github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-08-19 12:59:44 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

speedup 'hf mf chk'

Browse source 
* add separate timeout for tag response to nr_ar
* measure response time and use it for response timeout
* don't drop field between keyblocks
* some reformatting
* some whitespace fixes
This commit is contained in:
pwpiwi 2019-12-19 18:38:38 +01:00
commit e0ca05575c
9 changed files with 175 additions and 153 deletions
Download patch file Download diff file Expand all files Collapse all files

1
armsrc/iso14443a.c
View file

@ -1660,6 +1660,7 @@ static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t
int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity) int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
{ {
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return false; if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return false;
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false); LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
return Demod.len; return Demod.len;
} }

1
armsrc/iso14443a.h
View file

@ -52,4 +52,5 @@ extern int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *
extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats); extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats);
extern void iso14a_set_trigger(bool enable); extern void iso14a_set_trigger(bool enable);
extern void iso14a_set_timeout(uint32_t timeout); extern void iso14a_set_timeout(uint32_t timeout);
extern uint32_t iso14a_get_timeout(void);
#endif /* __ISO14443A_H */ #endif /* __ISO14443A_H */

64
armsrc/mifarecmd.c
View file

@ -87,7 +87,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
break; break;
}; };
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) { if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
break; break;
}; };
@ -244,7 +244,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
} }
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) { if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
isOK = 0; isOK = 0;
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
} }
@ -407,7 +407,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
break; break;
}; };
if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) { if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
break; break;
}; };
@ -705,7 +705,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
} }
uint32_t nt1; uint32_t nt1;
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) { if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error"); if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
continue; continue;
} }
@ -760,9 +760,8 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
// MIFARE nested authentication. // MIFARE nested authentication.
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) {
{
// params
uint8_t blockNo = arg0 & 0xff; uint8_t blockNo = arg0 & 0xff;
uint8_t keyType = (arg0 >> 8) & 0xff; uint8_t keyType = (arg0 >> 8) & 0xff;
uint8_t targetBlockNo = arg1 & 0xff; uint8_t targetBlockNo = arg1 & 0xff;
@ -771,7 +770,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
ui64Key = bytes_to_num(datain, 6); ui64Key = bytes_to_num(datain, 6);
// variables
uint16_t rtr, i, j, len; uint16_t rtr, i, j, len;
uint16_t davg; uint16_t davg;
static uint16_t dmin, dmax; static uint16_t dmin, dmax;
@ -788,11 +786,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
pcs = &mpcs; pcs = &mpcs;
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
uint32_t auth1_time, auth2_time; uint32_t auth1_time, auth2_time, authentication_timeout = 0;
static uint16_t delta_time; static uint16_t delta_time;
LED_A_ON(); LED_A_ON();
LED_C_OFF();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
// free eventually allocated BigBuf memory // free eventually allocated BigBuf memory
@ -835,7 +832,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
}; };
auth1_time = 0; auth1_time = 0;
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) { if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
rtr--; rtr--;
continue; continue;
@ -846,7 +843,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
} else { } else {
auth2_time = 0; auth2_time = 0;
} }
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) { if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
rtr--; rtr--;
continue; continue;
@ -914,7 +911,8 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
} }
auth1_time = 0; auth1_time = 0;
if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) { authentication_timeout = 0;
