Merge remote-tracking branch 'upstream/master'

COMPILING.txt

@@ -81,6 +81,29 @@ Download the ProxSpace environment archive and extract it to C:\
 = Mac OS X =
 ============
 
+Installing from HomeBrew tap
+---------------------------
+This method is recommended and tested on macOS Sierra 10.12.3
+
+1. Install homebrew if you haven't yet already done so: http://brew.sh/
+
+2. Tap proxmark repo:
+    brew tap proxmark/proxmark3 
+
+3. Install Proxmark3:
+
+Stable release
+    brew install proxmark3
+
+Latest non-stable from GitHub (use this if previous command fails)
+    brew install --HEAD proxmark3
+
+For more information go to https://github.com/Proxmark/homebrew-proxmark3
+
+
+Compilling from source manually (Legacy)
+---------------------------
+
 Tested on OSX 10.10 Yosemite
 
 1 - Install Xcode and Xcode Command Line Tools

armsrc/Makefile

@@ -19,7 +19,7 @@ SRC_LF = lfops.c hitag2.c hitagS.c lfsampling.c pcf7931.c lfdemod.c protocols.c
 SRC_ISO15693 = iso15693.c iso15693tools.c
 SRC_ISO14443a = epa.c iso14443a.c mifareutil.c mifarecmd.c mifaresniff.c
 SRC_ISO14443b = iso14443b.c
-SRC_CRAPTO1 = crapto1.c crypto1.c des.c aes.c
+SRC_CRAPTO1 = crypto1.c des.c aes.c
 SRC_CRC = iso14443crc.c crc.c crc16.c crc32.c
 
 #the FPGA bitstream files. Note: order matters!

armsrc/iso14443a.c

@@ -17,7 +17,7 @@
 #include "cmd.h"
 #include "iso14443crc.h"
 #include "iso14443a.h"
-#include "crapto1.h"
+#include "crapto1/crapto1.h"
 #include "mifareutil.h"
 #include "BigBuf.h"
 #include "protocols.h"

armsrc/mifarecmd.h

@@ -20,7 +20,7 @@
 
 #include "iso14443crc.h"
 #include "iso14443a.h"
-#include "crapto1.h"
+#include "crapto1/crapto1.h"
 #include "mifareutil.h"
 #include "common.h"
 

armsrc/mifaresniff.c

@@ -10,6 +10,15 @@
 
 #include "mifaresniff.h"
 #include "apps.h"
+#include "proxmark3.h"
+#include "util.h"
+#include "string.h"
+#include "iso14443crc.h"
+#include "iso14443a.h"
+#include "crapto1/crapto1.h"
+#include "mifareutil.h"
+#include "common.h"
+
 
 static int sniffState = SNF_INIT;
 static uint8_t sniffUIDType;

armsrc/mifaresniff.h

@@ -11,29 +11,22 @@
 #ifndef __MIFARESNIFF_H
 #define __MIFARESNIFF_H
 
-#include "proxmark3.h"
+#include <stdint.h>
-#include "apps.h"
+#include <stdbool.h>
 #include "util.h"
-#include "string.h"
-
-#include "iso14443crc.h"
-#include "iso14443a.h"
-#include "crapto1.h"
-#include "mifareutil.h"
-#include "common.h"
 
 #define SNF_INIT				0
-#define SNF_NO_FIELD		1
+#define SNF_NO_FIELD			1
-#define SNF_WUPREQ			2
+#define SNF_WUPREQ				2
 #define SNF_ATQA				3
-#define SNF_ANTICOL1		4
+#define SNF_ANTICOL1			4
 #define SNF_UID1				5
-#define SNF_ANTICOL2		6
+#define SNF_ANTICOL2			6
 #define SNF_UID2				7
 #define SNF_SAK					8
-#define SNF_CARD_IDLE		9
+#define SNF_CARD_IDLE			9
-#define SNF_CARD_CMD		10
+#define SNF_CARD_CMD			10
-#define SNF_CARD_RESP		11
+#define SNF_CARD_RESP			11
 
 #define SNF_UID_4				0
 #define SNF_UID_7				0
@@ -44,4 +37,4 @@ bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs);
 bool intMfSniffSend();
 bool MfSniffEnd(void);
 
-#endif
+#endif

armsrc/mifareutil.c

@@ -9,6 +9,7 @@
 // Work with mifare cards.
 //-----------------------------------------------------------------------------
 
+#include "mifareutil.h"
 #include "proxmark3.h"
 #include "apps.h"
 #include "util.h"
@@ -16,8 +17,7 @@
 
 #include "iso14443crc.h"
 #include "iso14443a.h"
-#include "crapto1.h"
+#include "crapto1/crapto1.h"
-#include "mifareutil.h"
 #include "des.h"
 
 int MF_DBGLEVEL = MF_DBG_ALL;

armsrc/mifareutil.h

@@ -8,11 +8,12 @@
 //-----------------------------------------------------------------------------
 // code for work with mifare cards.
 //-----------------------------------------------------------------------------
-#include "crapto1.h"
 
 #ifndef __MIFAREUTIL_H
 #define __MIFAREUTIL_H
 
+#include "crapto1/crapto1.h"
+
 // mifare authentication
 #define CRYPT_NONE    0
 #define CRYPT_ALL     1

client/Makefile

@@ -15,7 +15,7 @@ OBJDIR = obj
 LDLIBS = -L/opt/local/lib -L/usr/local/lib -lreadline -lpthread -lm
 LUALIB = ../liblua/liblua.a
 LDFLAGS = $(COMMON_FLAGS)
-CFLAGS = -std=c99 -D_ISOC99_SOURCE -I. -I../include -I../common -I../zlib -I/opt/local/include -I../liblua -Wall $(COMMON_FLAGS) -g -O4
+CFLAGS = -std=c99 -D_ISOC99_SOURCE -I. -I../include -I../common -I../tools -I../zlib -I/opt/local/include -I../liblua -Wall $(COMMON_FLAGS) -g -O4
 LUAPLATFORM = generic
 
 ifneq (,$(findstring MINGW,$(platform)))
@@ -54,11 +54,10 @@ endif
 
 CORESRCS = 	uart.c \
 		util.c \
-		sleep.c
 
 
-CMDSRCS = 	nonce2key/crapto1.c\
+CMDSRCS = 	crapto1/crapto1.c\
-			nonce2key/crypto1.c\
+			crapto1/crypto1.c\
 			nonce2key/nonce2key.c\
 			loclass/cipher.c \
 			loclass/cipherutils.c \

client/cmdcrc.c

@@ -8,7 +8,6 @@
 // CRC Calculations from the software reveng commands
 //-----------------------------------------------------------------------------
 
-#include <stdlib.h>
 #ifdef _WIN32
 #  include <io.h>
 #  include <fcntl.h>
@@ -19,8 +18,8 @@
 
 #include <stdio.h>
 #include <string.h>
-//#include <stdlib.h>
+#include <stdlib.h>
-//#include <ctype.h>
+#include <ctype.h>
 #include "cmdmain.h"
 #include "cmdcrc.h"
 #include "reveng/reveng.h"

client/cmdhf.c

@@ -8,10 +8,12 @@
 // High frequency commands
 //-----------------------------------------------------------------------------
 
+#include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include "proxmark3.h"
 #include "util.h"
+#include "data.h"
 #include "ui.h"
 #include "iso14443crc.h"
 #include "cmdmain.h"

client/cmdhf14a.c

@@ -431,7 +431,7 @@ int CmdHF14ACUIDs(const char *Cmd)
 	n = n > 0 ? n : 1;
 
 	PrintAndLog("Collecting %d UIDs", n);
-	PrintAndLog("Start: %u", time(NULL));
+	PrintAndLog("Start: %" PRIu64, msclock()/1000);
 	// repeat n times
 	for (int i = 0; i < n; i++) {
 		// execute anticollision procedure
@@ -454,7 +454,7 @@ int CmdHF14ACUIDs(const char *Cmd)
 			PrintAndLog("%s", uid_string);
 		}
 	}
-	PrintAndLog("End: %u", time(NULL));
+	PrintAndLog("End: %" PRIu64, msclock()/1000);
 
 	return 1;
 }

client/cmdhf14a.h

@@ -12,13 +12,14 @@
 #ifndef CMDHF14A_H__
 #define CMDHF14A_H__
 
-int CmdHF14A(const char *Cmd);
+#include <stdint.h>
 
+int CmdHF14A(const char *Cmd);
 int CmdHF14AList(const char *Cmd);
 int CmdHF14AMifare(const char *Cmd);
 int CmdHF14AReader(const char *Cmd);
 int CmdHF14ASim(const char *Cmd);
 int CmdHF14ASnoop(const char *Cmd);
-
 char* getTagInfo(uint8_t uid);
+
 #endif

client/cmdhfepa.c

@@ -8,15 +8,19 @@
 // Commands related to the German electronic Identification Card
 //-----------------------------------------------------------------------------
 
-#include "util.h"
+#include "cmdhfepa.h"
 
+#include <inttypes.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdio.h>
+#include "util.h"
 #include "proxmark3.h"
 #include "ui.h"
 #include "cmdparser.h"
 #include "common.h"
 #include "cmdmain.h"
-#include "sleep.h"
-#include "cmdhfepa.h"
 
 static int CmdHelp(const char *Cmd);
 
@@ -37,7 +41,7 @@ int CmdHFEPACollectPACENonces(const char *Cmd)
 	n = n > 0 ? n : 1;
 
 	PrintAndLog("Collecting %u %u-byte nonces", n, m);
-	PrintAndLog("Start: %u", time(NULL));
+	PrintAndLog("Start: %" PRIu64 , msclock()/1000);
 	// repeat n times
 	for (unsigned int i = 0; i < n; i++) {
 		// execute PACE
@@ -64,7 +68,7 @@ int CmdHFEPACollectPACENonces(const char *Cmd)
 			sleep(d);
 		}
 	}
-	PrintAndLog("End: %u", time(NULL));
+	PrintAndLog("End: %" PRIu64, msclock()/1000);
 
 	return 1;
 }

client/cmdhfmf.c

@@ -9,8 +9,10 @@
 //-----------------------------------------------------------------------------
 
 #include <inttypes.h>
+#include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <ctype.h>
 #include "proxmark3.h"
 #include "cmdmain.h"
 #include "util.h"
@@ -688,8 +690,8 @@ int CmdHF14AMfNested(const char *Cmd)
 		}
 	}
 	else { // ------------------------------------  multiple sectors working
-		clock_t time1;
+		uint64_t msclock1;
-		time1 = clock();
+		msclock1 = msclock();
 
 		e_sector = calloc(SectorsCnt, sizeof(sector_t));
 		if (e_sector == NULL) return 1;
@@ -759,7 +761,7 @@ int CmdHF14AMfNested(const char *Cmd)
 			}
 		}
 
-		printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)clock() - time1)/CLOCKS_PER_SEC, ((float)clock() - time1)/iterations/CLOCKS_PER_SEC);
+		printf("Time in nested: %1.3f (%1.3f sec per key)\n\n", ((float)(msclock() - msclock1))/1000.0, ((float)(msclock() - msclock1))/iterations/1000.0);
 		
 		PrintAndLog("-----------------------------------------------\nIterations count: %d\n\n", iterations);
 		//print them

client/cmdhfmfu.c

@@ -8,12 +8,15 @@
 // High frequency MIFARE ULTRALIGHT (C) commands
 //-----------------------------------------------------------------------------
 
+#include "cmdhfmfu.h"
+
+#include <stdint.h>
+#include <stdio.h>
 #include "proxmark3.h"
 #include "usb_cmd.h"
 #include "cmdmain.h"
 #include "ui.h"
 #include "loclass/des.h"
-#include "cmdhfmfu.h"
 #include "cmdhfmf.h"
 #include "cmdhf14a.h"
 #include "mifare.h"

client/cmdlfawid.c

@@ -10,6 +10,7 @@
 // Low frequency AWID26 commands
 //-----------------------------------------------------------------------------
 
+#include <string.h>
 #include <stdio.h>      // sscanf
 #include "proxmark3.h"  // Definitions, USB controls, etc
 #include "ui.h"         // PrintAndLog

client/cmdlfem4x.c

@@ -14,6 +14,7 @@
 #include "proxmark3.h"
 #include "ui.h"
 #include "util.h"
+#include "data.h"
 #include "graph.h"
 #include "cmdparser.h"
 #include "cmddata.h"

client/cmdlfhitag.c

@@ -19,7 +19,6 @@
 #include "util.h"
 #include "hitag2.h"
 #include "hitagS.h"
-#include "sleep.h"
 #include "cmdmain.h"
 
 static int CmdHelp(const char *Cmd);

client/cmdlfpresco.c

@@ -8,6 +8,7 @@
 //-----------------------------------------------------------------------------
 #include <string.h>
 #include <inttypes.h>
+#include <stdio.h>
 #include "cmdlfpresco.h"
 #include "proxmark3.h"
 #include "ui.h"

client/cmdlfpyramid.c

@@ -8,6 +8,7 @@
 //-----------------------------------------------------------------------------
 #include <string.h>
 #include <inttypes.h>
+#include <stdio.h>
 #include "cmdlfpyramid.h"
 #include "proxmark3.h"
 #include "ui.h"

client/cmdlft55xx.c

@@ -10,6 +10,8 @@
 #include <stdio.h>
 #include <string.h>
 #include <inttypes.h>
+#include <ctype.h>
+#include <time.h>
 #include "proxmark3.h"
 #include "ui.h"
 #include "graph.h"

client/cmdlfvisa2000.c

@@ -9,6 +9,9 @@
 //-----------------------------------------------------------------------------
 
