github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-20 21:33:47 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

cleaning up.

Browse source 
chg:  swapped random gen for mifare classic auth to known weak prng.
This commit is contained in:
iceman1001 2017-12-10 23:09:53 +01:00
commit bf2b2afeeb
2 changed files with 15 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

29
armsrc/mifarecmd.c
View file

@ -639,7 +639,6 @@ void MifareAcquireNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *
if (initialize) if (initialize)
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
LED_C_ON(); LED_C_ON();
for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE-4; i += 4 ) { for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE-4; i += 4 ) {
@ -714,8 +713,7 @@ void MifareAcquireNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *
// Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
// Computer and Communications Security, 2015 // Computer and Communications Security, 2015
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain) void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain) {
{
uint64_t ui64Key = 0; uint64_t ui64Key = 0;
uint8_t uid[10] = {0x00}; uint8_t uid[10] = {0x00};
uint32_t cuid = 0; uint32_t cuid = 0;
@ -747,9 +745,8 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
clear_trace(); clear_trace();
set_tracing(false); set_tracing(false);
if (initialize) { if (initialize)
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
}
LED_C_ON(); LED_C_ON();
@ -1051,7 +1048,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
// MIFARE check keys. key count up to 85. // MIFARE check keys. key count up to 85.
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
typedef struct sector_t { typedef struct sector_t {
uint8_t keyA[6]; uint8_t keyA[6];
uint8_t keyB[6]; uint8_t keyB[6];
@ -1067,18 +1063,6 @@ typedef struct chk_t {
struct Crypto1State *pcs; struct Crypto1State *pcs;
} chk_t; } chk_t;
// wait for the card to become ready again
// assume: fast reset of card
/*void chk_timeout(void){
uint8_t dummy_answer = 0;
ReaderTransmit(&dummy_answer, 1, NULL);
uint32_t timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
while(GetCountSspClk() < timeout);
}
*/
// checks one key. // checks one key.
// fast select, tries 5 times to select // fast select, tries 5 times to select
// //
@ -1087,7 +1071,6 @@ typedef struct chk_t {
// 1 = wrong key // 1 = wrong key
// 0 = correct key // 0 = correct key
uint8_t chkKey( struct chk_t *c ) { uint8_t chkKey( struct chk_t *c ) {
uint8_t i = 0, res = 2; uint8_t i = 0, res = 2;
while( i < 5 ) { while( i < 5 ) {
// this part is from Piwi's faster nonce collecting part in Hardnested. // this part is from Piwi's faster nonce collecting part in Hardnested.
@ -1104,7 +1087,6 @@ uint8_t chkKey( struct chk_t *c ) {
// if successfull auth, send HALT // if successfull auth, send HALT
// if ( !res ) // if ( !res )
// mifare_classic_halt_ex(c->pcs); // mifare_classic_halt_ex(c->pcs);
break; break;
} }
return res; return res;
@ -1121,8 +1103,6 @@ uint8_t chkKey_readb(struct chk_t *c, uint8_t *keyb) {
uint8_t data[16] = {0x00}; uint8_t data[16] = {0x00};
uint8_t res = mifare_classic_readblock(c->pcs, c->cuid, c->block, data); uint8_t res = mifare_classic_readblock(c->pcs, c->cuid, c->block, data);
//CHK_TIMEOUT();
// successful read // successful read
if ( !res ) { if ( !res ) {
// data was something else than zeros. // data was something else than zeros.
@ -1223,7 +1203,6 @@ void MifareChkKeys_fast(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *da
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs; struct Crypto1State *pcs;
pcs = &mpcs; pcs = &mpcs;
struct chk_t chk_data; struct chk_t chk_data;
uint8_t allkeys = sectorcnt << 1; uint8_t allkeys = sectorcnt << 1;
@ -1369,9 +1348,8 @@ void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) {
uint64_t key = 0; uint64_t key = 0;
bool have_uid = false; bool have_uid = false;
uint8_t cascade_levels = 0; uint8_t cascade_levels = 0;
int i, res; int i, res;
byte_t isOK = 0; uint8_t isOK = 0;
uint8_t uid[10] = {0x00}; uint8_t uid[10] = {0x00};
uint32_t cuid = 0; uint32_t cuid = 0;
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
@ -1415,6 +1393,7 @@ void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) {
key = bytes_to_num(datain + i * 6, 6); key = bytes_to_num(datain + i * 6, 6);
res = mifare_classic_auth(pcs, cuid, blockNo, keyType, key, AUTH_FIRST); res = mifare_classic_auth(pcs, cuid, blockNo, keyType, key, AUTH_FIRST);
CHK_TIMEOUT(); CHK_TIMEOUT();
if (res) if (res)

15
armsrc/mifareutil.c
View file

@ -119,21 +119,16 @@ int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo,
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing) { int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing) {
int len; int len;
uint32_t pos; uint32_t pos, nt, ntpp; // Supplied tag nonce
uint8_t par[1] = {0x00}; uint8_t par[1] = {0x00};
uint8_t nr[4];
// "random" reader nonce:
//byte_t nr[4] = {0x55, 0x41, 0x49, 0x92};
fast_prand();
byte_t nr[4];
num_to_bytes(prand(), 4, nr);
uint32_t nt, ntpp; // Supplied tag nonce
uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00}; uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00}; uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
// "random" reader nonce:
num_to_bytes( prng_successor( GetTickCount(), 32), 4, nr);
// Transmit MIFARE_CLASSIC_AUTH // Transmit MIFARE_CLASSIC_AUTH
len = mifare_sendcmd_short(pcs, isNested, 0x60 + (keyType & 0x01), blockNo, receivedAnswer, receivedAnswerPar, timing); len = mifare_sendcmd_short(pcs, isNested, 0x60 + (keyType & 0x01), blockNo, receivedAnswer, receivedAnswerPar, timing);
if (len != 4) return 1; if (len != 4) return 1;