint32_t *odd, *even, *o, *e, top;\r


@@ -595,92 +520,25 @@ struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8]
        odd = lfsr_prefix_ks(ks, 1);\r
        even = lfsr_prefix_ks(ks, 0);\r
 \r
        odd = lfsr_prefix_ks(ks, 1);\r
        even = lfsr_prefix_ks(ks, 0);\r
 \r

-       statelist = malloc((sizeof *statelist) << 21);  //how large should be?\r
-       if(!statelist || !odd || !even)\r
-       {\r
+       s = statelist = malloc((sizeof *statelist) << 20);\r
+       if(!s || !odd || !even) {\r

                free(statelist);\r
                free(odd);\r
                free(even);\r
                return 0;\r
        }\r
 \r
                free(statelist);\r
                free(odd);\r
                free(even);\r
                return 0;\r
        }\r
 \r

-       s = statelist;\r
-       for(o = odd; *o != -1; ++o)\r
-               for(e = even; *e != -1; ++e)\r
+       for(o = odd; *o + 1; ++o)\r
+               for(e = even; *e + 1; ++e)\r

                        for(top = 0; top < 64; ++top) {\r
                        for(top = 0; top < 64; ++top) {\r

-                               *o = (*o & 0x1fffff) | (top << 21);\r
-                               *e = (*e & 0x1fffff) | (top >> 3) << 21;\r
-                               s = brute_top(pfx, rr, par, *o, *e, s, no_par);\r
+                               *o += 1 << 21;\r
+                               *e += (!(top & 7) + 1) << 21;\r
+                               s = check_pfx_parity(pfx, rr, par, *o, *e, s);\r

                        }\r
 \r
                        }\r
 \r

-       s->odd = s->even = -1;\r
-       //printf("state count = %d\n",s-statelist);\r
+       s->odd = s->even = 0;\r

 \r
        free(odd);\r
        free(even);\r
 \r
        free(odd);\r
        free(even);\r

-\r

        return statelist;\r
        return statelist;\r

-}\r
-\r
-/*\r
-struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par, uint32_t nt, uint32_t uid)\r
-{\r
-    long long int amount = 0;\r
-    struct Crypto1State *statelist, *s;\r
-    uint32_t *odd, *even, *o, *e, top;\r
-\r
-    odd = lfsr_prefix_ks(ks, 1);\r
-    even = lfsr_prefix_ks(ks, 0);\r
-\r
-    s = statelist = malloc((sizeof *statelist) << 20);\r
-    if(!s || !odd || !even) {\r
-               free(odd);\r
-               free(even);\r
-               free(statelist);\r
-               return 0;\r
-    }\r
-\r
-    char filename[50] = "archivo.txt";\r
-    sprintf(filename, "logs/%x.txt", nt);\r
-    PrintAndLog("Name: %s\n", filename);\r
-    FILE *file = fopen(filename,"w+");\r
-       if ( !file ) {\r
-               s->odd = s->even = 0;\r
-               free(odd);\r
-               free(even);\r
-               PrintAndLog("Failed to create file");\r
-               return 0;\r
-       }\r
-    PrintAndLog("Creating file... ");\r
-       uint32_t xored = uid^nt;\r
-       \r
-    int lastOdd = 0;\r
-    for(o = odd; *o + 1; ++o)\r
-        for(e = even; *e + 1; ++e)\r
-            for(top = 0; top < 64; ++top) {\r
-                *o += 1 << 21;\r
-                *e += (!(top & 7) + 1) << 21;\r
-\r
-                //added by MG\r
-                if(lastOdd != statelist->odd){\r
-                                       // Here I create a temporal crypto1 state, \r
-                                       // where I load the odd and even state and work with it,\r
-                                       // in order not to interfere with regular mechanism, This is what I save to file\r
-                                       struct Crypto1State *state;\r
-                    lastOdd = state->odd = statelist->odd; state->even = statelist->even;\r
-                    lfsr_rollback_word(state,xored,0);\r
-                    fprintf(file,"%x %x \n",state->odd,state->even);\r
-                    amount++;\r
-                }\r
-                //s = check_pfx_parity(pfx, rr, par, *o, *e, s); //This is not useful at all when attacking chineese cards\r
-                               s = brute_top(pfx, rr, par, *o, *e, s, no_par); \r
-            }\r
-\r
-       PrintAndLog("File created, amount %u\n",amount);\r
-       fclose(file);\r
-       s->odd = s->even = 0;\r
-       free(odd);\r
-       free(even);\r
-    return statelist;\r
-}\r
- */\r
+}
\ No newline at end of file

