MIFARE Classic Key Recovery Improvements #3822
+1,922
−105
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,15 @@ | ||
| #include "../nfc_app_i.h" | ||
|
|
||
| #include <bit_lib/bit_lib.h> | ||
| #include <dolphin/dolphin.h> | ||
|
|
||
| #define TAG "NfcMfClassicDictAttack" | ||
|
|
||
| // TODO: Fix lag when leaving the dictionary attack view after Hardnested | ||
| // TODO: Re-enters backdoor detection between user and system dictionary if no backdoor is found | ||
|
|
||
| typedef enum { | ||
| DictAttackStateCUIDDictInProgress, | ||
| DictAttackStateUserDictInProgress, | ||
| DictAttackStateSystemDictInProgress, | ||
| } DictAttackState; | ||
|
|
@@ -29,7 +33,9 @@ NfcCommand nfc_dict_attack_worker_callback(NfcGenericEvent event, void* context) | |
| } else if(mfc_event->type == MfClassicPollerEventTypeRequestMode) { | ||
| const MfClassicData* mfc_data = | ||
| nfc_device_get_data(instance->nfc_device, NfcProtocolMfClassic); | ||
| mfc_event->data->poller_mode.mode = (instance->nfc_dict_context.enhanced_dict) ? | ||
|
There was a problem hiding this comment. I see one place where this There was a problem hiding this comment. This flag is to indicate whether nested attacks should be attempted. Nested attacks are disabled during the CUID dictionary attack to force the default behavior ( |
||
| MfClassicPollerModeDictAttackEnhanced : | ||
| MfClassicPollerModeDictAttackStandard; | ||
| mfc_event->data->poller_mode.data = mfc_data; | ||
| instance->nfc_dict_context.sectors_total = | ||
| mf_classic_get_total_sectors_num(mfc_data->type); | ||
|
|
@@ -58,6 +64,11 @@ NfcCommand nfc_dict_attack_worker_callback(NfcGenericEvent event, void* context) | |
| instance->nfc_dict_context.sectors_read = data_update->sectors_read; | ||
| instance->nfc_dict_context.keys_found = data_update->keys_found; | ||
| instance->nfc_dict_context.current_sector = data_update->current_sector; | ||
| instance->nfc_dict_context.nested_phase = data_update->nested_phase; | ||
| instance->nfc_dict_context.prng_type = data_update->prng_type; | ||
| instance->nfc_dict_context.backdoor = data_update->backdoor; | ||
| instance->nfc_dict_context.nested_target_key = data_update->nested_target_key; | ||
| instance->nfc_dict_context.msb_count = data_update->msb_count; | ||
| view_dispatcher_send_custom_event( | ||
| instance->view_dispatcher, NfcCustomEventDictAttackDataUpdate); | ||
| } else if(mfc_event->type == MfClassicPollerEventTypeNextSector) { | ||
|
|
@@ -117,19 +128,75 @@ static void nfc_scene_mf_classic_dict_attack_update_view(NfcApp* instance) { | |
| dict_attack_set_keys_found(instance->dict_attack, mfc_dict->keys_found); | ||
| dict_attack_set_current_dict_key(instance->dict_attack, mfc_dict->dict_keys_current); | ||
| dict_attack_set_current_sector(instance->dict_attack, mfc_dict->current_sector); | ||
| dict_attack_set_nested_phase(instance->dict_attack, mfc_dict->nested_phase); | ||
| dict_attack_set_prng_type(instance->dict_attack, mfc_dict->prng_type); | ||
| dict_attack_set_backdoor(instance->dict_attack, mfc_dict->backdoor); | ||
| dict_attack_set_nested_target_key(instance->dict_attack, mfc_dict->nested_target_key); | ||
| dict_attack_set_msb_count(instance->dict_attack, mfc_dict->msb_count); | ||
| } | ||
| } | ||
|
|
||
| static void nfc_scene_mf_classic_dict_attack_prepare_view(NfcApp* instance) { | ||
| uint32_t state = | ||
| scene_manager_get_scene_state(instance->scene_manager, NfcSceneMfClassicDictAttack); | ||
| if(state == DictAttackStateCUIDDictInProgress) { | ||
| size_t cuid_len = 0; | ||
| const uint8_t* cuid = nfc_device_get_uid(instance->nfc_device, &cuid_len); | ||
| FuriString* cuid_dict_path = furi_string_alloc_printf( | ||
| "%s/mf_classic_dict_%08lx.nfc", | ||
| EXT_PATH("nfc/assets"), | ||
| (uint32_t)bit_lib_bytes_to_num_be(cuid + (cuid_len - 4), 4)); | ||
|
|
||
| do { | ||
| if(!keys_dict_check_presence(furi_string_get_cstr(cuid_dict_path))) { | ||
| state = DictAttackStateUserDictInProgress; | ||
noproto marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| break; | ||
| } | ||
|
|
||
| instance->nfc_dict_context.dict = keys_dict_alloc( | ||
| furi_string_get_cstr(cuid_dict_path), | ||
