mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-08-14 02:26:59 -07:00
speedup 'hf mf chk'
* add separate timeout for tag response to nr_ar * measure response time and use it for response timeout * don't drop field between keyblocks * some reformatting * some whitespace fixes
This commit is contained in:
pwpiwi
parent
5a03ea993f
commit
e0ca05575c
9 changed files with 175 additions and 153 deletions
|
|
@ -1270,12 +1270,12 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
|
|||
uint32_t ThisTransferTime = 0;
|
||||
|
||||
if (timing) {
|
||||
if(*timing == 0) { // Measure time
|
||||
if (*timing == 0) { // Measure time
|
||||
*timing = (GetCountSspClk() + 8) & 0xfffffff8;
|
||||
} else {
|
||||
PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
|
||||
}
|
||||
if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
|
||||
if (MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
|
||||
while (GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
|
||||
LastTimeProxToAirStart = *timing;
|
||||
} else {
|
||||
|
|
@ -1289,7 +1289,7 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
|
|||
|
||||
uint16_t c = 0;
|
||||
for (;;) {
|
||||
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
|
||||
if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
|
||||
AT91C_BASE_SSC->SSC_THR = cmd[c];
|
||||
c++;
|
||||
if(c >= len) {
|
||||
|
|
@ -1600,7 +1600,7 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receive
|
|||
|
||||
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
|
||||
b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
|
||||
if(ManchesterDecoding(b, offset, 0)) {
|
||||
if (ManchesterDecoding(b, offset, 0)) {
|
||||
NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
|
||||
return true;
|
||||
} else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
|
||||
|
|
@ -1617,7 +1617,7 @@ void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t
|
|||
|
||||
// Send command to tag
|
||||
TransmitFor14443a(ToSend, ToSendMax, timing);
|
||||
if(trigger)
|
||||
if (trigger)
|
||||
LED_A_ON();
|
||||
|
||||
// Log reader command in trace buffer
|
||||
|
|
@ -1660,6 +1660,7 @@ static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t
|
|||
int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
|
||||
{
|
||||
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return false;
|
||||
|
||||
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
|
||||
return Demod.len;
|
||||
}
|
||||
|
|
@ -1737,7 +1738,7 @@ int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, u
|
|||
int len;
|
||||
|
||||
// init card struct
|
||||
if(p_hi14a_card) {
|
||||
if (p_hi14a_card) {
|
||||
p_hi14a_card->uidlen = 0;
|
||||
memset(p_hi14a_card->uid, 0, 10);
|
||||
p_hi14a_card->ats_len = 0;
|
||||
|
|
@ -1747,7 +1748,7 @@ int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, u
|
|||
return 0;
|
||||
}
|
||||
|
||||
if(p_hi14a_card) {
|
||||
if (p_hi14a_card) {
|
||||
memcpy(p_hi14a_card->atqa, resp, 2);
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -52,4 +52,5 @@ extern int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *
|
|||
extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats);
|
||||
extern void iso14a_set_trigger(bool enable);
|
||||
extern void iso14a_set_timeout(uint32_t timeout);
|
||||
extern uint32_t iso14a_get_timeout(void);
|
||||
#endif /* __ISO14443A_H */
|
||||
|
|
|
|||
|
|
@ -87,7 +87,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
|
|||
break;
|
||||
};
|
||||
|
||||
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
|
||||
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
|
||||
break;
|
||||
};
|
||||
|
|
@ -244,7 +244,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
|
|||
}
|
||||
|
||||
|
||||
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
|
||||
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
|
||||
isOK = 0;
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
|
||||
}
|
||||
|
|
@ -407,7 +407,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
|
|||
break;
|
||||
};
|
||||
|
||||
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
|
||||
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
|
||||
break;
|
||||
};
|
||||
|
|
@ -705,7 +705,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
|
|||
}
|
||||
|
||||
uint32_t nt1;
|
||||
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
|
||||
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL, NULL)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
|
||||
continue;
|
||||
}
|
||||
|
|
@ -760,9 +760,8 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
|
|||
// MIFARE nested authentication.