 #include "cmdlfvisa2000.h"
+
+#include <stdio.h>
+#include <string.h>
 #include "proxmark3.h"
 #include "ui.h"
 #include "util.h"

client/cmdmain.c

@@ -12,7 +12,6 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <string.h>
-#include "sleep.h"
 #include "cmdparser.h"
 #include "proxmark3.h"
 #include "data.h"

client/flash.c

@@ -12,8 +12,9 @@
 #include <string.h>
 #include <stdlib.h>
 #include <inttypes.h>
+#include <unistd.h>
 #include "proxmark3.h"
-#include "sleep.h"
+#include "util.h"
 #include "flash.h"
 #include "elf.h"
 #include "proxendian.h"

client/flasher.c

@@ -10,8 +10,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <inttypes.h>
-#include "sleep.h"
 #include "proxmark3.h"
+#include "util.h"
 #include "flash.h"
 #include "uart.h"
 #include "usb_cmd.h"

client/hid-flasher/flash.c

@@ -11,7 +11,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include "sleep.h"
 #include "proxusb.h"
 #include "flash.h"
 #include "elf.h"

client/hid-flasher/flasher.c

@@ -9,7 +9,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include "sleep.h"
 #include "proxusb.h"
 #include "flash.h"
 

client/hid-flasher/proxusb.c

@@ -18,7 +18,6 @@
 #include <strings.h>
 #include <errno.h>
 
-#include "sleep.h"
 #include "proxusb.h"
 #include "proxmark3.h"
 #include "usb_cmd.h"

client/loclass/elite_crack.c

@@ -40,7 +40,7 @@
 #include <stdbool.h>
 #include <string.h>
 #include <stdio.h>
-#include <time.h>
+#include "util.h"
 #include "cipherutils.h"
 #include "cipher.h"
 #include "ikeys.h"
@@ -512,7 +512,7 @@ int bruteforceDump(uint8_t dump[], size_t dumpsize, uint16_t keytable[])
 	uint8_t i;
 	int errors = 0;
 	size_t itemsize = sizeof(dumpdata);
-	clock_t t1 = clock();
+	uint64_t t1 = msclock();
 
 	dumpdata* attack = (dumpdata* ) malloc(itemsize);
 
@@ -522,9 +522,9 @@ int bruteforceDump(uint8_t dump[], size_t dumpsize, uint16_t keytable[])
 		errors += bruteforceItem(*attack, keytable);
 	}
 	free(attack);
-	t1 = clock() - t1;
+	t1 = msclock() - t1;
-	float diff = ((float)t1 / CLOCKS_PER_SEC );
+	float diff = (float)t1 / 1000.0;
-	prnlog("\nPerformed full crack in %f seconds",diff);
+	prnlog("\nPerformed full crack in %f seconds", diff);
 
 	// Pick out the first 16 bytes of the keytable.
 	// The keytable is now in 16-bit ints, where the upper 8 bits

client/mifarehost.c

@@ -13,7 +13,7 @@
 #include <string.h>
 #include <pthread.h>
 
-#include "nonce2key/crapto1.h"
+#include "crapto1/crapto1.h"
 #include "proxmark3.h"
 #include "usb_cmd.h"
 #include "cmdmain.h"

client/nonce2key/crapto1.c

@@ -1,573 +0,0 @@
-/*  crapto1.c
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program; if not, write to the Free Software
-	Foundation, Inc., 51 Franklin Street, Fifth Floor,
-	Boston, MA  02110-1301, US$
-
-	Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#include "crapto1.h"
-#include <stdlib.h>
-
-#if !defined LOWMEM && defined __GNUC__
-static uint8_t filterlut[1 << 20];
-static void __attribute__((constructor)) fill_lut()
-{
-		uint32_t i;
-		for(i = 0; i < 1 << 20; ++i)
-				filterlut[i] = filter(i);
-}
-#define filter(x) (filterlut[(x) & 0xfffff])
-#endif
-
-
-
-typedef struct bucket {
-	uint32_t *head;
-	uint32_t *bp;
-} bucket_t;
-
-typedef bucket_t bucket_array_t[2][0x100];
-
-typedef struct bucket_info {
-	struct {
-		uint32_t *head, *tail;
-		} bucket_info[2][0x100];
-		uint32_t numbuckets;
-	} bucket_info_t;
-
-
-static void bucket_sort_intersect(uint32_t* const estart, uint32_t* const estop,
-								  uint32_t* const ostart, uint32_t* const ostop,
-								  bucket_info_t *bucket_info, bucket_array_t bucket)
-{
-	uint32_t *p1, *p2;
-	uint32_t *start[2];
-	uint32_t *stop[2];
-
-	start[0] = estart;
-	stop[0] = estop;
-	start[1] = ostart;
-	stop[1] = ostop;
-
-	// init buckets to be empty
-	for (uint32_t i = 0; i < 2; i++) {
-		for (uint32_t j = 0x00; j <= 0xff; j++) {
-			bucket[i][j].bp = bucket[i][j].head;
-		}
-	}
-
-	// sort the lists into the buckets based on the MSB (contribution bits)
-	for (uint32_t i = 0; i < 2; i++) {
-		for (p1 = start[i]; p1 <= stop[i]; p1++) {
-			uint32_t bucket_index = (*p1 & 0xff000000) >> 24;
-			*(bucket[i][bucket_index].bp++) = *p1;
-		}
-	}
-
-
-	// write back intersecting buckets as sorted list.
-	// fill in bucket_info with head and tail of the bucket contents in the list and number of non-empty buckets.
-	uint32_t nonempty_bucket;
-	for (uint32_t i = 0; i < 2; i++) {
-		p1 = start[i];
-		nonempty_bucket = 0;
-		for (uint32_t j = 0x00; j <= 0xff; j++) {
-			if (bucket[0][j].bp != bucket[0][j].head && bucket[1][j].bp != bucket[1][j].head) { // non-empty intersecting buckets only
-				bucket_info->bucket_info[i][nonempty_bucket].head = p1;
-				for (p2 = bucket[i][j].head; p2 < bucket[i][j].bp; *p1++ = *p2++);
-				bucket_info->bucket_info[i][nonempty_bucket].tail = p1 - 1;
-				nonempty_bucket++;
-			}
-		}
-		bucket_info->numbuckets = nonempty_bucket;
-		}
-}
-
-/** binsearch
- * Binary search for the first occurence of *stop's MSB in sorted [start,stop]
- */
-static inline uint32_t*
-binsearch(uint32_t *start, uint32_t *stop)
-{
-	uint32_t mid, val = *stop & 0xff000000;
-	while(start != stop)
-		if(start[mid = (stop - start) >> 1] > val)
-			stop = &start[mid];
-		else
-			start += mid + 1;
-
-	return start;
-}
-
-/** update_contribution
- * helper, calculates the partial linear feedback contributions and puts in MSB
- */
-static inline void
-update_contribution(uint32_t *item, const uint32_t mask1, const uint32_t mask2)
-{
-	uint32_t p = *item >> 25;
-
-	p = p << 1 | parity(*item & mask1);
-	p = p << 1 | parity(*item & mask2);
-	*item = p << 24 | (*item & 0xffffff);
-}
-
-/** extend_table
- * using a bit of the keystream extend the table of possible lfsr states
- */
-static inline void
-extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)
-{
-	in <<= 24;
-
-	for(uint32_t *p = tbl; p <= *end; p++) {
-		*p <<= 1;
-		if(filter(*p) != filter(*p | 1)) {			 	// replace
-			*p |= filter(*p) ^ bit;
-			update_contribution(p, m1, m2);
-			*p ^= in;
-		} else if(filter(*p) == bit) {					// insert
-			*++*end = p[1];
-			p[1] = p[0] | 1;
-			update_contribution(p, m1, m2);
-			*p++ ^= in;
-			update_contribution(p, m1, m2);
-			*p ^= in;
-		} else {										// drop
-			*p-- = *(*end)--;
-		}
-	}
-
-}
-
-
-/** extend_table_simple
- * using a bit of the keystream extend the table of possible lfsr states
- */
-static inline void
-extend_table_simple(uint32_t *tbl, uint32_t **end, int bit)
-{
-	for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
-		if(filter(*tbl) ^ filter(*tbl | 1)) {	// replace
-			*tbl |= filter(*tbl) ^ bit;
-		} else if(filter(*tbl) == bit) {		// insert
-			*++*end = *++tbl;
-			*tbl = tbl[-1] | 1;
-		} else									// drop
-			*tbl-- = *(*end)--;
-}
-
-
-/** recover
- * recursively narrow down the search space, 4 bits of keystream at a time
- */
-static struct Crypto1State*
-recover(uint32_t *o_head, uint32_t *o_tail, uint32_t oks,
-	uint32_t *e_head, uint32_t *e_tail, uint32_t eks, int rem,
-	struct Crypto1State *sl, uint32_t in, bucket_array_t bucket)
-{
-	uint32_t *o, *e;
-	bucket_info_t bucket_info;
-
-	if(rem == -1) {
-		for(e = e_head; e <= e_tail; ++e) {
-			*e = *e << 1 ^ parity(*e & LF_POLY_EVEN) ^ !!(in & 4);
-			for(o = o_head; o <= o_tail; ++o, ++sl) {
-				sl->even = *o;
-				sl->odd = *e ^ parity(*o & LF_POLY_ODD);
-			}
-		}
-		sl->odd = sl->even = 0;
-		return sl;
-	}
-
-	for(uint32_t i = 0; i < 4 && rem--; i++) {
-		extend_table(o_head, &o_tail, (oks >>= 1) & 1,
-			LF_POLY_EVEN << 1 | 1, LF_POLY_ODD << 1, 0);
-		if(o_head > o_tail)
-			return sl;
-
-		extend_table(e_head, &e_tail, (eks >>= 1) & 1,
-			LF_POLY_ODD, LF_POLY_EVEN << 1 | 1, (in >>= 2) & 3);
-		if(e_head > e_tail)
-			return sl;
-	}
-
-	bucket_sort_intersect(e_head, e_tail, o_head, o_tail, &bucket_info, bucket);
-
-	for (int i = bucket_info.numbuckets - 1; i >= 0; i--) {
-		sl = recover(bucket_info.bucket_info[1][i].head, bucket_info.bucket_info[1][i].tail, oks,
-					 bucket_info.bucket_info[0][i].head, bucket_info.bucket_info[0][i].tail, eks,
-					 rem, sl, in, bucket);
-	}
-
-	return sl;
-}
-/** lfsr_recovery
- * recover the state of the lfsr given 32 bits of the keystream
- * additionally you can use the in parameter to specify the value
- * that was fed into the lfsr at the time the keystream was generated
- */
-struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
-{
-	struct Crypto1State *statelist;
-	uint32_t *odd_head = 0, *odd_tail = 0, oks = 0;
-	uint32_t *even_head = 0, *even_tail = 0, eks = 0;
-	int i;
-
-	// split the keystream into an odd and even part
-	for(i = 31; i >= 0; i -= 2)
-		oks = oks << 1 | BEBIT(ks2, i);
-	for(i = 30; i >= 0; i -= 2)
- 		eks = eks << 1 | BEBIT(ks2, i);
-
-	odd_head = odd_tail = malloc(sizeof(uint32_t) << 21);
-	even_head = even_tail = malloc(sizeof(uint32_t) << 21);
-	statelist =  malloc(sizeof(struct Crypto1State) << 18);
-	if(!odd_tail-- || !even_tail-- || !statelist) {
-		goto out;
-	}
-	statelist->odd = statelist->even = 0;
-
-	// allocate memory for out of place bucket_sort
-	bucket_array_t bucket;
-	for (uint32_t i = 0; i < 2; i++)
-		for (uint32_t j = 0; j <= 0xff; j++) {
-			bucket[i][j].head = malloc(sizeof(uint32_t)<<14);
-			if (!bucket[i][j].head) {
-				goto out;
-			}
-		}
-
-
-	// initialize statelists: add all possible states which would result into the rightmost 2 bits of the keystream
-	for(i = 1 << 20; i >= 0; --i) {
-		if(filter(i) == (oks & 1))
-			*++odd_tail = i;
-		if(filter(i) == (eks & 1))
-			*++even_tail = i;
-	}
-
-	// extend the statelists. Look at the next 8 Bits of the keystream (4 Bit each odd and even):
-	for(i = 0; i < 4; i++) {
-		extend_table_simple(odd_head,  &odd_tail, (oks >>= 1) & 1);
-		extend_table_simple(even_head, &even_tail, (eks >>= 1) & 1);
-	}
-
-	// the statelists now contain all states which could have generated the last 10 Bits of the keystream.
-	// 22 bits to go to recover 32 bits in total. From now on, we need to take the "in"
-	// parameter into account.
-
-	in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);		// Byte swapping
-
-	recover(odd_head, odd_tail, oks,
-		even_head, even_tail, eks, 11, statelist, in << 1, bucket);
-
-
-out:
-	free(odd_head);
-	free(even_head);
-	for (uint32_t i = 0; i < 2; i++)
-		for (uint32_t j = 0; j <= 0xff; j++)
-			free(bucket[i][j].head);
-
-	return statelist;
-}
-
-static const uint32_t S1[] = {     0x62141, 0x310A0, 0x18850, 0x0C428, 0x06214,
-	0x0310A, 0x85E30, 0xC69AD, 0x634D6, 0xB5CDE, 0xDE8DA, 0x6F46D, 0xB3C83,
-	0x59E41, 0xA8995, 0xD027F, 0x6813F, 0x3409F, 0x9E6FA};
-static const uint32_t S2[] = {  0x3A557B00, 0x5D2ABD80, 0x2E955EC0, 0x174AAF60,
-	0x0BA557B0, 0x05D2ABD8, 0x0449DE68, 0x048464B0, 0x42423258, 0x278192A8,
-	0x156042D0, 0x0AB02168, 0x43F89B30, 0x61FC4D98, 0x765EAD48, 0x7D8FDD20,
-	0x7EC7EE90, 0x7F63F748, 0x79117020};
-static const uint32_t T1[] = {
-	0x4F37D, 0x279BE, 0x97A6A, 0x4BD35, 0x25E9A, 0x12F4D, 0x097A6, 0x80D66,
-	0xC4006, 0x62003, 0xB56B4, 0x5AB5A, 0xA9318, 0xD0F39, 0x6879C, 0xB057B,
-	0x582BD, 0x2C15E, 0x160AF, 0x8F6E2, 0xC3DC4, 0xE5857, 0x72C2B, 0x39615,
-	0x98DBF, 0xC806A, 0xE0680, 0x70340, 0x381A0, 0x98665, 0x4C332, 0xA272C};
-static const uint32_t T2[] = {  0x3C88B810, 0x5E445C08, 0x2982A580, 0x14C152C0,
-	0x4A60A960, 0x253054B0, 0x52982A58, 0x2FEC9EA8, 0x1156C4D0, 0x08AB6268,
-	0x42F53AB0, 0x217A9D58, 0x161DC528, 0x0DAE6910, 0x46D73488, 0x25CB11C0,
-	0x52E588E0, 0x6972C470, 0x34B96238, 0x5CFC3A98, 0x28DE96C8, 0x12CFC0E0,
-	0x4967E070, 0x64B3F038, 0x74F97398, 0x7CDC3248, 0x38CE92A0, 0x1C674950,
-	0x0E33A4A8, 0x01B959D0, 0x40DCACE8, 0x26CEDDF0};
-static const uint32_t C1[] = { 0x846B5, 0x4235A, 0x211AD};
-static const uint32_t C2[] = { 0x1A822E0, 0x21A822E0, 0x21A822E0};
-/** Reverse 64 bits of keystream into possible cipher states
- * Variation mentioned in the paper. Somewhat optimized version
- */
-struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3)
-{
-	struct Crypto1State *statelist, *sl;
-	uint8_t oks[32], eks[32], hi[32];
-	uint32_t low = 0,  win = 0;
-	uint32_t *tail, table[1 << 16];
-	int i, j;
-
-	sl = statelist = malloc(sizeof(struct Crypto1State) << 4);
-	if(!sl)
-		return 0;
-	sl->odd = sl->even = 0;
-
-	for(i = 30; i >= 0; i -= 2) {
-		oks[i >> 1] = BIT(ks2, i ^ 24);
-		oks[16 + (i >> 1)] = BIT(ks3, i ^ 24);
-	}
-	for(i = 31; i >= 0; i -= 2) {
-		eks[i >> 1] = BIT(ks2, i ^ 24);
-		eks[16 + (i >> 1)] = BIT(ks3, i ^ 24);
-	}
-
-	for(i = 0xfffff; i >= 0; --i) {
-		if (filter(i) != oks[0])
-			continue;
-
-		*(tail = table) = i;
-		for(j = 1; tail >= table && j < 29; ++j)
-			extend_table_simple(table, &tail, oks[j]);
-
-		if(tail < table)
-			continue;
-
-		for(j = 0; j < 19; ++j)
-			low = low << 1 | parity(i & S1[j]);
-		for(j = 0; j < 32; ++j)
-			hi[j] = parity(i & T1[j]);
-
-		for(; tail >= table; --tail) {
-			for(j = 0; j < 3; ++j) {
-				*tail = *tail << 1;
-				*tail |= parity((i & C1[j]) ^ (*tail & C2[j]));
-				if(filter(*tail) != oks[29 + j])
-					goto continue2;
-			}
-
-			for(j = 0; j < 19; ++j)
-				win = win << 1 | parity(*tail & S2[j]);
-
-			win ^= low;
-			for(j = 0; j < 32; ++j) {
-				win = win << 1 ^ hi[j] ^ parity(*tail & T2[j]);
-				if(filter(win) != eks[j])
-					goto continue2;
-			}
-
-			*tail = *tail << 1 | parity(LF_POLY_EVEN & *tail);
-			sl->odd = *tail ^ parity(LF_POLY_ODD & win);
-			sl->even = win;
-			++sl;
-			sl->odd = sl->even = 0;
-			continue2:;
-		}
-	}
-	return statelist;
-}
-
-/** lfsr_rollback_bit
- * Rollback the shift register in order to get previous states
- */
-void lfsr_rollback_bit(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int out;
-	uint32_t tmp;
-
-	s->odd &= 0xffffff;
-	tmp = s->odd;
-	s->odd = s->even;
-	s->even = tmp;
-
-	out = s->even & 1;
-	out ^= LF_POLY_EVEN & (s->even >>= 1);
-	out ^= LF_POLY_ODD & s->odd;
-	out ^= !!in;
-	out ^= filter(s->odd) & !!fb;
-
-	s->even |= parity(out) << 23;
-}
-/** lfsr_rollback_byte
- * Rollback the shift register in order to get previous states
- */
-void lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int i;
-	for (i = 7; i >= 0; --i)
-		lfsr_rollback_bit(s, BEBIT(in, i), fb);
-}
-/** lfsr_rollback_word
- * Rollback the shift register in order to get previous states
- */
-void lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int i;
-	for (i = 31; i >= 0; --i)
-		lfsr_rollback_bit(s, BEBIT(in, i), fb);
-}
-
-/** nonce_distance
- * x,y valid tag nonces, then prng_successor(x, nonce_distance(x, y)) = y
- */
-static uint16_t *dist = 0;
-int nonce_distance(uint32_t from, uint32_t to)
-{
-	uint16_t x, i;
-	if(!dist) {
-		dist = malloc(2 << 16);
-		if(!dist)
-			return -1;
-		for (x = i = 1; i; ++i) {
-			dist[(x & 0xff) << 8 | x >> 8] = i;
-			x = x >> 1 | (x ^ x >> 2 ^ x >> 3 ^ x >> 5) << 15;
-		}
-	}
-	return (65535 + dist[to >> 16] - dist[from >> 16]) % 65535;
-}
-
-
-static uint32_t fastfwd[2][8] = {
-	{ 0, 0x4BC53, 0xECB1, 0x450E2, 0x25E29, 0x6E27A, 0x2B298, 0x60ECB},
-	{ 0, 0x1D962, 0x4BC53, 0x56531, 0xECB1, 0x135D3, 0x450E2, 0x58980}};
-
-
-/** lfsr_prefix_ks
- *
- * Is an exported helper function from the common prefix attack
- * Described in the "dark side" paper. It returns an -1 terminated array
- * of possible partial(21 bit) secret state.
- * The required keystream(ks) needs to contain the keystream that was used to
- * encrypt the NACK which is observed when varying only the 4 last bits of Nr
- * only correct iff [NR_3] ^ NR_3 does not depend on Nr_3
- */
-uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
-{
-	uint32_t *candidates = malloc(4 << 21);
-	uint32_t c,  entry;
-	int size, i;
-
-	if(!candidates)
-		return 0;
-
-	size = (1 << 21) - 1;
-	for(i = 0; i <= size; ++i)
-		candidates[i] = i;
-
-	for(c = 0;  c < 8; ++c)
-		for(i = 0;i <= size; ++i) {
-			entry = candidates[i] ^ fastfwd[isodd][c];
-
-			if(filter(entry >> 1) == BIT(ks[c], isodd))
-				if(filter(entry) == BIT(ks[c], isodd + 2))
-					continue;
-
-			candidates[i--] = candidates[size--];
-		}
-
-	candidates[size + 1] = -1;
-
-	return candidates;
-}
-
-/** brute_top
- * helper function which eliminates possible secret states using parity bits
- */
-static struct Crypto1State*
-brute_top(uint32_t prefix, uint32_t rresp, unsigned char parities[8][8],
-		  uint32_t odd, uint32_t even, struct Crypto1State* sl, uint8_t no_chk)
-{
-	struct Crypto1State s;
-	uint32_t ks1, nr, ks2, rr, ks3, good, c;
-
-	for(c = 0; c < 8; ++c) {
-		s.odd = odd ^ fastfwd[1][c];
-		s.even = even ^ fastfwd[0][c];
-
-		lfsr_rollback_bit(&s, 0, 0);
-		lfsr_rollback_bit(&s, 0, 0);
-		lfsr_rollback_bit(&s, 0, 0);
-
-		lfsr_rollback_word(&s, 0, 0);
-		lfsr_rollback_word(&s, prefix | c << 5, 1);
-
-		sl->odd = s.odd;
-		sl->even = s.even;
-
-		if (no_chk)
-			break;
-
-		ks1 = crypto1_word(&s, prefix | c << 5, 1);
-		ks2 = crypto1_word(&s,0,0);
-		ks3 = crypto1_word(&s, 0,0);
-		nr = ks1 ^ (prefix | c << 5);
-		rr = ks2 ^ rresp;
-
-		good = 1;
-		good &= parity(nr & 0x000000ff) ^ parities[c][3] ^ BIT(ks2, 24);
-		good &= parity(rr & 0xff000000) ^ parities[c][4] ^ BIT(ks2, 16);
-		good &= parity(rr & 0x00ff0000) ^ parities[c][5] ^ BIT(ks2,  8);
-		good &= parity(rr & 0x0000ff00) ^ parities[c][6] ^ BIT(ks2,  0);
-		good &= parity(rr & 0x000000ff) ^ parities[c][7] ^ BIT(ks3, 24);
-
-		if(!good)
-			return sl;
-	}
-
-	return ++sl;
-}
-
-
-/** lfsr_common_prefix
- * Implentation of the common prefix attack.
- * Requires the 28 bit constant prefix used as reader nonce (pfx)
- * The reader response used (rr)
- * The keystream used to encrypt the observed NACK's (ks)
- * The parity bits (par)
- * It returns a zero terminated list of possible cipher states after the
- * tag nonce was fed in
- */
-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par)
-{
-	struct Crypto1State *statelist, *s;
-	uint32_t *odd, *even, *o, *e, top;
-
-	odd = lfsr_prefix_ks(ks, 1);
-	even = lfsr_prefix_ks(ks, 0);
-
-	statelist = malloc((sizeof *statelist) << 21);	//how large should be?
-	if(!statelist || !odd || !even)
-	{
-				free(statelist);
-				free(odd);
-				free(even);
-				return 0;
-	}
-
-	s = statelist;
-	for(o = odd; *o != -1; ++o)
-		for(e = even; *e != -1; ++e)
-			for(top = 0; top < 64; ++top) {
-				*o = (*o & 0x1fffff) | (top << 21);
-				*e = (*e & 0x1fffff) | (top >> 3) << 21;
-				s = brute_top(pfx, rr, par, *o, *e, s, no_par);
-			}
-
-	s->odd = s->even = -1;
-	//printf("state count = %d\n",s-statelist);
-
-	free(odd);
-	free(even);
-
-	return statelist;
-}