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, &authentication_timeout)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error"); if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
continue; continue;
} }
@ -972,12 +970,13 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
// ----------------------------- crypto1 destroy // ----------------------------- crypto1 destroy
crypto1_destroy(pcs); crypto1_destroy(pcs);
byte_t buf[4 + 4 * 4]; uint8_t buf[4 + 4 * 4 + 4];
memcpy(buf, &cuid, 4); memcpy(buf, &cuid, 4);
memcpy(buf+4, &target_nt[0], 4); memcpy(buf+4, &target_nt[0], 4);
memcpy(buf+8, &target_ks[0], 4); memcpy(buf+8, &target_ks[0], 4);
memcpy(buf+12, &target_nt[1], 4); memcpy(buf+12, &target_nt[1], 4);
memcpy(buf+16, &target_ks[1], 4); memcpy(buf+16, &target_ks[1], 4);
memcpy(buf+20, &authentication_timeout, 4);
LED_B_ON(); LED_B_ON();
cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf)); cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
@ -989,58 +988,63 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
LEDsoff(); LEDsoff();
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// MIFARE check keys. key count up to 85. // MIFARE check keys. key count up to 85.
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain) void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain) {
{
uint8_t blockNo = arg0 & 0xff; uint8_t blockNo = arg0 & 0xff;
uint8_t keyType = (arg0 >> 8) & 0xff; uint8_t keyType = arg0 >> 8;
bool clearTrace = arg1 & 0x01; bool clearTrace = arg1 & 0x01;
bool multisectorCheck = arg1 & 0x02; bool multisectorCheck = arg1 & 0x02;
uint8_t set14aTimeout = (arg1 >> 8) & 0xff; bool init = arg1 & 0x04;
bool drop_field = arg1 & 0x08;
uint32_t auth_timeout = arg1 >> 16;
uint8_t keyCount = arg2; uint8_t keyCount = arg2;
LED_A_ON(); LED_A_ON();
// clear debug level if (init) {
int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
MF_DBGLEVEL = MF_DBG_NONE;
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
}
if (clearTrace) { if (clearTrace) {
clear_trace(); clear_trace();
} }
set_tracing(true); set_tracing(true);
if (set14aTimeout){ // clear debug level. We are expecting lots of authentication failures...
iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
} MF_DBGLEVEL = MF_DBG_NONE;
if (multisectorCheck) { if (multisectorCheck) {
TKeyIndex keyIndex = {{0}}; TKeyIndex keyIndex = {{0}};
uint8_t sectorCnt = blockNo; uint8_t sectorCnt = blockNo;
int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex); int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, &auth_timeout, OLD_MF_DBGLEVEL, &keyIndex);
if (res >= 0) { if (res >= 0) {
cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80); cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);
} else { } else {
cmd_send(CMD_ACK, 0, res, 0, NULL, 0); cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
drop_field = true;
} }
} else { } else {
int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL); int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
if (res > 0) { if (res > 0) {
cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6); cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
} else { } else {
cmd_send(CMD_ACK, 0, res, 0, NULL, 0); cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
drop_field = true;
} }
} }
if (drop_field) {
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF(); LED_D_OFF();
}
// restore debug level // restore debug level
MF_DBGLEVEL = OLD_MF_DBGLEVEL; MF_DBGLEVEL = OLD_MF_DBGLEVEL;
@ -1074,7 +1078,7 @@ void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data)
uint8_t block_number = 0; uint8_t block_number = 0;
uint64_t key = bytes_to_num(data, 6); uint64_t key = bytes_to_num(data, 6);
if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) { if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error"); if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
break; break;
} }
@ -1175,13 +1179,13 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) { for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
ui64Key = emlGetKey(sectorNo, keyType); ui64Key = emlGetKey(sectorNo, keyType);
if (sectorNo == 0){ if (sectorNo == 0){
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) { if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
isOK = false; isOK = false;
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo); if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
break; break;
} }
} else { } else {
if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) { if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED, NULL)) {
isOK = false; isOK = false;
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo); if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
break; break;

