mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-01-09 09:39:16 +08:00
119 lines
2.9 KiB
Lua
119 lines
2.9 KiB
Lua
-- Run me like this (connected via USB): ./pm3 -l hf_bruteforce.lua
|
|
-- Run me like this (connected via Blueshark addon): ./client/proxmark3 /dev/rfcomm0 -l ./hf_bruteforce.lua
|
|
|
|
local getopt = require('getopt')
|
|
|
|
copyright = ''
|
|
author = 'Daniel Underhay (updated), Keld Norman(original)'
|
|
version = 'v2.0.0'
|
|
usage = [[
|
|
|
|
pm3 --> script run hf_bruteforce -s start_id -e end_id -t timeout -x mifare_card_type
|
|
|
|
Arguments:
|
|
-h this help
|
|
-s 0-0xFFFFFFFF start id
|
|
-e 0-0xFFFFFFFF end id
|
|
-t 0-99999, pause timeout (ms) between cards (use the word 'pause' to wait for user input)
|
|
-x mfc, mfu mifare type: mfc for Mifare Classic (default) or mfu for Mifare Ultralight EV1
|
|
|
|
|
|
Example:
|
|
|
|
pm3 --> script run hf_bruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
|
|
|
|
Bruteforce a 4 byte UID Mifare classic card number, starting at 11223344, ending at 11223346.
|
|
|
|
|
|
pm3 --> script run hf_bruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
|
|
|
|
Bruteforce a 7 byte UID Mifare Ultralight card number, starting at 11223344556677, ending at 11223344556679.
|
|
|
|
]]
|
|
|
|
|
|
local DEBUG = true
|
|
|
|
---
|
|
-- Debug print function
|
|
local function dbg(args)
|
|
if not DEBUG then return end
|
|
if type(args) == 'table' then
|
|
local i = 1
|
|
while result[i] do
|
|
dbg(result[i])
|
|
i = i+1
|
|
end
|
|
else
|
|
print('###', args)
|
|
end
|
|
end
|
|
---
|
|
-- When errors occur
|
|
local function oops(err)
|
|
print('ERROR:', err)
|
|
core.clearCommandBuffer()
|
|
return nil, err
|
|
end
|
|
---
|
|
-- Usage help
|
|
local function help()
|
|
print(copyright)
|
|
print(author)
|
|
print(version)
|
|
print(desc)
|
|
print('Example usage')
|
|
print(example)
|
|
print(usage)
|
|
end
|
|
---
|
|
--- Print user message
|
|
local function msg(msg)
|
|
print( string.rep('--',20) )
|
|
print('')
|
|
print(msg)
|
|
print('')
|
|
print( string.rep('--',20) )
|
|
end
|
|
---
|
|
-- Start
|
|
local function main(args)
|
|
|
|
local timeout = 0
|
|
local start_id = 0
|
|
local end_id = 0xFFFFFFFFFFFFFF
|
|
local mftype = 'mfc'
|
|
|
|
for o, a in getopt.getopt(args, 'e:s:t:x:h') do
|
|
if o == 's' then start_id = a end
|
|
if o == 'e' then end_id = a end
|
|
if o == 't' then timeout = a end
|
|
if o == 'x' then mftype = a end
|
|
if o == 'h' then return print(usage) end
|
|
end
|
|
|
|
-- template
|
|
local command = ''
|
|
|
|
if mftype == 'mfc' then
|
|
command = 'hf 14a sim t 1 u %14X'
|
|
msg('Bruteforcing Mifare Classic card numbers')
|
|
elseif mftype == 'mfu' then
|
|
command = 'hf 14a sim t 2 u %14X'
|
|
msg('Bruteforcing Mifare Ultralight card numbers')
|
|
else
|
|
return print(usage)
|
|
end
|
|
|
|
if command == '' then return print(usage) end
|
|
|
|
for n = start_id, end_id do
|
|
local c = string.format( command, n )
|
|
print('Running: "'..c..'"')
|
|
core.console(c)
|
|
core.console('msleep '..timeout);
|
|
core.console('hw ping')
|
|
end
|
|
|
|
end
|
|
main(args)
|