diff --git a/client/nonce2key/crapto1.h b/client/nonce2key/crapto1.h
index 7f8345283772df27f9f37312efb6069eb992ac9f..c5e2ea0aa6c77fdac95f89fe2a4e089cbe90d500 100644 (file)
--- a/client/nonce2key/crapto1.h
+++ b/client/nonce2key/crapto1.h
@@ -15,10 +15,10 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
     MA  02110-1301, US$
 
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
     MA  02110-1301, US$
 

-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
+    Copyright (C) 2008-2014 bla <blapost@gmail.com>

 */
 */

-#ifndef CRAPTO1_INCLUDED
-#define CRAPTO1_INCLUDED
+#ifndef CRAPTO1_H__
+#define CRAPTO1_H__

 #include <stdint.h>
 #ifdef __cplusplus
 extern "C" {
 #include <stdint.h>
 #ifdef __cplusplus
 extern "C" {


@@ -36,17 +36,16 @@ uint32_t prng_successor(uint32_t x, uint32_t n);
 struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
 struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
 uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
 struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
 struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
 uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);

-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par);
+struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
+struct Crypto1State* lfsr_common_prefix_ex(uint32_t pfx, uint8_t ks[8], uint8_t par[8][8]);

 
 

-
-void lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
-void lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
-void lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb);
+uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
+uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
+uint32_t lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb);

 int nonce_distance(uint32_t from, uint32_t to);
 #define SWAPENDIAN(x)\
        (x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
 int nonce_distance(uint32_t from, uint32_t to);
 #define SWAPENDIAN(x)\
        (x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)

-
+       

 #define FOREACH_VALID_NONCE(N, FILTER, FSIZE)\
        uint32_t __n = 0,__M = 0, N = 0;\
        int __i;\
 #define FOREACH_VALID_NONCE(N, FILTER, FSIZE)\
        uint32_t __n = 0,__M = 0, N = 0;\
        int __i;\


@@ -70,22 +69,16 @@ static inline int parity(uint32_t x)
        x ^= x >> 4;
        return BIT(0x6996, x & 0xf);
 #else
        x ^= x >> 4;
        return BIT(0x6996, x & 0xf);
 #else

-        __asm(    "movl %1, %%eax\n"
-               "mov %%ax, %%cx\n"
-               "shrl $0x10, %%eax\n"
-               "xor %%ax, %%cx\n"
-                "xor %%ch, %%cl\n"
-                "setpo %%al\n"
-                "movzx %%al, %0\n": "=r"(x) : "r"(x): "eax","ecx");
+       __asm__(        "movl %1, %%eax\n"
+                       "mov %%ax, %%cx\n"
+                       "shrl $0x10, %%eax\n"
+                       "xor %%ax, %%cx\n"
+                       "xor %%ch, %%cl\n"
+                       "setpo %%al\n"
+                       "movzx %%al, %0\n": "=r"(x) : "r"(x): "eax","ecx");

        return x;
 #endif
 }
        return x;
 #endif
 }

-
-#if !defined LOWMEM && defined __GNUC__
-extern uint8_t filterlut[1 << 20];
-#define filter(x) (filterlut[(x) & 0xfffff])
-#define filter_unsafe(x) (filterlut[x])
-#else

 static inline int filter(uint32_t const x)
 {
        uint32_t f;
 static inline int filter(uint32_t const x)
 {
        uint32_t f;


