github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-08-19 04:49:38 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

speedup 'hf mf chk' (#901)

Browse source 
* add separate timeout for tag response to nr_ar
* measure response time and use it for response timeout
* don't drop field between keyblocks
* some reformatting
* some whitespace fixes
* fishing for microseconds in TransmitFor14443a()
* allow arbitrary number of keys in MifareChkKeys()
* and move progress printing to MifareChkKeys()

Co-authored-by: uzlonewolf <github_com@hacker-nin.com>
This commit is contained in:
pwpiwi 2020-01-09 15:42:31 +01:00 • committed by GitHub
commit a749b1e58b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 289 additions and 324 deletions
Download patch file Download diff file Expand all files Collapse all files

96
armsrc/iso14443a.c
View file

@ -270,8 +270,7 @@ const bool Mod_Miller_LUT[] = {
#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4]) #define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)]) #define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
static void UartReset() static void UartReset() {
{
Uart.state = STATE_UNSYNCD; Uart.state = STATE_UNSYNCD;
Uart.bitCount = 0; Uart.bitCount = 0;
Uart.len = 0; // number of decoded data bytes Uart.len = 0; // number of decoded data bytes
@ -280,8 +279,7 @@ static void UartReset()
Uart.parityBits = 0; // holds 8 parity bits Uart.parityBits = 0; // holds 8 parity bits
} }
static void UartInit(uint8_t *data, uint8_t *parity) static void UartInit(uint8_t *data, uint8_t *parity) {
{
Uart.output = data; Uart.output = data;
Uart.parity = parity; Uart.parity = parity;
Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
@ -291,8 +289,7 @@ static void UartInit(uint8_t *data, uint8_t *parity)
} }
// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time) static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time) {
{
Uart.fourBits = (Uart.fourBits << 8) | bit; Uart.fourBits = (Uart.fourBits << 8) | bit;
@ -447,8 +444,7 @@ const bool Mod_Manchester_LUT[] = {
#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)]) #define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
static void DemodReset() static void DemodReset() {
{
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
Demod.len = 0; // number of decoded data bytes Demod.len = 0; // number of decoded data bytes
Demod.parityLen = 0; Demod.parityLen = 0;
@ -461,16 +457,14 @@ static void DemodReset()
Demod.endTime = 0; Demod.endTime = 0;
} }
static void DemodInit(uint8_t *data, uint8_t *parity) static void DemodInit(uint8_t *data, uint8_t *parity) {
{
Demod.output = data; Demod.output = data;
Demod.parity = parity; Demod.parity = parity;
DemodReset(); DemodReset();
} }
// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time // use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time) static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time) {
{
Demod.twoBits = (Demod.twoBits << 8) | bit; Demod.twoBits = (Demod.twoBits << 8) | bit;
@ -729,8 +723,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Prepare tag messages // Prepare tag messages
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity) static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity) {
{
ToSendReset(); ToSendReset();
// Correction bit, might be removed when not needed // Correction bit, might be removed when not needed
@ -778,8 +771,7 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *par
} }
static void Code4bitAnswerAsTag(uint8_t cmd) static void Code4bitAnswerAsTag(uint8_t cmd) {
{
int i; int i;
ToSendReset(); ToSendReset();
@ -853,8 +845,7 @@ static void EmLogTraceTag(uint8_t *tag_data, uint16_t tag_len, uint8_t *tag_Pari
// Stop when button is pressed // Stop when button is pressed
// Or return true when command is captured // Or return true when command is captured
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len) static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len) {
{
// Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
// only, since we are receiving, not transmitting). // only, since we are receiving, not transmitting).
// Signal field is off with the appropriate LED // Signal field is off with the appropriate LED
@ -951,8 +942,8 @@ bool prepare_allocated_tag_modulation(tag_response_info_t* response_info, uint8_
// Main loop of simulated tag: receive commands from reader, decide what // Main loop of simulated tag: receive commands from reader, decide what
// response to send, and send it. // response to send, and send it.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) {
{
uint8_t sak; uint8_t sak;
// The first response contains the ATQA (note: bytes are transmitted in reverse order). // The first response contains the ATQA (note: bytes are transmitted in reverse order).
@ -1231,8 +1222,7 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
// prepare a delayed transfer. This simply shifts ToSend[] by a number // prepare a delayed transfer. This simply shifts ToSend[] by a number
// of bits specified in the delay parameter. // of bits specified in the delay parameter.
static void PrepareDelayedTransfer(uint16_t delay) static void PrepareDelayedTransfer(uint16_t delay) {
{
uint8_t bitmask = 0; uint8_t bitmask = 0;
uint8_t bits_to_shift = 0; uint8_t bits_to_shift = 0;
uint8_t bits_shifted = 0; uint8_t bits_shifted = 0;
@ -1261,8 +1251,7 @@ static void PrepareDelayedTransfer(uint16_t delay)
// if == 0: transfer immediately and return time of transfer // if == 0: transfer immediately and return time of transfer
// if != 0: delay transfer until time specified // if != 0: delay transfer until time specified
//------------------------------------------------------------------------------------- //-------------------------------------------------------------------------------------
static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing) static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing) {
{
LED_B_ON(); LED_B_ON();
LED_D_ON(); LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
@ -1270,12 +1259,12 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
uint32_t ThisTransferTime = 0; uint32_t ThisTransferTime = 0;
if (timing) { if (timing) {
if(*timing == 0) { // Measure time if (*timing == 0) { // Measure time
*timing = (GetCountSspClk() + 8) & 0xfffffff8; *timing = (GetCountSspClk() + 8) & 0xfffffff8;
} else { } else {
PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks) PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
} }
if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing"); if (MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
while (GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks) while (GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
LastTimeProxToAirStart = *timing; LastTimeProxToAirStart = *timing;
} else { } else {
@ -1284,12 +1273,9 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
LastTimeProxToAirStart = ThisTransferTime; LastTimeProxToAirStart = ThisTransferTime;
} }
// clear TXRDY
AT91C_BASE_SSC->SSC_THR = SEC_Y;
uint16_t c = 0; uint16_t c = 0;
for (;;) { for (;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = cmd[c]; AT91C_BASE_SSC->SSC_THR = cmd[c];
c++; c++;
if(c >= len) { if(c >= len) {
@ -1306,8 +1292,7 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Prepare reader command (in bits, support short frames) to send to FPGA // Prepare reader command (in bits, support short frames) to send to FPGA
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity) static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity) {
{
int i, j; int i, j;
int last; int last;
uint8_t b; uint8_t b;
@ -1390,8 +1375,7 @@ static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, cons
// Stop when button is pressed (return 1) or field was gone (return 2) // Stop when button is pressed (return 1) or field was gone (return 2)
// Or return 0 when command is captured // Or return 0 when command is captured
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity) int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity) {
{
uint32_t field_off_time = -1; uint32_t field_off_time = -1;
uint32_t samples = 0; uint32_t samples = 0;
int ret = 0; int ret = 0;
@ -1475,8 +1459,7 @@ int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
} }
static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen) static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen) {
{
LED_C_ON(); LED_C_ON();
uint8_t b; uint8_t b;
@ -1578,8 +1561,7 @@ int EmSendPrecompiledCmd(tag_response_info_t *response_info) {
// If a response is captured return true // If a response is captured return true
// If it takes too long return false // If it takes too long return false
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset) static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset) {
{
uint32_t c; uint32_t c;
// Set FPGA mode to "reader listen mode", no modulation (listen // Set FPGA mode to "reader listen mode", no modulation (listen
@ -1598,9 +1580,9 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receive
for (;;) { for (;;) {
WDT_HIT(); WDT_HIT();
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if(ManchesterDecoding(b, offset, 0)) { if (ManchesterDecoding(b, offset, 0)) {
NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD); NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
return true; return true;
} else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) { } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
@ -1611,13 +1593,13 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receive
} }
void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing) void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing) {
{
CodeIso14443aBitsAsReaderPar(frame, bits, par); CodeIso14443aBitsAsReaderPar(frame, bits, par);
// Send command to tag // Send command to tag
TransmitFor14443a(ToSend, ToSendMax, timing); TransmitFor14443a(ToSend, ToSendMax, timing);
if(trigger) if (trigger)
LED_A_ON(); LED_A_ON();
// Log reader command in trace buffer // Log reader command in trace buffer
@ -1625,14 +1607,12 @@ void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t
} }
void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing) void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing) {
{ ReaderTransmitBitsPar(frame, len*8, par, timing);
ReaderTransmitBitsPar(frame, len*8, par, timing);
} }
static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing) static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing) {
{
// Generate parity and redirect // Generate parity and redirect
uint8_t par[MAX_PARITY_SIZE]; uint8_t par[MAX_PARITY_SIZE];
GetParity(frame, len/8, par); GetParity(frame, len/8, par);
@ -1640,8 +1620,7 @@ static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
} }
void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing) void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing) {
{
// Generate parity and redirect // Generate parity and redirect
uint8_t par[MAX_PARITY_SIZE]; uint8_t par[MAX_PARITY_SIZE];
GetParity(frame, len, par); GetParity(frame, len, par);
@ -1649,17 +1628,16 @@ void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
} }
static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity) static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity) {
{
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return false; if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return false;
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false); LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
return Demod.len; return Demod.len;
} }
int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity) int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity) {
{
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return false; if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return false;
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false); LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
return Demod.len; return Demod.len;
} }
@ -1696,7 +1674,7 @@ static void iso14a_set_ATS_times(uint8_t *ats) {
static int GetATQA(uint8_t *resp, uint8_t *resp_par) { static int GetATQA(uint8_t *resp, uint8_t *resp_par) {
#define WUPA_RETRY_TIMEOUT 10 // 10ms #define WUPA_RETRY_TIMEOUT 10 // 10ms
uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP uint8_t wupa[] = {ISO14443A_CMD_WUPA}; // 0x26 - REQA 0x52 - WAKE-UP
uint32_t save_iso14a_timeout = iso14a_get_timeout(); uint32_t save_iso14a_timeout = iso14a_get_timeout();
iso14a_set_timeout(1236/(16*8)+1); // response to WUPA is expected at exactly 1236/fc. No need to wait longer. iso14a_set_timeout(1236/(16*8)+1); // response to WUPA is expected at exactly 1236/fc. No need to wait longer.
@ -1737,7 +1715,7 @@ int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, u
int len; int len;
// init card struct // init card struct
if(p_hi14a_card) { if (p_hi14a_card) {
p_hi14a_card->uidlen = 0; p_hi14a_card->uidlen = 0;
memset(p_hi14a_card->uid, 0, 10); memset(p_hi14a_card->uid, 0, 10);
p_hi14a_card->ats_len = 0; p_hi14a_card->ats_len = 0;
@ -1747,7 +1725,7 @@ int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, u
return 0; return 0;
} }
if(p_hi14a_card) { if (p_hi14a_card) {
memcpy(p_hi14a_card->atqa, resp, 2); memcpy(p_hi14a_card->atqa, resp, 2);
} }
@ -2034,8 +2012,8 @@ int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *data, u
// Read an ISO 14443a tag. Send out commands and store answers. // Read an ISO 14443a tag. Send out commands and store answers.
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void ReaderIso14443a(UsbCommand *c) void ReaderIso14443a(UsbCommand *c) {
{
iso14a_command_t param = c->arg[0]; iso14a_command_t param = c->arg[0];
uint8_t *cmd = c->d.asBytes; uint8_t *cmd = c->d.asBytes;
size_t len = c->arg[1] & 0xffff; size_t len = c->arg[1] & 0xffff;

