From a906a0f4570b88354c2825e49bb92e55bf5a1c2d Mon Sep 17 00:00:00 2001 From: LW Date: Wed, 18 Dec 2019 19:12:42 -0800 Subject: [PATCH] some cleanup and better error passing --- armsrc/mifarecmd.c | 33 +++++++++++++++++---------------- client/cmdhfmf.c | 12 ++++++------ client/mifare/mifarehost.c | 19 ++++++++++++++----- 3 files changed, 37 insertions(+), 27 deletions(-) diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index af1dff02..89afe06a 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -815,12 +815,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat for (rtr = 0; rtr < 17; rtr++) { - // Test if the action was cancelled - if(BUTTON_PRESS()) { - isOK = -2; - break; - } - // prepare next select. No need to power down the card. if(mifare_classic_halt(pcs, cuid)) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error"); @@ -828,6 +822,12 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat continue; } + // Test if the action was cancelled + if(BUTTON_PRESS()) { + isOK = -2; + break; + } + if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card"); rtr--; @@ -896,28 +896,28 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat target_nt[i] = 0; while(target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce - // break out of the loop on button press or new usb data - if(BUTTON_PRESS() || usb_poll_validate_length()) { - isOK = -2; - break; - } - // prepare next select. No need to power down the card. if(mifare_classic_halt(pcs, cuid)) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error"); continue; } + // break out of the loop on button press + if(BUTTON_PRESS()) { + isOK = -2; + break; + } + if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card"); continue; - }; + } auth1_time = 0; if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error"); continue; - }; + } // nested authentication auth2_time = auth1_time + delta_time; @@ -925,7 +925,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat if (len != 4) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len); continue; - }; + } nt2 = bytes_to_num(receivedAnswer, 4); if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]); @@ -951,7 +951,8 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat target_ks[i] = ks1; ncount++; if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces - if( ++target_nt_duplicate_count >= 10 ) { // unable to get a 2nd nonce after 10 tries, probably a fixed nonce + if( ++target_nt_duplicate_count >= NESTED_MAX_TRIES ) { // unable to get a 2nd nonce after NESTED_MAX_TRIES tries, probably a fixed nonce + if (MF_DBGLEVEL >= 2) Dbprintf("Nonce#2: cannot get nonce that != nonce#1, continuing anyway with single nonce! ntdist=%d", j); break; } diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 9ecf99fb..2fe74705 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -707,17 +707,17 @@ int CmdHF14AMfNested(const char *Cmd) if (cmdp == 'o') { // ------------------------------------ one sector working PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A'); int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true); - if (isOK) { + if (isOK < 0) { switch (isOK) { case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; case -2 : PrintAndLog("Button pressed. Aborted.\n"); break; case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break; - default : PrintAndLog("Unknown Error.\n"); + default : PrintAndLog("Unknown Error (%d)\n", isOK); } return 2; } key64 = bytes_to_num(keyBlock, 6); - if (key64) { + if (!isOK) { PrintAndLog("Found valid key:%012" PRIx64, key64); // transfer key to the emulator @@ -792,12 +792,12 @@ int CmdHF14AMfNested(const char *Cmd) if (e_sector[sectorNo].foundKey[trgKeyType]) continue; PrintAndLog("-----------------------------------------------"); int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate); - if(isOK) { + if(isOK < 0) { switch (isOK) { case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; case -2 : PrintAndLog("Button pressed. Aborted.\n"); break; case -3 : PrintAndLog("Tag isn't vulnerable to Nested Attack (random numbers are not predictable).\n"); break; - default : PrintAndLog("Unknown Error.\n"); + default : PrintAndLog("Unknown Error (%d)\n", isOK); } free(e_sector); return 2; @@ -808,7 +808,7 @@ int CmdHF14AMfNested(const char *Cmd) iterations++; key64 = bytes_to_num(keyBlock, 6); - if (key64) { + if (!isOK) { PrintAndLog("Found valid key:%012" PRIx64, key64); e_sector[sectorNo].foundKey[trgKeyType] = 1; e_sector[sectorNo].Key[trgKeyType] = key64; diff --git a/client/mifare/mifarehost.c b/client/mifare/mifarehost.c index 4e0117c8..7715a73c 100644 --- a/client/mifare/mifarehost.c +++ b/client/mifare/mifarehost.c @@ -341,7 +341,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t *keyBlock = NULL; uint64_t key64; - int isOK = -4; + int isOK = 1; // flush queue (void)WaitForResponseTimeout(CMD_ACK,NULL,100); @@ -371,8 +371,6 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, statelists[i].uid = uid; memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4); memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4); - - PrintAndLog("statelist %d: %02X %x %08X %08X", i, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt, statelists[i].ks1); } if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1) @@ -430,6 +428,10 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, statelists[0].tail.sltail=--p3; statelists[1].tail.sltail=--p4; + for (i = 0; i < 2; i++) { + PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt, statelists[i].ks1); + } + // the statelists now contain possible keys. The key we are searching for must be in the // intersection of both lists. Create the intersection: qsort(statelists[0].head.keyhead, statelists[0].len, sizeof(uint64_t), compare_uint64); @@ -446,6 +448,12 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, PrintAndLog("We have %d keys to check. This will take a very long time!", statelists[0].len); PrintAndLog("Press button to abort."); } + else if (statelists[0].len < 1) { + PrintAndLog("No candidate keys to check!"); + } + else { + PrintAndLog("We have %d key(s) to check.", statelists[0].len); + } uint32_t max_keys = (statelists[0].len > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : statelists[0].len; keyBlock = calloc(max_keys, 6); @@ -454,7 +462,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, memset(resultKey, 0, 6); // The list may still contain several key candidates. Test each of them with mfCheckKeys for (i = 0; i < statelists[0].len; i+=max_keys) { - PrintAndLog("Keys left to check: %d", statelists[0].len - i); + if (statelists[0].len > 1) PrintAndLog("Keys left to check: %d", statelists[0].len - i); if ((i+max_keys) >= statelists[0].len) max_keys = statelists[0].len - i; @@ -480,10 +488,11 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, } if (!isOK) - PrintAndLog("Key found after checking %d keys\n", i+max_keys); + PrintAndLog("Key found after checking %d key(s)\n", i+max_keys); free(statelists[0].head.slhead); free(statelists[1].head.slhead); + free(keyBlock); return isOK; }