Update hf iclass unhash to check lsb

Updated hf iclass unhash to check lsb to be 4x 0 and 4x 1.
If it doesn't respect that format it means it never went through hash0 (as hash0 forces the key format to have 4x LSB set to 1 and 4x LSB set to 0) and likely to be an AES based key.
This commit is contained in:
Antiklesys 2025-06-27 10:30:40 +08:00
commit 89465db4b1

View file

@ -5058,6 +5058,24 @@ static int CmdHFiClassUnhash(const char *Cmd) {
return PM3_EINVARG;
}
//check if divkey respects hash0 rules (legacy format) or if it could be AES Based
int count_lsb0 = 0;
int count_lsb1 = 0;
for (int i = 0; i < PICOPASS_BLOCK_SIZE; i++) {
if ((div_key[i] & 0x01) == 0) {
count_lsb0++;
} else {
count_lsb1++;
}
}
if(count_lsb0 != 4 || count_lsb1 != 4){
PrintAndLogEx(INFO, _RED_("Incorrect LSB Distribution, unable to unhash - the key might be AES based."));
return PM3_SUCCESS;
}
PrintAndLogEx(INFO, "Diversified key... %s", sprint_hex_inrow(div_key, sizeof(div_key)));
PrintAndLogEx(INFO, "-----------------------------------");
invert_hash0(div_key);