From c43806b5dbd827c0c998338779a6b743864019a9 Mon Sep 17 00:00:00 2001 From: noproto Date: Tue, 10 Sep 2024 14:10:09 -0400 Subject: [PATCH] Speed up backdoor detection, alert on new backdoor --- .../protocols/mf_classic/mf_classic_poller.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/lib/nfc/protocols/mf_classic/mf_classic_poller.c b/lib/nfc/protocols/mf_classic/mf_classic_poller.c index de0d645fd..2b122679e 100644 --- a/lib/nfc/protocols/mf_classic/mf_classic_poller.c +++ b/lib/nfc/protocols/mf_classic/mf_classic_poller.c @@ -560,16 +560,19 @@ NfcCommand mf_classic_poller_handler_analyze_backdoor(MfClassicPoller* instance) // Attempt backdoor authentication MfClassicError error = mf_classic_poller_auth( instance, 0, &dict_attack_ctx->current_key, MfClassicKeyTypeA, NULL, true); - bool backdoor_found = (error == MfClassicErrorNone); - - if(backdoor_found) { + if((next_key_index == 0) && (error == MfClassicErrorProtocol)) { + FURI_LOG_E(TAG, "No backdoor identified"); + dict_attack_ctx->backdoor = MfClassicBackdoorNone; + instance->state = MfClassicPollerStateRequestKey; + } else if(error == MfClassicErrorNone) { FURI_LOG_E(TAG, "Backdoor identified: v%d", backdoor_version); dict_attack_ctx->backdoor = mf_classic_backdoor_keys[next_key_index].type; instance->state = MfClassicPollerStateBackdoorReadSector; - } else if(next_key_index == (mf_classic_backdoor_keys_count - 1)) { - // We've tried all backdoor keys - dict_attack_ctx->backdoor = MfClassicBackdoorNone; - instance->state = MfClassicPollerStateRequestKey; + } else if( + (error == MfClassicErrorAuth) && + (next_key_index == (mf_classic_backdoor_keys_count - 1))) { + // We've tried all backdoor keys, this is a unique key and an important research finding + furi_crash("New backdoor: please report!"); } return command; @@ -1083,6 +1086,7 @@ NfcCommand mf_classic_poller_handler_nested_collect_nt(MfClassicPoller* instance } NfcCommand mf_classic_poller_handler_nested_calibrate(MfClassicPoller* instance) { + // TODO: Discard outliers (e.g. greater than 3 standard deviations) NfcCommand command = NfcCommandContinue; MfClassicPollerDictAttackContext* dict_attack_ctx = &instance->mode_ctx.dict_attack_ctx; uint32_t nt_enc_temp_arr[MF_CLASSIC_NESTED_CALIBRATION_COUNT];