rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

Update elite_crack.c

Browse Source 
Leveraging doMAC_brute for speed gains.

Precomputation (lines 330-346): Before the loop, sel_brute_idx[i] is set to the brute-byte index j if key_index[i] == bytes_to_recover[j], or 0xFF if that key_sel position is from a already-cracked constant entry. Fixed positions are filled into key_sel once here.

Hot loop (lines 356-361): Replaces:

numbytes_to_recover keytable writes + 8 keytable reads + 8 & 0xFF masks
With: up to numbytes_to_recover (1-3) direct shifts from brute — no keytable touches at all.

Success path (line 386): (brute >> (i * 8)) & 0xFF recovers the exact byte value that was just used for the winning iteration, equivalent to the old keytable[bytes_to_recover[i]] & 0xFF which was the same value that had just been written into the keytable from brute.
This commit is contained in:
Antiklesys
2026-04-03 11:38:08 +08:00
parent e1e689e266
commit f9474feec0
1 changed files with 25 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/loclass/elite_crack.c
+25 -18
View File
@@ -327,6 +327,24 @@ static void *bf_thread(void *thread_arg) {
memcpy(bytes_to_recover, targ->bytes_to_recover, sizeof(bytes_to_recover));
memcpy(keytable, targ->keytable, sizeof(keytable));
// Precompute which key_sel positions are fixed (already-cracked) vs. brute-forced.
// sel_brute_idx[i] == 0xFF: key_sel[i] is constant for this entire brute-force run.
// sel_brute_idx[i] == j: key_sel[i] = (brute >> (j*8)) & 0xFF each iteration.
uint8_t sel_brute_idx[8];
uint8_t key_sel[8];
for (uint8_t i = 0; i < 8; i++) {
sel_brute_idx[i] = 0xFF;
for (uint8_t j = 0; j < numbytes_to_recover; j++) {
if (key_index[i] == bytes_to_recover[j]) {
sel_brute_idx[i] = j;
break;
}
}
if (sel_brute_idx[i] == 0xFF) {
key_sel[i] = keytable[key_index[i]] & 0xFF;
}
}
while (!(brute & endmask)) {
int found = __atomic_load_n(&loclass_found, __ATOMIC_SEQ_CST);
@@ -335,24 +353,13 @@ static void *bf_thread(void *thread_arg) {
return NULL;
}
//Update the keytable with the brute-values
for (uint8_t i = 0; i < numbytes_to_recover; i++) {
keytable[bytes_to_recover[i]] &= 0xFF00;
keytable[bytes_to_recover[i]] |= (brute >> (i * 8) & 0xFF);
// Update only the bruted positions of key_sel directly from brute
for (uint8_t i = 0; i < 8; i++) {
if (sel_brute_idx[i] != 0xFF) {
key_sel[i] = (brute >> (sel_brute_idx[i] * 8)) & 0xFF;
}
}
uint8_t key_sel[8] = {0};
// Piece together the key
key_sel[0] = keytable[key_index[0]] & 0xFF;
key_sel[1] = keytable[key_index[1]] & 0xFF;
key_sel[2] = keytable[key_index[2]] & 0xFF;
key_sel[3] = keytable[key_index[3]] & 0xFF;
key_sel[4] = keytable[key_index[4]] & 0xFF;
key_sel[5] = keytable[key_index[5]] & 0xFF;
key_sel[6] = keytable[key_index[6]] & 0xFF;
key_sel[7] = keytable[key_index[7]] & 0xFF;
// Permute from iclass format to standard format
uint8_t key_sel_p[8] = {0};
@@ -364,7 +371,7 @@ static void *bf_thread(void *thread_arg) {
// Calc mac
uint8_t calculated_MAC[4] = {0};
doMAC(cc_nr, div_key, calculated_MAC);
doMAC_brute(cc_nr, div_key, calculated_MAC);
// success
if (memcmp(calculated_MAC, mac, 4) == 0) {
@@ -376,7 +383,7 @@ static void *bf_thread(void *thread_arg) {
}
for (uint8_t i = 0 ; i < numbytes_to_recover; i++) {
r->values[i] = keytable[bytes_to_recover[i]] & 0xFF;
r->values[i] = (brute >> (i * 8)) & 0xFF;
}
__atomic_store_n(&loclass_found, targ->thread_idx, __ATOMIC_SEQ_CST);
pthread_exit((void *)r);