This commit is contained in:
iceman1001 2024-09-06 22:59:23 +02:00
parent 72900d1bf9
commit e50459b2c5
6 changed files with 45 additions and 42 deletions

View file

@ -145,7 +145,7 @@ int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo,
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing) { int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing) {
return mifare_classic_authex_cmd(pcs, uid, blockNo, MIFARE_AUTH_KEYA + (keyType & 0xF), ui64Key, isNested, ntptr, NULL, NULL, timing, false, false); return mifare_classic_authex_cmd(pcs, uid, blockNo, MIFARE_AUTH_KEYA + (keyType & 0xF), ui64Key, isNested, ntptr, NULL, NULL, timing, false, false);
} }
int mifare_classic_authex_cmd(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t cmd, uint64_t ui64Key, uint8_t isNested, int mifare_classic_authex_cmd(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t cmd, uint64_t ui64Key, uint8_t isNested,
uint32_t *ntptr, uint32_t *ntencptr, uint8_t *ntencparptr, uint32_t *timing, bool corruptnrar, bool corruptnrarparity) { uint32_t *ntptr, uint32_t *ntencptr, uint8_t *ntencparptr, uint32_t *timing, bool corruptnrar, bool corruptnrarparity) {
// "random" reader nonce: // "random" reader nonce:
uint8_t nr[4]; uint8_t nr[4];

View file

@ -6486,13 +6486,13 @@ int CmdHFMFNDEFRead(const char *Cmd) {
// if given a filename, save it // if given a filename, save it
if (fnlen) { if (fnlen) {
// get total NDEF length before save. If fails, we save it all // get total NDEF length before save. If fails, we save it all
size_t n = 0; size_t n = 0;
if (NDEFGetTotalLength(data, datalen, &n) != PM3_SUCCESS) { if (NDEFGetTotalLength(data, datalen, &n) != PM3_SUCCESS) {
n = datalen; n = datalen;
} }
pm3_save_dump(filename, data, n, jsfNDEF); pm3_save_dump(filename, data, n, jsfNDEF);
} }
if (verbose == false) { if (verbose == false) {
@ -7590,7 +7590,7 @@ static int CmdHF14AMfWipe(const char *Cmd) {
num_sectors = NumOfSectors('1'); num_sectors = NumOfSectors('1');
memcpy(mf, "\x11\x22\x33\x44\x44\x08\x04\x00\x62\x63\x64\x65\x66\x67\x68\x69", MFBLOCK_SIZE); memcpy(mf, "\x11\x22\x33\x44\x44\x08\x04\x00\x62\x63\x64\x65\x66\x67\x68\x69", MFBLOCK_SIZE);
break; break;
} }
case (MIFARE_1K_MAX_KEY_SIZE): { case (MIFARE_1K_MAX_KEY_SIZE): {
PrintAndLogEx(INFO, "Loaded keys matching MIFARE Classic 1K"); PrintAndLogEx(INFO, "Loaded keys matching MIFARE Classic 1K");
memcpy(keyA, keys, (MIFARE_1K_MAXSECTOR * MIFARE_KEY_SIZE)); memcpy(keyA, keys, (MIFARE_1K_MAXSECTOR * MIFARE_KEY_SIZE));
@ -7670,10 +7670,10 @@ static int CmdHF14AMfWipe(const char *Cmd) {
if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
int8_t isOK = resp.oldarg[0]; int8_t isOK = resp.oldarg[0];
if (isOK == 1) { if (isOK == 1) {
PrintAndLogEx(NORMAL, "- key %c ( " _GREEN_("ok") " )", (kt== MF_KEY_A) ? 'A' : 'B'); PrintAndLogEx(NORMAL, "- key %c ( " _GREEN_("ok") " )", (kt == MF_KEY_A) ? 'A' : 'B');
break; break;
} else { } else {
PrintAndLogEx(NORMAL, "- key %c ( " _RED_("fail") " )", (kt== MF_KEY_A) ? 'A' : 'B'); PrintAndLogEx(NORMAL, "- key %c ( " _RED_("fail") " )", (kt == MF_KEY_A) ? 'A' : 'B');
} }
} else { } else {
PrintAndLogEx(WARNING, "Command execute timeout"); PrintAndLogEx(WARNING, "Command execute timeout");

View file

@ -4466,9 +4466,10 @@
"options": [ "options": [
"-h, --help This help", "-h, --help This help",
"--blk <dec> Target block", "--blk <dec> Target block",
"-b Target key B instead of default key A" "-b Target key B instead of default key A",
"-c <dec> Target Auth 6x"
], ],
"usage": "hf mf darkside [-hb] [--blk <dec> ]" "usage": "hf mf darkside [-hb] [--blk <dec> ] [-c <dec>]"
}, },
"hf mf decrypt": { "hf mf decrypt": {
"command": "hf mf decrypt", "command": "hf mf decrypt",
@ -12885,6 +12886,6 @@
"metadata": { "metadata": {
"commands_extracted": 743, "commands_extracted": 743,
"extracted_by": "PM3Help2JSON v1.00", "extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2024-09-05T16:36:25" "extracted_on": "2024-09-06T20:59:05"
} }
} }

