FIX: introduced a bug in a loop by uint8_t inside crapto1.c

CHG: textual helptext change in "hf mf nested"
CHG: loop inside "nested". Still not fast enough. I wonder if qsort can be exchanged for radixsort or bucket sort?

client/cmdhfmf.c

@@ -593,10 +593,11 @@ int CmdHF14AMfNested(const char *Cmd)
 		PrintAndLog("t - transfer keys into emulator memory");
 		PrintAndLog("d - write keys to binary file");
 		PrintAndLog(" ");
-		PrintAndLog("      sample1: hf mf nested 1 0 A FFFFFFFFFFFF ");
+		PrintAndLog(" samples:");
-		PrintAndLog("      sample2: hf mf nested 1 0 A FFFFFFFFFFFF t ");
+		PrintAndLog("              hf mf nested 1 0 A FFFFFFFFFFFF ");
-		PrintAndLog("      sample3: hf mf nested 1 0 A FFFFFFFFFFFF d ");
+		PrintAndLog("              hf mf nested 1 0 A FFFFFFFFFFFF t ");
-		PrintAndLog("      sample4: hf mf nested o 0 A FFFFFFFFFFFF 4 A");
+		PrintAndLog("              hf mf nested 1 0 A FFFFFFFFFFFF d ");
+		PrintAndLog("              hf mf nested o 0 A FFFFFFFFFFFF 4 A");
 		return 0;
 	}	
 	
@@ -1125,7 +1126,7 @@ int CmdHF14AMfChk(const char *Cmd)
 	clock_t t1 = clock();
 	
 	// check keys.
-	for (trgKeyType = 0; trgKeyType < 2; ++trgKeyType) {
+	for (trgKeyType = !keyType;  trgKeyType < 2;  (keyType==2) ? (++trgKeyType) : (trgKeyType=2) ) {
 
 		int b = blockNo;
 		for (int i = 0; i < SectorsCnt; ++i) {

client/mifarehost.c

@@ -22,26 +22,26 @@ int compar_int(const void * a, const void * b) {
 	//return (*(uint64_t*)b - *(uint64_t*)a);
 
 	// better:
-	if (*(uint64_t*)b < *(uint64_t*)a) return -1;
+	/*if (*(uint64_t*)b < *(uint64_t*)a) return -1;
 	if (*(uint64_t*)b > *(uint64_t*)a) return 1;
 	return 0;
-
+*/
-	//return (*(uint64_t*)b > *(uint64_t*)a) - (*(uint64_t*)b < *(uint64_t*)a);
+	return (*(uint64_t*)b > *(uint64_t*)a) - (*(uint64_t*)b < *(uint64_t*)a);
 }
 
 // Compare 16 Bits out of cryptostate
 int Compare16Bits(const void * a, const void * b) {
 
+/*
 	 if ((*(uint64_t*)b & 0x00ff000000ff0000) < (*(uint64_t*)a & 0x00ff000000ff0000)) return -1;
 	 if ((*(uint64_t*)b & 0x00ff000000ff0000) > (*(uint64_t*)a & 0x00ff000000ff0000)) return 1;	
 	 return 0;
-
+*/
-	/*return 
+	return 
 		((*(uint64_t*)b & 0x00ff000000ff0000) > (*(uint64_t*)a & 0x00ff000000ff0000))
 		-
 		((*(uint64_t*)b & 0x00ff000000ff0000) < (*(uint64_t*)a & 0x00ff000000ff0000))
 		;
-*/
 }
 
 typedef 
@@ -97,8 +97,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo
 	// error during nested
 	if (resp.arg[0]) return resp.arg[0];
 	
-//	memcpy(&uid, resp.d.asBytes, 4);
+	memcpy(&uid, resp.d.asBytes, 4);
-	uid = bytes_to_num(resp.d.asBytes, 4);
 		
 	for (i = 0; i < 2; i++) {
 		statelists[i].blockNo = resp.arg[2] & 0xff;
@@ -185,10 +184,9 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo
 	// uint32_t max_keys = keycnt > (USB_CMD_DATA_SIZE/6) ? (USB_CMD_DATA_SIZE/6) : keycnt;
 
 	uint32_t numOfCandidates = statelists[0].len;
-	if ( numOfCandidates == 0 ) goto out;
+	if ( numOfCandidates > 0 ) {
 
-	uint8_t *keyBlock = malloc(numOfCandidates*6);
+		uint8_t keyBlock[USB_CMD_DATA_SIZE] = {0x00};
-	if (keyBlock == NULL) return -6;
 
 		for (i = 0; i < numOfCandidates; ++i){
 			crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);
@@ -198,7 +196,6 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo
 		if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, false, numOfCandidates, keyBlock, &key64)) {		
 			free(statelists[0].head.slhead);
 			free(statelists[1].head.slhead);
-		free(keyBlock);
 			num_to_bytes(key64, 6, resultKey);
 
 			PrintAndLog("UID: %08x target block:%3u key type: %c  -- Found key [%012"llx"]",
@@ -210,7 +207,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo
 			return -5;
 		}
 		
-out:
+	}
 	PrintAndLog("UID: %08x target block:%3u key type: %c",
 			uid,
 			(uint16_t)resp.arg[2] & 0xff,

client/nonce2key/crapto1.c

@@ -188,11 +188,11 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
 	recover(odd_head, odd_tail, oks, even_head, even_tail, eks, 11, statelist, in << 1, bucket);
 
 out:
+	for (uint32_t i = 0; i < 2; i++)
+		for (uint32_t j = 0; j <= 0xff; j++)
+			free(bucket[i][j].head);
 	free(odd_head);
 	free(even_head);
-	for (uint8_t i = 0; i < 2; i++)
-		for (uint8_t j = 0; j <= 0xff; j++)
-			free(bucket[i][j].head);
 	return statelist;
 }