@@ -97,9 +90,6 @@ static inline int filter(uint32_t const x)
        f |= 0x0d938 >> (x >> 16 & 0xf) &  1;
        return BIT(0xEC57E80A, f);
 }
        f |= 0x0d938 >> (x >> 16 & 0xf) &  1;
        return BIT(0xEC57E80A, f);
 }

-#define filter_unsafe(x) (filter(x))
-#endif
-

 #ifdef __cplusplus
 }
 #endif
 #ifdef __cplusplus
 }
 #endif

diff --git a/client/nonce2key/crypto1.c b/client/nonce2key/crypto1.c
index 77fb5fb0852d4904f04c17c3a70f0adf5359d374..f6779a189415e37d3867d5e4816b5d1727882e32 100644 (file)
--- a/client/nonce2key/crypto1.c
+++ b/client/nonce2key/crypto1.c
@@ -20,9 +20,6 @@
 #include "crapto1.h"
 #include <stdlib.h>
 
 #include "crapto1.h"
 #include <stdlib.h>
 

-#define SWAPENDIAN(x)\
-       (x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
-

 struct Crypto1State * crypto1_create(uint64_t key)
 {
        struct Crypto1State *s = malloc(sizeof(*s));
 struct Crypto1State * crypto1_create(uint64_t key)
 {
        struct Crypto1State *s = malloc(sizeof(*s));


@@ -38,7 +35,6 @@ void crypto1_destroy(struct Crypto1State *state)
 {
        free(state);
 }
 {
        free(state);
 }

-

 void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
 {
        int i;
 void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
 {
        int i;


@@ -67,13 +63,13 @@ uint8_t crypto1_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
 }
 uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
 {
 }
 uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
 {

-/*     
+       /*

        uint8_t i, ret = 0;
 
        for (i = 0; i < 8; ++i)
                ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;
        uint8_t i, ret = 0;
 
        for (i = 0; i < 8; ++i)
                ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;

-*/
-       // unfold loop 20160112
+       */
+// unfold loop 20161012

        uint8_t ret = 0;
        ret |= crypto1_bit(s, BIT(in, 0), is_encrypted) << 0;
        ret |= crypto1_bit(s, BIT(in, 1), is_encrypted) << 1;
        uint8_t ret = 0;
        ret |= crypto1_bit(s, BIT(in, 0), is_encrypted) << 0;
        ret |= crypto1_bit(s, BIT(in, 1), is_encrypted) << 1;


@@ -87,11 +83,49 @@ uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
 }
 uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
 {
 }
 uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
 {

+       /*

        uint32_t i, ret = 0;
 
        uint32_t i, ret = 0;
 

-       for (i = 0; i < 4; ++i, in <<= 8)
-               ret = ret << 8 | crypto1_byte(s, in >> 24, is_encrypted);
-
+       for (i = 0; i < 32; ++i)
+               ret |= crypto1_bit(s, BEBIT(in, i), is_encrypted) << (i ^ 24);
+*/
+//unfold loop 2016012
+       uint32_t ret = 0;
+       ret |= crypto1_bit(s, BEBIT(in, 0), is_encrypted) << (0 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 1), is_encrypted) << (1 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 2), is_encrypted) << (2 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 3), is_encrypted) << (3 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 4), is_encrypted) << (4 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 5), is_encrypted) << (5 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 6), is_encrypted) << (6 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 7), is_encrypted) << (7 ^ 24);
+       
+       ret |= crypto1_bit(s, BEBIT(in, 8), is_encrypted) << (8 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 9), is_encrypted) << (9 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 10), is_encrypted) << (10 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 11), is_encrypted) << (11 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 12), is_encrypted) << (12 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 13), is_encrypted) << (13 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 14), is_encrypted) << (14 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 15), is_encrypted) << (15 ^ 24);
+
+       ret |= crypto1_bit(s, BEBIT(in, 16), is_encrypted) << (16 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 17), is_encrypted) << (17 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 18), is_encrypted) << (18 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 19), is_encrypted) << (19 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 20), is_encrypted) << (20 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 21), is_encrypted) << (21 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 22), is_encrypted) << (22 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 23), is_encrypted) << (23 ^ 24);
+
+       ret |= crypto1_bit(s, BEBIT(in, 24), is_encrypted) << (24 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 25), is_encrypted) << (25 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 26), is_encrypted) << (26 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 27), is_encrypted) << (27 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 28), is_encrypted) << (28 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 29), is_encrypted) << (29 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 30), is_encrypted) << (30 ^ 24);
+       ret |= crypto1_bit(s, BEBIT(in, 31), is_encrypted) << (31 ^ 24);