View file

@ -2,12 +2,12 @@
* ht2crack2search.c * ht2crack2search.c
* this searches the sorted tables for the given RNG data, retrieves the matching * this searches the sorted tables for the given RNG data, retrieves the matching
* PRNG state, checks it is correct, and then rolls back the PRNG to recover the key * PRNG state, checks it is correct, and then rolls back the PRNG to recover the key
* *
* Iceman 2024, * Iceman 2024,
* This is a multi threaded version. After discussions with mwalker33 about how to make this multi threaded * This is a multi threaded version. After discussions with mwalker33 about how to make this multi threaded
* version he concluded that the file lookups would be ideal. So we don't do it inside the individual file searches but * version he concluded that the file lookups would be ideal. So we don't do it inside the individual file searches but
* rather we can put each file to search in each thread instead. Come up with ways to make it faster! * rather we can put each file to search in each thread instead. Come up with ways to make it faster!
* *
* When testing remember OS cache fiddles with your mind and results. Running same test values will be much faster second run * When testing remember OS cache fiddles with your mind and results. Running same test values will be much faster second run
*/ */
@ -23,7 +23,7 @@ static int global_found = 0;
static int thread_count = 2; static int thread_count = 2;
static int g_bitoffset = 0; static int g_bitoffset = 0;
static uint8_t g_rngmatch[6]; static uint8_t g_rngmatch[6];
static uint8_t g_rngstate[6]; static uint8_t g_rngstate[6];
typedef struct { typedef struct {
int len; int len;
@ -454,7 +454,7 @@ int main(int argc, char *argv[]) {
pthread_mutex_init(&print_lock, NULL); pthread_mutex_init(&print_lock, NULL);
// findmatch(&rng, rngmatch, rngstate, &bitoffset) // findmatch(&rng, rngmatch, rngstate, &bitoffset)
// threads // threads
for (int i = 0; i < thread_count; ++i) { for (int i = 0; i < thread_count; ++i) {
targs *a = calloc(1, rng.len + sizeof(targs)); targs *a = calloc(1, rng.len + sizeof(targs));
@ -480,8 +480,10 @@ int main(int argc, char *argv[]) {
printf("\n" _RED_("!!!") " failed to find a key\n\n"); printf("\n" _RED_("!!!") " failed to find a key\n\n");
} else { } else {
printf("Found match:\n"); printf("Found match:\n");
printf("rngmatch.... "); print_hex(g_rngmatch, sizeof(g_rngmatch)); printf("rngmatch.... ");
printf("rngstate.... "); print_hex(g_rngstate, sizeof(g_rngstate)); print_hex(g_rngmatch, sizeof(g_rngmatch));
printf("rngstate.... ");
print_hex(g_rngstate, sizeof(g_rngstate));
printf("bitoffset... %d\n", g_bitoffset); printf("bitoffset... %d\n", g_bitoffset);
Hitag_State hstate; Hitag_State hstate;

View file

@ -439,17 +439,17 @@ int main(int argc, char *const argv[]) {
} }
printf("uid=%08x nt_enc=%08x nt_par_err=%i%i%i%i nt_par_enc=%i%i%i%i %u/%i: %u\n" printf("uid=%08x nt_enc=%08x nt_par_err=%i%i%i%i nt_par_enc=%i%i%i%i %u/%i: %u\n"
, authuid , authuid
, nt_enc , nt_enc
, nt_par_err_arr[0], nt_par_err_arr[1], nt_par_err_arr[2], nt_par_err_arr[3] , nt_par_err_arr[0], nt_par_err_arr[1], nt_par_err_arr[2], nt_par_err_arr[3]
, (nt_par_enc >> 3) & 1 , (nt_par_enc >> 3) & 1
, (nt_par_enc >> 2) & 1 , (nt_par_enc >> 2) & 1
, (nt_par_enc >> 1) & 1 , (nt_par_enc >> 1) & 1
, nt_par_enc & 1 , nt_par_enc & 1
, NKL.nr_nonces + 1 , NKL.nr_nonces + 1
, (argc - 1) / 3 , (argc - 1) / 3
, j , j
); );
pNtData->authuid = authuid; pNtData->authuid = authuid;
pNtData->sizeNK = j; pNtData->sizeNK = j;

View file

@ -141,19 +141,19 @@ int main(int argc, char *const argv[]) {
((nt_par_err_arr[3] ^ oddparity8((nt_enc >> 0) & 0xFF)) << 0); ((nt_par_err_arr[3] ^ oddparity8((nt_enc >> 0) & 0xFF)) << 0);
printf("uid=%08x nt=%08x nt_enc=%08x nt_par_err=%u%u%u%u nt_par_enc=%u%u%u%u ks1=%08x\n" printf("uid=%08x nt=%08x nt_enc=%08x nt_par_err=%u%u%u%u nt_par_enc=%u%u%u%u ks1=%08x\n"
, authuid , authuid
, nt , nt
, nt_enc , nt_enc
, nt_par_err_arr[0] , nt_par_err_arr[0]
, nt_par_err_arr[1] , nt_par_err_arr[1]
, nt_par_err_arr[2] , nt_par_err_arr[2]
, nt_par_err_arr[3] , nt_par_err_arr[3]
, (nt_par_enc >> 3) & 1 , (nt_par_enc >> 3) & 1
, (nt_par_enc >> 2) & 1 , (nt_par_enc >> 2) & 1
, (nt_par_enc >> 1) & 1 , (nt_par_enc >> 1) & 1
, nt_par_enc & 1 , nt_par_enc & 1
, nt ^ nt_enc , nt ^ nt_enc
); );
printf("Finding key candidates...\n"); printf("Finding key candidates...\n");