1
armsrc/iso14443a.h
View file

@ -52,4 +52,5 @@ extern int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *
extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats); extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats);
extern void iso14a_set_trigger(bool enable); extern void iso14a_set_trigger(bool enable);
extern void iso14a_set_timeout(uint32_t timeout); extern void iso14a_set_timeout(uint32_t timeout);
extern uint32_t iso14a_get_timeout(void);
#endif /* __ISO14443A_H */ #endif /* __ISO14443A_H */

91
armsrc/mifarecmd.c
View file

@ -87,7 +87,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
break; break;
}; };
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) { if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
break; break;
}; };
@ -244,7 +244,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
} }
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) { if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
isOK = 0; isOK = 0;
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
} }
@ -407,7 +407,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
break; break;
}; };
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) { if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
break; break;
}; };
@ -705,7 +705,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
} }
uint32_t nt1; uint32_t nt1;
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) { if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error"); if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
continue; continue;
} }
@ -760,9 +760,8 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
// MIFARE nested authentication. // MIFARE nested authentication.
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) {
{
// params
uint8_t blockNo = arg0 & 0xff; uint8_t blockNo = arg0 & 0xff;
uint8_t keyType = (arg0 >> 8) & 0xff; uint8_t keyType = (arg0 >> 8) & 0xff;
uint8_t targetBlockNo = arg1 & 0xff; uint8_t targetBlockNo = arg1 & 0xff;
@ -771,7 +770,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
ui64Key = bytes_to_num(datain, 6); ui64Key = bytes_to_num(datain, 6);
// variables
uint16_t rtr, i, j, len; uint16_t rtr, i, j, len;
uint16_t davg; uint16_t davg;
static uint16_t dmin, dmax; static uint16_t dmin, dmax;
@ -788,11 +786,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
pcs = &mpcs; pcs = &mpcs;
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
uint32_t auth1_time, auth2_time; uint32_t auth1_time, auth2_time, authentication_timeout = 0;
static uint16_t delta_time; static uint16_t delta_time;
LED_A_ON(); LED_A_ON();
LED_C_OFF();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
// free eventually allocated BigBuf memory // free eventually allocated BigBuf memory
@ -816,26 +813,26 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
for (rtr = 0; rtr < 17; rtr++) { for (rtr = 0; rtr < 17; rtr++) {
// prepare next select. No need to power down the card. // prepare next select. No need to power down the card.
if(mifare_classic_halt(pcs, cuid)) { if (mifare_classic_halt(pcs, cuid)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
rtr--; rtr--;
continue; continue;
} }
// Test if the action was cancelled // Test if the action was cancelled
if(BUTTON_PRESS()) { if (BUTTON_PRESS()) {
isOK = -2; isOK = -2;
break; break;
} }
if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) { if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
rtr--; rtr--;
continue; continue;
}; };
auth1_time = 0; auth1_time = 0;
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) { if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
rtr--; rtr--;
continue; continue;
@ -846,7 +843,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
} else { } else {
auth2_time = 0; auth2_time = 0;
} }
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) { if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
rtr--; rtr--;
continue; continue;
@ -891,10 +888,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
LED_C_ON(); LED_C_ON();
// get crypted nonces for target sector // get crypted nonces for target sector
for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
target_nt[i] = 0; target_nt[i] = 0;
while(target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
// prepare next select. No need to power down the card. // prepare next select. No need to power down the card.
if(mifare_classic_halt(pcs, cuid)) { if(mifare_classic_halt(pcs, cuid)) {
@ -903,19 +900,20 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
} }
// break out of the loop on button press // break out of the loop on button press
if(BUTTON_PRESS()) { if (BUTTON_PRESS()) {
isOK = -2; isOK = -2;
break; break;
} }
if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) { if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
continue; continue;
} }
auth1_time = 0; auth1_time = 0;
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) { authentication_timeout = 0;
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error"); if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, &authentication_timeout)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
continue; continue;
} }
@ -972,12 +970,13 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
// ----------------------------- crypto1 destroy // ----------------------------- crypto1 destroy
crypto1_destroy(pcs); crypto1_destroy(pcs);
byte_t buf[4 + 4 * 4]; uint8_t buf[4 + 4 * 4 + 4];
memcpy(buf, &cuid, 4); memcpy(buf, &cuid, 4);
memcpy(buf+4, &target_nt[0], 4); memcpy(buf+4, &target_nt[0], 4);
memcpy(buf+8, &target_ks[0], 4); memcpy(buf+8, &target_ks[0], 4);
memcpy(buf+12, &target_nt[1], 4); memcpy(buf+12, &target_nt[1], 4);
memcpy(buf+16, &target_ks[1], 4); memcpy(buf+16, &target_ks[1], 4);
memcpy(buf+20, &authentication_timeout, 4);
LED_B_ON(); LED_B_ON();
cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf)); cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
@ -989,49 +988,49 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
LEDsoff(); LEDsoff();
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// MIFARE check keys. key count up to 85. // MIFARE check keys. key count up to 85.
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain) void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain) {
{
uint8_t blockNo = arg0 & 0xff; uint8_t blockNo = arg0 & 0xff;
uint8_t keyType = (arg0 >> 8) & 0xff; uint8_t keyType = arg0 >> 8;
bool clearTrace = arg1 & 0x01; bool clearTrace = arg1 & 0x01;
bool multisectorCheck = arg1 & 0x02; bool multisectorCheck = arg1 & 0x02;
uint8_t set14aTimeout = (arg1 >> 8) & 0xff; bool init = arg1 & 0x04;
bool drop_field = arg1 & 0x08;
uint32_t auth_timeout = arg1 >> 16;
uint8_t keyCount = arg2; uint8_t keyCount = arg2;
LED_A_ON(); LED_A_ON();
// clear debug level if (init) {
int OLD_MF_DBGLEVEL = MF_DBGLEVEL; iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
MF_DBGLEVEL = MF_DBG_NONE; }
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
if (clearTrace) { if (clearTrace) {
clear_trace(); clear_trace();
} }
set_tracing(true); set_tracing(true);
if (set14aTimeout){ // clear debug level. We are expecting lots of authentication failures...
iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
} MF_DBGLEVEL = MF_DBG_NONE;
int res = 0;
if (multisectorCheck) { if (multisectorCheck) {
TKeyIndex keyIndex = {{0}}; TKeyIndex keyIndex = {{0}};
uint8_t sectorCnt = blockNo; uint8_t sectorCnt = blockNo;
int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex); res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, &auth_timeout, OLD_MF_DBGLEVEL, &keyIndex);
if (res >= 0) { if (res >= 0) {
cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80); cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);
} else { } else {
cmd_send(CMD_ACK, 0, res, 0, NULL, 0); cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
} }
} else { } else {
int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL); res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
if (res > 0) { if (res > 0) {
cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6); cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
} else { } else {
@ -1039,12 +1038,14 @@ void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
} }
} }
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); if (drop_field || res != 0) {
LED_D_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
}
// restore debug level // restore debug level
MF_DBGLEVEL = OLD_MF_DBGLEVEL; MF_DBGLEVEL = OLD_MF_DBGLEVEL;
LED_A_OFF(); LED_A_OFF();
} }
@ -1074,7 +1075,7 @@ void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data)
uint8_t block_number = 0; uint8_t block_number = 0;
uint64_t key = bytes_to_num(data, 6); uint64_t key = bytes_to_num(data, 6);
if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) { if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
break; break;
} }
@ -1175,13 +1176,13 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) { for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
ui64Key = emlGetKey(sectorNo, keyType); ui64Key = emlGetKey(sectorNo, keyType);
if (sectorNo == 0){ if (sectorNo == 0){
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) { if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
isOK = false; isOK = false;
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo); if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
break; break;
} }
} else { } else {
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) { if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED, NULL)) {
isOK = false; isOK = false;
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo); if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
break; break;