2
armsrc/mifarecmd.h
View file

@ -25,7 +25,7 @@ extern void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *
extern void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain); extern void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
extern void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
extern void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain); extern void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain);
extern void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain); extern void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain);
extern void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
extern void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
extern void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); extern void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);

66
armsrc/mifareutil.c
View file

@ -113,9 +113,7 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos]; ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];
par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos)); par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos));
} }
ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing); ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);
} else { } else {
ReaderTransmit(dcmd, sizeof(dcmd), timing); ReaderTransmit(dcmd, sizeof(dcmd), timing);
} }
@ -143,18 +141,18 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
return len; return len;
} }
// mifare classic commands // mifare classic commands
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested) int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout) {
{
return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL); return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL, auth_timeout);
} }
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing)
{ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing, uint32_t *auth_timeout) {
// variables
int len; int len;
uint32_t pos; uint32_t pos;
uint8_t tmp4[4];
uint8_t par[1] = {0x00}; uint8_t par[1] = {0x00};
byte_t nr[4]; byte_t nr[4];
uint32_t nt, ntpp; // Supplied tag nonce uint32_t nt, ntpp; // Supplied tag nonce
@ -202,8 +200,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
// Generate (encrypted) nr+parity by loading it into the cipher (Nr) // Generate (encrypted) nr+parity by loading it into the cipher (Nr)
par[0] = 0; par[0] = 0;
for (pos = 0; pos < 4; pos++) for (pos = 0; pos < 4; pos++) {
{
mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos]; mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];
par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos)); par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));
} }
@ -212,8 +209,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
nt = prng_successor(nt,32); nt = prng_successor(nt,32);
// ar+parity // ar+parity
for (pos = 4; pos < 8; pos++) for (pos = 4; pos < 8; pos++) {
{
nt = prng_successor(nt,8); nt = prng_successor(nt,8);
mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff); mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);
par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos)); par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos));
@ -223,17 +219,24 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL); ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
// Receive 4 byte tag answer // Receive 4 byte tag answer
uint32_t save_timeout = iso14a_get_timeout(); // save standard timeout
if (auth_timeout && *auth_timeout) {
iso14a_set_timeout(*auth_timeout); // set timeout for authentication response
}
uint32_t auth_timeout_start = GetCountSspClk();
len = ReaderReceive(receivedAnswer, receivedAnswerPar); len = ReaderReceive(receivedAnswer, receivedAnswerPar);
if (!len) iso14a_set_timeout(save_timeout); // restore standard timeout
{ if (!len) {
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout."); if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");
return 2; return 2;
} }
if (auth_timeout && !*auth_timeout) { // measure time for future authentication response timeout
*auth_timeout = (GetCountSspClk() - auth_timeout_start - (len * 9 + 2) * 8) / 8 + 1;
}
memcpy(tmp4, receivedAnswer, 4);
ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0, 0); ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0, 0);
if (ntpp != bytes_to_num(tmp4, 4)) { if (ntpp != bytes_to_num(receivedAnswer, 4)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response."); if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response.");
return 3; return 3;
} }
@ -241,8 +244,8 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
return 0; return 0;
} }
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData)
{ int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) {
// variables // variables
int len; int len;
uint8_t bt[2]; uint8_t bt[2];
@ -811,7 +814,7 @@ int mifare_desfire_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
// //
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// one key check // one key check
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) { int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs; struct Crypto1State *pcs;
@ -837,26 +840,19 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
} }
} }
if(mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) { if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed
// SpinDelayUs(AUTHENTICATION_TIMEOUT); // it not needs because mifare_classic_auth have timeout from iso14a_set_timeout()
return 2; return 2;
} else { } else {
/* // let it be here. it like halt command, but maybe it will work in some strange cases
uint8_t dummy_answer = 0;
ReaderTransmit(&dummy_answer, 1, NULL);
int timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
// wait for the card to become ready again
while(GetCountSspClk() < timeout) {};
*/
// it needs after success authentication
mifare_classic_halt(pcs, *cuid); mifare_classic_halt(pcs, *cuid);
} }
return 0; return 0;
} }
// multi key check // multi key check
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) { int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
uint8_t uid[10]; uint8_t uid[10];
uint32_t cuid = 0; uint32_t cuid = 0;
uint8_t cascade_levels = 0; uint8_t cascade_levels = 0;
@ -872,7 +868,7 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
} }
ui64Key = bytes_to_num(keys + i * 6, 6); ui64Key = bytes_to_num(keys + i * 6, 6);
int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, debugLevel); int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, auth_timeout, debugLevel);
// can't select // can't select
if (res == 1) { if (res == 1) {
@ -894,14 +890,16 @@ int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t
continue; // can't auth. wrong key. continue; // can't auth. wrong key.
} }
// successful authentication
return i + 1; return i + 1;
} }
return 0; return 0;
} }
// multisector multikey check // multisector multikey check
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex) { int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex) {
int res = 0; int res = 0;
// int clk = GetCountSspClk(); // int clk = GetCountSspClk();
@ -911,7 +909,7 @@ int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, u
int keyAB = keyType; int keyAB = keyType;
do { do {
res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, debugLevel); res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, auth_timeout, debugLevel);
if (res < 0){ if (res < 0){
return res; return res;
} }

14
armsrc/mifareutil.h
View file

@ -9,8 +9,8 @@
// code for work with mifare cards. // code for work with mifare cards.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
#ifndef __MIFAREUTIL_H #ifndef MIFAREUTIL_H__
#define __MIFAREUTIL_H #define MIFAREUTIL_H__
#include <stdint.h> #include <stdint.h>
#include <stdbool.h> #include <stdbool.h>
@ -42,8 +42,8 @@ int mifare_sendcmd(uint8_t cmd, uint8_t *data, uint8_t data_size, uint8_t* answe
int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing); int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
// mifare classic // mifare classic
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested); int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout);
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing); int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing, uint32_t *auth_timeout);
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid); int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid);
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
@ -87,8 +87,8 @@ int emlCheckValBl(int blockNum);
// mifare check keys // mifare check keys
typedef uint8_t TKeyIndex[2][40]; typedef uint8_t TKeyIndex[2][40];
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel); int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel); int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex); int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex);
#endif #endif

