Attack never gets past stage1 (tag reader : ACR122U-A9)

[xavave]

Hi,
This issue is still here ...After adding more printf to debug code I saw that ACR122U fails transceive bits with always the same error NFC_ERFTRANS -20 (RF Transmission Error)

res = nfc_initiator_transceive_bits(pnd, abtArEnc, 64, abtArEncPar, abtRx, sizeof(abtRx), abtRxPar))

and res always= -20 -->NFC_ERFTRANS

error thrown here : https://github.com/nfc-tools/mfcuk/blob/master/src/mfcuk.c#L605

maybe this is related to Known Issues:
1. The tag fixation with ACR122 is not performing well if CPU is under high load (eg. Flash Movie playing in IE, etc.)
2. Either a bug in libnfc 1.2.1 or a bug in RATB card-types 0x88 consecutive authentication goes like - one fails, one ok, even though correct keys are used
2.a Maybe need to check AC bits?
2.b Maybe AC bits/0x88 cards need a read/write or failed operation in between for the "state" to be ok and next auth to be successful?

Does anyone has an idea to solve known issue 2.b ?

Originally posted by @xavave in #30 (comment)

[DavidBerdik]

I am also having this issue. In some of my testing, mfcuk starts throwing errors as shown below.

[xavave]

after hours of debugging code in visual studio, with libnfc in debug log mode, I still can't solve it, but I saw there is a time out in pn53x.c even if I set the timeout value to infinity (0)

this error happens in mfcuk.c in function mfcuk_key_recovery_block
and the error is ALWAYS the same (-20) , so I never get some hits4 incremented (NACK error 0x05 is never hit)

[DavidBerdik]

I'm confused by what the implications of this are supposed to be. Are you suggesting that the issue lies with pn53x?

[xavave]

@DavidBerdik maybe there is an issue in pn53x.c but my knowledge is too limited to understand why for now .. I tried to contact mfcuk and libnfc authors (@neomilium ) to get some info, but no answer ..
mfcuk is supposed to hit NACK authentifcation error 0x5 sometimes(hit4 number) , but it doesn't

.. so I don't know which condition can break the loop on mfcuk_key_recovery_block function

Moreover in acr122_usb.c if I raise the usb timeout per pass (which is hardcoded with 200) to 500

I can then hit this error in acr122_usb_send (acr122_usb.c): Command Code verification failed with last_error = NFC_EIO (Invalid argument(s))

[DavidBerdik]

@xavave Thank you for putting so much effort in to this. I have tried doing this as well, but just like you, I am not knowledgeable enough to get it working. 😢

[xavave]

@DavidBerdik unfortunaltely, I don't know how to go further now, and libnfc project team (@neomilium , @doegox , @darconeous ) doesn't seem to be available ..
I've posted this issue on https://groups.google.com/forum/#!forum/nfc-tools-devel

[DavidBerdik]

@xavave I understand. Once your proxmark arrives and you have had time to test, please let me know of the results.

[xavave]

@DavidBerdik Hi , I tried to use darkside attack with proxmark 3 on tag with your hotel tag dump but :

[DavidBerdik]

@xavave What happens when you try to do the hardnested attack? The card uses several default keys and that one does work with the ACR122U.

[xavave]

@DavidBerdik mfoc hardnested (windows version) works well (as some keys are default keys) and quickly finds all keys on acr-122u (- 30 seconds)

with proxmark3 it works well too but, I have to specify at least one known key :

hardnested method on proxmark 3 as same input parameters than cropto1_bs.exe for ACR122U:
on proxmark 3 key solving is much faster (29 seconds on pm3 and 173 seconds on acr122U with same parameters: cropto1_bs_x64.exe 48925475AAE0 0 A 4 A)
cropto1_bs.exe with ACR122U, but results are the same:

btw cropto1_bs64 for windows is available on my blog post here:
http://legacy.averbouch.biz/libnfc-and-nfc-utils-binaries-on-windows-10/#alltools

other test with nested attack (duration : <5 seconds)

I tried also reader only attack which works well and quickly
following this post (in french):https://connect.ed-diamond.com/MISC/MISCHS-016/Proxmark-3-le-couteau-suisse-RFID

[Cazs03]

Not solution found? @xavave

[xavave]

@Cazs03 unfortunately, no, and libnfc team doesn't seem to work on this project these days...

[DavidBerdik]

@xavave Thank you for the details. Unfortunately, I cannot share my other test card on here for security reasons, so I guess I will be buying a proxmark as well.

[DavidBerdik]

@xavave I ordered a proxmark last week, but, between the fact that it's coming from China and COVID-19 drama, I'm not expecting it to be here for a while.