This commit is contained in:
iceman1001 2019-09-13 16:26:17 +02:00
parent ffa3e2a0f8
commit 49cd525cf1
2 changed files with 25 additions and 39 deletions

View file

@ -52,18 +52,17 @@ void RunMod() {
int playing = 0; int playing = 0;
int cardRead = 0; int cardRead = 0;
// Turn on selected LED
LED(selected + 1, 0);
for (;;) { for (;;) {
WDT_HIT(); WDT_HIT();
// exit from SamyRun, send a usbcommand. // exit from SamyRun, send a usbcommand.
if (data_available()) break; if (data_available()) break;
// Was our button held down or pressed? // Was our button held down or pressed?
int button_pressed = BUTTON_HELD(1000); int button_pressed = BUTTON_HELD(280);
SpinDelay(300); if (button_pressed != BUTTON_HOLD)
continue;
// Button was held for a second, begin recording // Button was held for a second, begin recording
if (button_pressed > 0 && cardRead == 0) { if (button_pressed > 0 && cardRead == 0) {
@ -71,16 +70,11 @@ void RunMod() {
LED(selected + 1, 0); LED(selected + 1, 0);
LED(LED_D, 0); LED(LED_D, 0);
WAIT_BUTTON_RELEASED();
// record // record
DbpString("[=] starting recording"); DbpString("[=] starting recording");
// wait for button to be released
while (BUTTON_PRESS())
WDT_HIT();
/* need this delay to prevent catching some weird data */
SpinDelay(500);
CmdHIDdemodFSK(1, &high[selected], &low[selected], 0); CmdHIDdemodFSK(1, &high[selected], &low[selected], 0);
Dbprintf("[=] recorded %x %x %08x", selected, high[selected], low[selected]); Dbprintf("[=] recorded %x %x %08x", selected, high[selected], low[selected]);
@ -99,12 +93,7 @@ void RunMod() {
// record // record
Dbprintf("[=] cloning %x %x %08x", selected, high[selected], low[selected]); Dbprintf("[=] cloning %x %x %08x", selected, high[selected], low[selected]);
// wait for button to be released WAIT_BUTTON_RELEASED();
while (BUTTON_PRESS())
WDT_HIT();
/* need this delay to prevent catching some weird data */
SpinDelay(500);
CopyHIDtoT55x7(0, high[selected], low[selected], 0); CopyHIDtoT55x7(0, high[selected], low[selected], 0);
Dbprintf("[=] cloned %x %x %08x", selected, high[selected], low[selected]); Dbprintf("[=] cloned %x %x %08x", selected, high[selected], low[selected]);
@ -136,9 +125,7 @@ void RunMod() {
LED(LED_B, 0); LED(LED_B, 0);
DbpString("[=] playing"); DbpString("[=] playing");
// wait for button to be released WAIT_BUTTON_RELEASED();
while (BUTTON_PRESS())
WDT_HIT();
Dbprintf("[=] %x %x %08x", selected, high[selected], low[selected]); Dbprintf("[=] %x %x %08x", selected, high[selected], low[selected]);
CmdHIDsimTAG(high[selected], low[selected], 0); CmdHIDsimTAG(high[selected], low[selected], 0);
@ -168,16 +155,15 @@ void RunMod() {
LED(LED_B, 0); LED(LED_B, 0);
DbpString("[=] entering bruteforce mode"); DbpString("[=] entering bruteforce mode");
// wait for button to be released
while (BUTTON_PRESS()) WAIT_BUTTON_RELEASED();
WDT_HIT();
// Calculate Facility Code and Card Number from high and low // Calculate Facility Code and Card Number from high and low
uint32_t cardnum = (low[selected] >> 1) & 0xFFFFF; uint32_t cardnum = (low[selected] >> 1) & 0xFFFFF;
uint32_t fc = ((high[selected] & 1) << 11) | (low[selected] >> 21); uint32_t fc = ((high[selected] & 1) << 11) | (low[selected] >> 21);
uint32_t original_cardnum = cardnum; uint32_t original_cardnum = cardnum;
Dbprintf("[=] Proxbrute - starting decrementing card number"); Dbprintf("[=] HID brute - starting decrementing card number");
while (cardnum > 0) { while (cardnum > 0) {
@ -207,7 +193,7 @@ void RunMod() {
cardnum = original_cardnum; cardnum = original_cardnum;
Dbprintf("[=] Proxbrute - starting incrementing card number"); Dbprintf("[=] HID brute - starting incrementing card number");
while (cardnum <= 0xFFFFF) { while (cardnum <= 0xFFFFF) {
@ -247,13 +233,13 @@ void RunMod() {
LED(selected + 1, 0); LED(selected + 1, 0);
} else { } else {
while (BUTTON_PRESS()) WAIT_BUTTON_RELEASED();
WDT_HIT();
} }
} }
} }
out: out:
SpinErr((LED_A | LED_B | LED_C | LED_D), 250, 5);
DbpString("[=] exiting"); DbpString("[=] exiting");
LEDsoff(); LEDsoff();
} }

