This commit is contained in:
iceman1001 2019-09-13 16:26:17 +02:00
parent ffa3e2a0f8
commit 49cd525cf1
2 changed files with 25 additions and 39 deletions

View file

@ -52,18 +52,17 @@ void RunMod() {
int playing = 0;
int cardRead = 0;
// Turn on selected LED
LED(selected + 1, 0);
for (;;) {
WDT_HIT();
// exit from SamyRun, send a usbcommand.
if (data_available()) break;
// Was our button held down or pressed?
int button_pressed = BUTTON_HELD(1000);
SpinDelay(300);
int button_pressed = BUTTON_HELD(280);
if (button_pressed != BUTTON_HOLD)
continue;
// Button was held for a second, begin recording
if (button_pressed > 0 && cardRead == 0) {
@ -71,16 +70,11 @@ void RunMod() {
LED(selected + 1, 0);
LED(LED_D, 0);
WAIT_BUTTON_RELEASED();
// record
DbpString("[=] starting recording");
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
/* need this delay to prevent catching some weird data */
SpinDelay(500);
CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
Dbprintf("[=] recorded %x %x %08x", selected, high[selected], low[selected]);
@ -99,12 +93,7 @@ void RunMod() {
// record
Dbprintf("[=] cloning %x %x %08x", selected, high[selected], low[selected]);
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
/* need this delay to prevent catching some weird data */
SpinDelay(500);
WAIT_BUTTON_RELEASED();
CopyHIDtoT55x7(0, high[selected], low[selected], 0);
Dbprintf("[=] cloned %x %x %08x", selected, high[selected], low[selected]);
@ -136,9 +125,7 @@ void RunMod() {
LED(LED_B, 0);
DbpString("[=] playing");
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
WAIT_BUTTON_RELEASED();
Dbprintf("[=] %x %x %08x", selected, high[selected], low[selected]);
CmdHIDsimTAG(high[selected], low[selected], 0);
@ -168,16 +155,15 @@ void RunMod() {
LED(LED_B, 0);
DbpString("[=] entering bruteforce mode");
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
WAIT_BUTTON_RELEASED();
// Calculate Facility Code and Card Number from high and low
uint32_t cardnum = (low[selected] >> 1) & 0xFFFFF;
uint32_t fc = ((high[selected] & 1) << 11) | (low[selected] >> 21);
uint32_t original_cardnum = cardnum;
Dbprintf("[=] Proxbrute - starting decrementing card number");
Dbprintf("[=] HID brute - starting decrementing card number");
while (cardnum > 0) {
@ -207,7 +193,7 @@ void RunMod() {
cardnum = original_cardnum;
Dbprintf("[=] Proxbrute - starting incrementing card number");
Dbprintf("[=] HID brute - starting incrementing card number");
while (cardnum <= 0xFFFFF) {
@ -247,13 +233,13 @@ void RunMod() {
LED(selected + 1, 0);
} else {
while (BUTTON_PRESS())
WDT_HIT();
WAIT_BUTTON_RELEASED();
}
}
}
out:
SpinErr((LED_A | LED_B | LED_C | LED_D), 250, 5);
DbpString("[=] exiting");
LEDsoff();
}

View file

@ -42,13 +42,13 @@ void RunMod() {
// exit from SamyRun, send a usbcommand.
if (data_available()) break;
// Was our button held down or pressed?
// Was our button held down or pressed?
int button_pressed = BUTTON_HELD(280);
if ( button_pressed != BUTTON_HOLD )
if (button_pressed != BUTTON_HOLD)
continue;
// Button was held for a second, begin recording
if ( state == STATE_READ ) {
if (state == STATE_READ) {
LEDsoff();
LED_A_ON();
@ -63,8 +63,8 @@ void RunMod() {
Dbprintf("[=] recorded | %x%08x", high, low);
// got nothing. blink and loop.
if ( high == 0 && low == 0 ) {
SpinErr( LED_A, 100, 12);
if (high == 0 && low == 0) {
SpinErr(LED_A, 100, 12);
DbpString("[=] only got zeros, retry recording after click");
continue;
}
@ -73,7 +73,7 @@ void RunMod() {
state = STATE_BRUTE;
continue;
} else if ( state == STATE_BRUTE ) {
} else if (state == STATE_BRUTE) {
LED_C_ON(); // Simulate
WAIT_BUTTON_RELEASED();
@ -97,7 +97,7 @@ void RunMod() {
// Was our button held down or pressed?
int button_pressed = BUTTON_HELD(280);
if ( button_pressed != BUTTON_HOLD ) break;
if (button_pressed != BUTTON_HOLD) break;
Dbprintf("[=] trying Facility = %08x ID %08x", high, i);
@ -107,13 +107,13 @@ void RunMod() {
SpinDelay(100);
}
state = STATE_READ;
SpinErr( (LED_A | LED_C ), 250, 2);
LEDsoff();
state = STATE_READ;
SpinErr((LED_A | LED_C), 250, 2);
LEDsoff();
}
}
SpinErr( (LED_A | LED_B | LED_C | LED_D), 250, 5);
SpinErr((LED_A | LED_B | LED_C | LED_D), 250, 5);
DbpString("[=] You can take the shell back :) ...");
LEDsoff();
}