55
client/cmdhfmf.c
View file

@ -570,7 +570,7 @@ int CmdHF14AMfRestore(const char *Cmd)
// Nested // Nested
//---------------------------------------------- //----------------------------------------------
static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint8_t *timeout) { static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint16_t *timeout) {
char ctmp3[4] = {0}; char ctmp3[4] = {0};
int len = param_getlength(Cmd, indx); int len = param_getlength(Cmd, indx);
if (len > 0 && len < 4){ if (len > 0 && len < 4){
@ -582,20 +582,19 @@ static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, boo
// slow and very slow // slow and very slow
if (ctmp3[0] == 's' || ctmp3[0] == 'S' || ctmp3[1] == 's' || ctmp3[1] == 'S') { if (ctmp3[0] == 's' || ctmp3[0] == 'S' || ctmp3[1] == 's' || ctmp3[1] == 'S') {
*timeout = 11; // slow *timeout = MF_CHKKEYS_SLOWTIMEOUT; // slow
if (!paramS1 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) { if (!paramS1 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) {
*timeout = 53; // very slow *timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
} }
if (paramS1 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) { if (paramS1 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) {
*timeout = 53; // very slow *timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow
} }
} }
} }
} }
int CmdHF14AMfNested(const char *Cmd) int CmdHF14AMfNested(const char *Cmd) {
{
int i, j, res, iterations; int i, j, res, iterations;
sector_t *e_sector = NULL; sector_t *e_sector = NULL;
uint8_t blockNo = 0; uint8_t blockNo = 0;
@ -606,8 +605,8 @@ int CmdHF14AMfNested(const char *Cmd)
uint8_t key[6] = {0, 0, 0, 0, 0, 0}; uint8_t key[6] = {0, 0, 0, 0, 0, 0};
uint8_t keyBlock[MifareDefaultKeysSize * 6]; uint8_t keyBlock[MifareDefaultKeysSize * 6];
uint64_t key64 = 0; uint64_t key64 = 0;
// timeout in units. (ms * 106)/10 or us*0.0106 // timeout in units. (ms * 106) or us*0.106
uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
bool autosearchKey = false; bool autosearchKey = false;
@ -654,10 +653,10 @@ int CmdHF14AMfNested(const char *Cmd)
if (param_getchar(Cmd, 1) == '*') { if (param_getchar(Cmd, 1) == '*') {
autosearchKey = true; autosearchKey = true;
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us", PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us",
SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106); SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
} else { } else {
blockNo = param_get8(Cmd, 1); blockNo = param_get8(Cmd, 1);
@ -676,7 +675,7 @@ int CmdHF14AMfNested(const char *Cmd)
} }
// check if we can authenticate to sector // check if we can authenticate to sector
res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64); res = mfCheckKeys(blockNo, keyType, timeout14a, true, true, true, 1, key, &key64);
if (res) { if (res) {
PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6)); PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
return 3; return 3;
@ -694,19 +693,19 @@ int CmdHF14AMfNested(const char *Cmd)
if (ctmp != 'A' && ctmp != 'a') if (ctmp != 'A' && ctmp != 'a')
trgKeyType = 1; trgKeyType = 1;
parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &timeout14a);
} else { } else {
parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &timeout14a);
} }
PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us", PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106); SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
} }
// one-sector nested // one-sector nested
if (cmdp == 'o') { // ------------------------------------ one sector working if (cmdp == 'o') { // ------------------------------------ one sector working
PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A'); PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');
int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true); int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, trgBlockNo, trgKeyType, keyBlock, true);
if (isOK < 0) { if (isOK < 0) {
switch (isOK) { switch (isOK) {
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
@ -754,7 +753,7 @@ int CmdHF14AMfNested(const char *Cmd)
} }
PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt); PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);
mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, MifareDefaultKeysSize, keyBlock, e_sector); mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, MifareDefaultKeysSize, keyBlock, e_sector);
// get known key from array // get known key from array