client/nonce2key/crapto1.h

@@ -1,97 +0,0 @@
-/*  crapto1.h
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA  02110-1301, US$
-
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#ifndef CRAPTO1_INCLUDED
-#define CRAPTO1_INCLUDED
-#include <stdint.h>
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-struct Crypto1State {uint32_t odd, even;};
-struct Crypto1State* crypto1_create(uint64_t);
-void crypto1_destroy(struct Crypto1State*);
-void crypto1_get_lfsr(struct Crypto1State*, uint64_t*);
-uint8_t crypto1_bit(struct Crypto1State*, uint8_t, int);
-uint8_t crypto1_byte(struct Crypto1State*, uint8_t, int);
-uint32_t crypto1_word(struct Crypto1State*, uint32_t, int);
-uint32_t prng_successor(uint32_t x, uint32_t n);
-
-struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
-struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
-uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par);
-
-
-void lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
-void lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
-void lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb);
-int nonce_distance(uint32_t from, uint32_t to);
-#define SWAPENDIAN(x)\
-	(x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
-
-#define FOREACH_VALID_NONCE(N, FILTER, FSIZE)\
-	uint32_t __n = 0,__M = 0, N = 0;\
-	int __i;\
-	for(; __n < 1 << 16; N = prng_successor(__M = ++__n, 16))\
-		for(__i = FSIZE - 1; __i >= 0; __i--)\
-			if(BIT(FILTER, __i) ^ parity(__M & 0xFF01))\
-				break;\
-			else if(__i)\
-				__M = prng_successor(__M, (__i == 7) ? 48 : 8);\
-			else 
-
-#define LF_POLY_ODD (0x29CE5C)
-#define LF_POLY_EVEN (0x870804)
-#define BIT(x, n) ((x) >> (n) & 1)
-#define BEBIT(x, n) BIT(x, (n) ^ 24)
-static inline int parity(uint32_t x)
-{
-#if !defined __i386__ || !defined __GNUC__
-	x ^= x >> 16;
-	x ^= x >> 8;
-	x ^= x >> 4;
-	return BIT(0x6996, x & 0xf);
-#else
-        __asm(    "movl %1, %%eax\n"
-		"mov %%ax, %%cx\n"
-		"shrl $0x10, %%eax\n"
-		"xor %%ax, %%cx\n"
-                "xor %%ch, %%cl\n"
-                "setpo %%al\n"
-                "movzx %%al, %0\n": "=r"(x) : "r"(x): "eax","ecx");
-	return x;
-#endif
-}
-static inline int filter(uint32_t const x)
-{
-	uint32_t f;
-
-	f  = 0xf22c0 >> (x       & 0xf) & 16;
-	f |= 0x6c9c0 >> (x >>  4 & 0xf) &  8;
-	f |= 0x3c8b0 >> (x >>  8 & 0xf) &  4;
-	f |= 0x1e458 >> (x >> 12 & 0xf) &  2;
-	f |= 0x0d938 >> (x >> 16 & 0xf) &  1;
-	return BIT(0xEC57E80A, f);
-}
-#ifdef __cplusplus
-}
-#endif
-#endif

client/nonce2key/crypto1.c

@@ -1,96 +0,0 @@
-/*  crypto1.c
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program; if not, write to the Free Software
-	Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-	MA  02110-1301, US
-
-	Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#include "crapto1.h"
-#include <stdlib.h>
-
-#define SWAPENDIAN(x)\
-	(x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
-
-struct Crypto1State * crypto1_create(uint64_t key)
-{
-	struct Crypto1State *s = malloc(sizeof(*s));
-	int i;
-
-	for(i = 47;s && i > 0; i -= 2) {
-		s->odd  = s->odd  << 1 | BIT(key, (i - 1) ^ 7);
-		s->even = s->even << 1 | BIT(key, i ^ 7);
-	}
-	return s;
-}
-void crypto1_destroy(struct Crypto1State *state)
-{
-	free(state);
-}
-void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
-{
-	int i;
-	for(*lfsr = 0, i = 23; i >= 0; --i) {
-		*lfsr = *lfsr << 1 | BIT(state->odd, i ^ 3);
-		*lfsr = *lfsr << 1 | BIT(state->even, i ^ 3);
-	}
-}
-uint8_t crypto1_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
-{
-	uint32_t feedin;
-	uint32_t tmp;
-	uint8_t ret = filter(s->odd);
-
-	feedin  = ret & !!is_encrypted;
-	feedin ^= !!in;
-	feedin ^= LF_POLY_ODD & s->odd;
-	feedin ^= LF_POLY_EVEN & s->even;
-	s->even = s->even << 1 | parity(feedin);
-
-	tmp = s->odd;
-	s->odd = s->even;
-	s->even = tmp;
-
-	return ret;
-}
-uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
-{
-	uint8_t i, ret = 0;
-
-	for (i = 0; i < 8; ++i)
-		ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;
-
-	return ret;
-}
-uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
-{
-	uint32_t i, ret = 0;
-
-	for (i = 0; i < 4; ++i, in <<= 8)
-		ret = ret << 8 | crypto1_byte(s, in >> 24, is_encrypted);
-
-	return ret;
-}
-
-/* prng_successor
- * helper used to obscure the keystream during authentication
- */
-uint32_t prng_successor(uint32_t x, uint32_t n)
-{
-	SWAPENDIAN(x);
-	while(n--)
-		x = x >> 1 | (x >> 16 ^ x >> 18 ^ x >> 19 ^ x >> 21) << 31;
-
-	return SWAPENDIAN(x);
-}

client/nonce2key/nonce2key.c

@@ -10,13 +10,15 @@
 // MIFARE Darkside hack
 //-----------------------------------------------------------------------------
 
