Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
Hi Iceman
I using your latest code to run 'hardnested ' however, it run into 'out of memory error' ,can you take a look what's the problem here?
sony@MichaelFu MINGW32 ~/iceman1001/client
$ ./proxmark3.exe com3
Prox/RFID mark3 RFID instrument
bootrom: iceman/master/v1.1.0-1678-g9c6000a-suspect 2016-10-29 23:04:07
os: iceman/master/v1.1.0-1678-g9c6000a-suspect 2016-10-29 23:04:26
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8
uC: AT91SAM7S256 Rev D
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 216554 bytes (83). Free: 45590 bytes (17).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
pm3 --> hf mf hardnested 0 A FFFFFFFFFFFF 63 A
hf mf hardnested 0 A FFFFFFFFFFFF 63 A
--target block no: 63, target key type:A, known target key: 0x000000000000 (not set), file action: none, Slow: No, Tests: 0
Allocating memory for partial statelists...
Generating partial statelists...
Generating bitflip statelist...
Acquiring nonces...
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Checking for Filter Flip Properties...
Acquired 1904 nonces ( 1622 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 20
Acquired 2016 nonces ( 1629 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 20
Acquired 2576 nonces ( 2067 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 3024 nonces ( 2248 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 4
Acquired 3584 nonces ( 2637 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 4032 nonces ( 2809 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 4592 nonces ( 3042 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 5040 nonces ( 3214 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Acquired 5600 nonces ( 3410 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Acquired 6048 nonces ( 3635 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Acquired 6608 nonces ( 3909 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 7056 nonces ( 3991 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Number of remaining possible keys: 3110444172640 (2^41.5)
Time for generating key candidates list: 6 seconds
Acquired 7504 nonces ( 4062 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Acquired 8064 nonces ( 4404 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 8512 nonces ( 4489 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 9072 nonces ( 4620 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 9520 nonces ( 4748 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Acquired 10080 nonces ( 4891 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Number of remaining possible keys: 608209898420 (2^39.1)
Time for generating key candidates list: 8 seconds
Acquired 10528 nonces ( 5040 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 11088 nonces ( 5195 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 11536 nonces ( 5240 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 12096 nonces ( 5418 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 12544 nonces ( 5445 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
Acquired 13104 nonces ( 5473 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
Acquired 13552 nonces ( 5512 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 14112 nonces ( 5603 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 9
Acquired 14560 nonces ( 5717 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 9
Acquired 15008 nonces ( 5762 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 9
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 15568 nonces ( 5911 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 11
Acquired 16016 nonces ( 5935 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 11
Acquired 16576 nonces ( 6006 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 12
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Number of remaining possible keys: 7736753012 (2^32.8)
Time for generating key candidates list: 4 seconds
Brute force phase starting.
Using 256-bit bitslices
Bitslicing best_first_byte^uid[3] (rollback byte): 02 ...
Bitslicing nonces...
Starting 4 cracking threads to search 68 buckets containing a total of 7736753012 states...
....................................................................Fail! Tested 3441785716 states, in 23 seconds
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Number of remaining possible keys: 7732334004 (2^32.8)
Time for generating key candidates list: 5 seconds
Brute force phase starting.
Using 256-bit bitslices
Bitslicing best_first_byte^uid[3] (rollback byte%2
Offline
Hi,
I do some mods to hardnested attack, could you save the nonces collected with 'w' and upload somewhere for debug it?
Thanks
Hi Iceman
I using your latest code to run 'hardnested ' however, it run into 'out of memory error' ,can you take a look what's the problem here?
sony@MichaelFu MINGW32 ~/iceman1001/client
$ ./proxmark3.exe com3
Prox/RFID mark3 RFID instrument
bootrom: iceman/master/v1.1.0-1678-g9c6000a-suspect 2016-10-29 23:04:07
os: iceman/master/v1.1.0-1678-g9c6000a-suspect 2016-10-29 23:04:26
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8uC: AT91SAM7S256 Rev D
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 216554 bytes (83). Free: 45590 bytes (17).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memorypm3 --> hf mf hardnested 0 A FFFFFFFFFFFF 63 A
hf mf hardnested 0 A FFFFFFFFFFFF 63 A
--target block no: 63, target key type:A, known target key: 0x000000000000 (not set), file action: none, Slow: No, Tests: 0
Allocating memory for partial statelists...
Generating partial statelists...
Generating bitflip statelist...
Acquiring nonces...
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Checking for Filter Flip Properties...
