This commit is contained in:
iceman1001 2024-09-06 22:59:23 +02:00
parent 72900d1bf9
commit e50459b2c5
6 changed files with 45 additions and 42 deletions

View file

@ -145,7 +145,7 @@ int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo,
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing) {
return mifare_classic_authex_cmd(pcs, uid, blockNo, MIFARE_AUTH_KEYA + (keyType & 0xF), ui64Key, isNested, ntptr, NULL, NULL, timing, false, false);
}
int mifare_classic_authex_cmd(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t cmd, uint64_t ui64Key, uint8_t isNested,
int mifare_classic_authex_cmd(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t cmd, uint64_t ui64Key, uint8_t isNested,
uint32_t *ntptr, uint32_t *ntencptr, uint8_t *ntencparptr, uint32_t *timing, bool corruptnrar, bool corruptnrarparity) {
// "random" reader nonce:
uint8_t nr[4];

View file

@ -6486,13 +6486,13 @@ int CmdHFMFNDEFRead(const char *Cmd) {
// if given a filename, save it
if (fnlen) {
// get total NDEF length before save. If fails, we save it all
size_t n = 0;
// get total NDEF length before save. If fails, we save it all
size_t n = 0;
if (NDEFGetTotalLength(data, datalen, &n) != PM3_SUCCESS) {
n = datalen;
n = datalen;
}
pm3_save_dump(filename, data, n, jsfNDEF);
pm3_save_dump(filename, data, n, jsfNDEF);
}
if (verbose == false) {
@ -7590,7 +7590,7 @@ static int CmdHF14AMfWipe(const char *Cmd) {
num_sectors = NumOfSectors('1');
memcpy(mf, "\x11\x22\x33\x44\x44\x08\x04\x00\x62\x63\x64\x65\x66\x67\x68\x69", MFBLOCK_SIZE);
break;
}
}
case (MIFARE_1K_MAX_KEY_SIZE): {
PrintAndLogEx(INFO, "Loaded keys matching MIFARE Classic 1K");
memcpy(keyA, keys, (MIFARE_1K_MAXSECTOR * MIFARE_KEY_SIZE));
@ -7670,10 +7670,10 @@ static int CmdHF14AMfWipe(const char *Cmd) {
if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
int8_t isOK = resp.oldarg[0];
if (isOK == 1) {
PrintAndLogEx(NORMAL, "- key %c ( " _GREEN_("ok") " )", (kt== MF_KEY_A) ? 'A' : 'B');
PrintAndLogEx(NORMAL, "- key %c ( " _GREEN_("ok") " )", (kt == MF_KEY_A) ? 'A' : 'B');
break;
} else {
PrintAndLogEx(NORMAL, "- key %c ( " _RED_("fail") " )", (kt== MF_KEY_A) ? 'A' : 'B');
PrintAndLogEx(NORMAL, "- key %c ( " _RED_("fail") " )", (kt == MF_KEY_A) ? 'A' : 'B');
}
} else {
PrintAndLogEx(WARNING, "Command execute timeout");

View file

@ -4466,9 +4466,10 @@
"options": [
"-h, --help This help",
"--blk <dec> Target block",
"-b Target key B instead of default key A"
"-b Target key B instead of default key A",
"-c <dec> Target Auth 6x"
],
"usage": "hf mf darkside [-hb] [--blk <dec> ]"
"usage": "hf mf darkside [-hb] [--blk <dec> ] [-c <dec>]"
},
"hf mf decrypt": {
"command": "hf mf decrypt",
@ -12885,6 +12886,6 @@
"metadata": {
"commands_extracted": 743,
"extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2024-09-05T16:36:25"
"extracted_on": "2024-09-06T20:59:05"
}
}