-#include <inttypes.h>
-#include <time.h>
-
 #include "nonce2key.h"
+
+#include <inttypes.h>
+#include <stdio.h>
+#include <stdlib.h>
 #include "mifarehost.h"
 #include "ui.h"
 #include "util.h"
+#include "crapto1/crapto1.h"
 
 int compar_state(const void * a, const void * b) {
 	// didn't work: (the result is truncated to 32 bits)
@@ -31,7 +33,7 @@ int compar_state(const void * a, const void * b) {
 int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
   struct Crypto1State *state;
   uint32_t i, pos, rr, nr_diff, key_count;//, ks1, ks2;
-  byte_t bt, ks3x[8], par[8][8];
+  uint8_t bt, ks3x[8], par[8][8];
   uint64_t key_recovered;
   int64_t *state_s;
   static uint32_t last_uid;
@@ -71,17 +73,17 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
     printf("%01x|\n", par[i][7]);
   }
   
-	if (par_info==0)
+	if (par_info == 0)
-		PrintAndLog("parity is all zero,try special attack!just wait for few more seconds...");
+		PrintAndLog("Parity is all zero, trying special attack! Just wait for few more seconds...");
   
-	state = lfsr_common_prefix(nr, rr, ks3x, par, par_info==0);
+	state = lfsr_common_prefix(nr, rr, ks3x, par);
 	state_s = (int64_t*)state;
 	
 	//char filename[50] ;
     //sprintf(filename, "nt_%08x_%d.txt", nt, nr);
     //printf("name %s\n", filename);
 	//FILE* fp = fopen(filename,"w");
-	for (i = 0; (state) && ((state + i)->odd != -1); i++)
+	for (i = 0; (state) && *(state_s + i); i++)
 	{
 		lfsr_rollback_word(state+i, uid^nt, 0);
 		crypto1_get_lfsr(state + i, &key_recovered);
@@ -97,9 +99,8 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
 	*(state_s + i) = -1;
 	
 	//Create the intersection:
-	if (par_info == 0 )
+	if (par_info == 0 ) {
-		if ( last_keylist != NULL)
+		if (last_keylist != NULL) {
-		{
 			int64_t *p1, *p2, *p3;
 			p1 = p3 = last_keylist; 
 			p2 = state_s;
@@ -114,12 +115,11 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
 					while (compar_state(p1, p2) == 1) ++p2;
 				}
 			}
-			key_count = p3 - last_keylist;;
+			key_count = p3 - last_keylist;
-		}
+		} else {
-		else
 			key_count = 0;
-	else
+		}
-	{
+	} else {
 		last_keylist = state_s;
 		key_count = i;
 	}
@@ -137,7 +137,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
 			*key = key64;
 			free(last_keylist);
 			last_keylist = NULL;
-			if (par_info ==0)
+			if (par_info == 0)
 				free(state);
 			return 0;
 		}
@@ -161,7 +161,7 @@ bool mfkey32(nonces_t data, uint64_t *outputkey) {
 	uint32_t ar0_enc = data.ar;  // first encrypted reader response
 	uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
 	uint32_t ar1_enc = data.ar2; // second encrypted reader response
-	clock_t t1 = clock();
+	uint64_t t1 = msclock();
 	bool isSuccess = false;
 	uint8_t counter=0;
 
@@ -182,8 +182,8 @@ bool mfkey32(nonces_t data, uint64_t *outputkey) {
 		}
 	}
 	isSuccess = (counter == 1);
-	t1 = clock() - t1;
+	t1 = msclock() - t1;
-	//if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.0f ticks \nFound %d possible keys", (float)t1, counter);
+	//if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.1f seconds \nFound %d possible keys", (float)t1/1000.0, counter);
 	*outputkey = ( isSuccess ) ? outkey : 0;
 	crypto1_destroy(s);
 	/* //un-comment to save all keys to a stats.txt file 
@@ -213,7 +213,7 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey) {
 	int counter = 0;
 	
 	//PrintAndLog("Enter mfkey32_moebius");
-	clock_t t1 = clock();
+	uint64_t t1 = msclock();
 
 	s = lfsr_recovery32(ar0_enc ^ prng_successor(nt0, 64), 0);
   
@@ -234,8 +234,8 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey) {
 		}
 	}
 	isSuccess	= (counter == 1);
-	t1 = clock() - t1;
+	t1 = msclock() - t1;
-	//if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks \nFound %d possible keys", (float)t1,counter);
+	//if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.1f seconds \nFound %d possible keys", (float)t1/1000.0, counter);
 	*outputkey = ( isSuccess ) ? outkey : 0;
 	crypto1_destroy(s);
 	/* // un-comment to output all keys to stats.txt
@@ -266,7 +266,7 @@ int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32
 	struct Crypto1State *revstate;
 	
 	PrintAndLog("Enter mfkey64");
-	clock_t t1 = clock();
+	uint64_t t1 = msclock();
 	
 	// Extract the keystream from the messages
 	ks2 = ar_enc ^ prng_successor(nt, 64);
@@ -281,8 +281,8 @@ int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32
 	crypto1_destroy(revstate);
 	*outputkey = key;
 	
-	t1 = clock() - t1;
+	t1 = msclock() - t1;
-	if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks \n", (float)t1);
+	if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.1f seconds \n", (float)t1/1000.0);
 	return 0;
 }
 

client/nonce2key/nonce2key.h

@@ -13,11 +13,8 @@
 #ifndef __NONCE2KEY_H
 #define __NONCE2KEY_H
 
-#include <stdio.h>
+#include <stdint.h>
-#include <stdlib.h>
+#include <stdbool.h>
-#include "crapto1.h"
-#include "common.h"
-//#include <stdbool.h> //for bool
 
 typedef struct {
 			  uint32_t cuid;

client/proxmark3.c

@@ -22,7 +22,6 @@
 #include "cmdmain.h"
 #include "uart.h"
 #include "ui.h"
-#include "sleep.h"
 #include "cmdparser.h"
 #include "cmdhw.h"
 #include "whereami.h"

client/scripting.c

@@ -8,6 +8,7 @@
 // Some lua scripting glue to proxmark core.
 //-----------------------------------------------------------------------------
 
+#include <stdlib.h>
 #include <lua.h>
 #include <lualib.h>
 #include <lauxlib.h>

client/sleep.c

@@ -1,28 +0,0 @@
-//-----------------------------------------------------------------------------
-// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
-//
-// This code is licensed to you under the terms of the GNU GPL, version 2 or,
-// at your option, any later version. See the LICENSE.txt file for the text of
-// the license.
-//-----------------------------------------------------------------------------
-// platform-independant sleep macros
-//-----------------------------------------------------------------------------
-
-#ifndef _WIN32
-
-#define _POSIX_C_SOURCE	199309L
-#include "sleep.h"
-#include <time.h>
-#include <stdio.h>
-#include <sys/time.h>
-#include <errno.h>
-
-void nsleep(uint64_t n) {
-  struct timespec timeout;
-  timeout.tv_sec = n/1000000000;
-  timeout.tv_nsec = n%1000000000;
-  while (nanosleep(&timeout, &timeout) && errno == EINTR);
-}
-
-#endif // _WIN32
-

client/sleep.h

@@ -1,27 +0,0 @@
-//-----------------------------------------------------------------------------
-// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
-//
-// This code is licensed to you under the terms of the GNU GPL, version 2 or,
-// at your option, any later version. See the LICENSE.txt file for the text of
-// the license.
-//-----------------------------------------------------------------------------
-// platform-independant sleep macros
-//-----------------------------------------------------------------------------
-
-#ifndef SLEEP_H__
-#define SLEEP_H__
-
-#ifdef _WIN32
-# include <windows.h>
-# define sleep(n) Sleep(1000 * n)
-# define msleep(n) Sleep(n)
-#else
-# include <inttypes.h>
-# include <unistd.h>
-  void nsleep(uint64_t n);
-# define msleep(n) nsleep(1000000 * n)
-# define usleep(n) nsleep(1000 * n)
-#endif // _WIN32
-
-#endif // SLEEP_H__
-

client/snooper.c

@@ -8,7 +8,6 @@
 // Snooper binary
 //-----------------------------------------------------------------------------
 
-#include "sleep.h"
 #include "ui.h"
 #include "proxusb.h"
 #include "cmdmain.h"

client/ui.c

@@ -12,7 +12,6 @@
 #include <stdarg.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <time.h>
 #include <readline/readline.h>
 #include <pthread.h>
 
@@ -34,7 +33,7 @@ void PrintAndLog(char *fmt, ...)
 	static FILE *logfile = NULL;
 	static int logging=1;
 
-	// lock this section to avoid interlacing prints from different threats
+	// lock this section to avoid interlacing prints from different threads
 	pthread_mutex_lock(&print_lock);
   
 	if (logging && !logfile) {

client/util.c

@@ -8,15 +8,26 @@
 // utilities
 //-----------------------------------------------------------------------------
 
-#include <ctype.h>
+#if !defined(_WIN32)
+#define _POSIX_C_SOURCE	199309L			// need nanosleep()
+#endif
+
 #include "util.h"
+
+#include <stdint.h>
+#include <string.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <time.h>
+#include "data.h"
+
 #define MAX_BIN_BREAK_LENGTH   (3072+384+1)
 
 #ifndef _WIN32
 #include <termios.h>
 #include <sys/ioctl.h> 
 
-
 int ukbhit(void)
 {
   int cnt = 0;
@@ -42,6 +53,7 @@ int ukbhit(void)
 }
 
 #else
+
 #include <conio.h>
 int ukbhit(void) {
 	return kbhit();
@@ -600,3 +612,38 @@ void clean_ascii(unsigned char *buf, size_t len) {
       buf[i] = '.';
   }
 }
+
+
+// Timer functions
+#if !defined (_WIN32)
+#include <errno.h>
+
+static void nsleep(uint64_t n) {
+  struct timespec timeout;
+  timeout.tv_sec = n/1000000000;
+  timeout.tv_nsec = n%1000000000;
+  while (nanosleep(&timeout, &timeout) && errno == EINTR);
+}
+
+void msleep(uint32_t n) {
+	nsleep(1000000 * n);
+}
+
+#endif // _WIN32
+
+// a milliseconds timer for performance measurement
+uint64_t msclock() {
+#if defined(_WIN32)
+#include <sys/types.h>
+	struct _timeb t;
+	if (_ftime_s(&t)) {
+		return 0;
+	} else {
+		return 1000 * t.time + t.millitm;
+	}
+#else
+	struct timespec t;
+	clock_gettime(CLOCK_MONOTONIC, &t);
+	return (t.tv_sec * 1000 + t.tv_nsec / 1000000);
+#endif
+}

client/util.h

@@ -8,13 +8,11 @@
 // utilities
 //-----------------------------------------------------------------------------
 
-#include <stdio.h>
+#ifndef UTIL_H__
-#include <stdint.h>  //included in data.h
+#define UTIL_H__
-#include <stdlib.h>
+
-#include <string.h>
+#include <stdint.h>
-#include <ctype.h>
+#include <stddef.h>
-#include <time.h>    //time, gmtime
-#include "data.h"    //for FILE_PATH_SIZE
 
 #ifndef ROTR
 # define ROTR(x,n) (((uintmax_t)(x) >> (n)) | ((uintmax_t)(x) << ((sizeof(x) * 8) - (n))))
@@ -25,55 +23,69 @@
 #ifndef MAX
 # define MAX(a, b) (((a) > (b)) ? (a) : (b))
 #endif
+
 #define EVEN                        0
 #define ODD                         1
 
-int ukbhit(void);
+extern int ukbhit(void);
 
-void AddLogLine(char *fileName, char *extData, char *c);
+extern void AddLogLine(char *fileName, char *extData, char *c);
-void AddLogHex(char *fileName, char *extData, const uint8_t * data, const size_t len);
+extern void AddLogHex(char *fileName, char *extData, const uint8_t * data, const size_t len);
-void AddLogUint64(char *fileName, char *extData, const uint64_t data);
+extern void AddLogUint64(char *fileName, char *extData, const uint64_t data);
-void AddLogCurrentDT(char *fileName);
+extern void AddLogCurrentDT(char *fileName);
-void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount);
+extern void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount);
 
-void print_hex(const uint8_t * data, const size_t len);
+extern void print_hex(const uint8_t * data, const size_t len);
-char * sprint_hex(const uint8_t * data, const size_t len);
+extern char *sprint_hex(const uint8_t * data, const size_t len);
-char * sprint_bin(const uint8_t * data, const size_t len);
+extern char *sprint_bin(const uint8_t * data, const size_t len);
-char * sprint_bin_break(const uint8_t *data, const size_t len, const uint8_t breaks);
+extern char *sprint_bin_break(const uint8_t *data, const size_t len, const uint8_t breaks);
-char * sprint_hex_ascii(const uint8_t *data, const size_t len);
+extern char *sprint_hex_ascii(const uint8_t *data, const size_t len);
-char * sprint_ascii(const uint8_t *data, const size_t len);
+extern char *sprint_ascii(const uint8_t *data, const size_t len);
 
-void num_to_bytes(uint64_t n, size_t len, uint8_t* dest);
+extern void num_to_bytes(uint64_t n, size_t len, uint8_t* dest);
-uint64_t bytes_to_num(uint8_t* src, size_t len);
+extern uint64_t bytes_to_num(uint8_t* src, size_t len);
-void num_to_bytebits(uint64_t	n, size_t len, uint8_t *dest);
+extern void num_to_bytebits(uint64_t	n, size_t len, uint8_t *dest);
-void num_to_bytebitsLSBF(uint64_t n, size_t len, uint8_t *dest);
+extern void num_to_bytebitsLSBF(uint64_t n, size_t len, uint8_t *dest);
-char * printBits(size_t const size, void const * const ptr);
+extern char *printBits(size_t const size, void const * const ptr);
-uint32_t SwapBits(uint32_t value, int nrbits);
+extern uint32_t SwapBits(uint32_t value, int nrbits);
-uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize);
+extern uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize);
-void SwapEndian64ex(const uint8_t *src, const size_t len, const uint8_t blockSize, uint8_t *dest);
+extern void SwapEndian64ex(const uint8_t *src, const size_t len, const uint8_t blockSize, uint8_t *dest);
 