2
armsrc/mifarecmd.h
View file

@ -25,7 +25,7 @@ extern void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *
extern void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain); extern void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
extern void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
extern void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain); extern void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain);
extern void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain); extern void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain);
extern void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
extern void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
extern void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);

88
armsrc/mifareutil.c
View file

@ -113,9 +113,7 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos]; ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];
par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos)); par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos));
} }
ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing); ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);
} else { } else {
ReaderTransmit(dcmd, sizeof(dcmd), timing); ReaderTransmit(dcmd, sizeof(dcmd), timing);
} }
@ -143,18 +141,18 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
return len; return len;
} }
// mifare classic commands // mifare classic commands
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested) int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout) {
{
return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL); return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL, auth_timeout);
} }
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing)
{ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing, uint32_t *auth_timeout) {
// variables
int len; int len;
uint32_t pos; uint32_t pos;
uint8_t tmp4[4];
uint8_t par[1] = {0x00}; uint8_t par[1] = {0x00};
byte_t nr[4]; byte_t nr[4];
uint32_t nt, ntpp; // Supplied tag nonce uint32_t nt, ntpp; // Supplied tag nonce
@ -202,8 +200,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
// Generate (encrypted) nr+parity by loading it into the cipher (Nr) // Generate (encrypted) nr+parity by loading it into the cipher (Nr)
par[0] = 0; par[0] = 0;
for (pos = 0; pos < 4; pos++) for (pos = 0; pos < 4; pos++) {
{
mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos]; mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];
par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos)); par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));
} }
@ -212,8 +209,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
nt = prng_successor(nt,32); nt = prng_successor(nt,32);
// ar+parity // ar+parity
for (pos = 4; pos < 8; pos++) for (pos = 4; pos < 8; pos++) {
{
nt = prng_successor(nt,8); nt = prng_successor(nt,8);
mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff); mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);
par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos)); par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos));
@ -223,17 +219,24 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL); ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
// Receive 4 byte tag answer // Receive 4 byte tag answer
uint32_t save_timeout = iso14a_get_timeout(); // save standard timeout
if (auth_timeout && *auth_timeout) {
iso14a_set_timeout(*auth_timeout); // set timeout for authentication response
}
uint32_t auth_timeout_start = GetCountSspClk();
len = ReaderReceive(receivedAnswer, receivedAnswerPar); len = ReaderReceive(receivedAnswer, receivedAnswerPar);
if (!len) iso14a_set_timeout(save_timeout); // restore standard timeout
{ if (!len) {
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout."); if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");
return 2; return 2;
} }
if (auth_timeout && !*auth_timeout) { // measure time for future authentication response timeout
*auth_timeout = (GetCountSspClk() - auth_timeout_start - (len * 9 + 2) * 8) / 8 + 1;
}
memcpy(tmp4, receivedAnswer, 4); ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0, 0);
ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);
if (ntpp != bytes_to_num(tmp4, 4)) { if (ntpp != bytes_to_num(receivedAnswer, 4)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response."); if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response.");
return 3; return 3;
} }
@ -241,8 +244,8 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
return 0; return 0;
} }
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData)
{ int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) {
// variables // variables
int len; int len;
uint8_t bt[2]; uint8_t bt[2];
@ -811,7 +814,7 @@ int mifare_desfire_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// one key check // one key check
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) { int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs; struct Crypto1State *pcs;
@ -820,7 +823,7 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
// Iceman: use piwi's faster nonce collecting part in hardnested. // Iceman: use piwi's faster nonce collecting part in hardnested.
if (*cascade_levels == 0) { // need a full select cycle to get the uid first if (*cascade_levels == 0) { // need a full select cycle to get the uid first
iso14a_card_select_t card_info; iso14a_card_select_t card_info;
if(!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) { if (!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card"); if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card");
return 1; return 1;
} }
@ -831,32 +834,25 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
default: break; default: break;
} }
} else { // no need for anticollision. We can directly select the card } else { // no need for anticollision. We can directly select the card
if(!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) { if (!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card (UID) lvl=%d", *cascade_levels); if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card (UID) lvl=%d", *cascade_levels);
return 1; return 1;
} }
} }
if(mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) { if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed
// SpinDelayUs(AUTHENTICATION_TIMEOUT); // it not needs because mifare_classic_auth have timeout from iso14a_set_timeout()
return 2; return 2;
} else { } else {
/* // let it be here. it like halt command, but maybe it will work in some strange cases
uint8_t dummy_answer = 0;
ReaderTransmit(&dummy_answer, 1, NULL);
int timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
// wait for the card to become ready again
while(GetCountSspClk() < timeout) {};
*/
// it needs after success authentication
mifare_classic_halt(pcs, *cuid); mifare_classic_halt(pcs, *cuid);
} }
return 0; return 0;
} }
// multi key check // multi key check
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) { int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
uint8_t uid[10]; uint8_t uid[10];
uint32_t cuid = 0; uint32_t cuid = 0;
uint8_t cascade_levels = 0; uint8_t cascade_levels = 0;
@ -865,14 +861,8 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
int retryCount = 0; int retryCount = 0;
for (uint8_t i = 0; i < keyCount; i++) { for (uint8_t i = 0; i < keyCount; i++) {
// Allow button press / usb cmd to interrupt device
if (BUTTON_PRESS() && !usb_poll_validate_length()) {
Dbprintf("ChkKeys: Cancel operation. Exit...");
return -2;
}
ui64Key = bytes_to_num(keys + i * 6, 6); ui64Key = bytes_to_num(keys + i * 6, 6);
int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, debugLevel); int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, auth_timeout, debugLevel);
// can't select // can't select
if (res == 1) { if (res == 1) {
@ -894,14 +884,20 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
continue; // can't auth. wrong key. continue; // can't auth. wrong key.
} }
// successful authentication
return i + 1; return i + 1;
} }
if (BUTTON_PRESS()) {
return -2;
}
return 0; return 0;
} }
// multisector multikey check // multisector multikey check
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex) { int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex) {
int res = 0; int res = 0;
// int clk = GetCountSspClk(); // int clk = GetCountSspClk();
@ -911,11 +907,11 @@ int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, u
int keyAB = keyType; int keyAB = keyType;
do { do {
res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, debugLevel); res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, auth_timeout, debugLevel);
if (res < 0){ if (res < 0) {
return res; return res;
} }
if (res > 0){ if (res > 0) {
(*keyIndex)[keyAB & 0x01][sc] = res; (*keyIndex)[keyAB & 0x01][sc] = res;
} }
} while(--keyAB > 0); } while(--keyAB > 0);
@ -923,7 +919,7 @@ int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, u
// Dbprintf("%d %d", GetCountSspClk() - clk, (GetCountSspClk() - clk)/(SectorCount*keyCount*(keyType==2?2:1))); // Dbprintf("%d %d", GetCountSspClk() - clk, (GetCountSspClk() - clk)/(SectorCount*keyCount*(keyType==2?2:1)));
return 0; return 1;
} }

