From 89465db4b127ed9d4a3b77fd84f252dfa50f426c Mon Sep 17 00:00:00 2001 From: Antiklesys Date: Fri, 27 Jun 2025 10:30:40 +0800 Subject: [PATCH] Update hf iclass unhash to check lsb Updated hf iclass unhash to check lsb to be 4x 0 and 4x 1. If it doesn't respect that format it means it never went through hash0 (as hash0 forces the key format to have 4x LSB set to 1 and 4x LSB set to 0) and likely to be an AES based key. --- client/src/cmdhficlass.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index ffa5d8f7d..786049787 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -5058,6 +5058,24 @@ static int CmdHFiClassUnhash(const char *Cmd) { return PM3_EINVARG; } + //check if divkey respects hash0 rules (legacy format) or if it could be AES Based + + int count_lsb0 = 0; + int count_lsb1 = 0; + + for (int i = 0; i < PICOPASS_BLOCK_SIZE; i++) { + if ((div_key[i] & 0x01) == 0) { + count_lsb0++; + } else { + count_lsb1++; + } + } + + if(count_lsb0 != 4 || count_lsb1 != 4){ + PrintAndLogEx(INFO, _RED_("Incorrect LSB Distribution, unable to unhash - the key might be AES based.")); + return PM3_SUCCESS; + } + PrintAndLogEx(INFO, "Diversified key... %s", sprint_hex_inrow(div_key, sizeof(div_key))); PrintAndLogEx(INFO, "-----------------------------------"); invert_hash0(div_key);