|
||||
//
|
||||
//-----------------------------------------------------------------------------
|
||||
void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
|
||||
{
|
||||
// params
|
||||
void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) {
|
||||
|
||||
uint8_t blockNo = arg0 & 0xff;
|
||||
uint8_t keyType = (arg0 >> 8) & 0xff;
|
||||
uint8_t targetBlockNo = arg1 & 0xff;
|
||||
|
|
@ -771,7 +770,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
|
||||
ui64Key = bytes_to_num(datain, 6);
|
||||
|
||||
// variables
|
||||
uint16_t rtr, i, j, len;
|
||||
uint16_t davg;
|
||||
static uint16_t dmin, dmax;
|
||||
|
|
@ -788,11 +786,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
pcs = &mpcs;
|
||||
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
|
||||
|
||||
uint32_t auth1_time, auth2_time;
|
||||
uint32_t auth1_time, auth2_time, authentication_timeout = 0;
|
||||
static uint16_t delta_time;
|
||||
|
||||
LED_A_ON();
|
||||
LED_C_OFF();
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
||||
|
||||
// free eventually allocated BigBuf memory
|
||||
|
|
@ -816,26 +813,26 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
for (rtr = 0; rtr < 17; rtr++) {
|
||||
|
||||
// prepare next select. No need to power down the card.
|
||||
if(mifare_classic_halt(pcs, cuid)) {
|
||||
if (mifare_classic_halt(pcs, cuid)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
|
||||
rtr--;
|
||||
continue;
|
||||
}
|
||||
|
||||
// Test if the action was cancelled
|
||||
if(BUTTON_PRESS()) {
|
||||
if (BUTTON_PRESS()) {
|
||||
isOK = -2;
|
||||
break;
|
||||
}
|
||||
|
||||
if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
|
||||
if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
|
||||
rtr--;
|
||||
continue;
|
||||
};
|
||||
|
||||
auth1_time = 0;
|
||||
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
|
||||
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, NULL)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
|
||||
rtr--;
|
||||
continue;
|
||||
|
|
@ -846,7 +843,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
} else {
|
||||
auth2_time = 0;
|
||||
}
|
||||
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
|
||||
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
|
||||
rtr--;
|
||||
continue;
|
||||
|
|
@ -891,10 +888,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
LED_C_ON();
|
||||
|
||||
// get crypted nonces for target sector
|
||||
for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
|
||||
for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
|
||||
|
||||
target_nt[i] = 0;
|
||||
while(target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
|
||||
while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
|
||||
|
||||
// prepare next select. No need to power down the card.
|
||||
if(mifare_classic_halt(pcs, cuid)) {
|
||||
|
|
@ -903,19 +900,20 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
}
|
||||
|
||||
// break out of the loop on button press
|
||||
if(BUTTON_PRESS()) {
|
||||
if (BUTTON_PRESS()) {
|
||||
isOK = -2;
|
||||
break;
|
||||
}
|
||||
|
||||
if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
|
||||
if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
|
||||
continue;
|
||||
}
|
||||
|
||||
auth1_time = 0;
|
||||
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
|
||||
authentication_timeout = 0;
|
||||
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, &authentication_timeout)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
|
||||
continue;
|
||||
}
|
||||
|
||||
|
|
@ -972,12 +970,13 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
// ----------------------------- crypto1 destroy
|
||||
crypto1_destroy(pcs);
|
||||
|
||||
byte_t buf[4 + 4 * 4];
|
||||
uint8_t buf[4 + 4 * 4 + 4];
|
||||
memcpy(buf, &cuid, 4);
|
||||
memcpy(buf+4, &target_nt[0], 4);
|
||||
memcpy(buf+8, &target_ks[0], 4);
|
||||
memcpy(buf+12, &target_nt[1], 4);
|
||||
memcpy(buf+16, &target_ks[1], 4);
|
||||
memcpy(buf+20, &authentication_timeout, 4);
|
||||
|
||||
LED_B_ON();
|
||||
cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
|
||||
|
|
@ -989,62 +988,67 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
|
|||
LEDsoff();
|
||||
}
|
||||
|
||||
|
||||
//-----------------------------------------------------------------------------
|
||||
// MIFARE check keys. key count up to 85.
