From de867f502fd3611678d3ed26f69eb6b141f542fc Mon Sep 17 00:00:00 2001 From: pwpiwi Date: Mon, 20 Mar 2017 21:05:26 +0100 Subject: [PATCH] fix: crapto3.3 sometimes crashing with hf mf mifare on Fudan clones (no par, all NACK) (#233) added readme.txt again in tools/nonce2key --- client/nonce2key/nonce2key.c | 2 +- common/crapto1/crapto1.c | 19 +++++-------------- common/crapto1/crapto1.h | 2 +- tools/nonce2key/Makefile | 2 +- tools/nonce2key/nonce2key.c | 2 +- tools/nonce2key/readme.txt | 7 +++++++ 6 files changed, 16 insertions(+), 18 deletions(-) create mode 100644 tools/nonce2key/readme.txt diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c index d146b723..6573b39d 100644 --- a/client/nonce2key/nonce2key.c +++ b/client/nonce2key/nonce2key.c @@ -76,7 +76,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_ if (par_info == 0) PrintAndLog("Parity is all zero, trying special attack! Just wait for few more seconds..."); - state = lfsr_common_prefix(nr, rr, ks3x, par); + state = lfsr_common_prefix(nr, rr, ks3x, par, (par_info == 0)); state_s = (int64_t*)state; //char filename[50] ; diff --git a/common/crapto1/crapto1.c b/common/crapto1/crapto1.c index 82c5b65b..50ff6e1a 100644 --- a/common/crapto1/crapto1.c +++ b/common/crapto1/crapto1.c @@ -465,18 +465,9 @@ uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd) */ static struct Crypto1State* check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8], - uint32_t odd, uint32_t even, struct Crypto1State* sl) + uint32_t odd, uint32_t even, struct Crypto1State* sl, uint32_t no_par) { - uint32_t ks1, nr, ks2, rr, ks3, c, good = 1, no_par = 1; - - for (int i = 0; i < 8; i++) { - for (int j = 0; j < 8; j++) { - if (parities[i][j] != 0) { - no_par = 0; - break; - } - } - } + uint32_t ks1, nr, ks2, rr, ks3, c, good = 1; for(c = 0; good && c < 8; ++c) { sl->odd = odd ^ fastfwd[1][c]; @@ -510,7 +501,7 @@ check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8], * Implentation of the common prefix attack. */ struct Crypto1State* -lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]) +lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint32_t no_par) { struct Crypto1State *statelist, *s; uint32_t *odd, *even, *o, *e, top; @@ -518,7 +509,7 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]) odd = lfsr_prefix_ks(ks, 1); even = lfsr_prefix_ks(ks, 0); - s = statelist = malloc((sizeof *statelist) << 20); + s = statelist = malloc((sizeof *statelist) << 21); // need more for no_par special attack. Enough??? if(!s || !odd || !even) { free(statelist); statelist = 0; @@ -530,7 +521,7 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]) for(top = 0; top < 64; ++top) { *o += 1 << 21; *e += (!(top & 7) + 1) << 21; - s = check_pfx_parity(pfx, rr, par, *o, *e, s); + s = check_pfx_parity(pfx, rr, par, *o, *e, s, no_par); } s->odd = s->even = 0; diff --git a/common/crapto1/crapto1.h b/common/crapto1/crapto1.h index aef59b03..e718b1f2 100644 --- a/common/crapto1/crapto1.h +++ b/common/crapto1/crapto1.h @@ -41,7 +41,7 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in); struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3); uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd); struct Crypto1State* -lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]); +lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint32_t no_par); uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb); diff --git a/tools/nonce2key/Makefile b/tools/nonce2key/Makefile index 11e019de..9772e13d 100644 --- a/tools/nonce2key/Makefile +++ b/tools/nonce2key/Makefile @@ -14,7 +14,7 @@ all: $(OBJS) $(EXES) %.o : %.c $(CC) $(CFLAGS) -c -o $@ $< -% : %.c +% : %.c $(OBJS) $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS) $< clean: diff --git a/tools/nonce2key/nonce2key.c b/tools/nonce2key/nonce2key.c index b789dca4..9cee06d6 100644 --- a/tools/nonce2key/nonce2key.c +++ b/tools/nonce2key/nonce2key.c @@ -47,7 +47,7 @@ int main(const int argc, const char* argv[]) { printf("%01x|\n",par[i][7]); } - state = lfsr_common_prefix(nr,rr,ks3x,par); + state = lfsr_common_prefix(nr,rr,ks3x,par,0); lfsr_rollback_word(state,uid^nt,0); crypto1_get_lfsr(state,&key_recovered); printf("\nkey recovered: %012" PRIx64 "\n\n",key_recovered); diff --git a/tools/nonce2key/readme.txt b/tools/nonce2key/readme.txt new file mode 100644 index 00000000..d9f0862f --- /dev/null +++ b/tools/nonce2key/readme.txt @@ -0,0 +1,7 @@ +To test the nonce2key tool. + +:: tip +You can use the output from "hf mf mifare" to use with this tool. + +:: sample +./nonce2key e9cadd9c a8bf4a12 a020a8285858b090 050f010607060e07 -- 2.39.5