-char param_getchar(const char *line, int paramnum);
+extern char param_getchar(const char *line, int paramnum);
-int param_getptr(const char *line, int *bg, int *en, int paramnum);
+extern int param_getptr(const char *line, int *bg, int *en, int paramnum);
-uint8_t param_get8(const char *line, int paramnum);
+extern uint8_t param_get8(const char *line, int paramnum);
-uint8_t param_get8ex(const char *line, int paramnum, int deflt, int base);
+extern uint8_t param_get8ex(const char *line, int paramnum, int deflt, int base);
-uint32_t param_get32ex(const char *line, int paramnum, int deflt, int base);
+extern uint32_t param_get32ex(const char *line, int paramnum, int deflt, int base);
-uint64_t param_get64ex(const char *line, int paramnum, int deflt, int base);
+extern uint64_t param_get64ex(const char *line, int paramnum, int deflt, int base);
-uint8_t param_getdec(const char *line, int paramnum, uint8_t *destination);
+extern uint8_t param_getdec(const char *line, int paramnum, uint8_t *destination);
-uint8_t param_isdec(const char *line, int paramnum);
+extern uint8_t param_isdec(const char *line, int paramnum);
-int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt);
+extern int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt);
-int param_gethex_ex(const char *line, int paramnum, uint8_t * data, int *hexcnt);
+extern int param_gethex_ex(const char *line, int paramnum, uint8_t * data, int *hexcnt);
-int param_getstr(const char *line, int paramnum, char * str);
+extern int param_getstr(const char *line, int paramnum, char * str);
 
- int hextobinarray( char *target,  char *source);
+extern int hextobinarray( char *target,  char *source);
- int hextobinstring( char *target,  char *source);
+extern int hextobinstring( char *target,  char *source);
- int binarraytohex( char *target,  char *source,  int length);
+extern int binarraytohex( char *target,  char *source,  int length);
-void binarraytobinstring(char *target,  char *source,  int length);
+extern void binarraytobinstring(char *target,  char *source,  int length);
-uint8_t GetParity( uint8_t *string, uint8_t type,  int length);
+extern uint8_t GetParity( uint8_t *string, uint8_t type,  int length);
-void wiegand_add_parity(uint8_t *target, uint8_t *source, uint8_t length);
+extern void wiegand_add_parity(uint8_t *target, uint8_t *source, uint8_t length);
 
-void xor(unsigned char *dst, unsigned char *src, size_t len);
+extern void xor(unsigned char *dst, unsigned char *src, size_t len);
-int32_t le24toh(uint8_t data[3]);
+extern int32_t le24toh(uint8_t data[3]);
-uint32_t le32toh (uint8_t *data);
+extern uint32_t le32toh (uint8_t *data);
-void rol(uint8_t *data, const size_t len);
+extern void rol(uint8_t *data, const size_t len);
 
-void clean_ascii(unsigned char *buf, size_t len);
+extern void clean_ascii(unsigned char *buf, size_t len);
+
+// timer functions/macros
+#ifdef _WIN32
+# include <windows.h>
+# define sleep(n) Sleep(1000 *(n))
+# define msleep(n) Sleep((n))
+#else
+extern void msleep(uint32_t n);		// sleep n milliseconds
+#endif // _WIN32
+
+extern uint64_t msclock(); 			// a milliseconds clock
+
+#endif // UTIL_H__

common/Makefile.common

@@ -63,7 +63,7 @@ endif
 
 
 # Also search prerequisites in the common directory (for usb.c), the fpga directory (for fpga.bit), and the zlib directory
-VPATH = . ../common ../fpga ../zlib
+VPATH = . ../common ../common/crapto1 ../fpga ../zlib
 
 INCLUDES = ../include/proxmark3.h ../include/at91sam7s512.h ../include/config_gpio.h ../include/usb_cmd.h $(APP_INCLUDES)
 

common/crapto1/crapto1.h

@@ -15,7 +15,7 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
     MA  02110-1301, US$
 
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
+    Copyright (C) 2008-2014 bla <blapost@gmail.com>
 */
 #ifndef CRAPTO1_INCLUDED
 #define CRAPTO1_INCLUDED
@@ -25,7 +25,11 @@ extern "C" {
 #endif
 
 struct Crypto1State {uint32_t odd, even;};
+#if defined(__arm__)
 void crypto1_create(struct Crypto1State *s, uint64_t key);
+#else
+struct Crypto1State *crypto1_create(uint64_t key);
+#endif
 void crypto1_destroy(struct Crypto1State*);
 void crypto1_get_lfsr(struct Crypto1State*, uint64_t*);
 uint8_t crypto1_bit(struct Crypto1State*, uint8_t, int);
@@ -39,6 +43,7 @@ uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
 struct Crypto1State*
 lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
 
+
 uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
 uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
 uint32_t lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb);
@@ -66,7 +71,7 @@ static inline int parity(uint32_t x)
 	x ^= x >> 4;
 	return BIT(0x6996, x & 0xf);
 #else
-        asm(    "movl %1, %%eax\n"
+        __asm(    "movl %1, %%eax\n"
 		"mov %%ax, %%cx\n"
 		"shrl $0x10, %%eax\n"
 		"xor %%ax, %%cx\n"

common/crapto1/crypto1.c

@@ -23,9 +23,9 @@
 #define SWAPENDIAN(x)\
 	(x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
 
+#if defined(__arm__) && !defined(__linux__) && !defined(_WIN32)			// bare metal ARM lacks malloc()/free()
 void crypto1_create(struct Crypto1State *s, uint64_t key)
 {
-//	struct Crypto1State *s = malloc(sizeof(*s));
 	int i;
 
 	for(i = 47;s && i > 0; i -= 2) {
@@ -36,10 +36,26 @@ void crypto1_create(struct Crypto1State *s, uint64_t key)
 }
 void crypto1_destroy(struct Crypto1State *state)
 {
-//	free(state);
 	state->odd = 0;
 	state->even = 0;
 }
+#else
+struct Crypto1State * crypto1_create(uint64_t key)
+{
+	struct Crypto1State *s = malloc(sizeof(*s));
+	int i;
+
+	for(i = 47;s && i > 0; i -= 2) {
+		s->odd  = s->odd  << 1 | BIT(key, (i - 1) ^ 7);
+		s->even = s->even << 1 | BIT(key, i ^ 7);
+	}
+	return s;
+}
+void crypto1_destroy(struct Crypto1State *state)
+{
+	free(state);
+}
+#endif
 void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
 {
 	int i;
@@ -50,8 +66,7 @@ void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
 }
 uint8_t crypto1_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
 {
-	uint32_t feedin;
+	uint32_t feedin, t;
-	uint32_t tmp;
 	uint8_t ret = filter(s->odd);
 
 	feedin  = ret & !!is_encrypted;
@@ -60,9 +75,7 @@ uint8_t crypto1_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
 	feedin ^= LF_POLY_EVEN & s->even;
 	s->even = s->even << 1 | parity(feedin);
 
-	tmp = s->odd;
+	t = s->odd, s->odd = s->even, s->even = t;
-	s->odd = s->even;
-	s->even = tmp;
 
 	return ret;
 }

tools/mfkey/Makefile

@@ -1,17 +1,20 @@
+VPATH = ../../common/crapto1
 CC = gcc
 LD = gcc
-CFLAGS = -Wall -Winline -O4
+CFLAGS = -I../../common -Wall -O4
 LDFLAGS =
 
-OBJS = crapto1.o crypto1.o
+OBJS = crypto1.o crapto1.o
-HEADERS = 
+EXES = mfkey32 mfkey64
-EXES = mfkey64 mfkey32
+WINEXES = $(patsubst %, %.exe, $(EXES))
-LIBS =
-	
-all: $(OBJS) $(EXES) $(LIBS)
 
-% : %.c $(OBJS)
+all: $(OBJS) $(EXES)
-	$(LD) $(CFLAGS) -o $@ $< $(OBJS) $(LDFLAGS)
+
+%.o : %.c
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+% : %.c
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS) $<
 
 clean: 
-	rm -f $(OBJS) $(EXES) $(LIBS) 
+	rm -f $(OBJS) $(EXES) $(WINEXES)