|
||||
//
|
||||
//-----------------------------------------------------------------------------
|
||||
void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
|
||||
{
|
||||
void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain) {
|
||||
|
||||
uint8_t blockNo = arg0 & 0xff;
|
||||
uint8_t keyType = (arg0 >> 8) & 0xff;
|
||||
uint8_t keyType = arg0 >> 8;
|
||||
bool clearTrace = arg1 & 0x01;
|
||||
bool multisectorCheck = arg1 & 0x02;
|
||||
uint8_t set14aTimeout = (arg1 >> 8) & 0xff;
|
||||
bool init = arg1 & 0x04;
|
||||
bool drop_field = arg1 & 0x08;
|
||||
uint32_t auth_timeout = arg1 >> 16;
|
||||
uint8_t keyCount = arg2;
|
||||
|
||||
LED_A_ON();
|
||||
|
||||
// clear debug level
|
||||
int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
|
||||
MF_DBGLEVEL = MF_DBG_NONE;
|
||||
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
||||
|
||||
if (init) {
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
|
||||
}
|
||||
|
||||
if (clearTrace) {
|
||||
clear_trace();
|
||||
}
|
||||
set_tracing(true);
|
||||
|
||||
if (set14aTimeout){
|
||||
iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe
|
||||
}
|
||||
// clear debug level. We are expecting lots of authentication failures...
|
||||
int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
|
||||
MF_DBGLEVEL = MF_DBG_NONE;
|
||||
|
||||
if (multisectorCheck) {
|
||||
TKeyIndex keyIndex = {{0}};
|
||||
uint8_t sectorCnt = blockNo;
|
||||
int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex);
|
||||
int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, &auth_timeout, OLD_MF_DBGLEVEL, &keyIndex);
|
||||
|
||||
if (res >= 0) {
|
||||
cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);
|
||||
} else {
|
||||
cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
|
||||
drop_field = true;
|
||||
}
|
||||
} else {
|
||||
int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL);
|
||||
int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
|
||||
|
||||
if (res > 0) {
|
||||
cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
|
||||
} else {
|
||||
cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
|
||||
drop_field = true;
|
||||
}
|
||||
}
|
||||
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LED_D_OFF();
|
||||
if (drop_field) {
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LED_D_OFF();
|
||||
}
|
||||
|
||||
// restore debug level
|
||||
MF_DBGLEVEL = OLD_MF_DBGLEVEL;
|
||||
|
||||
|
||||
LED_A_OFF();
|
||||
}
|
||||
|
||||
|
|
@ -1074,7 +1078,7 @@ void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data)
|
|||
|
||||
uint8_t block_number = 0;
|
||||
uint64_t key = bytes_to_num(data, 6);
|
||||
if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) {
|
||||
if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST, NULL)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
|
||||
break;
|
||||
}
|
||||
|
|
@ -1175,13 +1179,13 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
|
|||
for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
|
||||
ui64Key = emlGetKey(sectorNo, keyType);
|
||||
if (sectorNo == 0){
|
||||
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
|
||||
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
|
||||
isOK = false;
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
|
||||
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED, NULL)) {
|
||||
isOK = false;
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ extern void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *
|
|||
extern void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
|
||||
extern void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
|
||||
extern void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain);
|
||||
extern void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain);
|
||||
extern void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain);
|
||||
extern void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
|
||||
extern void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
|
||||
extern void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
|
||||
|
|
|
|||
|
|
@ -113,9 +113,7 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
|
|||
ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];
|
||||
par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos));
|
||||
}
|
||||
|
||||
ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);
|
||||
|
||||
} else {
|
||||
ReaderTransmit(dcmd, sizeof(dcmd), timing);
|
||||
}
|
||||
|
|
@ -143,18 +141,18 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
|
|||
return len;
|
||||
}
|
||||
|
||||
|
||||
// mifare classic commands
|
||||
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested)
|
||||
{
|
||||
return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL);
|
||||
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout) {
|
||||
|
||||
return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL, auth_timeout);
|
||||
}
|
||||
|
||||
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing)
|
||||
{
|
||||
// variables
|
||||
|
||||
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing, uint32_t *auth_timeout) {
|
||||
|
||||
int len;
|
||||
uint32_t pos;
|
||||
uint8_t tmp4[4];
|
||||
uint8_t par[1] = {0x00};
|
||||
byte_t nr[4];
|
||||
uint32_t nt, ntpp; // Supplied tag nonce
