rfidrig/ChameleonUltra
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/ChameleonUltra.git synced 2026-05-12 11:22:59 -07:00
Code Issues Packages Projects Releases Wiki Activity

Remove unused MF1_DETECT_DARKSIDE, reallocate 2003 to MF1_STATIC_NESTED_ACQUIRE

Browse Source 
MF1_DETECT_DARKSIDE was actually runnign the full attack, as there is no quick way to detect Darkside
So if you want to check for Darkside, just run directly MF1_DARKSIDE_ACQUIRE.
This commit is contained in:
Philippe Teuwen
2023-09-19 16:03:20 +02:00
parent 624e96aee9
commit 5a9d49ddb4
6 changed files with 7 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/protocol.md
+4 -4
View File
@@ -211,10 +211,10 @@ Notes:
* Command: no data
* Response: 1 byte, according to `mf1_nested_type_t` enum
* CLI: cf `hf 14a info`
### 2003: MF1_DETECT_DARKSIDE
* Command: no data
* Response: 1 byte, according to `mf1_darkside_status_t` enum
* CLI: unused
### 2003: MF1_STATIC_NESTED_ACQUIRE
* Command: 10 bytes: `type_known|block_known|key_known[6]|type_target|block_target`. Key as 6 bytes.
* Response: 4+N*8 bytes: `uid[4]` followed by N tuples of `nt[4]|nt_enc[4]`. All values as U32.
* CLI: cf `hf mf nested` on static nonce tag
### 2004: MF1_DARKSIDE_ACQUIRE
* Command: 4 bytes: `type_target|block_target|first_recover|sync_max`
* Response: 1 byte if Darkside failed, according to `mf1_darkside_status_t` enum,
firmware/application/src/app_cmd.c
+1 -12
View File
@@ -256,15 +256,6 @@ static data_frame_tx_t *cmd_processor_mf1_detect_prng(uint16_t cmd, uint16_t sta
return data_frame_make(cmd, HF_TAG_OK, sizeof(type), &type);
}
static data_frame_tx_t *cmd_processor_mf1_detect_darkside(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
uint8_t darkside_status;
status = check_darkside_support((mf1_darkside_status_t *)&darkside_status);
if (status != HF_TAG_OK) {
return data_frame_make(cmd, status, 0, NULL);
}
return data_frame_make(cmd, HF_TAG_OK, sizeof(darkside_status), &darkside_status);
}
static data_frame_tx_t *cmd_processor_mf1_darkside_acquire(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
if (length != 4) {
return data_frame_make(cmd, STATUS_PAR_ERR, 0, NULL);
@@ -938,8 +929,7 @@ static cmd_data_map_t m_data_cmd_map[] = {
{ DATA_CMD_HF14A_SCAN, before_hf_reader_run, cmd_processor_hf14a_scan, after_hf_reader_run },
{ DATA_CMD_MF1_DETECT_SUPPORT, before_hf_reader_run, cmd_processor_mf1_detect_support, after_hf_reader_run },
{ DATA_CMD_MF1_DETECT_PRNG, before_hf_reader_run, cmd_processor_mf1_detect_prng, after_hf_reader_run },
{ DATA_CMD_MF1_DETECT_DARKSIDE, before_hf_reader_run, cmd_processor_mf1_detect_darkside, after_hf_reader_run },
{ DATA_CMD_MF1_STATIC_NESTED_ACQUIRE, before_hf_reader_run, cmd_processor_mf1_static_nested_acquire, after_hf_reader_run },
{ DATA_CMD_MF1_DARKSIDE_ACQUIRE, before_hf_reader_run, cmd_processor_mf1_darkside_acquire, after_hf_reader_run },
{ DATA_CMD_MF1_DETECT_NT_DIST, before_hf_reader_run, cmd_processor_mf1_detect_nt_dist, after_hf_reader_run },
{ DATA_CMD_MF1_NESTED_ACQUIRE, before_hf_reader_run, cmd_processor_mf1_nested_acquire, after_hf_reader_run },
@@ -947,7 +937,6 @@ static cmd_data_map_t m_data_cmd_map[] = {
{ DATA_CMD_MF1_AUTH_ONE_KEY_BLOCK, before_hf_reader_run, cmd_processor_mf1_auth_one_key_block, after_hf_reader_run },
{ DATA_CMD_MF1_READ_ONE_BLOCK, before_hf_reader_run, cmd_processor_mf1_read_one_block, after_hf_reader_run },
{ DATA_CMD_MF1_WRITE_ONE_BLOCK, before_hf_reader_run, cmd_processor_mf1_write_one_block, after_hf_reader_run },
