From: iceman1001 Date: Fri, 30 Oct 2015 08:09:35 +0000 (+0100) Subject: CHG: some desfire changes from @bforbort fork. *untested* X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/857bc2ff6a4b7112b61def90b4716dcdf2c448af CHG: some desfire changes from @bforbort fork. *untested* --- diff --git a/armsrc/desfire_key.c b/armsrc/desfire_key.c index b3aa14e9..9ae2c3f0 100644 --- a/armsrc/desfire_key.c +++ b/armsrc/desfire_key.c @@ -60,6 +60,7 @@ void Desfire_3des_key_new_with_version (const uint8_t value[16], desfirekey_t ke if ( key != NULL ){ key->type = T_3DES; memcpy (key->data, value, 16); + memcpy (key->data + 16, value, 8); update_key_schedules (key); } } diff --git a/armsrc/mifaredesfire.c b/armsrc/mifaredesfire.c index b1e035f9..57681d71 100644 --- a/armsrc/mifaredesfire.c +++ b/armsrc/mifaredesfire.c @@ -1,5 +1,4 @@ #include "mifaredesfire.h" -#include "des.h" #include "BigBuf.h" #define MAX_APPLICATION_COUNT 28 @@ -198,6 +197,10 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain InitDesfireCard(); + LED_A_ON(); + LED_B_OFF(); + LED_C_OFF(); + // 3 olika sätt att authenticera. AUTH (CRC16) , AUTH_ISO (CRC32) , AUTH_AES (CRC32) // 4 olika crypto algo DES, 3DES, 3K3DES, AES // 3 olika kommunikations sätt, PLAIN,MAC,CRYPTO @@ -205,20 +208,32 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain // des, nyckel 0, switch (mode){ case 1:{ - if (algo == 1) { - - uint8_t keybytes[8] = {0x00}; + uint8_t keybytes[16]; uint8_t RndA[8] = {0x00}; uint8_t RndB[8] = {0x00}; + if (algo == 2) { if (datain[1] == 0xff){ + memcpy(keybytes,PICC_MASTER_KEY16,16); + } else { + memcpy(keybytes, datain+1, datalen); + } + } else { + if (algo == 1) { + if (datain[1] == 0xff){ memcpy(keybytes,null_key_data8,8); } else{ memcpy(keybytes, datain+1, datalen); } + } + } struct desfire_key defaultkey = {0}; desfirekey_t key = &defaultkey; + + if (algo == 2) + Desfire_3des_key_new_with_version(keybytes, key); + else if (algo ==1) Desfire_des_key_new(keybytes, key); cmd[0] = AUTHENTICATE; @@ -240,8 +255,11 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain } memcpy( encRndB, resp+3, 8); - + if (algo == 2) + tdes_dec(&decRndB, &encRndB, key->data); + else if (algo == 1) des_dec(&decRndB, &encRndB, key->data); + memcpy(RndB, decRndB, 8); rol(decRndB,8); @@ -250,14 +268,21 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain memcpy(RndA, decRndA, 8); uint8_t encRndA[8] = {0x00}; + if (algo == 2) + tdes_dec(&encRndA, &decRndA, key->data); + else if (algo == 1) des_dec(&encRndA, &decRndA, key->data); memcpy(both, encRndA, 8); for (int x = 0; x < 8; x++) { decRndB[x] = decRndB[x] ^ encRndA[x]; + } + if (algo == 2) + tdes_dec(&encRndB, &decRndB, key->data); + else if (algo == 1) des_dec(&encRndB, &decRndB, key->data); memcpy(both + 8, encRndB, 8); @@ -282,7 +307,12 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain //print_result("SESSION : ", skey->data, 8); memcpy(encRndA, resp+3, 8); + + if (algo == 2) + tdes_dec(&encRndA, &encRndA, key->data); + else if (algo == 1) des_dec(&encRndA, &encRndA, key->data); + rol(decRndA,8); for (int x = 0; x < 8; x++) { if (decRndA[x] != encRndA[x]) { @@ -295,6 +325,8 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain //Change the selected key to a new value. /* + // Current key is a 3DES key, change it to a DES key + if (algo == 2) { cmd[0] = CHANGE_KEY; cmd[1] = keyno; @@ -312,6 +344,48 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain memcpy(buff3, &first, 1); memcpy(buff3 + 1, &second, 1); + tdes_dec(&buff1, &buff1, skey->data); + memcpy(cmd+2,buff1,8); + + for (int x = 0; x < 8; x++) { + buff2[x] = buff2[x] ^ buff1[x]; + } + tdes_dec(&buff2, &buff2, skey->data); + memcpy(cmd+10,buff2,8); + + for (int x = 0; x < 8; x++) { + buff3[x] = buff3[x] ^ buff2[x]; + } + tdes_dec(&buff3, &buff3, skey->data); + memcpy(cmd+18,buff3,8); + + // The command always times out on the first attempt, this will retry until a response + // is recieved. + len = 0; + while(!len) { + len = DesfireAPDU(cmd,26,resp); + } + + } else { + // Current key is a DES key, change it to a 3DES key + if (algo == 1) { + cmd[0] = CHANGE_KEY; + cmd[1] = keyno; + + uint8_t newKey[16] = {0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,0x4e,0x4f}; + + uint8_t first, second; + uint8_t buff1[8] = {0x00}; + uint8_t buff2[8] = {0x00}; + uint8_t buff3[8] = {0x00}; + + memcpy(buff1,newKey, 8); + memcpy(buff2,newKey + 8, 8); + + ComputeCrc14443(CRC_14443_A, newKey, 16, &first, &second); + memcpy(buff3, &first, 1); + memcpy(buff3 + 1, &second, 1); + des_dec(&buff1, &buff1, skey->data); memcpy(cmd+2,buff1,8); @@ -333,18 +407,20 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain while(!len) { len = DesfireAPDU(cmd,26,resp); } + } + } */ OnSuccess(); + if (algo == 2) + cmd_send(CMD_ACK,1,0,0,skey->data,16); + else if (algo == 1) cmd_send(CMD_ACK,1,0,0,skey->data,8); - } else { DbpString("Authetication failed."); OnError(6); return; } - - } } break; case 2: @@ -416,6 +492,7 @@ void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain OnError(7); return; } + break; } } diff --git a/armsrc/mifaredesfire.h b/armsrc/mifaredesfire.h index 7cd81c7e..3d59f950 100644 --- a/armsrc/mifaredesfire.h +++ b/armsrc/mifaredesfire.h @@ -11,5 +11,6 @@ #include "desfire_key.h" #include "mifareutil.h" #include "common.h" +#include "des.h" #endif diff --git a/common/protocols.h b/common/protocols.h index d20c95fc..152039b9 100644 --- a/common/protocols.h +++ b/common/protocols.h @@ -268,14 +268,14 @@ void printIclassDumpInfo(uint8_t* iclass_dump); void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t *app_areas, uint8_t *kb); /* T55x7 configuration register definitions */ -#define T55x7_POR_DELAY 0x00000001 -#define T55x7_ST_TERMINATOR 0x00000008 -#define T55x7_PWD 0x00000010 +#define T55x7_POR_DELAY 0x00000001 +#define T55x7_ST_TERMINATOR 0x00000008 +#define T55x7_PWD 0x00000010 #define T55x7_MAXBLOCK_SHIFT 5 -#define T55x7_AOR 0x00000200 -#define T55x7_PSKCF_RF_2 0 -#define T55x7_PSKCF_RF_4 0x00000400 -#define T55x7_PSKCF_RF_8 0x00000800 +#define T55x7_AOR 0x00000200 +#define T55x7_PSKCF_RF_2 0 +#define T55x7_PSKCF_RF_4 0x00000400 +#define T55x7_PSKCF_RF_8 0x00000800 #define T55x7_MODULATION_DIRECT 0 #define T55x7_MODULATION_PSK1 0x00001000 #define T55x7_MODULATION_PSK2 0x00002000 @@ -287,17 +287,17 @@ void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t * #define T55x7_MODULATION_MANCHESTER 0x00008000 #define T55x7_MODULATION_BIPHASE 0x00010000 #define T55x7_MODULATION_DIPHASE 0x00018000 -#define T55x7_BITRATE_RF_8 0 -#define T55x7_BITRATE_RF_16 0x00040000 -#define T55x7_BITRATE_RF_32 0x00080000 -#define T55x7_BITRATE_RF_40 0x000C0000 -#define T55x7_BITRATE_RF_50 0x00100000 -#define T55x7_BITRATE_RF_64 0x00140000 +#define T55x7_BITRATE_RF_8 0 +#define T55x7_BITRATE_RF_16 0x00040000 +#define T55x7_BITRATE_RF_32 0x00080000 +#define T55x7_BITRATE_RF_40 0x000C0000 +#define T55x7_BITRATE_RF_50 0x00100000 +#define T55x7_BITRATE_RF_64 0x00140000 #define T55x7_BITRATE_RF_100 0x00180000 #define T55x7_BITRATE_RF_128 0x001C0000 /* T5555 (Q5) configuration register definitions */ -#define T5555_ST_TERMINATOR 0x00000001 +#define T5555_ST_TERMINATOR 0x00000001 #define T5555_MAXBLOCK_SHIFT 0x00000001 #define T5555_MODULATION_MANCHESTER 0 #define T5555_MODULATION_PSK1 0x00000010 @@ -307,15 +307,15 @@ void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t * #define T5555_MODULATION_FSK2 0x00000050 #define T5555_MODULATION_BIPHASE 0x00000060 #define T5555_MODULATION_DIRECT 0x00000070 -#define T5555_INVERT_OUTPUT 0x00000080 -#define T5555_PSK_RF_2 0 -#define T5555_PSK_RF_4 0x00000100 -#define T5555_PSK_RF_8 0x00000200 -#define T5555_USE_PWD 0x00000400 -#define T5555_USE_AOR 0x00000800 -#define T5555_BITRATE_SHIFT 12 -#define T5555_FAST_WRITE 0x00004000 -#define T5555_PAGE_SELECT 0x00008000 +#define T5555_INVERT_OUTPUT 0x00000080 +#define T5555_PSK_RF_2 0 +#define T5555_PSK_RF_4 0x00000100 +#define T5555_PSK_RF_8 0x00000200 +#define T5555_USE_PWD 0x00000400 +#define T5555_USE_AOR 0x00000800 +#define T5555_BITRATE_SHIFT 12 +#define T5555_FAST_WRITE 0x00004000 +#define T5555_PAGE_SELECT 0x00008000 uint32_t GetT55xxClockBit(uint32_t clock);