RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-02-13 10:43:01 +08:00
Code Issues Projects Releases Packages Wiki Activity

REM: removed an unused doublett function "printBits" in util.c

Browse source 
ADD:  added a new string helper function "sprint_hex_ascii" in util.c
ADD:  added "LF AWID BRUTE", a very simple bruteforce command for the awid commands.
      it takes a facility-code,  and iterates all possible 0xFFFF cardnum by sending sim command. It also uses the usb_poll function to stop the bruteforce on keypress and not leaving the pm3 device running the simulation.
the command implements the help parameter.
This commit is contained in:
iceman1001 2015-12-14 22:50:54 +01:00
parent 0c97a4562d
commit 508b37ba9c
6 changed files with 73 additions and 47 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
armsrc/lfops.c
View file

@ -400,7 +400,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
for(;;) {
//wait until SSC_CLK goes HIGH
while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
if(BUTTON_PRESS() || (usb_poll_validate_length() )) {
if(BUTTON_PRESS() || usb_poll_validate_length() ) {
DbpString("Stopped");
return;
}
@ -417,7 +417,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
//wait until SSC_CLK goes LOW
while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
if(BUTTON_PRESS()) {
if( BUTTON_PRESS() || usb_poll_validate_length() ) {
DbpString("Stopped");
return;
}
@ -594,20 +594,10 @@ void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
}
}
Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, invert: %d, n: %d",fcHigh, fcLow, clk, invert, n);
/*Dbprintf("DEBUG: First 32:");
uint8_t *dest = BigBuf_get_addr();
i=0;
Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
i+=16;
Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
*/
if (ledcontrol)
LED_A_ON();
if (ledcontrol) LED_A_ON();
SimulateTagLowFrequency(n, 0, ledcontrol);
if (ledcontrol)
LED_A_OFF();
if (ledcontrol) LED_A_OFF();
}
// compose ask waveform for one bit(ASK)

63
client/cmdlfawid.c
View file

@ -19,7 +19,8 @@
#include "util.h" // weigandparity
#include "protocols.h" // for T55xx config register definitions
#include "cmdmain.h"
#include "sleep.h"
static int CmdHelp(const char *Cmd);
int usage_lf_awid_fskdemod(void) {
@ -57,7 +58,7 @@ int usage_lf_awid_clone(void) {
PrintAndLog("");
PrintAndLog("Usage: lf awid clone <Facility-Code> <Card-Number>");
PrintAndLog("Options :");
PrintAndLog(" <Facility-Code> : 8-bit value AWID facility code");
PrintAndLog(" <Facility-Code> : 8-bit value AWID facility code");
PrintAndLog(" <Card Number> : 16-bit value AWID card number");
PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
PrintAndLog("");
@ -65,6 +66,18 @@ int usage_lf_awid_clone(void) {
return 0;
}
int usage_lf_awid_brute(void){
PrintAndLog("Enables bruteforce of AWID26 card with specified facility-code.");
PrintAndLog("Per AWID26 format, the facility-code (FC) is 8-bit and the card number is 16-bit.");
PrintAndLog("");
PrintAndLog("Usage: lf awid brute <Facility-Code>");
PrintAndLog("Options :");
PrintAndLog(" <Facility-Code> : 8-bit value AWID facility code");
PrintAndLog("");
PrintAndLog("Sample : lf awid brute 224");
return 0;
}
int CmdAWIDDemodFSK(const char *Cmd) {
int findone = 0;
if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod();
@ -189,11 +202,57 @@ int CmdAWIDClone(const char *Cmd) {
return 0;
}
int CmdAWIDBrute(const char *Cmd){
uint8_t fc = 0x00;
uint8_t bits[96];
uint8_t *bs = bits;
size_t size = sizeof(bits);
memset(bs, 0x00, size);
char cmdp = param_getchar(Cmd, 0);
if (strlen(Cmd) > 3 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_brute();
fc = param_get8(Cmd, 0);
if ( fc == 0) return usage_lf_awid_brute();
PrintAndLog("Bruteforceing AWID26");
PrintAndLog("Press pm3-button to abort simulation or run another command");
uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
uint64_t arg2 = 50; // clk RF/50 invert=0
UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};
for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){
if (ukbhit()) {
PrintAndLog("aborted via keyboard!");
c.cmd = CMD_PING;
c.arg[0] = 0x00;
c.arg[1] = 0x00;
c.arg[2] = 0x00;
clearCommandBuffer();
SendCommand(&c);
return 1;
}
(void)getAWIDBits(fc, cn, bs);
memcpy(c.d.asBytes, bs, size);
clearCommandBuffer();
SendCommand(&c);
PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
// pause
sleep(1);
}
return 0;
}
static command_t CommandTable[] = {
{"help", CmdHelp, 1, "This help"},
{"fskdemod", CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"},
{"sim", CmdAWIDSim, 0, "<Facility-Code> <Card Number> -- AWID tag simulator"},
{"clone", CmdAWIDClone, 0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7"},
{"brute", CmdAWIDBrute, 0, "<Facility-Code> -- bruteforce card number"},
{NULL, NULL, 0, NULL}
};