tools/mfkey/crapto1.c

@@ -1,478 +0,0 @@
-/*  crapto1.c
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA  02110-1301, US$
-
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#include "crapto1.h"
-#include <stdlib.h>
-
-#if !defined LOWMEM && defined __GNUC__
-static uint8_t filterlut[1 << 20];
-static void __attribute__((constructor)) fill_lut()
-{
-        uint32_t i;
-        for(i = 0; i < 1 << 20; ++i)
-                filterlut[i] = filter(i);
-}
-#define filter(x) (filterlut[(x) & 0xfffff])
-#endif
-
-static void quicksort(uint32_t* const start, uint32_t* const stop)
-{
-	uint32_t *it = start + 1, *rit = stop;
-
-	if(it > rit)
-		return;
-
-	while(it < rit)
-		if(*it <= *start)
-			++it;
-		else if(*rit > *start)
-			--rit;
-		else
-			*it ^= (*it ^= *rit, *rit ^= *it);
-
-	if(*rit >= *start)
-		--rit;
-	if(rit != start)
-		*rit ^= (*rit ^= *start, *start ^= *rit);
-
-	quicksort(start, rit - 1);
-	quicksort(rit + 1, stop);
-}
-/** binsearch
- * Binary search for the first occurence of *stop's MSB in sorted [start,stop]
- */
-static inline uint32_t* binsearch(uint32_t *start, uint32_t *stop)
-{
-	uint32_t mid, val = *stop & 0xff000000;
-	while(start != stop)
-		if(start[mid = (stop - start) >> 1] > val)
-			stop = &start[mid];
-		else
-			start += mid + 1;
-
-	return start;
-}
-
-/** update_contribution
- * helper, calculates the partial linear feedback contributions and puts in MSB
- */
-static inline void
-update_contribution(uint32_t *item, const uint32_t mask1, const uint32_t mask2)
-{
-	uint32_t p = *item >> 25;
-
-	p = p << 1 | parity(*item & mask1);
-	p = p << 1 | parity(*item & mask2);
-	*item = p << 24 | (*item & 0xffffff);
-}
-
-/** extend_table
- * using a bit of the keystream extend the table of possible lfsr states
- */
-static inline void
-extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)
-{
-	in <<= 24;
-	for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
-		if(filter(*tbl) ^ filter(*tbl | 1)) {
-			*tbl |= filter(*tbl) ^ bit;
-			update_contribution(tbl, m1, m2);
-			*tbl ^= in;
-		} else if(filter(*tbl) == bit) {
-			*++*end = tbl[1];
-			tbl[1] = tbl[0] | 1;
-			update_contribution(tbl, m1, m2);
-			*tbl++ ^= in;
-			update_contribution(tbl, m1, m2);
-			*tbl ^= in;
-		} else
-			*tbl-- = *(*end)--;
-}
-/** extend_table_simple
- * using a bit of the keystream extend the table of possible lfsr states
- */
-static inline void extend_table_simple(uint32_t *tbl, uint32_t **end, int bit)
-{
-	for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
-		if(filter(*tbl) ^ filter(*tbl | 1))
-			*tbl |= filter(*tbl) ^ bit;
-		else if(filter(*tbl) == bit) {
-			*++*end = *++tbl;
-			*tbl = tbl[-1] | 1;
-		} else
-			*tbl-- = *(*end)--;
-}
-/** recover
- * recursively narrow down the search space, 4 bits of keystream at a time
- */
-static struct Crypto1State*
-recover(uint32_t *o_head, uint32_t *o_tail, uint32_t oks,
-	uint32_t *e_head, uint32_t *e_tail, uint32_t eks, int rem,
-	struct Crypto1State *sl, uint32_t in)
-{
-	uint32_t *o, *e, i;
-
-	if(rem == -1) {
-		for(e = e_head; e <= e_tail; ++e) {
-			*e = *e << 1 ^ parity(*e & LF_POLY_EVEN) ^ !!(in & 4);
-			for(o = o_head; o <= o_tail; ++o, ++sl) {
-				sl->even = *o;
-				sl->odd = *e ^ parity(*o & LF_POLY_ODD);
-				sl[1].odd = sl[1].even = 0;
-			}
-		}
-		return sl;
-	}
-
-	for(i = 0; i < 4 && rem--; i++) {
-		oks >>= 1;
-		eks >>= 1;
-		in >>= 2;
-		extend_table(o_head, &o_tail, oks & 1, LF_POLY_EVEN << 1 | 1,
-			     LF_POLY_ODD << 1, 0);
-		if(o_head > o_tail)
-			return sl;
-
-		extend_table(e_head, &e_tail, eks & 1, LF_POLY_ODD,
-			     LF_POLY_EVEN << 1 | 1, in & 3);
-		if(e_head > e_tail)
-			return sl;
-	}
-
-	quicksort(o_head, o_tail);
-	quicksort(e_head, e_tail);
-
-	while(o_tail >= o_head && e_tail >= e_head)
-		if(((*o_tail ^ *e_tail) >> 24) == 0) {
-			o_tail = binsearch(o_head, o = o_tail);
-			e_tail = binsearch(e_head, e = e_tail);
-			sl = recover(o_tail--, o, oks,
-				     e_tail--, e, eks, rem, sl, in);
-		}
-		else if(*o_tail > *e_tail)
-			o_tail = binsearch(o_head, o_tail) - 1;
-		else
-			e_tail = binsearch(e_head, e_tail) - 1;
-
-	return sl;
-}
-/** lfsr_recovery
- * recover the state of the lfsr given 32 bits of the keystream
- * additionally you can use the in parameter to specify the value
- * that was fed into the lfsr at the time the keystream was generated
- */
-struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
-{
-	struct Crypto1State *statelist;
-	uint32_t *odd_head = 0, *odd_tail = 0, oks = 0;
-	uint32_t *even_head = 0, *even_tail = 0, eks = 0;
-	int i;
-
-	for(i = 31; i >= 0; i -= 2)
-		oks = oks << 1 | BEBIT(ks2, i);
-	for(i = 30; i >= 0; i -= 2)
-		eks = eks << 1 | BEBIT(ks2, i);
-
-	odd_head = odd_tail = malloc(sizeof(uint32_t) << 21);
-	even_head = even_tail = malloc(sizeof(uint32_t) << 21);
-	statelist =  malloc(sizeof(struct Crypto1State) << 18);
-	if(!odd_tail-- || !even_tail-- || !statelist) {
-		free(statelist);
-		statelist = 0;
-		goto out;
-	}
-
-	statelist->odd = statelist->even = 0;
-
-	for(i = 1 << 20; i >= 0; --i) {
-		if(filter(i) == (oks & 1))
-			*++odd_tail = i;
-		if(filter(i) == (eks & 1))
-			*++even_tail = i;
-	}
-
-	for(i = 0; i < 4; i++) {
-		extend_table_simple(odd_head,  &odd_tail, (oks >>= 1) & 1);
-		extend_table_simple(even_head, &even_tail, (eks >>= 1) & 1);
-	}
-
-	in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);
-	recover(odd_head, odd_tail, oks,
-		even_head, even_tail, eks, 11, statelist, in << 1);
-
-out:
-	free(odd_head);
-	free(even_head);
-	return statelist;
-}
-
-static const uint32_t S1[] = {     0x62141, 0x310A0, 0x18850, 0x0C428, 0x06214,
-	0x0310A, 0x85E30, 0xC69AD, 0x634D6, 0xB5CDE, 0xDE8DA, 0x6F46D, 0xB3C83,
-	0x59E41, 0xA8995, 0xD027F, 0x6813F, 0x3409F, 0x9E6FA};
-static const uint32_t S2[] = {  0x3A557B00, 0x5D2ABD80, 0x2E955EC0, 0x174AAF60,
-	0x0BA557B0, 0x05D2ABD8, 0x0449DE68, 0x048464B0, 0x42423258, 0x278192A8,
-	0x156042D0, 0x0AB02168, 0x43F89B30, 0x61FC4D98, 0x765EAD48, 0x7D8FDD20,
-	0x7EC7EE90, 0x7F63F748, 0x79117020};
-static const uint32_t T1[] = {
-	0x4F37D, 0x279BE, 0x97A6A, 0x4BD35, 0x25E9A, 0x12F4D, 0x097A6, 0x80D66,
-	0xC4006, 0x62003, 0xB56B4, 0x5AB5A, 0xA9318, 0xD0F39, 0x6879C, 0xB057B,
-	0x582BD, 0x2C15E, 0x160AF, 0x8F6E2, 0xC3DC4, 0xE5857, 0x72C2B, 0x39615,
-	0x98DBF, 0xC806A, 0xE0680, 0x70340, 0x381A0, 0x98665, 0x4C332, 0xA272C};
-static const uint32_t T2[] = {  0x3C88B810, 0x5E445C08, 0x2982A580, 0x14C152C0,
-	0x4A60A960, 0x253054B0, 0x52982A58, 0x2FEC9EA8, 0x1156C4D0, 0x08AB6268,
-	0x42F53AB0, 0x217A9D58, 0x161DC528, 0x0DAE6910, 0x46D73488, 0x25CB11C0,
-	0x52E588E0, 0x6972C470, 0x34B96238, 0x5CFC3A98, 0x28DE96C8, 0x12CFC0E0,
-	0x4967E070, 0x64B3F038, 0x74F97398, 0x7CDC3248, 0x38CE92A0, 0x1C674950,
-	0x0E33A4A8, 0x01B959D0, 0x40DCACE8, 0x26CEDDF0};
-static const uint32_t C1[] = { 0x846B5, 0x4235A, 0x211AD};
-static const uint32_t C2[] = { 0x1A822E0, 0x21A822E0, 0x21A822E0};
-/** Reverse 64 bits of keystream into possible cipher states
- * Variation mentioned in the paper. Somewhat optimized version
- */
-struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3)
-{
-	struct Crypto1State *statelist, *sl;
-	uint8_t oks[32], eks[32], hi[32];
-	uint32_t low = 0,  win = 0;
-	uint32_t *tail, table[1 << 16];
-	int i, j;
-
-	sl = statelist = malloc(sizeof(struct Crypto1State) << 4);
-	if(!sl)
-		return 0;
-	sl->odd = sl->even = 0;
-
-	for(i = 30; i >= 0; i -= 2) {
-		oks[i >> 1] = BEBIT(ks2, i);
-		oks[16 + (i >> 1)] = BEBIT(ks3, i);
-	}
-	for(i = 31; i >= 0; i -= 2) {
-		eks[i >> 1] = BEBIT(ks2, i);
-		eks[16 + (i >> 1)] = BEBIT(ks3, i);
-	}
-
-	for(i = 0xfffff; i >= 0; --i) {
-		if (filter(i) != oks[0])
-			continue;
-
-		*(tail = table) = i;
-		for(j = 1; tail >= table && j < 29; ++j)
-			extend_table_simple(table, &tail, oks[j]);
-
-		if(tail < table)
-			continue;
-
-		for(j = 0; j < 19; ++j)
-			low = low << 1 | parity(i & S1[j]);
-		for(j = 0; j < 32; ++j)
-			hi[j] = parity(i & T1[j]);
-
-		for(; tail >= table; --tail) {
-			for(j = 0; j < 3; ++j) {
-				*tail = *tail << 1;
-				*tail |= parity((i & C1[j]) ^ (*tail & C2[j]));
-				if(filter(*tail) != oks[29 + j])
-					goto continue2;
-			}
-
-			for(j = 0; j < 19; ++j)
-				win = win << 1 | parity(*tail & S2[j]);
-
-			win ^= low;
-			for(j = 0; j < 32; ++j) {
-				win = win << 1 ^ hi[j] ^ parity(*tail & T2[j]);
-				if(filter(win) != eks[j])
-					goto continue2;
-			}
-
-			*tail = *tail << 1 | parity(LF_POLY_EVEN & *tail);
-			sl->odd = *tail ^ parity(LF_POLY_ODD & win);
-			sl->even = win;
-			++sl;
-			sl->odd = sl->even = 0;
-			continue2:;
-		}
-	}
-	return statelist;
-}
-
-/** lfsr_rollback_bit
- * Rollback the shift register in order to get previous states
- */
-uint8_t lfsr_rollback_bit(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int out;
-	uint8_t ret;
-
-	s->odd &= 0xffffff;
-	s->odd ^= (s->odd ^= s->even, s->even ^= s->odd);
-
-	out = s->even & 1;
-	out ^= LF_POLY_EVEN & (s->even >>= 1);
-	out ^= LF_POLY_ODD & s->odd;
-	out ^= !!in;
-	out ^= (ret = filter(s->odd)) & !!fb;
-
-	s->even |= parity(out) << 23;
-	return ret;
-}
-/** lfsr_rollback_byte
- * Rollback the shift register in order to get previous states
- */
-uint8_t lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int i, ret = 0;
-	for (i = 7; i >= 0; --i)
-		ret |= lfsr_rollback_bit(s, BIT(in, i), fb) << i;
-	return ret;
-}
-/** lfsr_rollback_word
- * Rollback the shift register in order to get previous states
- */
-uint32_t lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int i;
-	uint32_t ret = 0;
-	for (i = 31; i >= 0; --i)
-		ret |= lfsr_rollback_bit(s, BEBIT(in, i), fb) << (i ^ 24);
-	return ret;
-}
-
-/** nonce_distance
- * x,y valid tag nonces, then prng_successor(x, nonce_distance(x, y)) = y
- */
-static uint16_t *dist = 0;
-int nonce_distance(uint32_t from, uint32_t to)
-{
-	uint16_t x, i;
-	if(!dist) {
-		dist = malloc(2 << 16);
-		if(!dist)
-			return -1;
-		for (x = i = 1; i; ++i) {
-			dist[(x & 0xff) << 8 | x >> 8] = i;
-			x = x >> 1 | (x ^ x >> 2 ^ x >> 3 ^ x >> 5) << 15;
-		}
-	}
-	return (65535 + dist[to >> 16] - dist[from >> 16]) % 65535;
-}
-
-
-static uint32_t fastfwd[2][8] = {
-	{ 0, 0x4BC53, 0xECB1, 0x450E2, 0x25E29, 0x6E27A, 0x2B298, 0x60ECB},
-	{ 0, 0x1D962, 0x4BC53, 0x56531, 0xECB1, 0x135D3, 0x450E2, 0x58980}};
-/** lfsr_prefix_ks
- *
- * Is an exported helper function from the common prefix attack
- * Described in the "dark side" paper. It returns an -1 terminated array
- * of possible partial(21 bit) secret state.
- * The required keystream(ks) needs to contain the keystream that was used to
- * encrypt the NACK which is observed when varying only the 3 last bits of Nr
- * only correct iff [NR_3] ^ NR_3 does not depend on Nr_3
- */
-uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
-{
-	uint32_t c, entry, *candidates = malloc(4 << 10);
-	int i, size = 0, good;
-
-	if(!candidates)
-		return 0;
-
-	for(i = 0; i < 1 << 21; ++i) {
-		for(c = 0, good = 1; good && c < 8; ++c) {
-			entry = i ^ fastfwd[isodd][c];
-			good &= (BIT(ks[c], isodd) == filter(entry >> 1));
-			good &= (BIT(ks[c], isodd + 2) == filter(entry));
-		}
-		if(good)
-			candidates[size++] = i;
-	}
-
-	candidates[size] = -1;
-
-	return candidates;
-}
-
-/** check_pfx_parity
- * helper function which eliminates possible secret states using parity bits
- */
-static struct Crypto1State*
-check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
-          	uint32_t odd, uint32_t even, struct Crypto1State* sl)
-{
-	uint32_t ks1, nr, ks2, rr, ks3, c, good = 1;
-
-	for(c = 0; good && c < 8; ++c) {
-		sl->odd = odd ^ fastfwd[1][c];
-		sl->even = even ^ fastfwd[0][c];
-
-		lfsr_rollback_bit(sl, 0, 0);
-		lfsr_rollback_bit(sl, 0, 0);
-
-		ks3 = lfsr_rollback_bit(sl, 0, 0);
-		ks2 = lfsr_rollback_word(sl, 0, 0);
-		ks1 = lfsr_rollback_word(sl, prefix | c << 5, 1);
-
-		nr = ks1 ^ (prefix | c << 5);
-		rr = ks2 ^ rresp;
-
-		good &= parity(nr & 0x000000ff) ^ parities[c][3] ^ BIT(ks2, 24);
-		good &= parity(rr & 0xff000000) ^ parities[c][4] ^ BIT(ks2, 16);
-		good &= parity(rr & 0x00ff0000) ^ parities[c][5] ^ BIT(ks2,  8);
-		good &= parity(rr & 0x0000ff00) ^ parities[c][6] ^ BIT(ks2,  0);
-		good &= parity(rr & 0x000000ff) ^ parities[c][7] ^ ks3;
-	}
-
-	return sl + good;
-} 
-
-
-/** lfsr_common_prefix
- * Implentation of the common prefix attack.
- */
-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
-{
-	struct Crypto1State *statelist, *s;
-	uint32_t *odd, *even, *o, *e, top;
-
-	odd = lfsr_prefix_ks(ks, 1);
-	even = lfsr_prefix_ks(ks, 0);
-
-	s = statelist = malloc((sizeof *statelist) << 20);
-	if(!s || !odd || !even) {
-		free(statelist);
-		statelist = 0;
-                goto out;
-	}
-
-	for(o = odd; *o + 1; ++o)
-		for(e = even; *e + 1; ++e)
-			for(top = 0; top < 64; ++top) {
-				*o += 1 << 21;
-				*e += (!(top & 7) + 1) << 21;
-				s = check_pfx_parity(pfx, rr, par, *o, *e, s);
-			}
-
-	s->odd = s->even = 0;
-out:
-	free(odd);
-	free(even);
-	return statelist;
-}

tools/mfkey/crapto1.h

@@ -1,93 +0,0 @@
-/*  crapto1.h
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA  02110-1301, US$
-
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#ifndef CRAPTO1_INCLUDED
-#define CRAPTO1_INCLUDED
-#include <stdint.h>
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-struct Crypto1State {uint32_t odd, even;};
-struct Crypto1State* crypto1_create(uint64_t);
-void crypto1_destroy(struct Crypto1State*);
-void crypto1_get_lfsr(struct Crypto1State*, uint64_t*);
-uint8_t crypto1_bit(struct Crypto1State*, uint8_t, int);
-uint8_t crypto1_byte(struct Crypto1State*, uint8_t, int);
-uint32_t crypto1_word(struct Crypto1State*, uint32_t, int);
-uint32_t prng_successor(uint32_t x, uint32_t n);
-
-struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
-struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
-uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
-
-uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
-uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
-uint32_t lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb);
-int nonce_distance(uint32_t from, uint32_t to);
-#define FOREACH_VALID_NONCE(N, FILTER, FSIZE)\
-	uint32_t __n = 0,__M = 0, N = 0;\
-	int __i;\
-	for(; __n < 1 << 16; N = prng_successor(__M = ++__n, 16))\
-		for(__i = FSIZE - 1; __i >= 0; __i--)\
-			if(BIT(FILTER, __i) ^ parity(__M & 0xFF01))\
-				break;\
-			else if(__i)\
-				__M = prng_successor(__M, (__i == 7) ? 48 : 8);\
-			else 
-
-#define LF_POLY_ODD (0x29CE5C)
-#define LF_POLY_EVEN (0x870804)
-#define BIT(x, n) ((x) >> (n) & 1)
-#define BEBIT(x, n) BIT(x, (n) ^ 24)
-static inline int parity(uint32_t x)
-{
-#if !defined __i386__ || !defined __GNUC__
-	x ^= x >> 16;
-	x ^= x >> 8;
-	x ^= x >> 4;
-	return BIT(0x6996, x & 0xf);
-#else
-        asm(    "movl %1, %%eax\n"
-		"mov %%ax, %%cx\n"
-		"shrl $0x10, %%eax\n"
-		"xor %%ax, %%cx\n"
-                "xor %%ch, %%cl\n"
-                "setpo %%al\n"
-                "movzx %%al, %0\n": "=r"(x) : "r"(x): "eax","ecx");
-	return x;
-#endif
-}
-static inline int filter(uint32_t const x)
-{
-	uint32_t f;
-
-	f  = 0xf22c0 >> (x       & 0xf) & 16;
-	f |= 0x6c9c0 >> (x >>  4 & 0xf) &  8;
-	f |= 0x3c8b0 >> (x >>  8 & 0xf) &  4;
-	f |= 0x1e458 >> (x >> 12 & 0xf) &  2;
-	f |= 0x0d938 >> (x >> 16 & 0xf) &  1;
-	return BIT(0xEC57E80A, f);
-}
-#ifdef __cplusplus
-}
-#endif
-#endif