View file

@ -2,12 +2,12 @@
* ht2crack2search.c
* this searches the sorted tables for the given RNG data, retrieves the matching
* PRNG state, checks it is correct, and then rolls back the PRNG to recover the key
*
*
* Iceman 2024,
* This is a multi threaded version. After discussions with mwalker33 about how to make this multi threaded
* version he concluded that the file lookups would be ideal. So we don't do it inside the individual file searches but
* version he concluded that the file lookups would be ideal. So we don't do it inside the individual file searches but
* rather we can put each file to search in each thread instead. Come up with ways to make it faster!
*
*
* When testing remember OS cache fiddles with your mind and results. Running same test values will be much faster second run
*/
@ -23,7 +23,7 @@ static int global_found = 0;
static int thread_count = 2;
static int g_bitoffset = 0;
static uint8_t g_rngmatch[6];
static uint8_t g_rngstate[6];
static uint8_t g_rngstate[6];
typedef struct {
int len;
@ -454,7 +454,7 @@ int main(int argc, char *argv[]) {
pthread_mutex_init(&print_lock, NULL);
// findmatch(&rng, rngmatch, rngstate, &bitoffset)
// threads
for (int i = 0; i < thread_count; ++i) {
targs *a = calloc(1, rng.len + sizeof(targs));
@ -480,8 +480,10 @@ int main(int argc, char *argv[]) {
printf("\n" _RED_("!!!") " failed to find a key\n\n");
} else {
printf("Found match:\n");
printf("rngmatch.... "); print_hex(g_rngmatch, sizeof(g_rngmatch));
printf("rngstate.... "); print_hex(g_rngstate, sizeof(g_rngstate));
printf("rngmatch.... ");
print_hex(g_rngmatch, sizeof(g_rngmatch));
printf("rngstate.... ");
print_hex(g_rngstate, sizeof(g_rngstate));
printf("bitoffset... %d\n", g_bitoffset);
Hitag_State hstate;

View file

@ -439,17 +439,17 @@ int main(int argc, char *const argv[]) {
}
printf("uid=%08x nt_enc=%08x nt_par_err=%i%i%i%i nt_par_enc=%i%i%i%i %u/%i: %u\n"
, authuid
, nt_enc
, nt_par_err_arr[0], nt_par_err_arr[1], nt_par_err_arr[2], nt_par_err_arr[3]
, (nt_par_enc >> 3) & 1
, (nt_par_enc >> 2) & 1
, (nt_par_enc >> 1) & 1
, nt_par_enc & 1
, NKL.nr_nonces + 1
, (argc - 1) / 3
, j
);
, authuid
, nt_enc
, nt_par_err_arr[0], nt_par_err_arr[1], nt_par_err_arr[2], nt_par_err_arr[3]
, (nt_par_enc >> 3) & 1
, (nt_par_enc >> 2) & 1
, (nt_par_enc >> 1) & 1
, nt_par_enc & 1
, NKL.nr_nonces + 1
, (argc - 1) / 3
, j
);
pNtData->authuid = authuid;
pNtData->sizeNK = j;

View file

@ -141,19 +141,19 @@ int main(int argc, char *const argv[]) {
((nt_par_err_arr[3] ^ oddparity8((nt_enc >> 0) & 0xFF)) << 0);
printf("uid=%08x nt=%08x nt_enc=%08x nt_par_err=%u%u%u%u nt_par_enc=%u%u%u%u ks1=%08x\n"
, authuid
, nt
, nt_enc
, nt_par_err_arr[0]
, nt_par_err_arr[1]
, nt_par_err_arr[2]
, nt_par_err_arr[3]
, (nt_par_enc >> 3) & 1
, (nt_par_enc >> 2) & 1
, (nt_par_enc >> 1) & 1
, nt_par_enc & 1
, nt ^ nt_enc
);
, authuid
, nt
, nt_enc
, nt_par_err_arr[0]
, nt_par_err_arr[1]
, nt_par_err_arr[2]
, nt_par_err_arr[3]
, (nt_par_enc >> 3) & 1
, (nt_par_enc >> 2) & 1
, (nt_par_enc >> 1) & 1
, nt_par_enc & 1
, nt ^ nt_enc
);
printf("Finding key candidates...\n");