mirrors/unleashed-firmware
1
Fork 0
mirror of https://github.com/DarkFlippers/unleashed-firmware.git synced 2025-12-12 12:42:30 +04:00
Code Issues Activity

upd mfkey

Browse Source
This commit is contained in:
MX
2025-09-09 15:31:43 +03:00
parent c091a58486
commit ffb8eb7cff
4 changed files with 1563 additions and 1075 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
applications/system/mfkey/application.fam
View File

@@ -15,7 +15,7 @@ App(
fap_icon_assets="images",
fap_weburl="https://github.com/noproto/FlipperMfkey",
fap_description="MIFARE Classic key recovery tool",
fap_version="3.0",
fap_version="3.1",
)
App(

83
applications/system/mfkey/crypto1.h
View File

@@ -54,47 +54,41 @@ static const uint8_t lookup2[256] = {
2, 6, 6, 6, 6, 2, 2, 6, 6, 2, 6, 2, 2, 2, 6, 2, 2, 6, 6, 6, 6, 2, 2, 6, 6, 2, 6, 2, 2,
2, 6, 2, 2, 6, 6, 6, 6, 2, 2, 6, 6, 2, 6, 2, 2, 2, 6, 2, 2, 6, 6, 6, 6};
static inline int filter(uint32_t const x) {
static inline int filter(uint32_t const x)
{
uint32_t f;
f = lookup1[x & 0xff] | lookup2[(x >> 8) & 0xff];
f |= 0x0d938 >> (x >> 16 & 0xf) & 1;
return BIT(0xEC57E80A, f);
}
#ifndef __ARM_ARCH_7EM__
static inline uint8_t evenparity32(uint32_t x) {
return __builtin_parity(x);
}
#endif
#ifdef __ARM_ARCH_7EM__
static inline uint8_t evenparity32(uint32_t x) {
uint32_t result;
__asm__ volatile("eor r1, %[x], %[x], lsr #16 \n\t" // r1 = x ^ (x >> 16)
"eor r1, r1, r1, lsr #8 \n\t" // r1 = r1 ^ (r1 >> 8)
"eor r1, r1, r1, lsr #4 \n\t" // r1 = r1 ^ (r1 >> 4)
"eor r1, r1, r1, lsr #2 \n\t" // r1 = r1 ^ (r1 >> 2)
"eor r1, r1, r1, lsr #1 \n\t" // r1 = r1 ^ (r1 >> 1)
"and %[result], r1, #1 \n\t" // result = r1 & 1
: [result] "=r"(result)
: [x] "r"(x)
: "r1");
return result;
static inline uint8_t evenparity32(uint32_t x)
{
// fold 32 bits -> 16 -> 8 -> 4
x ^= x >> 16;
x ^= x >> 8;
x ^= x >> 4;
// magic 0x6996: bit i tells you parity of i (0 ≤ i < 16)
return (uint8_t)((0x6996u >> (x & 0xF)) & 1);
}
#endif
static inline void update_contribution(unsigned int data[], int item, int mask1, int mask2) {
static inline void update_contribution(unsigned int data[], int item, int mask1, int mask2)
{
int p = data[item] >> 25;
p = p << 1 | evenparity32(data[item] & mask1);
p = p << 1 | evenparity32(data[item] & mask2);
data[item] = p << 24 | (data[item] & 0xffffff);
}
static inline uint32_t crypt_word(struct Crypto1State* s) {
static inline uint32_t crypt_word(struct Crypto1State *s)
{
// "in" and "x" are always 0 (last iteration)
uint32_t res_ret = 0;
uint32_t feedin, t;
for(int i = 0; i <= 31; i++) {
for (int i = 0; i <= 31; i++)
{
res_ret |= (filter(s->odd) << (24 ^ i)); //-V629
feedin = LF_POLY_EVEN & s->even;
feedin ^= LF_POLY_ODD & s->odd;
@@ -104,10 +98,12 @@ static inline uint32_t crypt_word(struct Crypto1State* s) {
return res_ret;
}
static inline void crypt_word_noret(struct Crypto1State* s, uint32_t in, int x) {
static inline void crypt_word_noret(struct Crypto1State *s, uint32_t in, int x)
{
uint8_t ret;
uint32_t feedin, t, next_in;
for(int i = 0; i <= 31; i++) {
for (int i = 0; i <= 31; i++)
{
next_in = BEBIT(in, i);
ret = filter(s->odd);
feedin = ret & (!!x);
@@ -120,11 +116,13 @@ static inline void crypt_word_noret(struct Crypto1State* s, uint32_t in, int x)
return;
}
static inline uint32_t crypt_word_ret(struct Crypto1State* s, uint32_t in, int x) {
static inline uint32_t crypt_word_ret(struct Crypto1State *s, uint32_t in, int x)
{
uint32_t ret = 0;
uint32_t feedin, t, next_in;
uint8_t next_ret;
for(int i = 0; i <= 31; i++) {
for (int i = 0; i <= 31; i++)
{
next_in = BEBIT(in, i);
next_ret = filter(s->odd);
feedin = next_ret & (!!x);
@@ -138,15 +136,18 @@ static inline uint32_t crypt_word_ret(struct Crypto1State* s, uint32_t in, int x
return ret;
}
static uint8_t get_nth_byte(uint32_t value, int n) {
if(n < 0 || n > 3) {
static uint8_t get_nth_byte(uint32_t value, int n)
{
if (n < 0 || n > 3)
{
// Handle invalid input
return 0;
}
return (value >> (8 * (3 - n))) & 0xFF;
}
static uint8_t crypt_bit(struct Crypto1State* s, uint8_t in, int is_encrypted) {
static uint8_t crypt_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
{
uint32_t feedin, t;
uint8_t ret = filter(s->odd);
feedin = ret & !!is_encrypted;
@@ -163,15 +164,18 @@ static inline uint32_t crypt_word_par(
uint32_t in,
int is_encrypted,
uint32_t nt_plain,
uint8_t* parity_keystream_bits) {
uint8_t *parity_keystream_bits)
{
uint32_t ret = 0;
*parity_keystream_bits = 0; // Reset parity keystream bits
for(int i = 0; i < 32; i++) {
for (int i = 0; i < 32; i++)
{
uint8_t bit = crypt_bit(s, BEBIT(in, i), is_encrypted);
ret |= bit << (24 ^ i);
// Save keystream parity bit
if((i + 1) % 8 == 0) {
if ((i + 1) % 8 == 0)
{
*parity_keystream_bits |=
(filter(s->odd) ^ nfc_util_even_parity8(get_nth_byte(nt_plain, i / 8)))
<< (3 - (i / 8));
@@ -180,10 +184,12 @@ static inline uint32_t crypt_word_par(
return ret;
}
static inline void rollback_word_noret(struct Crypto1State* s, uint32_t in, int x) {
static inline void rollback_word_noret(struct Crypto1State *s, uint32_t in, int x)
{
uint8_t ret;
uint32_t feedin, t, next_in;
for(int i = 31; i >= 0; i--) {
for (int i = 31; i >= 0; i--)
{
next_in = BEBIT(in, i);
s->odd &= 0xffffff;
t = s->odd, s->odd = s->even, s->even = t;
@@ -221,7 +227,8 @@ uint32_t rollback_word(struct Crypto1State *s, uint32_t in, int x) {
}
*/
uint8_t napi_lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb) {
uint8_t napi_lfsr_rollback_bit(struct Crypto1State *s, uint32_t in, int fb)
{
int out;
uint8_t ret;
uint32_t t;
@@ -238,7 +245,8 @@ uint8_t napi_lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb) {
return ret;
}
uint32_t napi_lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb) {
uint32_t napi_lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
{
int i;
uint32_t ret = 0;
for (i = 31; i >= 0; --i)
@@ -246,7 +254,8 @@ uint32_t napi_lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb) {
return ret;
}
static inline uint32_t prng_successor(uint32_t x, uint32_t n) {
static inline uint32_t prng_successor(uint32_t x, uint32_t n)
{
SWAPENDIAN(x);
while (n--)
x = x >> 1 | (x >> 16 ^ x >> 18 ^ x >> 19 ^ x >> 21) << 31;