bool keyFound = false; bool keyFound = false;
@ -791,7 +790,7 @@ int CmdHF14AMfNested(const char *Cmd)
for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) { for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) {
if (e_sector[sectorNo].foundKey[trgKeyType]) continue; if (e_sector[sectorNo].foundKey[trgKeyType]) continue;
PrintAndLog("-----------------------------------------------"); PrintAndLog("-----------------------------------------------");
int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate); int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);
if(isOK < 0) { if(isOK < 0) {
switch (isOK) { switch (isOK) {
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break; case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;
@ -814,7 +813,7 @@ int CmdHF14AMfNested(const char *Cmd)
e_sector[sectorNo].Key[trgKeyType] = key64; e_sector[sectorNo].Key[trgKeyType] = key64;
// try to check this key as a key to the other sectors // try to check this key as a key to the other sectors
mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, 1, keyBlock, e_sector); mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, 1, keyBlock, e_sector);
} }
} }
} }
@ -1049,8 +1048,8 @@ int CmdHF14AMfNestedHard(const char *Cmd)
} }
int CmdHF14AMfChk(const char *Cmd) int CmdHF14AMfChk(const char *Cmd) {
{
if (strlen(Cmd)<3) { if (strlen(Cmd)<3) {
PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]"); PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]");
PrintAndLog(" * - all sectors"); PrintAndLog(" * - all sectors");
@ -1081,7 +1080,7 @@ int CmdHF14AMfChk(const char *Cmd)
uint8_t keyType = 0; uint8_t keyType = 0;
uint64_t key64 = 0; uint64_t key64 = 0;
// timeout in units. (ms * 106)/10 or us*0.0106 // timeout in units. (ms * 106)/10 or us*0.0106
uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default
bool param3InUse = false; bool param3InUse = false;
bool transferToEml = 0; bool transferToEml = 0;
bool createDumpFile = 0; bool createDumpFile = 0;
@ -1134,7 +1133,7 @@ int CmdHF14AMfChk(const char *Cmd)
}; };
} }
parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a); parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);
if (singleBlock & createDumpFile) { if (singleBlock & createDumpFile) {
PrintAndLog (" block key check (<block no>) and write to dump file (d) combination is not supported "); PrintAndLog (" block key check (<block no>) and write to dump file (d) combination is not supported ");
@ -1142,10 +1141,10 @@ int CmdHF14AMfChk(const char *Cmd)
return 1; return 1;
} }
param3InUse = transferToEml | createDumpFile | (btimeout14a != MF_CHKKEYS_DEFTIMEOUT); param3InUse = transferToEml | createDumpFile | (timeout14a != MF_CHKKEYS_DEFTIMEOUT);
PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us", PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",
SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106); SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);
for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) { for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) {
if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) { if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {
@ -1251,7 +1250,9 @@ int CmdHF14AMfChk(const char *Cmd)
for (uint32_t c = 0; c < keycnt; c += max_keys) { for (uint32_t c = 0; c < keycnt; c += max_keys) {
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c; uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
res = mfCheckKeysSec(SectorsCnt, keyType, btimeout14a, clearTraceLog, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106 bool init = (c == 0);
bool drop_field = (c + size == keycnt);
res = mfCheckKeysSec(SectorsCnt, keyType, timeout14a, clearTraceLog, init, drop_field, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106
clearTraceLog = false; clearTraceLog = false;
if (res != 1) { if (res != 1) {
@ -1272,7 +1273,9 @@ int CmdHF14AMfChk(const char *Cmd)
for (uint32_t c = 0; c < keycnt; c += max_keys) { for (uint32_t c = 0; c < keycnt; c += max_keys) {
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c; uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;
res = mfCheckKeys(blockNo, keyAB & 0x01, true, size, &keyBlock[6 * c], &key64); bool init = (c == 0);
bool drop_field = (c + size == keycnt);
res = mfCheckKeys(blockNo, keyAB & 0x01, timeout14a, true, init, drop_field, size, &keyBlock[6 * c], &key64);
clearTraceLog = false; clearTraceLog = false;
if (res != 1) { if (res != 1) {