        return ret;
 }
 
        return ret;
 }
 

diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c
index 81f5ae1c762303a3abba5afb39ac4a3935ca1d9a..99ede9e04426fadecdf9e47d1d83aa4a5164883d 100644 (file)
--- a/client/nonce2key/nonce2key.c
+++ b/client/nonce2key/nonce2key.c
@@ -9,14 +9,10 @@
 //-----------------------------------------------------------------------------
 // MIFARE Darkside hack
 //-----------------------------------------------------------------------------
 //-----------------------------------------------------------------------------
 // MIFARE Darkside hack
 //-----------------------------------------------------------------------------

-
-#define __STDC_FORMAT_MACROS
-#include <inttypes.h>
-#define llx PRIx64
-

 #include "nonce2key.h"
 #include "mifarehost.h"
 #include "ui.h"
 #include "nonce2key.h"
 #include "mifarehost.h"
 #include "ui.h"

+#include "proxmark3.h"

 
 int compar_state(const void * a, const void * b) {
        // didn't work: (the result is truncated to 32 bits)
 
 int compar_state(const void * a, const void * b) {
        // didn't work: (the result is truncated to 32 bits)


@@ -31,19 +27,8 @@ int compar_state(const void * a, const void * b) {
 int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
 
        struct Crypto1State *state;
 int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
 
        struct Crypto1State *state;

-       uint32_t i, pos, rr = 0, nr_diff, key_count;//, ks1, ks2;
+       uint32_t i, pos, rr = 0, nr_diff;

        byte_t bt, ks3x[8], par[8][8];
        byte_t bt, ks3x[8], par[8][8];

-       uint64_t key_recovered;
-       int64_t *state_s;
-
-       static uint32_t last_uid;
-       static int64_t *last_keylist;
-  
-       if (last_uid != uid && last_keylist != NULL) {
-               free(last_keylist);
-               last_keylist = NULL;
-       }
-       last_uid = uid;

 
        // Reset the last three significant bits of the reader nonce
        nr &= 0xffffff1f;
 
        // Reset the last three significant bits of the reader nonce
        nr &= 0xffffff1f;


@@ -66,95 +51,16 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
                nr_diff = nr | i << 5;
                printf("| %02x |%08x|", i << 5, nr_diff);
                printf(" %01x |  %01x  |", ks3x[i], ks3x[i]^5);
                nr_diff = nr | i << 5;
                printf("| %02x |%08x|", i << 5, nr_diff);
                printf(" %01x |  %01x  |", ks3x[i], ks3x[i]^5);

-               for (pos = 0; pos < 7; pos++) 
-                       printf("%01x,", par[i][pos]);
+               for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]);

                printf("%01x|\n", par[i][7]);
        }
        printf("+----+--------+---+-----+---------------+\n");
 
                printf("%01x|\n", par[i][7]);
        }
        printf("+----+--------+---+-----+---------------+\n");
 