|
||||
|
|
@ -202,8 +200,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
|
|||
|
||||
// Generate (encrypted) nr+parity by loading it into the cipher (Nr)
|
||||
par[0] = 0;
|
||||
for (pos = 0; pos < 4; pos++)
|
||||
{
|
||||
for (pos = 0; pos < 4; pos++) {
|
||||
mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];
|
||||
par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));
|
||||
}
|
||||
|
|
@ -212,8 +209,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
|
|||
nt = prng_successor(nt,32);
|
||||
|
||||
// ar+parity
|
||||
for (pos = 4; pos < 8; pos++)
|
||||
{
|
||||
for (pos = 4; pos < 8; pos++) {
|
||||
nt = prng_successor(nt,8);
|
||||
mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);
|
||||
par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos));
|
||||
|
|
@ -223,17 +219,24 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
|
|||
ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
|
||||
|
||||
// Receive 4 byte tag answer
|
||||
uint32_t save_timeout = iso14a_get_timeout(); // save standard timeout
|
||||
if (auth_timeout && *auth_timeout) {
|
||||
iso14a_set_timeout(*auth_timeout); // set timeout for authentication response
|
||||
}
|
||||
uint32_t auth_timeout_start = GetCountSspClk();
|
||||
len = ReaderReceive(receivedAnswer, receivedAnswerPar);
|
||||
if (!len)
|
||||
{
|
||||
iso14a_set_timeout(save_timeout); // restore standard timeout
|
||||
if (!len) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");
|
||||
return 2;
|
||||
}
|
||||
if (auth_timeout && !*auth_timeout) { // measure time for future authentication response timeout
|
||||
*auth_timeout = (GetCountSspClk() - auth_timeout_start - (len * 9 + 2) * 8) / 8 + 1;
|
||||
}
|
||||
|
||||
memcpy(tmp4, receivedAnswer, 4);
|
||||
ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);
|
||||
ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0, 0);
|
||||
|
||||
if (ntpp != bytes_to_num(tmp4, 4)) {
|
||||
if (ntpp != bytes_to_num(receivedAnswer, 4)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response.");
|
||||
return 3;
|
||||
}
|
||||
|
|
@ -241,8 +244,8 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
|
|||
return 0;
|
||||
}
|
||||
|
||||
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData)
|
||||
{
|
||||
|
||||
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) {
|
||||
// variables
|
||||
int len;
|
||||
uint8_t bt[2];
|
||||
|
|
@ -811,7 +814,7 @@ int mifare_desfire_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
|
|||
//
|
||||
//-----------------------------------------------------------------------------
|
||||
// one key check
|
||||
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) {
|
||||
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
|
||||
|
||||
struct Crypto1State mpcs = {0, 0};
|
||||
struct Crypto1State *pcs;
|
||||
|
|
@ -820,7 +823,7 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
|
|||
// Iceman: use piwi's faster nonce collecting part in hardnested.
|
||||
if (*cascade_levels == 0) { // need a full select cycle to get the uid first
|
||||
iso14a_card_select_t card_info;
|
||||
if(!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {
|
||||
if (!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {
|
||||
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card");
|
||||
return 1;
|
||||
}
|
||||
|
|
@ -831,32 +834,25 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
|
|||
default: break;
|
||||
}
|
||||
} else { // no need for anticollision. We can directly select the card
|
||||
if(!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {
|
||||
if (!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {
|
||||
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card (UID) lvl=%d", *cascade_levels);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
if(mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
|
||||
// SpinDelayUs(AUTHENTICATION_TIMEOUT); // it not needs because mifare_classic_auth have timeout from iso14a_set_timeout()
|
||||
if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed
|
||||
return 2;
|
||||
} else {
|
||||
/* // let it be here. it like halt command, but maybe it will work in some strange cases
|
||||
uint8_t dummy_answer = 0;
|
||||
ReaderTransmit(&dummy_answer, 1, NULL);
|
||||
int timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
|
||||
// wait for the card to become ready again
|
||||
while(GetCountSspClk() < timeout) {};
|
||||
*/
|
||||
// it needs after success authentication
|
||||
mifare_classic_halt(pcs, *cuid);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
// multi key check
|
||||
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) {
|
||||
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
|
||||
|
||||
uint8_t uid[10];
|
||||
uint32_t cuid = 0;
|
||||
uint8_t cascade_levels = 0;
|
||||
|
|
@ -872,7 +868,7 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
|
|||
}
|
||||
|
||||
ui64Key = bytes_to_num(keys + i * 6, 6);
|
||||
int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, debugLevel);
|
||||
int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, auth_timeout, debugLevel);
|
||||
|
||||
// can't select
|
||||
if (res == 1) {
|
||||
|
|
@ -894,14 +890,16 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
|
|||
continue; // can't auth. wrong key.