26
armsrc/mifareutil.h
View file

@ -9,8 +9,8 @@
// code for work with mifare cards. // code for work with mifare cards.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
#ifndef __MIFAREUTIL_H #ifndef MIFAREUTIL_H__
#define __MIFAREUTIL_H #define MIFAREUTIL_H__
#include <stdint.h> #include <stdint.h>
#include <stdbool.h> #include <stdbool.h>
@ -19,11 +19,11 @@
#include "usb_cdc.h" #include "usb_cdc.h"
// mifare authentication // mifare authentication
#define CRYPT_NONE 0 #define CRYPT_NONE 0
#define CRYPT_ALL 1 #define CRYPT_ALL 1
#define CRYPT_REQUEST 2 #define CRYPT_REQUEST 2
#define AUTH_FIRST 0 #define AUTH_FIRST 0
#define AUTH_NESTED 2 #define AUTH_NESTED 2
// reader voltage field detector // reader voltage field detector
#define MF_MINFIELDV 4000 #define MF_MINFIELDV 4000
@ -42,10 +42,10 @@ int mifare_sendcmd(uint8_t cmd, uint8_t *data, uint8_t data_size, uint8_t* answe
int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing); int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
// mifare classic // mifare classic
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested); int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout);
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing); int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing, uint32_t *auth_timeout);
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid); int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid);
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
// Ultralight/NTAG... // Ultralight/NTAG...
@ -87,8 +87,8 @@ int emlCheckValBl(int blockNum);
// mifare check keys // mifare check keys
typedef uint8_t TKeyIndex[2][40]; typedef uint8_t TKeyIndex[2][40];
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel); int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel); int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex); int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex);
#endif #endif