34
client/mifare/mifarehost.c
View file

@ -10,6 +10,7 @@
#include "mifarehost.h" #include "mifarehost.h"
#include <inttypes.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
@ -115,8 +116,7 @@ static uint32_t nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint32_t ar, u
} }
int mfDarkside(uint64_t *key) int mfDarkside(uint64_t *key) {
{
uint32_t uid = 0; uint32_t uid = 0;
uint32_t nt = 0, nr = 0, ar = 0; uint32_t nt = 0, nr = 0, ar = 0;
uint64_t par_list = 0, ks_list = 0; uint64_t par_list = 0, ks_list = 0;
@ -208,7 +208,9 @@ int mfDarkside(uint64_t *key)
num_to_bytes(keylist[i*max_keys + j], 6, keyBlock+(j*6)); num_to_bytes(keylist[i*max_keys + j], 6, keyBlock+(j*6));
} }
} }
if (!mfCheckKeys(0, 0, false, size, keyBlock, key)) { bool init = (i == 0);
bool drop_field = (i + size == keycount);
if (!mfCheckKeys(0, 0, 0, false, init, drop_field, size, keyBlock, key)) {
break; break;
} }
} }
@ -228,11 +230,13 @@ int mfDarkside(uint64_t *key)
} }
int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){ int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key) {
*key = -1; *key = -1;
bool multisectorCheck = false;
uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), clear_trace, keycnt}}; UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
memcpy(c.d.asBytes, keyBlock, 6 * keycnt); memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
SendCommand(&c); SendCommand(&c);
@ -251,14 +255,18 @@ int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t key
return 0; return 0;
} }
int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector){
int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector){
uint8_t keyPtr = 0; uint8_t keyPtr = 0;
if (e_sector == NULL) if (e_sector == NULL)
return -1; return -1;
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), (clear_trace | 0x02)|((timeout14a & 0xff) << 8), keycnt}}; bool multisectorCheck = true;
uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
memcpy(c.d.asBytes, keyBlock, 6 * keycnt); memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
SendCommand(&c); SendCommand(&c);
@ -328,8 +336,7 @@ __attribute__((force_align_arg_pointer))
} }
int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) {
{
uint32_t i, j; uint32_t i, j;
uint32_t uid; uint32_t uid;
UsbCommand resp; UsbCommand resp;
@ -379,6 +386,10 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4); memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
} }
uint32_t authentication_timeout;
memcpy(&authentication_timeout, resp.d.asBytes + 20, 4);
PrintAndLog("Setting authentication timeout to %" PRIu32 "us", authentication_timeout * 1000 / 106);
if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1) if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1)
num_unique_nonces = 1; num_unique_nonces = 1;
else else
@ -491,7 +502,10 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
} }
key64 = 0; key64 = 0;
isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, true, max_keys, keyBlock, &key64);
bool init = (i == 0);
bool drop_field = (i + max_keys == statelists[0].len);
isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, authentication_timeout, true, init, drop_field, max_keys, keyBlock, &key64);
if (isOK == 1) { // timeout if (isOK == 1) { // timeout
isOK = -1; isOK = -1;

17
client/mifare/mifarehost.h
View file

@ -8,8 +8,8 @@
// High frequency ISO14443A commands // High frequency ISO14443A commands
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
#ifndef MIFAREHOST_H #ifndef MIFAREHOST_H__
#define MIFAREHOST_H #define MIFAREHOST_H__
#include <stdint.h> #include <stdint.h>
#include <stdbool.h> #include <stdbool.h>
@ -17,9 +17,10 @@
#include "util.h" #include "util.h"
// defaults // defaults
// timeout in units. (ms * 106)/10 or us*0.0106 // timeout in units. ms * 106 or us * 0.106
// 5 == 500us #define MF_CHKKEYS_DEFTIMEOUT 50 // 0.47ms
#define MF_CHKKEYS_DEFTIMEOUT 5 #define MF_CHKKEYS_SLOWTIMEOUT 106 // 1ms
#define MF_CHKKEYS_VERYSLOWTIMEOUT 530 // 5ms
// mfCSetBlock work flags // mfCSetBlock work flags
#define CSETBLOCK_UID 0x01 #define CSETBLOCK_UID 0x01
@ -38,9 +39,9 @@ typedef struct {
extern char logHexFileName[FILE_PATH_SIZE]; extern char logHexFileName[FILE_PATH_SIZE];
extern int mfDarkside(uint64_t *key); extern int mfDarkside(uint64_t *key);
extern int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate); extern int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t *keyBlock, uint64_t *key); extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t *keyBlock, uint64_t *key);
extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector); extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
extern int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data); extern int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data);