Acquired 1904 nonces ( 1622 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 20
Acquired 2016 nonces ( 1629 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 20
Acquired 2576 nonces ( 2067 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 3024 nonces ( 2248 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 4
Acquired 3584 nonces ( 2637 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 4032 nonces ( 2809 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 4592 nonces ( 3042 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 5040 nonces ( 3214 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Acquired 5600 nonces ( 3410 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Acquired 6048 nonces ( 3635 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Acquired 6608 nonces ( 3909 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 7056 nonces ( 3991 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Number of remaining possible keys: 3110444172640 (2^41.5)
Time for generating key candidates list: 6 seconds
Acquired 7504 nonces ( 4062 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 0
Acquired 8064 nonces ( 4404 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 8512 nonces ( 4489 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 9072 nonces ( 4620 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Acquired 9520 nonces ( 4748 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Acquired 10080 nonces ( 4891 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 1
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Number of remaining possible keys: 608209898420 (2^39.1)
Time for generating key candidates list: 8 seconds
Acquired 10528 nonces ( 5040 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 11088 nonces ( 5195 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 11536 nonces ( 5240 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 2
Acquired 12096 nonces ( 5418 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 12544 nonces ( 5445 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
Acquired 13104 nonces ( 5473 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
Acquired 13552 nonces ( 5512 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 7
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 14112 nonces ( 5603 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 9
Acquired 14560 nonces ( 5717 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 9
Acquired 15008 nonces ( 5762 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 9
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
#db# AcquireNonces: Can't select card (UID)
Acquired 15568 nonces ( 5911 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 11
Acquired 16016 nonces ( 5935 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 11
Acquired 16576 nonces ( 6006 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 12
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
#db# Authentication failed. Error card response.
#db# AcquireNonces: Auth1 error
Number of remaining possible keys: 7736753012 (2^32.8)
Time for generating key candidates list: 4 seconds
Brute force phase starting.
Using 256-bit bitslices
Bitslicing best_first_byte^uid[3] (rollback byte): 02 ...
Bitslicing nonces...
Starting 4 cracking threads to search 68 buckets containing a total of 7736753012 states...
....................................................................Fail! Tested 3441785716 states, in 23 seconds
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Number of remaining possible keys: 7732334004 (2^32.8)
Time for generating key candidates list: 5 seconds
Brute force phase starting.
Using 256-bit bitslices
Bitslicing best_first_byte^uid[3] (rollback byte%2
Offline
This one doesn't cause the outofmem, but it did cause a seg kill when it was made.
Offline
Hi matrix
I reproduce the issue and upload the nonces.bin for your debugging. I am just guessing there are some memory leak in your mod. looks like your mod is automatically resuming to search the bucket from the break point when the first round fail .
the file is here:
https://www.sendspace.com/file/9a0u5f
and the following is a snapshot for this reproduction:
Starting 4 cracking threads to search 68 buckets containing a total of 1506617192 states...
....................................................................Fail! Tested 1506617192 states, in 9 seconds
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Number of remaining possible keys: 473158520 (2^28.8)
Time for generating key candidates list: 10 seconds
Brute force phase starting.
Using 256-bit bitslices
Bitslicing best_first_byte^uid[3] (rollback byte): CB ...
Bitslicing nonces...
Starting 4 cracking threads to search 68 buckets containing a total of 473158520 states...
....................................................................Fail! Tested 473158520 states, in 2 seconds
Acquired 16016 nonces ( 6576 with distinct bytes 0 and 1). Number of bytes with probability for correctly guessed Sum(a8) > 95.0%: 24
Generating crypto1 state candidates...
Number of possible keys with Sum(a0) = 128: 117726714265600 (2^46.7)
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Out of memory error.
Number of remaining possible keys: 407397222 (2^28.6)
Time for generating key candidates list: 8 seconds
Brute force phase starting.
Using 256-bit bitslices
Bitslicing best_first_byte^uid[3] (rollback byte): CB ...
Bitslicing nonces...
Starting 4 cracking threads to search 68 buckets containing a total of 407397222 states...
..................................................
sony@MichaelFu MINGW32 ~/iceman1001/client
$
Hi,
I do some mods to hardnested attack, could you save the nonces collected with 'w' and upload somewhere for debug it?
Thanks
Last edited by lasersword (2016-10-30 04:32:10)
Offline
Hi @lasersword,
I do other mods this night, not yet committed to @iceman fork.
Check it here : https://github.com/matrix/proxmark3
Could you retest them ?
Thanks,
matrix
Offline
I've pushed @matrix latest commit into iceman fork.
Running it: http://pastebin.com/sxR6up1P
Offline
Offline
Not anymore.
Offline
Pages: 1