81
client/cmdhfmf.c
View file

@ -570,7 +570,7 @@ int CmdHF14AMfRestore(const char *Cmd)
// Nested // Nested
//---------------------------------------------- //----------------------------------------------
static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint8_t *timeout) { static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint16_t *timeout) {
char ctmp3[4] = {0}; char ctmp3[4] = {0};
int len = param_getlength(Cmd, indx); int len = param_getlength(Cmd, indx);
if (len > 0 && len < 4){ if (len > 0 && len < 4){
@ -582,20 +582,19 @@ static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, boo
// slow and very slow // slow and very slow
if (ctmp3[0] == 's' || ctmp3[0] == 'S' || ctmp3[1] == 's' || ctmp3[1] == 'S') { if (ctmp3[0] == 's' || ctmp3[0] == 'S' || ctmp3[1] == 's' || ctmp3[1] == 'S') {
*timeout = 11; // slow *timeout = MF_CHKKEYS_SLOWTIMEOUT; // slow
if (!paramS1 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) { if (!paramS1 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) {
*timeout = 53; // very slow *timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
} }
if (paramS1 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) { if (paramS1 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) {
*timeout = 53; // very slow *timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
} }
} }
} }
} }
int CmdHF14AMfNested(const char *Cmd) int CmdHF14AMfNested(const char *Cmd) {
{
int i, j, res, iterations; int i, j, res, iterations;
sector_t *e_sector = NULL; sector_t *e_sector = NULL;
uint8_t blockNo = 0; uint8_t blockNo = 0;
@ -606,8 +605,8 @@ int CmdHF14AMfNested(const char *Cmd)
uint8_t key[6] = {0, 0, 0, 0, 0, 0}; uint8_t key[6] = {0, 0, 0, 0, 0, 0};
uint8_t keyBlock[MifareDefaultKeysSize * 6]; uint8_t keyBlock[MifareDefaultKeysSize * 6];
uint64_t key64 = 0; uint64_t key64 = 0;
// timeout in units. (ms * 106)/10 or us*0.0106 // timeout in units. (ms * 106) or us*0.106
uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
bool autosearchKey = false; bool autosearchKey = false;
@ -654,10 +653,10 @@ int CmdHF14AMfNested(const char *Cmd)
if (param_getchar(Cmd, 1) == '*') { if (param_getchar(Cmd, 1) == '*') {
autosearchKey = true; autosearchKey = true;
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us", PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us",
SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106); SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
} else { } else {
blockNo = param_get8(Cmd, 1); blockNo = param_get8(Cmd, 1);
@ -676,7 +675,7 @@ int CmdHF14AMfNested(const char *Cmd)
} }
// check if we can authenticate to sector // check if we can authenticate to sector
res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64); res = mfCheckKeys(blockNo, keyType, timeout14a, true, 1, key, &key64);
if (res) { if (res) {
PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6)); PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
return 3; return 3;
@ -694,19 +693,19 @@ int CmdHF14AMfNested(const char *Cmd)
if (ctmp != 'A' && ctmp != 'a') if (ctmp != 'A' && ctmp != 'a')
trgKeyType = 1; trgKeyType = 1;
parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &timeout14a);
} else { } else {
parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &timeout14a);
} }
PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us", PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106); SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
} }
// one-sector nested // one-sector nested
if (cmdp == 'o') { // ------------------------------------ one sector working if (cmdp == 'o') { // ------------------------------------ one sector working
PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A'); PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true); int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, trgBlockNo, trgKeyType, keyBlock, true);
if (isOK < 0) { if (isOK < 0) {
switch (isOK) { switch (isOK) {
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
@ -754,7 +753,7 @@ int CmdHF14AMfNested(const char *Cmd)
} }
PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt); PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, MifareDefaultKeysSize, keyBlock, e_sector); mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, MifareDefaultKeysSize, keyBlock, e_sector);
// get known key from array // get known key from array
bool keyFound = false; bool keyFound = false;
@ -791,7 +790,7 @@ int CmdHF14AMfNested(const char *Cmd)
for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) { for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) {
if (e_sector[sectorNo].foundKey[trgKeyType]) continue; if (e_sector[sectorNo].foundKey[trgKeyType]) continue;
PrintAndLog("-----------------------------------------------"); PrintAndLog("-----------------------------------------------");
int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate); int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);
if(isOK < 0) { if(isOK < 0) {
switch (isOK) { switch (isOK) {
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
@ -814,7 +813,7 @@ int CmdHF14AMfNested(const char *Cmd)
e_sector[sectorNo].Key[trgKeyType] = key64; e_sector[sectorNo].Key[trgKeyType] = key64;
// try to check this key as a key to the other sectors // try to check this key as a key to the other sectors
mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, 1, keyBlock, e_sector); mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, 1, keyBlock, e_sector);
} }
} }
} }
@ -1049,8 +1048,8 @@ int CmdHF14AMfNestedHard(const char *Cmd)
} }
int CmdHF14AMfChk(const char *Cmd) int CmdHF14AMfChk(const char *Cmd) {
{
if (strlen(Cmd)<3) { if (strlen(Cmd)<3) {
PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]"); PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]");
PrintAndLog(" * - all sectors"); PrintAndLog(" * - all sectors");
@ -1081,7 +1080,7 @@ int CmdHF14AMfChk(const char *Cmd)
uint8_t keyType = 0; uint8_t keyType = 0;
uint64_t key64 = 0; uint64_t key64 = 0;
// timeout in units. (ms * 106)/10 or us*0.0106 // timeout in units. (ms * 106)/10 or us*0.0106
uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
bool param3InUse = false; bool param3InUse = false;
bool transferToEml = 0; bool transferToEml = 0;
bool createDumpFile = 0; bool createDumpFile = 0;
@ -1134,7 +1133,7 @@ int CmdHF14AMfChk(const char *Cmd)
}; };
} }
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
if (singleBlock & createDumpFile) { if (singleBlock & createDumpFile) {
PrintAndLog (" block key check (<block no>) and write to dump file (d) combination is not supported "); PrintAndLog (" block key check (<block no>) and write to dump file (d) combination is not supported ");
@ -1142,10 +1141,10 @@ int CmdHF14AMfChk(const char *Cmd)
return 1; return 1;
} }
param3InUse = transferToEml | createDumpFile | (btimeout14a != MF_CHKKEYS_DEFTIMEOUT); param3InUse = transferToEml | createDumpFile | (timeout14a != MF_CHKKEYS_DEFTIMEOUT);
PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us", PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106); SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) { for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) {
if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) { if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {
@ -1251,7 +1250,9 @@ int CmdHF14AMfChk(const char *Cmd)
for (uint32_t c = 0; c < keycnt; c += max_keys) { for (uint32_t c = 0; c < keycnt; c += max_keys) {
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c; uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
res = mfCheckKeysSec(SectorsCnt, keyType, btimeout14a, clearTraceLog, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106 bool init = (c == 0);
bool drop_field = (c + size == keycnt);
res = mfCheckKeysSec(SectorsCnt, keyType, timeout14a, clearTraceLog, init, drop_field, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
clearTraceLog = false; clearTraceLog = false;
if (res != 1) { if (res != 1) {
@ -1269,27 +1270,23 @@ int CmdHF14AMfChk(const char *Cmd)
} else { } else {
int keyAB = keyType; int keyAB = keyType;
do { do {
for (uint32_t c = 0; c < keycnt; c += max_keys) { res = mfCheckKeys(blockNo, keyAB & 0x01, timeout14a, true, keycnt, keyBlock, &key64);
clearTraceLog = false;
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c; if (res != 1) {
res = mfCheckKeys(blockNo, keyAB & 0x01, true, size, &keyBlock[6 * c], &key64); if (!res) {
clearTraceLog = false; // Use the common format below
// PrintAndLog("Found valid key:[%d:%c]%012" PRIx64, blockNo, (keyAB & 0x01)?'B':'A', key64);
foundAKey = true;
if (res != 1) { // Store the Single Key for display list
if (!res) { // For a single block check, SectorsCnt = Sector that contains the block
// Use the common format below e_sector[SectorsCnt-1].foundKey[(keyAB & 0x01)] = true; // flag key found
// PrintAndLog("Found valid key:[%d:%c]%012" PRIx64, blockNo, (keyAB & 0x01)?'B':'A', key64); e_sector[SectorsCnt-1].Key[(keyAB & 0x01)] = key64; // Save key data
foundAKey = true;
// Store the Single Key for display list
// For a single block check, SectorsCnt = Sector that contains the block
e_sector[SectorsCnt-1].foundKey[(keyAB & 0x01)] = true; // flag key found
e_sector[SectorsCnt-1].Key[(keyAB & 0x01)] = key64; // Save key data
}
} else {
PrintAndLog("Command execute timeout");
} }
} else {
PrintAndLog("Command execute timeout");
} }
} while(--keyAB > 0); } while(--keyAB > 0);
} }