-       if ( par_info == 0 )
-               PrintAndLog("Parity is all zero, try special attack! Wait for few more seconds...");
-  
-       state = lfsr_common_prefix(nr, rr, ks3x, par, par_info==0);
-       state_s = (int64_t*)state;
-       
-       //char filename[50] ;
-    //sprintf(filename, "nt_%08x_%d.txt", nt, nr);
-    //printf("name %s\n", filename);
-       //FILE* fp = fopen(filename,"w");
-       for (i = 0; (state) && ((state + i)->odd != -1); i++)
-       {
-               lfsr_rollback_word(state+i, uid^nt, 0);
-               crypto1_get_lfsr(state + i, &key_recovered);
-               *(state_s + i) = key_recovered;
-               //fprintf(fp, "%012llx\n",key_recovered);
-       }
-       //fclose(fp);
-       
-       if(!state)
-               return 1;
-       
-       // quicksort statelist
-       qsort(state_s, i, sizeof(*state_s), compar_state);
-
-       // set last element marker 
-       *(state_s + i) = -1;
-       
-       //Create the intersection:
-       if (par_info == 0 ) {
-               if ( last_keylist != NULL)      {
-                       int64_t *p1, *p2, *p3;
-                       p1 = p3 = last_keylist; 
-                       p2 = state_s;
-                       while ( *p1 != -1 && *p2 != -1 ) {
-                               if (compar_state(p1, p2) == 0) {
-                                       printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",
-                                               (uint64_t)(p1-last_keylist),
-                                               (uint64_t)(p2-state_s),
-                                               (uint64_t)(p3-last_keylist),
-                                               *p1);
-                                       *p3++ = *p1++;
-                                       p2++;
-                               } else {
-                                       while (compar_state(p1, p2) == -1) ++p1;
-                                       while (compar_state(p1, p2) == 1) ++p2;
-                               }
-                       }
-                       key_count = p3 - last_keylist;
-               } else {
-                       key_count = 0;
-               }
-       } else {
-               last_keylist = state_s;
-               key_count = i;
-       }
-       
-       printf("key candidates count: %d\n", key_count);
-
-       // The list may still contain several key candidates. Test each of them with mfCheckKeys
-       int res;
-       uint8_t keyBlock[6];
-       uint64_t key64;
-       for (i = 0; i < key_count; i++) {
-
-               key64 = *(last_keylist + i);
-               num_to_bytes(key64, 6, keyBlock);
-               key64 = 0;
-               // Call tag to verify if key is correct
-               res = mfCheckKeys(0, 0, false, 1, keyBlock, &key64);
-               if (!res) {
-                       *key = key64;
-                       free(last_keylist);
-                       last_keylist = NULL;
-                       if (par_info == 0)
-                               free(state);
-                       return 0;
-               }
-       }       
-       
-       free(last_keylist);
-       last_keylist = state_s;
-       return 1;
+       state = lfsr_common_prefix(nr, rr, ks3x, par);
+       lfsr_rollback_word(state, uid^nt, 0);
+       crypto1_get_lfsr(state, key);
+       crypto1_destroy(state);
+       return 0;

 }
 
 // *outputkey is not used...
 }
 
 // *outputkey is not used...


@@ -203,8 +109,9 @@ int tryMfk32(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){
                                break;
                }
        }
                                break;
                }
        }

+       
+       num_to_bytes(key, 6, outputkey);

        crypto1_destroy(t);
        crypto1_destroy(t);

-       crypto1_destroy(s);

        return isSuccess;
 }
 
        return isSuccess;
 }
 


@@ -248,8 +155,8 @@ int tryMfk32_moebius(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){
                                break;
                }
        }
                                break;
                }
        }

+       num_to_bytes(key, 6, outputkey);

        crypto1_destroy(t);
        crypto1_destroy(t);

-       crypto1_destroy(s);

        return isSuccess;
 }
 
        return isSuccess;
 }
 


@@ -295,6 +202,7 @@ int tryMfk64(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){
        lfsr_rollback_word(revstate, uid ^ nt, 0);
        crypto1_get_lfsr(revstate, &key);
        PrintAndLog("Found Key: [%012"llx"]",key);
        lfsr_rollback_word(revstate, uid ^ nt, 0);
        crypto1_get_lfsr(revstate, &key);
        PrintAndLog("Found Key: [%012"llx"]",key);

+       num_to_bytes(key, 6, outputkey);

        crypto1_destroy(revstate);
        return 0;
 }
\ No newline at end of file
        crypto1_destroy(revstate);
        return 0;
 }
\ No newline at end of file