github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-08-21 05:43:23 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

hf mf sim x reader attack add-ons

Browse source 
forgot to include the mfkey32 attack
This commit is contained in:
marshmellow42 2016-06-22 11:26:11 -04:00
commit 7314995a5a
2 changed files with 43 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

42
client/nonce2key/nonce2key.c
View file

@ -149,3 +149,45 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
return 1;
}
// 32 bit recover key from 2 nonces
uint64_t mfkey32(uint32_t uid, uint32_t nt, uint32_t nr0_enc, uint32_t ar0_enc, uint32_t nr1_enc, uint32_t ar1_enc) {
struct Crypto1State *s,*t;
uint64_t key=0; // recovered key
/*uint32_t uid; // serial number
uint32_t nt; // tag challenge
uint32_t nr0_enc; // first encrypted reader challenge
uint32_t ar0_enc; // first encrypted reader response
uint32_t nr1_enc; // second encrypted reader challenge
uint32_t ar1_enc; // second encrypted reader response
*/
uint8_t found=0;
//uint32_t ks2; // keystream used to encrypt reader response
// Generate lfsr succesors of the tag challenge
prng_successor(nt, 64);
prng_successor(nt, 96);
// Extract the keystream from the messages
//ks2 = ar0_enc ^ prng_successor(nt, 64);
s = lfsr_recovery32(ar0_enc ^ prng_successor(nt, 64), 0);
for(t = s; t->odd | t->even; ++t) {
lfsr_rollback_word(t, 0, 0);
lfsr_rollback_word(t, nr0_enc, 1);
lfsr_rollback_word(t, uid ^ nt, 0);
crypto1_get_lfsr(t, &key);
crypto1_word(t, uid ^ nt, 0);
crypto1_word(t, nr1_enc, 1);
if (ar1_enc == (crypto1_word(t, 0, 0) ^ prng_successor(nt, 64))) {
//printf("\nFound Key: [%012"llx"]\n\n",key);
found = 1;
break;
}
}
free(s);
if (found) return key;
return 0;
}

1
client/nonce2key/nonce2key.h
View file

@ -19,5 +19,6 @@
#include "common.h"
int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key);
uint64_t mfkey32(uint32_t uid, uint32_t nt, uint32_t nr0_enc, uint32_t ar0_enc, uint32_t nr1_enc, uint32_t ar1_enc);
#endif