197
client/mifare/mifarehost.c
View file

@ -10,6 +10,7 @@
#include "mifarehost.h" #include "mifarehost.h"
#include <inttypes.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
@ -115,8 +116,7 @@ static uint32_t nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint32_t ar, u
} }
int mfDarkside(uint64_t *key) int mfDarkside(uint64_t *key) {
{
uint32_t uid = 0; uint32_t uid = 0;
uint32_t nt = 0, nr = 0, ar = 0; uint32_t nt = 0, nr = 0, ar = 0;
uint64_t par_list = 0, ks_list = 0; uint64_t par_list = 0, ks_list = 0;
@ -196,22 +196,15 @@ int mfDarkside(uint64_t *key)
PrintAndLog("Found a possible key. Trying to authenticate...\n"); PrintAndLog("Found a possible key. Trying to authenticate...\n");
} }
*key = -1; uint8_t *keys_to_chk = malloc(keycount * 6);
uint8_t keyBlock[USB_CMD_DATA_SIZE]; for (int i = 0; i < keycount; i++) {
int max_keys = USB_CMD_DATA_SIZE/6; num_to_bytes(keylist[i], 6, keys_to_chk+i);
for (int i = 0; i < keycount; i += max_keys) {
int size = keycount - i > max_keys ? max_keys : keycount - i;
for (int j = 0; j < size; j++) {
if (par_list == 0) {
num_to_bytes(last_keylist[i*max_keys + j], 6, keyBlock+(j*6));
} else {
num_to_bytes(keylist[i*max_keys + j], 6, keyBlock+(j*6));
}
}
if (!mfCheckKeys(0, 0, false, size, keyBlock, key)) {
break;
}
} }
*key = -1;
mfCheckKeys(0, 0, 0, false, keycount, keys_to_chk, key);
free(keys_to_chk);
if (*key != -1) { if (*key != -1) {
free(last_keylist); free(last_keylist);
@ -228,37 +221,73 @@ int mfDarkside(uint64_t *key)
} }
int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){ int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keys, uint64_t *found_key) {
*key = -1; bool display_progress = false;
uint64_t start_time = msclock();
uint64_t next_print_time = start_time + 5 * 1000;
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), clear_trace, keycnt}}; if (keycnt > 1000) {
memcpy(c.d.asBytes, keyBlock, 6 * keycnt); PrintAndLog("We have %d keys to check. This will take some time!", keycnt);
SendCommand(&c); PrintAndLog("Press button to abort.");
display_progress = true;
UsbCommand resp;
if (!WaitForResponseTimeout(CMD_ACK,&resp,3000))
return 1;
if ((resp.arg[0] & 0xff) != 0x01) {
if (((int)resp.arg[1]) < 0)
return (int)resp.arg[1];
return 2;
} }
*key = bytes_to_num(resp.d.asBytes, 6); uint32_t max_keys = (keycnt > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : keycnt;
return 0; *found_key = -1;
bool multisectorCheck = false;
for (int i = 0, ii = 0; i < keycnt; i += max_keys) {
if ((i + max_keys) >= keycnt) {
max_keys = keycnt - i;
}
bool init = (i == 0);
bool drop_field = (max_keys == keycnt);
uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, max_keys}};
memcpy(c.d.asBytes, keys + i * 6, max_keys * 6);
SendCommand(&c);
UsbCommand resp;
if (!WaitForResponseTimeout(CMD_ACK, &resp, 3000))
return 1;
if ((resp.arg[0] & 0xff) != 0x01) {
if (((int)resp.arg[1]) < 0) { // error
return (int)resp.arg[1];
} else { // nothing found yet
if (display_progress && msclock() >= next_print_time) {
float brute_force_per_second = (float)(i - ii) / (float)(msclock() - start_time) * 1000.0;
ii = i;
start_time = msclock();
next_print_time = start_time + 10 * 1000;
PrintAndLog(" %8d keys left | %5.1f keys/sec | worst case %6.1f seconds remaining", keycnt - i, brute_force_per_second, (keycnt-i)/brute_force_per_second);
}
}
} else { // success
*found_key = bytes_to_num(resp.d.asBytes, 6);
return 0;
}
}
return 2; // nothing found
} }
int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector){
int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector) {
uint8_t keyPtr = 0; uint8_t keyPtr = 0;
if (e_sector == NULL) if (e_sector == NULL)
return -1; return -1;
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), (clear_trace | 0x02)|((timeout14a & 0xff) << 8), keycnt}}; bool multisectorCheck = true;
uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
memcpy(c.d.asBytes, keyBlock, 6 * keycnt); memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
SendCommand(&c); SendCommand(&c);
@ -301,7 +330,7 @@ typedef
uint32_t uid; uint32_t uid;
uint32_t blockNo; uint32_t blockNo;
uint32_t keyType; uint32_t keyType;
uint32_t nt; uint32_t nt_enc;
uint32_t ks1; uint32_t ks1;
} StateList_t; } StateList_t;
@ -313,12 +342,11 @@ void
__attribute__((force_align_arg_pointer)) __attribute__((force_align_arg_pointer))
#endif #endif
#endif #endif
*nested_worker_thread(void *arg) *nested_worker_thread(void *arg) {
{
struct Crypto1State *p1; struct Crypto1State *p1;
StateList_t *statelist = arg; StateList_t *statelist = arg;
statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt ^ statelist->uid); statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt_enc ^ statelist->uid);
for (p1 = statelist->head.slhead; *(uint64_t *)p1 != 0; p1++); for (p1 = statelist->head.slhead; *(uint64_t *)p1 != 0; p1++);
statelist->len = p1 - statelist->head.slhead; statelist->len = p1 - statelist->head.slhead;
statelist->tail.sltail = --p1; statelist->tail.sltail = --p1;
@ -328,9 +356,8 @@ __attribute__((force_align_arg_pointer))
} }
int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) {
{ uint32_t i;
uint32_t i, j;
uint32_t uid; uint32_t uid;
UsbCommand resp; UsbCommand resp;
@ -344,11 +371,6 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
int isOK = 1; int isOK = 1;
uint64_t next_print_time = 0;