|
||||
}
|
||||
|
||||
// successful authentication
|
||||
return i + 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
// multisector multikey check
|
||||
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex) {
|
||||
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex) {
|
||||
int res = 0;
|
||||
|
||||
// int clk = GetCountSspClk();
|
||||
|
|
@ -911,7 +909,7 @@ int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, u
|
|||
|
||||
int keyAB = keyType;
|
||||
do {
|
||||
res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, debugLevel);
|
||||
res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, auth_timeout, debugLevel);
|
||||
if (res < 0){
|
||||
return res;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@
|
|||
// code for work with mifare cards.
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
#ifndef __MIFAREUTIL_H
|
||||
#define __MIFAREUTIL_H
|
||||
#ifndef MIFAREUTIL_H__
|
||||
#define MIFAREUTIL_H__
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
|
|
@ -19,11 +19,11 @@
|
|||
#include "usb_cdc.h"
|
||||
|
||||
// mifare authentication
|
||||
#define CRYPT_NONE 0
|
||||
#define CRYPT_ALL 1
|
||||
#define CRYPT_REQUEST 2
|
||||
#define AUTH_FIRST 0
|
||||
#define AUTH_NESTED 2
|
||||
#define CRYPT_NONE 0
|
||||
#define CRYPT_ALL 1
|
||||
#define CRYPT_REQUEST 2
|
||||
#define AUTH_FIRST 0
|
||||
#define AUTH_NESTED 2
|
||||
|
||||
// reader voltage field detector
|
||||
#define MF_MINFIELDV 4000
|
||||
|
|
@ -42,10 +42,10 @@ int mifare_sendcmd(uint8_t cmd, uint8_t *data, uint8_t data_size, uint8_t* answe
|
|||
int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
|
||||
|
||||
// mifare classic
|
||||
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested);
|
||||
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing);
|
||||
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout);
|
||||
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing, uint32_t *auth_timeout);
|
||||
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
|
||||
int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid);
|
||||
int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid);
|
||||
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
|
||||
|
||||
// Ultralight/NTAG...
|
||||
|
|
@ -87,8 +87,8 @@ int emlCheckValBl(int blockNum);
|
|||
|
||||
// mifare check keys
|
||||
typedef uint8_t TKeyIndex[2][40];
|
||||
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel);
|
||||
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel);
|
||||
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex);
|
||||
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
|
||||
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
|
||||
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex);
|
||||
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -570,7 +570,7 @@ int CmdHF14AMfRestore(const char *Cmd)
|
|||
// Nested
|
||||
//----------------------------------------------
|
||||
|
||||
static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint8_t *timeout) {
|
||||
static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint16_t *timeout) {
|
||||
char ctmp3[4] = {0};
|
||||
int len = param_getlength(Cmd, indx);
|
||||
if (len > 0 && len < 4){
|
||||
|
|
@ -582,20 +582,19 @@ static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, boo
|
|||
|
||||
// slow and very slow
|
||||
if (ctmp3[0] == 's' || ctmp3[0] == 'S' || ctmp3[1] == 's' || ctmp3[1] == 'S') {
|
||||
*timeout = 11; // slow
|
||||
*timeout = MF_CHKKEYS_SLOWTIMEOUT; // slow
|
||||
|
||||
if (!paramS1 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) {
|
||||
*timeout = 53; // very slow
|
||||
*timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
|
||||
}
|
||||
if (paramS1 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) {
|
||||
*timeout = 53; // very slow
|
||||
*timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
int CmdHF14AMfNested(const char *Cmd)
|
||||
{
|
||||
int CmdHF14AMfNested(const char *Cmd) {
|
||||
int i, j, res, iterations;
|
||||
sector_t *e_sector = NULL;
|
||||
uint8_t blockNo = 0;
|
||||
|
|
@ -606,8 +605,8 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
uint8_t key[6] = {0, 0, 0, 0, 0, 0};
|
||||
uint8_t keyBlock[MifareDefaultKeysSize * 6];
|