860
applications/system/mfkey/mfkey.c
View File

File diff suppressed because it is too large Load Diff

39
applications/system/mfkey/mfkey.h
View File

@@ -9,21 +9,25 @@
#include <toolbox/stream/buffered_file_stream.h>
#include <nfc/protocols/mf_classic/mf_classic.h>
struct Crypto1State {
struct Crypto1State
{
uint32_t odd, even;
};
struct Msb {
struct Msb
{
int tail;
uint32_t states[768];
};
typedef enum {
typedef enum
{
MissingNonces,
ZeroNonces,
InsufficientRAM,
} MFKeyError;
typedef enum {
typedef enum
{
Ready,
Initializing,
DictionaryAttack,
@@ -34,7 +38,8 @@ typedef enum {
} MFKeyState;
// TODO: Can we eliminate any of the members of this struct?
typedef struct {
typedef struct
{
FuriMutex *mutex;
MFKeyError err;
MFKeyState mfkey_state;
@@ -53,15 +58,20 @@ typedef struct {
bool close_thread_please;
FuriThread *mfkeythread;
KeysDict *cuid_dict;
MfClassicKey *key_buffer;
size_t key_buffer_size;
size_t key_buffer_count;
} ProgramState;
typedef enum {
typedef enum
{
mfkey32,
static_nested,
static_encrypted
} AttackType;
typedef struct {
typedef struct
{
AttackType attack;
MfClassicKey key; // key
uint32_t uid; // serial number
@@ -69,9 +79,11 @@ typedef struct {
uint32_t nt1; // tag challenge second
uint32_t uid_xor_nt0; // uid ^ nt0
uint32_t uid_xor_nt1; // uid ^ nt1
union {
union
{
// Mfkey32
struct {
struct
{
uint32_t p64; // 64th successor of nt0
uint32_t p64b; // 64th successor of nt1
uint32_t nr0_enc; // first encrypted reader challenge
@@ -80,7 +92,8 @@ typedef struct {
uint32_t ar1_enc; // second encrypted reader response
};
// Nested
struct {
struct
{
uint32_t ks1_1_enc; // first encrypted keystream
uint32_t ks1_2_enc; // second encrypted keystream
char par_1_str[5]; // first parity bits (string representation)
@@ -91,14 +104,16 @@ typedef struct {
};
} MfClassicNonce;
typedef struct {
typedef struct
{
Stream *stream;
uint32_t total_nonces;
MfClassicNonce *remaining_nonce_array;
size_t remaining_nonces;
} MfClassicNonceArray;
struct KeysDict {
struct KeysDict
{
Stream *stream;
size_t key_size;
size_t key_size_symbols;