uint64_t start_time;
float brute_force_time;
float brute_force_per_second;
// flush queue // flush queue
(void)WaitForResponseTimeout(CMD_ACK,NULL,100); (void)WaitForResponseTimeout(CMD_ACK,NULL,100);
@ -375,11 +397,15 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
statelists[i].blockNo = resp.arg[2] & 0xff; statelists[i].blockNo = resp.arg[2] & 0xff;
statelists[i].keyType = (resp.arg[2] >> 8) & 0xff; statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;
statelists[i].uid = uid; statelists[i].uid = uid;
memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4); memcpy(&statelists[i].nt_enc, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4); memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
} }
if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1) uint32_t authentication_timeout;
memcpy(&authentication_timeout, resp.d.asBytes + 20, 4);
PrintAndLog("Setting authentication timeout to %" PRIu32 "us", authentication_timeout * 1000 / 106);
if (statelists[0].nt_enc == statelists[1].nt_enc && statelists[0].ks1 == statelists[1].ks1)
num_unique_nonces = 1; num_unique_nonces = 1;
else else
num_unique_nonces = 2; num_unique_nonces = 2;
@ -410,14 +436,14 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
savestate = *p1; savestate = *p1;
while(Compare16Bits(p1, savep) == 0 && p1 <= statelists[0].tail.sltail) { while(Compare16Bits(p1, savep) == 0 && p1 <= statelists[0].tail.sltail) {
*p3 = *p1; *p3 = *p1;
lfsr_rollback_word(p3, statelists[0].nt ^ statelists[0].uid, 0); lfsr_rollback_word(p3, statelists[0].nt_enc ^ statelists[0].uid, 0);
p3++; p3++;
p1++; p1++;
} }
savestate = *p2; savestate = *p2;
while(Compare16Bits(p2, savep) == 0 && p2 <= statelists[1].tail.sltail) { while(Compare16Bits(p2, savep) == 0 && p2 <= statelists[1].tail.sltail) {
*p4 = *p2; *p4 = *p2;
lfsr_rollback_word(p4, statelists[1].nt ^ statelists[1].uid, 0); lfsr_rollback_word(p4, statelists[1].nt_enc ^ statelists[1].uid, 0);
p4++; p4++;
p2++; p2++;
} }
@ -435,7 +461,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
statelists[1].tail.sltail=--p4; statelists[1].tail.sltail=--p4;
for (i = 0; i < 2; i++) { for (i = 0; i < 2; i++) {
PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt, statelists[i].ks1); PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt_enc:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt_enc, statelists[i].ks1);
} }
// the statelists now contain possible keys. The key we are searching for must be in the // the statelists now contain possible keys. The key we are searching for must be in the
@ -450,64 +476,29 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
PrintAndLog("Nonce 1 and 2 are the same!"); PrintAndLog("Nonce 1 and 2 are the same!");
} }
if (statelists[0].len > 100) { uint32_t num_keys = statelists[0].len;
PrintAndLog("We have %d keys to check. This will take a very long time!", statelists[0].len); keyBlock = calloc(num_keys, 6);
PrintAndLog("Press button to abort.");
}
else if (statelists[0].len < 1) {
PrintAndLog("No candidate keys to check!");
}
else {
PrintAndLog("We have %d key(s) to check.", statelists[0].len);
}
uint32_t max_keys = (statelists[0].len > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : statelists[0].len;
keyBlock = calloc(max_keys, 6);
if (keyBlock == NULL) { if (keyBlock == NULL) {
free(statelists[0].head.slhead); free(statelists[0].head.slhead);
free(statelists[1].head.slhead); free(statelists[1].head.slhead);
return -4; return -4;
} }
memset(resultKey, 0, 6); for (i = 0; i < num_keys; i++) {
start_time = msclock(); crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);
next_print_time = start_time + 1 * 1000; num_to_bytes(key64, 6, keyBlock + i*6);
// The list may still contain several key candidates. Test each of them with mfCheckKeys
for (i = 0; i < statelists[0].len; i+=max_keys) {
if (next_print_time <= msclock()) {
brute_force_per_second = ((float)i) / (((float)(msclock() - start_time)) / 1000.0);
brute_force_time = ((float)(statelists[0].len - i)) / brute_force_per_second;
next_print_time = msclock() + 10 * 1000;
PrintAndLog(" %8d keys left | %5.1f keys/sec | worst case %6.1f seconds remaining", statelists[0].len - i, brute_force_per_second, brute_force_time);
}
if ((i+max_keys) >= statelists[0].len)
max_keys = statelists[0].len - i;
for (j = 0; j < max_keys; j++) {
crypto1_get_lfsr(statelists[0].head.slhead + i + j, &key64);
num_to_bytes(key64, 6, keyBlock+(j*6));
}
key64 = 0;
isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, true, max_keys, keyBlock, &key64);
if (isOK == 1) { // timeout
isOK = -1;
break;
}
else if (isOK < 0) { // -2 is button pressed
break;
}
else if (!isOK) {
num_to_bytes(key64, 6, resultKey);
break;
}
} }
if (isOK == 0 && statelists[0].len != 1) // The list may still contain several key candidates. Test each of them with mfCheckKeys
PrintAndLog("Key found in %0.2f seconds after checking %d keys\n", ((float)(msclock() - start_time)) / 1000.0, i+max_keys); isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, authentication_timeout, true, num_keys, keyBlock, &key64);
if (isOK == 0) { // success, key found
num_to_bytes(key64, 6, resultKey);
}
if (isOK == 1) { // timeout
isOK = -1;
}
free(statelists[0].head.slhead); free(statelists[0].head.slhead);
free(statelists[1].head.slhead); free(statelists[1].head.slhead);