||||
uint64_t key64 = 0;
|
||||
// timeout in units. (ms * 106)/10 or us*0.0106
|
||||
uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
|
||||
// timeout in units. (ms * 106) or us*0.106
|
||||
uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
|
||||
|
||||
bool autosearchKey = false;
|
||||
|
||||
|
|
@ -654,10 +653,10 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
if (param_getchar(Cmd, 1) == '*') {
|
||||
autosearchKey = true;
|
||||
|
||||
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a);
|
||||
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
|
||||
|
||||
PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us",
|
||||
SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);
|
||||
SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
|
||||
} else {
|
||||
blockNo = param_get8(Cmd, 1);
|
||||
|
||||
|
|
@ -676,7 +675,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
}
|
||||
|
||||
// check if we can authenticate to sector
|
||||
res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64);
|
||||
res = mfCheckKeys(blockNo, keyType, timeout14a, true, true, true, 1, key, &key64);
|
||||
if (res) {
|
||||
PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
|
||||
return 3;
|
||||
|
|
@ -694,19 +693,19 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
if (ctmp != 'A' && ctmp != 'a')
|
||||
trgKeyType = 1;
|
||||
|
||||
parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &btimeout14a);
|
||||
parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &timeout14a);
|
||||
} else {
|
||||
parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &btimeout14a);
|
||||
parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &timeout14a);
|
||||
}
|
||||
|
||||
PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
|
||||
SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);
|
||||
SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
|
||||
}
|
||||
|
||||
// one-sector nested
|
||||
if (cmdp == 'o') { // ------------------------------------ one sector working
|
||||
PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
|
||||
int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
|
||||
int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, trgBlockNo, trgKeyType, keyBlock, true);
|
||||
if (isOK < 0) {
|
||||
switch (isOK) {
|
||||
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
|
||||
|
|
@ -754,7 +753,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
}
|
||||
|
||||
PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
|
||||
mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, MifareDefaultKeysSize, keyBlock, e_sector);
|
||||
mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, MifareDefaultKeysSize, keyBlock, e_sector);
|
||||
|
||||
// get known key from array
|
||||
bool keyFound = false;
|
||||
|
|
@ -791,7 +790,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) {
|
||||
if (e_sector[sectorNo].foundKey[trgKeyType]) continue;
|
||||
PrintAndLog("-----------------------------------------------");
|
||||
int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);
|
||||
int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);
|
||||
if(isOK < 0) {
|
||||
switch (isOK) {
|
||||
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
|
||||
|
|
@ -814,7 +813,7 @@ int CmdHF14AMfNested(const char *Cmd)
|
|||
e_sector[sectorNo].Key[trgKeyType] = key64;
|
||||
|
||||
// try to check this key as a key to the other sectors
|
||||
mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, 1, keyBlock, e_sector);
|
||||
mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, 1, keyBlock, e_sector);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1049,8 +1048,8 @@ int CmdHF14AMfNestedHard(const char *Cmd)
|
|||
}
|
||||
|
||||
|
||||
int CmdHF14AMfChk(const char *Cmd)
|
||||
{
|
||||
int CmdHF14AMfChk(const char *Cmd) {
|
||||
|
||||
if (strlen(Cmd)<3) {
|
||||
PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]");
|
||||
PrintAndLog(" * - all sectors");
|
||||
|
|
@ -1081,7 +1080,7 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
uint8_t keyType = 0;
|
||||
uint64_t key64 = 0;
|
||||
// timeout in units. (ms * 106)/10 or us*0.0106
|
||||
uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
|
||||
uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
|
||||
bool param3InUse = false;
|
||||
bool transferToEml = 0;
|
||||
bool createDumpFile = 0;
|
||||
|
|
@ -1134,7 +1133,7 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
};
|
||||
}
|
||||
|
||||
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a);
|
||||
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
|
||||
|
||||
if (singleBlock & createDumpFile) {
|
||||
PrintAndLog (" block key check (<block no>) and write to dump file (d) combination is not supported ");
|
||||
|
|
@ -1142,10 +1141,10 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
return 1;
|
||||
}
|
||||
|
||||
param3InUse = transferToEml | createDumpFile | (btimeout14a != MF_CHKKEYS_DEFTIMEOUT);
|
||||
param3InUse = transferToEml | createDumpFile | (timeout14a != MF_CHKKEYS_DEFTIMEOUT);
|
||||
|
||||
PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
|
||||
SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);
|
||||
SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
|
||||
|
||||
for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) {
|
||||
if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {
|
||||
|
|
@ -1251,7 +1250,9 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
for (uint32_t c = 0; c < keycnt; c += max_keys) {
|
||||
|
||||
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
|
||||
res = mfCheckKeysSec(SectorsCnt, keyType, btimeout14a, clearTraceLog, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
|
||||
bool init = (c == 0);
|
||||
bool drop_field = (c + size == keycnt);
|
||||
res = mfCheckKeysSec(SectorsCnt, keyType, timeout14a, clearTraceLog, init, drop_field, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
|
||||
clearTraceLog = false;
|
||||
|
||||
if (res != 1) {
|
||||
|
|
@ -1272,7 +1273,9 @@ int CmdHF14AMfChk(const char *Cmd)
|
|||
for (uint32_t c = 0; c < keycnt; c += max_keys) {
|
||||
|
||||
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
|
||||
res = mfCheckKeys(blockNo, keyAB & 0x01, true, size, &keyBlock[6 * c], &key64);
|
||||
bool init = (c == 0);
|
||||
bool drop_field = (c + size == keycnt);
|
||||
res = mfCheckKeys(blockNo, keyAB & 0x01, timeout14a, true, init, drop_field, size, &keyBlock[6 * c], &key64);
|
||||
clearTraceLog = false;
|
||||
|
||||
if (res != 1) {
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@
|
|||
|
||||
#include "mifarehost.h"
|
||||
|
||||
#include <inttypes.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
|
@ -115,8 +116,7 @@ static uint32_t nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint32_t ar, u
|
|||
}
|
||||
|
||||
|
||||
int mfDarkside(uint64_t *key)
|
||||
{
|
||||
int mfDarkside(uint64_t *key) {
|
||||
uint32_t uid = 0;
|
||||
uint32_t nt = 0, nr = 0, ar = 0;
|
||||
uint64_t par_list = 0, ks_list = 0;
|
||||
|
|
@ -208,7 +208,9 @@ int mfDarkside(uint64_t *key)
|
|||
num_to_bytes(keylist[i*max_keys + j], 6, keyBlock+(j*6));
|
||||
}
|
||||
}
|
||||
if (!mfCheckKeys(0, 0, false, size, keyBlock, key)) {
|
||||
bool init = (i == 0);
|
||||
bool drop_field = (i + size == keycount);
|
||||
if (!mfCheckKeys(0, 0, 0, false, init, drop_field, size, keyBlock, key)) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
|
@ -228,11 +230,13 @@ int mfDarkside(uint64_t *key)
|
|||
}
|
||||
|
||||
|
||||
int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){
|
||||
int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key) {
|
||||
|
||||
*key = -1;
|
||||
bool multisectorCheck = false;
|
||||
uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
|
||||
|
||||
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), clear_trace, keycnt}};
|
||||
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
|
||||
memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
|
||||
SendCommand(&c);
|
||||
|
||||
|
|
@ -251,14 +255,18 @@ int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t key
|
|||
return 0;
|
||||
}
|
||||
|
||||
int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector){
|
||||
|
||||
int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector){
|
||||
|
||||
uint8_t keyPtr = 0;
|
||||
|
||||
if (e_sector == NULL)
|
||||
return -1;
|
||||
|
||||
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), (clear_trace | 0x02)|((timeout14a & 0xff) << 8), keycnt}};