View file

@ -42,13 +42,13 @@ void RunMod() {
// exit from SamyRun, send a usbcommand. // exit from SamyRun, send a usbcommand.
if (data_available()) break; if (data_available()) break;
// Was our button held down or pressed? // Was our button held down or pressed?
int button_pressed = BUTTON_HELD(280); int button_pressed = BUTTON_HELD(280);
if ( button_pressed != BUTTON_HOLD ) if (button_pressed != BUTTON_HOLD)
continue; continue;
// Button was held for a second, begin recording // Button was held for a second, begin recording
if ( state == STATE_READ ) { if (state == STATE_READ) {
LEDsoff(); LEDsoff();
LED_A_ON(); LED_A_ON();
@ -63,8 +63,8 @@ void RunMod() {
Dbprintf("[=] recorded | %x%08x", high, low); Dbprintf("[=] recorded | %x%08x", high, low);
// got nothing. blink and loop. // got nothing. blink and loop.
if ( high == 0 && low == 0 ) { if (high == 0 && low == 0) {
SpinErr( LED_A, 100, 12); SpinErr(LED_A, 100, 12);
DbpString("[=] only got zeros, retry recording after click"); DbpString("[=] only got zeros, retry recording after click");
continue; continue;
} }
@ -73,7 +73,7 @@ void RunMod() {
state = STATE_BRUTE; state = STATE_BRUTE;
continue; continue;
} else if ( state == STATE_BRUTE ) { } else if (state == STATE_BRUTE) {
LED_C_ON(); // Simulate LED_C_ON(); // Simulate
WAIT_BUTTON_RELEASED(); WAIT_BUTTON_RELEASED();
@ -97,7 +97,7 @@ void RunMod() {
// Was our button held down or pressed? // Was our button held down or pressed?
int button_pressed = BUTTON_HELD(280); int button_pressed = BUTTON_HELD(280);
if ( button_pressed != BUTTON_HOLD ) break; if (button_pressed != BUTTON_HOLD) break;
Dbprintf("[=] trying Facility = %08x ID %08x", high, i); Dbprintf("[=] trying Facility = %08x ID %08x", high, i);
@ -107,13 +107,13 @@ void RunMod() {
SpinDelay(100); SpinDelay(100);
} }
state = STATE_READ; state = STATE_READ;
SpinErr( (LED_A | LED_C ), 250, 2); SpinErr((LED_A | LED_C), 250, 2);
LEDsoff(); LEDsoff();
} }
} }
SpinErr( (LED_A | LED_B | LED_C | LED_D), 250, 5); SpinErr((LED_A | LED_B | LED_C | LED_D), 250, 5);
DbpString("[=] You can take the shell back :) ..."); DbpString("[=] You can take the shell back :) ...");
LEDsoff(); LEDsoff();
} }