31
client/mifare/mifarehost.h
View file

@ -8,8 +8,8 @@
// High frequency ISO14443A commands // High frequency ISO14443A commands
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
#ifndef MIFAREHOST_H #ifndef MIFAREHOST_H__
#define MIFAREHOST_H #define MIFAREHOST_H__
#include <stdint.h> #include <stdint.h>
#include <stdbool.h> #include <stdbool.h>
@ -17,18 +17,19 @@
#include "util.h" #include "util.h"
// defaults // defaults
// timeout in units. (ms * 106)/10 or us*0.0106 // timeout in units. ms * 106 or us * 0.106
// 5 == 500us #define MF_CHKKEYS_DEFTIMEOUT 50 // 0.47ms
#define MF_CHKKEYS_DEFTIMEOUT 5 #define MF_CHKKEYS_SLOWTIMEOUT 106 // 1ms
#define MF_CHKKEYS_VERYSLOWTIMEOUT 530 // 5ms
// mfCSetBlock work flags // mfCSetBlock work flags
#define CSETBLOCK_UID 0x01 #define CSETBLOCK_UID 0x01
#define CSETBLOCK_WUPC 0x02 #define CSETBLOCK_WUPC 0x02
#define CSETBLOCK_HALT 0x04 #define CSETBLOCK_HALT 0x04
#define CSETBLOCK_INIT_FIELD 0x08 #define CSETBLOCK_INIT_FIELD 0x08
#define CSETBLOCK_RESET_FIELD 0x10 #define CSETBLOCK_RESET_FIELD 0x10
#define CSETBLOCK_SINGLE_OPER 0x1F #define CSETBLOCK_SINGLE_OPER 0x1F
#define CSETBLOCK_MAGIC_1B 0x40 #define CSETBLOCK_MAGIC_1B 0x40
typedef struct { typedef struct {
uint64_t Key[2]; uint64_t Key[2];
@ -38,9 +39,9 @@ typedef struct {
extern char logHexFileName[FILE_PATH_SIZE]; extern char logHexFileName[FILE_PATH_SIZE];
extern int mfDarkside(uint64_t *key); extern int mfDarkside(uint64_t *key);
extern int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate); extern int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t *keyBlock, uint64_t *key); extern int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keyBlock, uint64_t *key);
extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector); extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
extern int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data); extern int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data);