tools/mfkey/crypto1.c

@@ -1,93 +0,0 @@
-/*  crypto1.c
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA  02110-1301, US
-
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#include "crapto1.h"
-#include <stdlib.h>
-
-#define SWAPENDIAN(x)\
-	(x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
-
-struct Crypto1State * crypto1_create(uint64_t key)
-{
-	struct Crypto1State *s = malloc(sizeof(*s));
-	int i;
-
-	for(i = 47;s && i > 0; i -= 2) {
-		s->odd  = s->odd  << 1 | BIT(key, (i - 1) ^ 7);
-		s->even = s->even << 1 | BIT(key, i ^ 7);
-	}
-	return s;
-}
-void crypto1_destroy(struct Crypto1State *state)
-{
-	free(state);
-}
-void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
-{
-	int i;
-	for(*lfsr = 0, i = 23; i >= 0; --i) {
-		*lfsr = *lfsr << 1 | BIT(state->odd, i ^ 3);
-		*lfsr = *lfsr << 1 | BIT(state->even, i ^ 3);
-	}
-}
-uint8_t crypto1_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
-{
-	uint32_t feedin;
-	uint8_t ret = filter(s->odd);
-
-	feedin  = ret & !!is_encrypted;
-	feedin ^= !!in;
-	feedin ^= LF_POLY_ODD & s->odd;
-	feedin ^= LF_POLY_EVEN & s->even;
-	s->even = s->even << 1 | parity(feedin);
-
-	s->odd ^= (s->odd ^= s->even, s->even ^= s->odd);
-
-	return ret;
-}
-uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
-{
-	uint8_t i, ret = 0;
-
-	for (i = 0; i < 8; ++i)
-		ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;
-
-	return ret;
-}
-uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
-{
-	uint32_t i, ret = 0;
-
-	for (i = 0; i < 32; ++i)
-		ret |= crypto1_bit(s, BEBIT(in, i), is_encrypted) << (i ^ 24);
-
-	return ret;
-}
-
-/* prng_successor
- * helper used to obscure the keystream during authentication
- */
-uint32_t prng_successor(uint32_t x, uint32_t n)
-{
-	SWAPENDIAN(x);
-	while(n--)
-		x = x >> 1 | (x >> 16 ^ x >> 18 ^ x >> 19 ^ x >> 21) << 31;
-
-	return SWAPENDIAN(x);
-}

tools/mfkey/mfkey32.c

@@ -1,5 +1,5 @@
 #include <inttypes.h>
-#include "crapto1.h"
+#include "crapto1/crapto1.h"
 #include <stdio.h>
 #include <stdlib.h>
 

tools/mfkey/mfkey64.c

@@ -1,5 +1,5 @@
 #include <inttypes.h>
-#include "crapto1.h"
+#include "crapto1/crapto1.h"
 #include <stdio.h>
 #include <string.h>
 
@@ -34,7 +34,7 @@ int main (int argc, char *argv[]) {
   for (int i = 0; i < encc; i++) {
     enclen[i] = strlen(argv[i + 6]) / 2;
     for (int i2 = 0; i2 < enclen[i]; i2++) {
-      sscanf(argv[i+6] + i2*2,"%2x", (uint8_t*)&enc[i][i2]);
+      sscanf(argv[i+6] + i2*2,"%2x", (unsigned int *)&enc[i][i2]);
     }
   }
   printf("Recovering key for:\n");

tools/nonce2key/Makefile

@@ -1,22 +1,21 @@
+VPATH = ../../common/crapto1
 CC = gcc
 LD = gcc
-CFLAGS = -Wall -O4 -c
+CFLAGS = -I../../common -Wall -O4
 LDFLAGS =
 
 OBJS = crypto1.o crapto1.o
 HEADERS = crapto1.h
 EXES = nonce2key
+WINEXES = $(patsubst %, %.exe, $(EXES))
 
 all: $(OBJS) $(EXES)
 
 %.o : %.c
-	$(CC) $(CFLAGS) -o $@ $<
+	$(CC) $(CFLAGS) -c -o $@ $<
 
 % : %.c
-	$(LD) $(LDFLAGS) -o $@ $(OBJS) $<
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS) $<
 
-crypto1test: libnfc $(OBJS)
-	$(LD) $(LDFLAGS) -o crypto1test crypto1test.c $(OBJS)
- 
 clean: 
-	rm -f $(OBJS) $(EXES)
+	rm -f $(OBJS) $(EXES) $(WINEXES)

tools/nonce2key/crapto1.c

@@ -1,494 +0,0 @@
-/*  crapto1.c
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA  02110-1301, US$
-
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#include "crapto1.h"
-#include <stdlib.h>
-
-#if !defined LOWMEM && defined __GNUC__
-static uint8_t filterlut[1 << 20];
-static void __attribute__((constructor)) fill_lut()
-{
-        uint32_t i;
-        for(i = 0; i < 1 << 20; ++i)
-                filterlut[i] = filter(i);
-}
-#define filter(x) (filterlut[(x) & 0xfffff])
-#endif
-
-static void quicksort(uint32_t* const start, uint32_t* const stop)
-{
-	uint32_t *it = start + 1, *rit = stop;
-
-	if(it > rit)
-		return;
-
-	while(it < rit)
-		if(*it <= *start)
-			++it;
-		else if(*rit > *start)
-			--rit;
-		else
-			*it ^= (*it ^= *rit, *rit ^= *it);
-
-	if(*rit >= *start)
-		--rit;
-	if(rit != start)
-		*rit ^= (*rit ^= *start, *start ^= *rit);
-
-	quicksort(start, rit - 1);
-	quicksort(rit + 1, stop);
-}
-/** binsearch
- * Binary search for the first occurence of *stop's MSB in sorted [start,stop]
- */
-static inline uint32_t*
-binsearch(uint32_t *start, uint32_t *stop)
-{
-	uint32_t mid, val = *stop & 0xff000000;
-	while(start != stop)
-		if(start[mid = (stop - start) >> 1] > val)
-			stop = &start[mid];
-		else
-			start += mid + 1;
-
-	return start;
-}
-
-/** update_contribution
- * helper, calculates the partial linear feedback contributions and puts in MSB
- */
-static inline void
-update_contribution(uint32_t *item, const uint32_t mask1, const uint32_t mask2)
-{
-	uint32_t p = *item >> 25;
-
-	p = p << 1 | parity(*item & mask1);
-	p = p << 1 | parity(*item & mask2);
-	*item = p << 24 | (*item & 0xffffff);
-}
-
-/** extend_table
- * using a bit of the keystream extend the table of possible lfsr states
- */
-static inline void
-extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)
-{
-	in <<= 24;
-	for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
-		if(filter(*tbl) ^ filter(*tbl | 1)) {
-			*tbl |= filter(*tbl) ^ bit;
-			update_contribution(tbl, m1, m2);
-			*tbl ^= in;
-		} else if(filter(*tbl) == bit) {
-			*++*end = tbl[1];
-			tbl[1] = tbl[0] | 1;
-			update_contribution(tbl, m1, m2);
-			*tbl++ ^= in;
-			update_contribution(tbl, m1, m2);
-			*tbl ^= in;
-		} else
-			*tbl-- = *(*end)--;
-}
-/** extend_table_simple
- * using a bit of the keystream extend the table of possible lfsr states
- */
-static inline void
-extend_table_simple(uint32_t *tbl, uint32_t **end, int bit)
-{
-	for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
-		if(filter(*tbl) ^ filter(*tbl | 1)) {
-			*tbl |= filter(*tbl) ^ bit;
-		} else if(filter(*tbl) == bit) {
-			*++*end = *++tbl;
-			*tbl = tbl[-1] | 1;
-		} else
-			*tbl-- = *(*end)--;
-}
-/** recover
- * recursively narrow down the search space, 4 bits of keystream at a time
- */
-static struct Crypto1State*
-recover(uint32_t *o_head, uint32_t *o_tail, uint32_t oks,
-	uint32_t *e_head, uint32_t *e_tail, uint32_t eks, int rem,
-	struct Crypto1State *sl, uint32_t in)
-{
-	uint32_t *o, *e, i;
-
-	if(rem == -1) {
-		for(e = e_head; e <= e_tail; ++e) {
-			*e = *e << 1 ^ parity(*e & LF_POLY_EVEN) ^ !!(in & 4);
-			for(o = o_head; o <= o_tail; ++o, ++sl) {
-				sl->even = *o;
-				sl->odd = *e ^ parity(*o & LF_POLY_ODD);
-				sl[1].odd = sl[1].even = 0;
-			}
-		}
-		return sl;
-	}
-
-	for(i = 0; i < 4 && rem--; i++) {
-		extend_table(o_head, &o_tail, (oks >>= 1) & 1,
-			LF_POLY_EVEN << 1 | 1, LF_POLY_ODD << 1, 0);
-		if(o_head > o_tail)
-			return sl;
-
-		extend_table(e_head, &e_tail, (eks >>= 1) & 1,
-			LF_POLY_ODD, LF_POLY_EVEN << 1 | 1, (in >>= 2) & 3);
-		if(e_head > e_tail)
-			return sl;
-	}
-
-	quicksort(o_head, o_tail);
-	quicksort(e_head, e_tail);
-
-	while(o_tail >= o_head && e_tail >= e_head)
-		if(((*o_tail ^ *e_tail) >> 24) == 0) {
-			o_tail = binsearch(o_head, o = o_tail);
-			e_tail = binsearch(e_head, e = e_tail);
-			sl = recover(o_tail--, o, oks,
-				     e_tail--, e, eks, rem, sl, in);
-		}
-		else if(*o_tail > *e_tail)
-			o_tail = binsearch(o_head, o_tail) - 1;
-		else
-			e_tail = binsearch(e_head, e_tail) - 1;
-
-	return sl;
-}
-/** lfsr_recovery
- * recover the state of the lfsr given 32 bits of the keystream
- * additionally you can use the in parameter to specify the value
- * that was fed into the lfsr at the time the keystream was generated
- */
-struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
-{
-	struct Crypto1State *statelist;
-	uint32_t *odd_head = 0, *odd_tail = 0, oks = 0;
-	uint32_t *even_head = 0, *even_tail = 0, eks = 0;
-	int i;
-
-	for(i = 31; i >= 0; i -= 2)
-		oks = oks << 1 | BEBIT(ks2, i);
-	for(i = 30; i >= 0; i -= 2)
- 		eks = eks << 1 | BEBIT(ks2, i);
-
-	odd_head = odd_tail = malloc(sizeof(uint32_t) << 21);
-	even_head = even_tail = malloc(sizeof(uint32_t) << 21);
-	statelist =  malloc(sizeof(struct Crypto1State) << 18);
-	if(!odd_tail-- || !even_tail-- || !statelist)
-		goto out;
-
-	statelist->odd = statelist->even = 0;
-
-	for(i = 1 << 20; i >= 0; --i) {
-		if(filter(i) == (oks & 1))
-			*++odd_tail = i;
-		if(filter(i) == (eks & 1))
-			*++even_tail = i;
-	}
-
-	for(i = 0; i < 4; i++) {
-		extend_table_simple(odd_head,  &odd_tail, (oks >>= 1) & 1);
-		extend_table_simple(even_head, &even_tail, (eks >>= 1) & 1);
-	}
-
-	in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);
-	recover(odd_head, odd_tail, oks,
-		even_head, even_tail, eks, 11, statelist, in << 1);
-
-out:
-	free(odd_head);
-	free(even_head);
-	return statelist;
-}
-
-static const uint32_t S1[] = {     0x62141, 0x310A0, 0x18850, 0x0C428, 0x06214,
-	0x0310A, 0x85E30, 0xC69AD, 0x634D6, 0xB5CDE, 0xDE8DA, 0x6F46D, 0xB3C83,
-	0x59E41, 0xA8995, 0xD027F, 0x6813F, 0x3409F, 0x9E6FA};
-static const uint32_t S2[] = {  0x3A557B00, 0x5D2ABD80, 0x2E955EC0, 0x174AAF60,
-	0x0BA557B0, 0x05D2ABD8, 0x0449DE68, 0x048464B0, 0x42423258, 0x278192A8,
-	0x156042D0, 0x0AB02168, 0x43F89B30, 0x61FC4D98, 0x765EAD48, 0x7D8FDD20,
-	0x7EC7EE90, 0x7F63F748, 0x79117020};
-static const uint32_t T1[] = {
-	0x4F37D, 0x279BE, 0x97A6A, 0x4BD35, 0x25E9A, 0x12F4D, 0x097A6, 0x80D66,
-	0xC4006, 0x62003, 0xB56B4, 0x5AB5A, 0xA9318, 0xD0F39, 0x6879C, 0xB057B,
-	0x582BD, 0x2C15E, 0x160AF, 0x8F6E2, 0xC3DC4, 0xE5857, 0x72C2B, 0x39615,
-	0x98DBF, 0xC806A, 0xE0680, 0x70340, 0x381A0, 0x98665, 0x4C332, 0xA272C};
-static const uint32_t T2[] = {  0x3C88B810, 0x5E445C08, 0x2982A580, 0x14C152C0,
-	0x4A60A960, 0x253054B0, 0x52982A58, 0x2FEC9EA8, 0x1156C4D0, 0x08AB6268,
-	0x42F53AB0, 0x217A9D58, 0x161DC528, 0x0DAE6910, 0x46D73488, 0x25CB11C0,
-	0x52E588E0, 0x6972C470, 0x34B96238, 0x5CFC3A98, 0x28DE96C8, 0x12CFC0E0,
-	0x4967E070, 0x64B3F038, 0x74F97398, 0x7CDC3248, 0x38CE92A0, 0x1C674950,
-	0x0E33A4A8, 0x01B959D0, 0x40DCACE8, 0x26CEDDF0};
-static const uint32_t C1[] = { 0x846B5, 0x4235A, 0x211AD};
-static const uint32_t C2[] = { 0x1A822E0, 0x21A822E0, 0x21A822E0};
-/** Reverse 64 bits of keystream into possible cipher states
- * Variation mentioned in the paper. Somewhat optimized version
- */
-struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3)
-{
-	struct Crypto1State *statelist, *sl;
-	uint8_t oks[32], eks[32], hi[32];
-	uint32_t low = 0,  win = 0;
-	uint32_t *tail, table[1 << 16];
-	int i, j;
-
-	sl = statelist = malloc(sizeof(struct Crypto1State) << 4);
-	if(!sl)
-		return 0;
-	sl->odd = sl->even = 0;
-
-	for(i = 30; i >= 0; i -= 2) {
-		oks[i >> 1] = BIT(ks2, i ^ 24);
-		oks[16 + (i >> 1)] = BIT(ks3, i ^ 24);
-	}
-	for(i = 31; i >= 0; i -= 2) {
-		eks[i >> 1] = BIT(ks2, i ^ 24);
-		eks[16 + (i >> 1)] = BIT(ks3, i ^ 24);
-	}
-
-	for(i = 0xfffff; i >= 0; --i) {
-		if (filter(i) != oks[0])
-			continue;
-
-		*(tail = table) = i;
-		for(j = 1; tail >= table && j < 29; ++j)
-			extend_table_simple(table, &tail, oks[j]);
-
-		if(tail < table)
-			continue;
-
-		for(j = 0; j < 19; ++j)
-			low = low << 1 | parity(i & S1[j]);
-		for(j = 0; j < 32; ++j)
-			hi[j] = parity(i & T1[j]);
-
-		for(; tail >= table; --tail) {
-			for(j = 0; j < 3; ++j) {
-				*tail = *tail << 1;
-				*tail |= parity((i & C1[j]) ^ (*tail & C2[j]));
-				if(filter(*tail) != oks[29 + j])
-					goto continue2;
-			}
-
-			for(j = 0; j < 19; ++j)
-				win = win << 1 | parity(*tail & S2[j]);
-
-			win ^= low;
-			for(j = 0; j < 32; ++j) {
-				win = win << 1 ^ hi[j] ^ parity(*tail & T2[j]);
-				if(filter(win) != eks[j])
-					goto continue2;
-			}
-
-			*tail = *tail << 1 | parity(LF_POLY_EVEN & *tail);
-			sl->odd = *tail ^ parity(LF_POLY_ODD & win);
-			sl->even = win;
-			++sl;
-			sl->odd = sl->even = 0;
-			continue2:;
-		}
-	}
-	return statelist;
-}
-
-/** lfsr_rollback_bit
- * Rollback the shift register in order to get previous states
- */
-void lfsr_rollback_bit(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int out;
-
-	s->odd &= 0xffffff;
-	s->odd ^= (s->odd ^= s->even, s->even ^= s->odd);
-
-	out = s->even & 1;
-	out ^= LF_POLY_EVEN & (s->even >>= 1);
-	out ^= LF_POLY_ODD & s->odd;
-	out ^= !!in;
-	out ^= filter(s->odd) & !!fb;
-
-	s->even |= parity(out) << 23;
-}
-/** lfsr_rollback_byte
- * Rollback the shift register in order to get previous states
- */
-void lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int i;
-	for (i = 7; i >= 0; --i)
-		lfsr_rollback_bit(s, BEBIT(in, i), fb);
-}
-/** lfsr_rollback_word
- * Rollback the shift register in order to get previous states
- */
-void lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
-{
-	int i;
-	for (i = 31; i >= 0; --i)
-		lfsr_rollback_bit(s, BEBIT(in, i), fb);
-}
-
-/** nonce_distance
- * x,y valid tag nonces, then prng_successor(x, nonce_distance(x, y)) = y
- */
-static uint16_t *dist = 0;
-int nonce_distance(uint32_t from, uint32_t to)
-{
-	uint16_t x, i;
-	if(!dist) {
-		dist = malloc(2 << 16);
-		if(!dist)
-			return -1;
-		for (x = i = 1; i; ++i) {
-			dist[(x & 0xff) << 8 | x >> 8] = i;
-			x = x >> 1 | (x ^ x >> 2 ^ x >> 3 ^ x >> 5) << 15;
-		}
-	}
-	return (65535 + dist[to >> 16] - dist[from >> 16]) % 65535;
-}
-
-
-static uint32_t fastfwd[2][8] = {
-	{ 0, 0x4BC53, 0xECB1, 0x450E2, 0x25E29, 0x6E27A, 0x2B298, 0x60ECB},
-	{ 0, 0x1D962, 0x4BC53, 0x56531, 0xECB1, 0x135D3, 0x450E2, 0x58980}};
-
-
-/** lfsr_prefix_ks
- *
- * Is an exported helper function from the common prefix attack
- * Described in the "dark side" paper. It returns an -1 terminated array
- * of possible partial(21 bit) secret state.
- * The required keystream(ks) needs to contain the keystream that was used to
- * encrypt the NACK which is observed when varying only the 4 last bits of Nr
- * only correct iff [NR_3] ^ NR_3 does not depend on Nr_3
- */
-uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
-{
-	uint32_t *candidates = malloc(4 << 21);
-	uint32_t c,  entry;
-	int size, i;
-
-	if(!candidates)
-		return 0;
-
-	size = (1 << 21) - 1;
-	for(i = 0; i <= size; ++i)
-		candidates[i] = i;
-
-	for(c = 0;  c < 8; ++c)
-		for(i = 0;i <= size; ++i) {
-			entry = candidates[i] ^ fastfwd[isodd][c];
-
-			if(filter(entry >> 1) == BIT(ks[c], isodd))
-				if(filter(entry) == BIT(ks[c], isodd + 2))
-					continue;
-
-			candidates[i--] = candidates[size--];
-		}
-
-	candidates[size + 1] = -1;
-
-	return candidates;
-}
-
-/** brute_top
- * helper function which eliminates possible secret states using parity bits
- */
-static struct Crypto1State*
-brute_top(uint32_t prefix, uint32_t rresp, unsigned char parities[8][8],
-          uint32_t odd, uint32_t even, struct Crypto1State* sl)
-{
-	struct Crypto1State s;
-	uint32_t ks1, nr, ks2, rr, ks3, good, c;
-
-	for(c = 0; c < 8; ++c) {
-		s.odd = odd ^ fastfwd[1][c];
-		s.even = even ^ fastfwd[0][c];
-		
-		lfsr_rollback_bit(&s, 0, 0);
-		lfsr_rollback_bit(&s, 0, 0);
-		lfsr_rollback_bit(&s, 0, 0);
-		
-		lfsr_rollback_word(&s, 0, 0);
-		lfsr_rollback_word(&s, prefix | c << 5, 1);
-		
-		sl->odd = s.odd;
-		sl->even = s.even;
-	
-		ks1 = crypto1_word(&s, prefix | c << 5, 1);
-		ks2 = crypto1_word(&s,0,0);
-		ks3 = crypto1_word(&s, 0,0);
-		nr = ks1 ^ (prefix | c << 5);
-		rr = ks2 ^ rresp;
-
-		good = 1;
-		good &= parity(nr & 0x000000ff) ^ parities[c][3] ^ BIT(ks2, 24);
-		good &= parity(rr & 0xff000000) ^ parities[c][4] ^ BIT(ks2, 16);
-		good &= parity(rr & 0x00ff0000) ^ parities[c][5] ^ BIT(ks2,  8);
-		good &= parity(rr & 0x0000ff00) ^ parities[c][6] ^ BIT(ks2,  0);
-		good &= parity(rr & 0x000000ff) ^ parities[c][7] ^ BIT(ks3, 24);
-
-		if(!good)
-			return sl;
-	}
-
-	return ++sl;
-} 
-
-
-/** lfsr_common_prefix
- * Implentation of the common prefix attack.
- * Requires the 28 bit constant prefix used as reader nonce (pfx)
- * The reader response used (rr)
- * The keystream used to encrypt the observed NACK's (ks)
- * The parity bits (par)
- * It returns a zero terminated list of possible cipher states after the
- * tag nonce was fed in
- */
-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
-{
-	struct Crypto1State *statelist, *s;
-	uint32_t *odd, *even, *o, *e, top;
-
-	odd = lfsr_prefix_ks(ks, 1);
-	even = lfsr_prefix_ks(ks, 0);
-
-	statelist = malloc((sizeof *statelist) << 20);
-	if(!statelist || !odd || !even)
-                return 0;
-
-
-	s = statelist;
-	for(o = odd; *o != 0xffffffff; ++o)
-		for(e = even; *e != 0xffffffff; ++e)
-			for(top = 0; top < 64; ++top) {
-				*o = (*o & 0x1fffff) | (top << 21);
-				*e = (*e & 0x1fffff) | (top >> 3) << 21;
-				s = brute_top(pfx, rr, par, *o, *e, s);
-			}
-
-	s->odd = s->even = 0;
-
-	free(odd);
-	free(even);
-
-	return statelist;
-}

