RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-03-29 16:33:07 +08:00
Code Issues Projects Releases Packages Wiki Activity

mf_nonce_brute, several fixes:

Browse source 
* Fix suggested in issue  by @datatags
* Fix max count including 0xFFFF (else recovering key ffffffffffff fails)
* Fix help example of partial recovery
* Fix typo in var name
* Reenable regression test in pm3_tests
This commit is contained in:
Philippe Teuwen 2021-05-26 12:12:26 +02:00
parent 4c36f5a5f7
commit 90dcccdaca
2 changed files with 11 additions and 10 deletions
tools
mf_nonce_brute
mf_nonce_brute.c
pm3_tests.sh

17
tools/mf_nonce_brute/mf_nonce_brute.c
View file

@ -71,7 +71,7 @@ uint8_t cmds[8][2] = {
//static int global_counter = 0;
static int global_found = 0;
static int global_found_candidate = 0;
static uint64_t global_candiate_key = 0;
static uint64_t global_candidate_key = 0;
static int thread_count = 2;
static int param_getptr(const char *line, int *bg, int *en, int paramnum) {
@ -376,7 +376,7 @@ static void *brute_thread(void *arguments) {
// TC == 4 (
// threads calls 0 ev1 == false
// threads calls 0,1,2 ev1 == true
for (count = args->idx; count < 0xFFFF; count += thread_count - 1) {
for (count = args->idx; count <= 0xFFFF; count += thread_count - 1) {
if (__atomic_load_n(&global_found, __ATOMIC_ACQUIRE) == 1) {
break;
@ -448,7 +448,7 @@ static void *brute_thread(void *arguments) {
}
//release lock
pthread_mutex_unlock(&print_lock);
__sync_fetch_and_add(&global_candiate_key, key);
__sync_fetch_and_add(&global_candidate_key, key);
free(revstate);
break;
}
@ -465,13 +465,13 @@ static void *brute_key_thread(void *arguments) {
uint8_t local_enc[args->enc_len];
memcpy(local_enc, args->enc, args->enc_len);
for (uint64_t count = args->idx; count < 0xFFFF; count += thread_count) {
for (uint64_t count = args->idx; count <= 0xFFFF; count += thread_count) {
if (__atomic_load_n(&global_found, __ATOMIC_ACQUIRE) == 1) {
break;
}
key |= (count << 32);
key = args->part_key | (count << 32);
// Init cipher with key
struct Crypto1State *pcs = crypto1_create(key);
@ -519,7 +519,8 @@ static int usage(void) {
printf(" ./mf_nonce_brute fa247164 fb47c594 0000 71909d28 0c254817 1000 0dc7cfbd 1110\n");
printf("\n");
printf("**** Possible key candidate ****\n");
printf("Key candidate: [ffffffffffff]\n");
printf("Key candidate: [....ffffffff]\n");
printf("Too few next cmd bytes, skipping phase 2\n");
printf("\n");
printf(" ./mf_nonce_brute 96519578 d7e3c6ac 0011 cd311951 9da49e49 0010 2bb22e00 0100 a4f7f398ebdb4e484d1cb2b174b939d18b469f3fa5d9caab\n");
printf("\n");
@ -629,7 +630,7 @@ int main(int argc, char *argv[]) {
printf("\n----------- " _CYAN_("Phase 2") " ------------------------\n");
printf("uid.................. %08x\n", uid);
printf("partial key.......... %08x\n", (uint32_t)(global_candiate_key & 0xFFFFFFFF));
printf("partial key.......... %08x\n", (uint32_t)(global_candidate_key & 0xFFFFFFFF));
printf("nt enc............... %08x\n", nt_enc);
printf("nr enc............... %08x\n", nr_enc);
printf("next encrypted cmd... %s\n", sprint_hex_inrow_ex(enc, enc_len, 0));
@ -642,7 +643,7 @@ int main(int argc, char *argv[]) {
b->thread = i;
b->idx = i;
b->uid = uid;
b->part_key = (uint32_t)(global_candiate_key & 0xFFFFFFFF);
b->part_key = (uint32_t)(global_candidate_key & 0xFFFFFFFF);
b->nt_enc = nt_enc;
b->nr_enc = nr_enc;
b->enc_len = enc_len;

4
tools/pm3_tests.sh
View file

@ -275,8 +275,8 @@ while true; do
if $TESTALL || $TESTMFNONCEBRUTE; then
echo -e "\n${C_BLUE}Testing mf_nonce_brute:${C_NC} ${MFNONCEBRUTEBIN:=./tools/mf_nonce_brute/mf_nonce_brute}"
if ! CheckFileExist "mf_nonce_brute exists" "$MFNONCEBRUTEBIN"; then break; fi
if ! CheckExecute slow "mf_nonce_brute test" "$MFNONCEBRUTEBIN 9c599b32 5a920d85 1011 98d76b77 d6c6e870 0000 ca7e0b63 0111 3e709c8a" "Key found \[.*ffffffffffff.*\]"; then break; fi
# if ! CheckExecute slow "mf_nonce_brute test" "$MFNONCEBRUTEBIN 96519578 d7e3c6ac 0011 cd311951 9da49e49 0010 2bb22e00 0100 a4f7f398" "Key found \[.*3b7e4fd575ad.*\]"; then break; fi
if ! CheckExecute slow "mf_nonce_brute test 1/2" "$MFNONCEBRUTEBIN 9c599b32 5a920d85 1011 98d76b77 d6c6e870 0000 ca7e0b63 0111 3e709c8a" "Key found \[.*ffffffffffff.*\]"; then break; fi
if ! CheckExecute slow "mf_nonce_brute test 2/2" "$MFNONCEBRUTEBIN 96519578 d7e3c6ac 0011 cd311951 9da49e49 0010 2bb22e00 0100 a4f7f398" "Key found \[.*3b7e4fd575ad.*\]"; then break; fi
fi
# hitag2crack not yet part of "all"
# if $TESTALL || $TESTHITAG2CRACK; then