| KeysDictModeOpenExisting, | ||
| sizeof(MfClassicKey)); | ||
|
|
||
| if(keys_dict_get_total_keys(instance->nfc_dict_context.dict) == 0) { | ||
| keys_dict_free(instance->nfc_dict_context.dict); | ||
| state = DictAttackStateUserDictInProgress; | ||
| break; | ||
| } | ||
|
|
||
| dict_attack_set_header(instance->dict_attack, "MF Classic CUID Dictionary"); | ||
| } while(false); | ||
|
|
||
| furi_string_free(cuid_dict_path); | ||
| } | ||
| if(state == DictAttackStateUserDictInProgress) { | ||
| do { | ||
| instance->nfc_dict_context.enhanced_dict = true; | ||
|
|
||
| if(keys_dict_check_presence(NFC_APP_MF_CLASSIC_DICT_SYSTEM_NESTED_PATH)) { | ||
| storage_common_remove( | ||
| instance->storage, NFC_APP_MF_CLASSIC_DICT_SYSTEM_NESTED_PATH); | ||
| } | ||
| if(keys_dict_check_presence(NFC_APP_MF_CLASSIC_DICT_SYSTEM_PATH)) { | ||
| storage_common_copy( | ||
| instance->storage, | ||
| NFC_APP_MF_CLASSIC_DICT_SYSTEM_PATH, | ||
| NFC_APP_MF_CLASSIC_DICT_SYSTEM_NESTED_PATH); | ||
| } | ||
|
|
||
| if(!keys_dict_check_presence(NFC_APP_MF_CLASSIC_DICT_USER_PATH)) { | ||
| state = DictAttackStateSystemDictInProgress; | ||
| break; | ||
| } | ||
|
|
||
| if(keys_dict_check_presence(NFC_APP_MF_CLASSIC_DICT_USER_NESTED_PATH)) { | ||
| storage_common_remove(instance->storage, NFC_APP_MF_CLASSIC_DICT_USER_NESTED_PATH); | ||
| } | ||
| storage_common_copy( | ||
| instance->storage, | ||
| NFC_APP_MF_CLASSIC_DICT_USER_PATH, | ||
| NFC_APP_MF_CLASSIC_DICT_USER_NESTED_PATH); | ||
|
|
||
| instance->nfc_dict_context.dict = keys_dict_alloc( | ||
| NFC_APP_MF_CLASSIC_DICT_USER_PATH, KeysDictModeOpenAlways, sizeof(MfClassicKey)); | ||
| if(keys_dict_get_total_keys(instance->nfc_dict_context.dict) == 0) { | ||
|
|
@@ -164,7 +231,7 @@ void nfc_scene_mf_classic_dict_attack_on_enter(void* context) { | |
| NfcApp* instance = context; | ||
|
|
||
| scene_manager_set_scene_state( | ||
| instance->scene_manager, NfcSceneMfClassicDictAttack, DictAttackStateCUIDDictInProgress); | ||
| nfc_scene_mf_classic_dict_attack_prepare_view(instance); | ||
| dict_attack_set_card_state(instance->dict_attack, true); | ||
| view_dispatcher_switch_to_view(instance->view_dispatcher, NfcViewDictAttack); | ||
|
|
@@ -193,7 +260,21 @@ bool nfc_scene_mf_classic_dict_attack_on_event(void* context, SceneManagerEvent | |
| scene_manager_get_scene_state(instance->scene_manager, NfcSceneMfClassicDictAttack); | ||
| if(event.type == SceneManagerEventTypeCustom) { | ||
| if(event.event == NfcCustomEventDictAttackComplete) { | ||
| bool ran_nested_dict = instance->nfc_dict_context.nested_phase != | ||
| MfClassicNestedPhaseNone; | ||
| if(state == DictAttackStateCUIDDictInProgress) { | ||
| nfc_poller_stop(instance->poller); | ||
| nfc_poller_free(instance->poller); | ||
| keys_dict_free(instance->nfc_dict_context.dict); | ||
| scene_manager_set_scene_state( | ||
| instance->scene_manager, | ||
| NfcSceneMfClassicDictAttack, | ||
| DictAttackStateUserDictInProgress); | ||
| nfc_scene_mf_classic_dict_attack_prepare_view(instance); | ||
| instance->poller = nfc_poller_alloc(instance->nfc, NfcProtocolMfClassic); | ||
| nfc_poller_start(instance->poller, nfc_dict_attack_worker_callback, instance); | ||
| consumed = true; | ||
| } else if(state == DictAttackStateUserDictInProgress && !(ran_nested_dict)) { | ||
| nfc_poller_stop(instance->poller); | ||
| nfc_poller_free(instance->poller); | ||
| keys_dict_free(instance->nfc_dict_context.dict); | ||
|
|
@@ -222,7 +303,27 @@ bool nfc_scene_mf_classic_dict_attack_on_event(void* context, SceneManagerEvent | |
| } else if(event.event == NfcCustomEventDictAttackSkip) { | ||
| const MfClassicData* mfc_data = nfc_poller_get_data(instance->poller); | ||
| nfc_device_set_data(instance->nfc_device, NfcProtocolMfClassic, mfc_data); | ||
| bool ran_nested_dict = instance->nfc_dict_context.nested_phase != | ||
|
There was a problem hiding this comment. In my opinion, this one is not needed here because we have the same on line 264 which we can move out from if to line 262. There was a problem hiding this comment. And by the way, maybe it would be better to change type of nested_phase to appropriate enum instead of There was a problem hiding this comment.