{ DATA_CMD_MF1_STATIC_NESTED_ACQUIRE, before_hf_reader_run, cmd_processor_mf1_static_nested_acquire, after_hf_reader_run },
{ DATA_CMD_EM410X_SCAN, before_reader_run, cmd_processor_em410x_scan, NULL },
{ DATA_CMD_EM410X_WRITE_TO_T55XX, before_reader_run, cmd_processor_em410x_write_to_t55XX, NULL },
firmware/application/src/data_cmd.h
+1 -2
View File
@@ -57,14 +57,13 @@
#define DATA_CMD_HF14A_SCAN (2000)
#define DATA_CMD_MF1_DETECT_SUPPORT (2001)
#define DATA_CMD_MF1_DETECT_PRNG (2002)
#define DATA_CMD_MF1_DETECT_DARKSIDE (2003)
#define DATA_CMD_MF1_STATIC_NESTED_ACQUIRE (2003)
#define DATA_CMD_MF1_DARKSIDE_ACQUIRE (2004)
#define DATA_CMD_MF1_DETECT_NT_DIST (2005)
#define DATA_CMD_MF1_NESTED_ACQUIRE (2006)
#define DATA_CMD_MF1_AUTH_ONE_KEY_BLOCK (2007)
#define DATA_CMD_MF1_READ_ONE_BLOCK (2008)
#define DATA_CMD_MF1_WRITE_ONE_BLOCK (2009)
#define DATA_CMD_MF1_STATIC_NESTED_ACQUIRE (2010)
//
// ******************************************************************
firmware/application/src/rfid/reader/hf/mf1_toolbox.c
-14
View File
@@ -569,20 +569,6 @@ void antenna_switch_delay(uint32_t delay_ms) {
g_ant_reset_delay = delay_ms;
}
/**
* @brief :Determine whether this card supports DARKSIDE attack
* @retval : If support, return hf_tag_ok and darkside_status = OK. If it is not supported,
* Return to the results of abnormal results during the detection process in darkside_status
* Or other card -related communication errors, the most common is loss card HF_TAG_NO
*
*/
uint8_t check_darkside_support(mf1_darkside_status_t *darkside_status) {
// Instantiated parameter
DarksideCore_t dc;
//Determine and return the result directly
return darkside_recover_key(0x03, PICC_AUTHENT1A, true, 0x15, &dc, darkside_status);
}
/**
* @brief : Determine whether this card supports M1 verification steps
* @retval : If support, it will return hf_tag_ok,
firmware/application/src/rfid/reader/hf/mf1_toolbox.h
-1
View File
@@ -90,7 +90,6 @@ uint8_t nested_distance_detect(
uint8_t nested_recover_key(NESTED_CORE_PARAM_DEF, mf1_nested_core_t ncs[SETS_NR]);
uint8_t static_nested_recover_key(NESTED_CORE_PARAM_DEF, mf1_static_nested_core_t* sncs);
uint8_t check_darkside_support(mf1_darkside_status_t *darkside_status);
uint8_t check_prng_type(mf1_prng_type_t *type);
uint8_t check_std_mifare_nt_support(bool *support);
void antenna_switch_delay(uint32_t delay_ms);
software/script/chameleon_cmd.py
+1 -14
View File
@@ -61,15 +61,13 @@ DATA_CMD_SET_BLE_PAIRING_ENABLE = 1037
DATA_CMD_HF14A_SCAN = 2000
DATA_CMD_MF1_DETECT_SUPPORT = 2001
DATA_CMD_MF1_DETECT_PRNG = 2002
# FIXME: implemented but unused in CLI commands
DATA_CMD_MF1_DETECT_DARKSIDE = 2003
DATA_CMD_MF1_STATIC_NESTED_ACQUIRE = 2003
DATA_CMD_MF1_DARKSIDE_ACQUIRE = 2004
DATA_CMD_MF1_DETECT_NT_DIST = 2005
DATA_CMD_MF1_NESTED_ACQUIRE = 2006
DATA_CMD_MF1_AUTH_ONE_KEY_BLOCK = 2007
DATA_CMD_MF1_READ_ONE_BLOCK = 2008
DATA_CMD_MF1_WRITE_ONE_BLOCK = 2009
DATA_CMD_MF1_STATIC_NESTED_ACQUIRE = 2010
DATA_CMD_EM410X_SCAN = 3000
DATA_CMD_EM410X_WRITE_TO_T55XX = 3001
@@ -465,17 +463,6 @@ class ChameleonCMD:
resp.data = resp.data[0]
return resp
@expect_response(chameleon_status.Device.HF_TAG_OK)
def mf1_detect_darkside_support(self):
"""
Check if the card is vulnerable to mifare classic darkside attack
:return:
"""
resp = self.device.send_cmd_sync(DATA_CMD_MF1_DETECT_DARKSIDE, timeout=20)
if resp.status == chameleon_status.Device.HF_TAG_OK:
resp.data = resp.data[0]
return resp
@expect_response(chameleon_status.Device.HF_TAG_OK)
def mf1_detect_nt_dist(self, block_known, type_known, key_known):
"""