3
client/cmdlfawid.h
View file

@ -12,13 +12,14 @@
#define CMDLFAWID_H__
int CmdLFAWID(const char *Cmd);
//int CmdAWIDDemod(const char *Cmd);
int CmdAWIDDemodFSK(const char *Cmd);
int CmdAWIDSim(const char *Cmd);
int CmdAWIDClone(const char *Cmd);
int CmdAWIDBrute(const char *Cmd);
int getAWIDBits(unsigned int fc, unsigned int cn, uint8_t *AWIDBits);
int usage_lf_awid_fskdemod(void);
int usage_lf_awid_clone(void);
int usage_lf_awid_sim(void);
int usage_lf_awid_brute(void);
#endif

34
client/util.c
View file

@ -159,6 +159,8 @@ char *sprint_bin(const uint8_t *data, const size_t len) {
char *sprint_hex_ascii(const uint8_t *data, const size_t len) {
static char buf[1024];
memset(buf, 0x00, 1024);
char *tmp = buf;
sprintf(tmp, "%s| %s", sprint_hex(data, len) , data);
return buf;
}
void num_to_bytes(uint64_t n, size_t len, uint8_t* dest)
@ -192,8 +194,8 @@ void num_to_bytebits(uint64_t n, size_t len, uint8_t *dest) {
// hh,gg,ff,ee,dd,cc,bb,aa, pp,oo,nn,mm,ll,kk,jj,ii
// up to 64 bytes or 512 bits
uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize){
//static uint8_t buf[64];
uint8_t buf[64];
static uint8_t buf[64];
//uint8_t buf[64];
memset(buf, 0x00, 64);
uint8_t *tmp = buf;
for (uint8_t block=0; block < (uint8_t)(len/blockSize); block++){
@ -204,28 +206,6 @@ uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockS
return tmp;
}
//assumes little endian
char * printBits(size_t const size, void const * const ptr)
{
unsigned char *b = (unsigned char*) ptr;
unsigned char byte;
static char buf[1024];
char * tmp = buf;
int i, j;
for (i=size-1;i>=0;i--)
{
for (j=7;j>=0;j--)
{
byte = b[i] & (1<<j);
byte >>= j;
sprintf(tmp, "%u", byte);
tmp++;
}
}
return buf;
}
// -------------------------------------------------------------------------
// string parameters lib
// -------------------------------------------------------------------------
@ -344,13 +324,11 @@ int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt)
{
int bg, en, temp, i;
if (hexcnt % 2)
return 1;
if (hexcnt & 1) return 1;
if (param_getptr(line, &bg, &en, paramnum)) return 1;
if (en - bg + 1 != hexcnt)
return 1;
if (en - bg + 1 != hexcnt) return 1;
for(i = 0; i < hexcnt; i += 2) {
if (!(isxdigit(line[bg + i]) && isxdigit(line[bg + i + 1])) ) return 1;

1
client/util.h
View file

@ -45,7 +45,6 @@ char *sprint_hex_ascii(const uint8_t *data, const size_t len);
void num_to_bytes(uint64_t n, size_t len, uint8_t* dest);
uint64_t bytes_to_num(uint8_t* src, size_t len);
void num_to_bytebits(uint64_t n, size_t len, uint8_t *dest);
char * printBits(size_t const size, void const * const ptr);
uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize);
char param_getchar(const char *line, int paramnum);

1
common/usb_cdc.c
View file

@ -304,7 +304,6 @@ bool usb_poll()
**/
bool usb_poll_validate_length()
{
if (!usb_check()) return false;
if (!(pUdp->UDP_CSR[AT91C_EP_OUT] & btReceiveBank)) return false;
return (pUdp->UDP_CSR[AT91C_EP_OUT] >> 16) > 0;