Native client support for FM11RF08S SEN recovery

CHANGELOG.md

@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+- Added `hf mf sen` command: native client support for FM11RF08S SEN recovery (@C2Pwn)
 - Added Makefile `PLATFORM_FILE` variable to specify another Makefile.platform file (@doegox)
 - Added `hf calypso probecmdcompat` command (@kormax)
 - Added secure channel operations to `hf iclass sam` and fixed/improved I2C bus operations (@antiklesys)

client/CMakeLists.txt

@@ -411,6 +411,7 @@ set (TARGET_SOURCES
         ${PM3_ROOT}/client/src/cmdhfmfdes.c
         ${PM3_ROOT}/client/src/cmdhfmfhard.c
         ${PM3_ROOT}/client/src/cmdhfmfp.c
+        ${PM3_ROOT}/client/src/cmdhfmfsen.c
         ${PM3_ROOT}/client/src/cmdhfmfu.c
         ${PM3_ROOT}/client/src/cmdhfntag424.c
         ${PM3_ROOT}/client/src/cmdhfsaflok.c

client/Makefile

@@ -753,8 +753,9 @@ SRCS =  mifare/aiddesfire.c \
         cmdhfmf.c \
         cmdhfmfdes.c \
         cmdhfmfhard.c \
-        cmdhfmfu.c \
         cmdhfmfp.c \
+        cmdhfmfsen.c \
+        cmdhfmfu.c \
         cmdhfntag424.c \
         cmdhfsaflok.c \
         cmdhfseos.c \

client/experimental_lib/CMakeLists.txt

@@ -331,6 +331,7 @@ set (TARGET_SOURCES
         ${PM3_ROOT}/client/src/cmdhfmfdes.c
         ${PM3_ROOT}/client/src/cmdhfmfhard.c
         ${PM3_ROOT}/client/src/cmdhfmfp.c
+        ${PM3_ROOT}/client/src/cmdhfmfsen.c
         ${PM3_ROOT}/client/src/cmdhfmfu.c
         ${PM3_ROOT}/client/src/cmdhfntag424.c
         ${PM3_ROOT}/client/src/cmdhfsaflok.c

client/src/cmdhfmf.c

@@ -47,6 +47,7 @@
 #include "fpga.h"
 #include "mifare/mifarehost.h"
 #include "crypto/originality.h"
+#include "cmdhfmfsen.h"     // Mifare Classic Static Nonce
 
 // Defines for Saflok parsing
 #define SAFLOK_YEAR_OFFSET 1980
@@ -11086,6 +11087,7 @@ static command_t CommandTable[] = {
     {"nested",      CmdHF14AMfNested,       IfPm3Iso14443a,  "Nested attack"},
     {"hardnested",  CmdHF14AMfNestedHard,   AlwaysAvailable, "Nested attack for hardened MIFARE Classic cards"},
     {"staticnested", CmdHF14AMfNestedStatic, IfPm3Iso14443a, "Nested attack against static nonce MIFARE Classic cards"},
+    {"sen",         CmdHF14AMfSEN,          IfPm3Iso14443a,  "FM11RF08S Static Encrypted Nonce attack"},
     {"brute",       CmdHF14AMfSmartBrute,   IfPm3Iso14443a,  "Smart bruteforce to exploit weak key generators"},
     {"autopwn",     CmdHF14AMfAutoPWN,      IfPm3Iso14443a,  "Automatic key recovery tool for MIFARE Classic"},
 //    {"keybrute",    CmdHF14AMfKeyBrute,     IfPm3Iso14443a,  "J_Run's 2nd phase of multiple sector nested authentication key recovery"},

client/src/cmdhfmfsen.h

@@ -0,0 +1,40 @@
+//-----------------------------------------------------------------------------
+// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// See LICENSE.txt for the text of the license.
+//-----------------------------------------------------------------------------
+// FM11RF08S static encrypted nonce recovery
+//-----------------------------------------------------------------------------
+
+#ifndef CMDHFMFSEN_H__
+#define CMDHFMFSEN_H__
+
+#include <stdint.h>
+#include "mifare.h"
+#include "mifare/mifaredefault.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define FM11_BACKDOOR_KEY_COUNT 4
+extern const uint8_t fm11_backdoor_keys[FM11_BACKDOOR_KEY_COUNT][MIFARE_KEY_SIZE];
+
+int fm11_collect_nonces(const uint8_t *key, iso14a_card_select_t *card, iso14a_fm11rf08s_nonces_with_data_t *nonces);
+int CmdHF14AMfSEN(const char *Cmd);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CMDHFMFSEN_H__ */

client/src/mifare/mifaredefault.h

@@ -115,6 +115,8 @@ static const uint64_t g_mifare_default_keys[] = {
     0x587ee5f9350f,
     0xa0478cc39091,
     0x533cb6c723f6,
+    0x717273747555,
+    0x434445464733,
     0x8fd0a4f256e9,
     0x0000014b5c31,
     0xb578f38a5c61,

client/src/mifare/mifarehost.c

@@ -309,13 +309,20 @@ int mf_check_keys_fast_ex(uint8_t sectorsCnt, uint8_t firstChunk, uint8_t lastCh
     if ((singleSectorParams >> 15) & 1) {
 
         if (curr_keys) {
+            uint8_t block_no = singleSectorParams & 0xFF;
+            uint8_t key_type = (singleSectorParams >> 8) & 1;
+            uint8_t sector_no = mfSectorNum(block_no);
+            if (sector_no < sectorsCnt) {
+                e_sector[sector_no].Key[key_type] = bytes_to_num(resp.data.asBytes, MIFARE_KEY_SIZE);
+                e_sector[sector_no].foundKey[key_type] = true;
+            }
 
             PrintAndLogEx(NORMAL, "");
             PrintAndLogEx(SUCCESS, "\nTarget block " _GREEN_("%4u") " key type " _GREEN_("%c") " -- found valid key [ " _GREEN_("%s") " ]",
-                          singleSectorParams & 0xFF,
-                          ((singleSectorParams >> 8) & 1) ? 'B' : 'A',
-                          sprint_hex_inrow(resp.data.asBytes, MIFARE_KEY_SIZE)
-                         );
+                            block_no,
+                            key_type ? 'B' : 'A',
+                            sprint_hex_inrow(resp.data.asBytes, MIFARE_KEY_SIZE)
+                            );
 
             return PM3_SUCCESS;
         }