tools/nonce2key/crapto1.h

@@ -1,94 +0,0 @@
-/*  crapto1.h
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA  02110-1301, US$
-
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#ifndef CRAPTO1_INCLUDED
-#define CRAPTO1_INCLUDED
-#include <stdint.h>
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-struct Crypto1State {uint32_t odd, even;};
-struct Crypto1State* crypto1_create(uint64_t);
-void crypto1_destroy(struct Crypto1State*);
-void crypto1_get_lfsr(struct Crypto1State*, uint64_t*);
-uint8_t crypto1_bit(struct Crypto1State*, uint8_t, int);
-uint8_t crypto1_byte(struct Crypto1State*, uint8_t, int);
-uint32_t crypto1_word(struct Crypto1State*, uint32_t, int);
-uint32_t prng_successor(uint32_t x, uint32_t n);
-
-struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
-struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
-uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
-
-
-void lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
-void lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
-void lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb);
-int nonce_distance(uint32_t from, uint32_t to);
-#define FOREACH_VALID_NONCE(N, FILTER, FSIZE)\
-	uint32_t __n = 0,__M = 0, N = 0;\
-	int __i;\
-	for(; __n < 1 << 16; N = prng_successor(__M = ++__n, 16))\
-		for(__i = FSIZE - 1; __i >= 0; __i--)\
-			if(BIT(FILTER, __i) ^ parity(__M & 0xFF01))\
-				break;\
-			else if(__i)\
-				__M = prng_successor(__M, (__i == 7) ? 48 : 8);\
-			else 
-
-#define LF_POLY_ODD (0x29CE5C)
-#define LF_POLY_EVEN (0x870804)
-#define BIT(x, n) ((x) >> (n) & 1)
-#define BEBIT(x, n) BIT(x, (n) ^ 24)
-static inline int parity(uint32_t x)
-{
-#if !defined __i386__ || !defined __GNUC__
-	x ^= x >> 16;
-	x ^= x >> 8;
-	x ^= x >> 4;
-	return BIT(0x6996, x & 0xf);
-#else
-        asm(    "movl %1, %%eax\n"
-		"mov %%ax, %%cx\n"
-		"shrl $0x10, %%eax\n"
-		"xor %%ax, %%cx\n"
-                "xor %%ch, %%cl\n"
-                "setpo %%al\n"
-                "movzx %%al, %0\n": "=r"(x) : "r"(x): "eax","ecx");
-	return x;
-#endif
-}
-static inline int filter(uint32_t const x)
-{
-	uint32_t f;
-
-	f  = 0xf22c0 >> (x       & 0xf) & 16;
-	f |= 0x6c9c0 >> (x >>  4 & 0xf) &  8;
-	f |= 0x3c8b0 >> (x >>  8 & 0xf) &  4;
-	f |= 0x1e458 >> (x >> 12 & 0xf) &  2;
-	f |= 0x0d938 >> (x >> 16 & 0xf) &  1;
-	return BIT(0xEC57E80A, f);
-}
-#ifdef __cplusplus
-}
-#endif
-#endif

tools/nonce2key/crypto1.c

@@ -1,93 +0,0 @@
-/*  crypto1.c
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA  02110-1301, US
-
-    Copyright (C) 2008-2008 bla <blapost@gmail.com>
-*/
-#include "crapto1.h"
-#include <stdlib.h>
-
-#define SWAPENDIAN(x)\
-	(x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
-
-struct Crypto1State * crypto1_create(uint64_t key)
-{
-	struct Crypto1State *s = malloc(sizeof(*s));
-	int i;
-
-	for(i = 47;s && i > 0; i -= 2) {
-		s->odd  = s->odd  << 1 | BIT(key, (i - 1) ^ 7);
-		s->even = s->even << 1 | BIT(key, i ^ 7);
-	}
-	return s;
-}
-void crypto1_destroy(struct Crypto1State *state)
-{
-	free(state);
-}
-void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
-{
-	int i;
-	for(*lfsr = 0, i = 23; i >= 0; --i) {
-		*lfsr = *lfsr << 1 | BIT(state->odd, i ^ 3);
-		*lfsr = *lfsr << 1 | BIT(state->even, i ^ 3);
-	}
-}
-uint8_t crypto1_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
-{
-	uint32_t feedin;
-	uint8_t ret = filter(s->odd);
-
-	feedin  = ret & !!is_encrypted;
-	feedin ^= !!in;
-	feedin ^= LF_POLY_ODD & s->odd;
-	feedin ^= LF_POLY_EVEN & s->even;
-	s->even = s->even << 1 | parity(feedin);
-
-	s->odd ^= (s->odd ^= s->even, s->even ^= s->odd);
-
-	return ret;
-}
-uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
-{
-	uint8_t i, ret = 0;
-
-	for (i = 0; i < 8; ++i)
-		ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;
-
-	return ret;
-}
-uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
-{
-	uint32_t i, ret = 0;
-
-	for (i = 0; i < 4; ++i, in <<= 8)
-		ret = ret << 8 | crypto1_byte(s, in >> 24, is_encrypted);
-
-	return ret;
-}
-
-/* prng_successor
- * helper used to obscure the keystream during authentication
- */
-uint32_t prng_successor(uint32_t x, uint32_t n)
-{
-	SWAPENDIAN(x);
-	while(n--)
-		x = x >> 1 | (x >> 16 ^ x >> 18 ^ x >> 19 ^ x >> 21) << 31;
-
-	return SWAPENDIAN(x);
-}

tools/nonce2key/nonce2key.c

@@ -1,13 +1,13 @@
-#include "crapto1.h"
+#include "crapto1/crapto1.h"
 #include <inttypes.h>
 #include <stdio.h>
 typedef unsigned char byte_t;
 
 int main(const int argc, const char* argv[]) {
   struct Crypto1State *state;
-  uint32_t pos, uid, nt, nr, rr, nr_diff, ks1, ks2;
+  uint32_t pos, uid, nt, nr, rr, nr_diff;
   byte_t bt, i, ks3x[8], par[8][8];
-  uint64_t key, key_recovered;
+  uint64_t key_recovered;
   uint64_t par_info;
   uint64_t ks_info;
   nr = rr = 0;