This exists to reduce computation so we don't do the comparison on every custom event.
Will follow up on your other comment: #3822 (comment) |
||
| MfClassicNestedPhaseNone; | ||
| if(state == DictAttackStateCUIDDictInProgress) { | ||
| if(instance->nfc_dict_context.is_card_present) { | ||
| nfc_poller_stop(instance->poller); | ||
| nfc_poller_free(instance->poller); | ||
| keys_dict_free(instance->nfc_dict_context.dict); | ||
| scene_manager_set_scene_state( | ||
| instance->scene_manager, | ||
| NfcSceneMfClassicDictAttack, | ||
| DictAttackStateUserDictInProgress); | ||
| nfc_scene_mf_classic_dict_attack_prepare_view(instance); | ||
| instance->poller = nfc_poller_alloc(instance->nfc, NfcProtocolMfClassic); | ||
| nfc_poller_start(instance->poller, nfc_dict_attack_worker_callback, instance); | ||
| } else { | ||
| nfc_scene_mf_classic_dict_attack_notify_read(instance); | ||
| scene_manager_next_scene(instance->scene_manager, NfcSceneReadSuccess); | ||
| dolphin_deed(DolphinDeedNfcReadSuccess); | ||
| } | ||
| consumed = true; | ||
| } else if(state == DictAttackStateUserDictInProgress && !(ran_nested_dict)) { | ||
| if(instance->nfc_dict_context.is_card_present) { | ||
| nfc_poller_stop(instance->poller); | ||
| nfc_poller_free(instance->poller); | ||
|
|
@@ -240,7 +341,7 @@ bool nfc_scene_mf_classic_dict_attack_on_event(void* context, SceneManagerEvent | |
| dolphin_deed(DolphinDeedNfcReadSuccess); | ||
| } | ||
| consumed = true; | ||
| } else { | ||
| nfc_scene_mf_classic_dict_attack_notify_read(instance); | ||
| scene_manager_next_scene(instance->scene_manager, NfcSceneReadSuccess); | ||
| dolphin_deed(DolphinDeedNfcReadSuccess); | ||
|
|
@@ -262,7 +363,7 @@ void nfc_scene_mf_classic_dict_attack_on_exit(void* context) { | |
|
|
||
| dict_attack_reset(instance->dict_attack); | ||
| scene_manager_set_scene_state( | ||
| instance->scene_manager, NfcSceneMfClassicDictAttack, DictAttackStateCUIDDictInProgress); | ||
|
|
||
| keys_dict_free(instance->nfc_dict_context.dict); | ||
|
|
||
|
|
@@ -275,6 +376,20 @@ void nfc_scene_mf_classic_dict_attack_on_exit(void* context) { | |
| instance->nfc_dict_context.is_key_attack = false; | ||
| instance->nfc_dict_context.key_attack_current_sector = 0; | ||
| instance->nfc_dict_context.is_card_present = false; | ||
| instance->nfc_dict_context.nested_phase = MfClassicNestedPhaseNone; | ||
| instance->nfc_dict_context.prng_type = MfClassicPrngTypeUnknown; | ||
| instance->nfc_dict_context.backdoor = MfClassicBackdoorUnknown; | ||
| instance->nfc_dict_context.nested_target_key = 0; | ||
| instance->nfc_dict_context.msb_count = 0; | ||
| instance->nfc_dict_context.enhanced_dict = false; | ||
|
|
||
| // Clean up temporary files used for nested dictionary attack | ||
| if(keys_dict_check_presence(NFC_APP_MF_CLASSIC_DICT_USER_NESTED_PATH)) { | ||
| storage_common_remove(instance->storage, NFC_APP_MF_CLASSIC_DICT_USER_NESTED_PATH); | ||
| } | ||
| if(keys_dict_check_presence(NFC_APP_MF_CLASSIC_DICT_SYSTEM_NESTED_PATH)) { | ||
| storage_common_remove(instance->storage, NFC_APP_MF_CLASSIC_DICT_SYSTEM_NESTED_PATH); | ||
| } | ||
|
|
||
| nfc_blink_stop(instance); | ||
| notification_message(instance->notifications, &sequence_display_backlight_enforce_auto); | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What about these TODOs? Are they still actual or not?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
They are actual, but not for this PR necessarily. I have them documenting the planned performance and code style improvements. Ideally with a follow-up PR, so users have a working process before I've had the chance to fully optimize it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
More context: to the best of my knowledge the PR is stable and testing is appreciated. The cost of the performance TODOs will add up to milliseconds for the vast majority of attacks.
For the two TODOs referenced here, I've observed under certain conditions Hardnested taking a few seconds to return from the dictionary attack. The backdoor re-entry cost is somewhere in the order of milliseconds.