|
||||
bool multisectorCheck = true;
|
||||
uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
|
||||
|
||||
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
|
||||
memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
|
||||
SendCommand(&c);
|
||||
|
||||
|
|
@ -328,8 +336,7 @@ __attribute__((force_align_arg_pointer))
|
|||
}
|
||||
|
||||
|
||||
int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate)
|
||||
{
|
||||
int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) {
|
||||
uint32_t i, j;
|
||||
uint32_t uid;
|
||||
UsbCommand resp;
|
||||
|
|
@ -379,6 +386,10 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
|
|||
memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
|
||||
}
|
||||
|
||||
uint32_t authentication_timeout;
|
||||
memcpy(&authentication_timeout, resp.d.asBytes + 20, 4);
|
||||
PrintAndLog("Setting authentication timeout to %" PRIu32 "us", authentication_timeout * 1000 / 106);
|
||||
|
||||
if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1)
|
||||
num_unique_nonces = 1;
|
||||
else
|
||||
|
|
@ -474,7 +485,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
|
|||
start_time = msclock();
|
||||
next_print_time = start_time + 1 * 1000;
|
||||
// The list may still contain several key candidates. Test each of them with mfCheckKeys
|
||||
for (i = 0; i < statelists[0].len; i+=max_keys) {
|
||||
for (i = 0; i < statelists[0].len; i += max_keys) {
|
||||
if (next_print_time <= msclock()) {
|
||||
brute_force_per_second = ((float)i) / (((float)(msclock() - start_time)) / 1000.0);
|
||||
brute_force_time = ((float)(statelists[0].len - i)) / brute_force_per_second;
|
||||
|
|
@ -491,7 +502,10 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
|
|||
}
|
||||
|
||||
key64 = 0;
|
||||
isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, true, max_keys, keyBlock, &key64);
|
||||
|
||||
bool init = (i == 0);
|
||||
bool drop_field = (i + max_keys == statelists[0].len);
|
||||
isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, authentication_timeout, true, init, drop_field, max_keys, keyBlock, &key64);
|
||||
|
||||
if (isOK == 1) { // timeout
|
||||
isOK = -1;
|
||||
|
|
|
|||
|
|
@ -8,8 +8,8 @@
|
|||
// High frequency ISO14443A commands
|
||||
//-----------------------------------------------------------------------------
|
||||
|
||||
#ifndef MIFAREHOST_H
|
||||
#define MIFAREHOST_H
|
||||
#ifndef MIFAREHOST_H__
|
||||
#define MIFAREHOST_H__
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdbool.h>
|
||||
|
|
@ -17,18 +17,19 @@
|
|||
#include "util.h"
|
||||
|
||||
// defaults
|
||||
// timeout in units. (ms * 106)/10 or us*0.0106
|
||||
// 5 == 500us
|
||||
#define MF_CHKKEYS_DEFTIMEOUT 5
|
||||
// timeout in units. ms * 106 or us * 0.106
|
||||
#define MF_CHKKEYS_DEFTIMEOUT 50 // 0.47ms
|
||||
#define MF_CHKKEYS_SLOWTIMEOUT 106 // 1ms
|
||||
#define MF_CHKKEYS_VERYSLOWTIMEOUT 530 // 5ms
|
||||
|
||||
// mfCSetBlock work flags
|
||||
#define CSETBLOCK_UID 0x01
|
||||
#define CSETBLOCK_WUPC 0x02
|
||||
#define CSETBLOCK_HALT 0x04
|
||||
#define CSETBLOCK_INIT_FIELD 0x08
|
||||
#define CSETBLOCK_RESET_FIELD 0x10
|
||||
#define CSETBLOCK_SINGLE_OPER 0x1F
|
||||
#define CSETBLOCK_MAGIC_1B 0x40
|
||||
#define CSETBLOCK_UID 0x01
|
||||
#define CSETBLOCK_WUPC 0x02
|
||||
#define CSETBLOCK_HALT 0x04
|
||||
#define CSETBLOCK_INIT_FIELD 0x08
|
||||
#define CSETBLOCK_RESET_FIELD 0x10
|
||||
#define CSETBLOCK_SINGLE_OPER 0x1F
|
||||
#define CSETBLOCK_MAGIC_1B 0x40
|
||||
|
||||
typedef struct {
|
||||
uint64_t Key[2];
|
||||
|
|
@ -38,9 +39,9 @@ typedef struct {
|
|||
extern char logHexFileName[FILE_PATH_SIZE];
|
||||
|
||||
extern int mfDarkside(uint64_t *key);
|
||||
extern int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
|
||||
extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t *keyBlock, uint64_t *key);
|
||||
extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
|
||||
extern int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
|
||||
extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t *keyBlock, uint64_t *key);
|
||||
extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
|
||||
|
||||
extern int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data);
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue