roel wrote:Thank you very much for making this project zveriu.
My pleasure to contribute to the open source community - hopefully it will not be used in abusive/illegal manners though (relying on the users' thoughtful actions!)
roel wrote:It needs just a few minor tweaks I guess to make it running on all platforms, but it windows it seems to work fine 
Tweaks and improvements are on the way 
- just stay tuned for the toolkit to get it's spin and dices rolling
roel wrote:Though it is kind of confusing that it asks for a "key" and a "block", the block I understand, but the key is going to be recovered right?
Actually the history behind is like this - the sample code used as basis for this project (which is a code provided by you roel - thanks) required key and block (the auth example).
However, given what the tool is supposed to do, it makes KEY the parameter useless (at most optional just to make a positive/negative test for authentication) as well as BLOCK parameter optional - if a block parameter is supplied, that block will be used in 60 xx AUTH command, otherwise a random/default block (eg. block 0) will be used.
And yes, even if the key parameter is required (though not needed - just pass some bogus 12 hex digits), the real key for some sector is being successfully recovered - exactly what the tool is supposed to do.
All - please let me know improvements and features wish-list and I will check what I can incorporate and improve to make it worth all the time spent on this
NOTE: the tool still have some minor bugs, to be improved on version 0.2, specifically some reported that this text comes in the logs and thus no key is recovered sometimes:
SUCCESS
Trying to recover the key
Press 1 to continue search of other keys...
Press anything else to exit...
At: 0d
Authentication Succesful
A quick-fix would be to find these lines of code and introduce the ones with comments below:
// If someone wonders why (i<(1<<20)) - this is the size of malloc() in lsfr_common_prefix(), so this is max number of states in the list
// List which is ZERO-terminated, i.e. both odd and even are zero when the list finishes
for (i=0; (state) && ((state+i)->odd != 0 || (state+i)->even != 0) && (i<(1<<20)); i++)
{
current_state = state + i;
lfsr_rollback_word(current_state, uid ^ ptrFoundTagNonceEntry->tagNonce, 0);
crypto1_get_lfsr(current_state, &key_recovered);
printf("\nkey recovered: %012llx\n\n", key_recovered);
flag_key_recovered = 1; // ADD THIS LINE, ALSO DECLARE VARIABLE AHEAD
}
crypto1_destroy(state);
// ADD THIS BLOCK
if (!flag_key_recovered)
{
printf("{Nr} is not a DEADBEEF.... Need to find BEEF ALIVE!... Trying next one...\n");
ptrFoundTagNonceEntry->spoofNrEnc++;
ptrFoundTagNonceEntry->spoofArEnc = 0xFACECAFE;
ptrFoundTagNonceEntry->spoofParBitsEnc = 0x0;
// First we need to satisfy STAGE1
ptrFoundTagNonceEntry->current_out_of_8 = -1;
return false;
}
