]> git.zerfleddert.de Git - proxmark3-svn/commitdiff
Cleanup Code
authormwalker33 <mwal5099@bigpond.net.au>
Tue, 18 Jun 2019 11:17:12 +0000 (21:17 +1000)
committermwalker33 <mwal5099@bigpond.net.au>
Tue, 18 Jun 2019 11:17:12 +0000 (21:17 +1000)
Update downlink option from e to r
fixed long leading reference
added downling option to original bruteforce

armsrc/lfops.c
client/cmdlft55xx.c
client/cmdlft55xx.h

index 36efe72900494ac8ace5616c04a694a5bb830bb4..112a11739f5d165053f7b70f9f5a4bef359f6fb5 100644 (file)
@@ -1519,6 +1519,10 @@ void T55xxWriteBlockExt(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg
        uint8_t Page = (arg & 0x2)>>1;
        bool testMode = arg & 0x4;
        uint32_t i = 0;
        uint8_t Page = (arg & 0x2)>>1;
        bool testMode = arg & 0x4;
        uint32_t i = 0;
+       uint8_t downlink_mode;
+       
+       downlink_mode = (arg >> 3) & 0x03;
+       
 
        // Set up FPGA, 125kHz
        LFSetupFPGAForADC(95, true);
 
        // Set up FPGA, 125kHz
        LFSetupFPGAForADC(95, true);
@@ -1529,6 +1533,9 @@ void T55xxWriteBlockExt(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        WaitUS(START_GAP);
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        WaitUS(START_GAP);
 
+       // Long Leading Reference, same as fixed/default just with leading reference
+       if (downlink_mode == 1)  T55xxWrite_LLR (); 
+
        if (testMode) Dbprintf("TestMODE");
        // Std Opcode 10
        T55xxWriteBit(testMode ? 0 : 1);
        if (testMode) Dbprintf("TestMODE");
        // Std Opcode 10
        T55xxWriteBit(testMode ? 0 : 1);
@@ -1597,8 +1604,8 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t arg) {
        
        switch (downlink_mode)
        {
        
        switch (downlink_mode)
        {
-               case 0 :        T55xxWriteBlockExt          (Data, Block, Pwd, arg);    break;
-               case 1 :    T55xxWrite_LLR ();
+               case 0 ://      T55xxWriteBlockExt          (Data, Block, Pwd, arg);    break;
+               case 1 :  //  T55xxWrite_LLR ();
                                        T55xxWriteBlockExt          (Data, Block, Pwd, arg);
                                        break;
                case 2 :        T55xxWriteBlockExt_Leading0 (Data, Block, Pwd, arg);    break;
                                        T55xxWriteBlockExt          (Data, Block, Pwd, arg);
                                        break;
                case 2 :        T55xxWriteBlockExt_Leading0 (Data, Block, Pwd, arg);    break;
@@ -1618,7 +1625,10 @@ void T55xxReadBlockExt (uint16_t arg0, uint8_t Block, uint32_t Pwd) {
        uint8_t Page = (arg0 & 0x2) >> 1;
        uint32_t i = 0;
        bool RegReadMode = (Block == 0xFF);//regular read mode
        uint8_t Page = (arg0 & 0x2) >> 1;
        uint32_t i = 0;
        bool RegReadMode = (Block == 0xFF);//regular read mode
-
+       uint8_t downlink_mode;
+       
+       downlink_mode = (arg0 >> 3) & 0x03;
+       
        //clear buffer now so it does not interfere with timing later
        BigBuf_Clear_ext(false);
 
        //clear buffer now so it does not interfere with timing later
        BigBuf_Clear_ext(false);
 
@@ -1634,6 +1644,9 @@ void T55xxReadBlockExt (uint16_t arg0, uint8_t Block, uint32_t Pwd) {
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        WaitUS(START_GAP);
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        WaitUS(START_GAP);
 
+       // Long Leading Reference, same as fixed/default just with leading reference
+       if (downlink_mode == 1)  T55xxWrite_LLR (); 
+               
        // Opcode 1[page]
        T55xxWriteBit(1);
        T55xxWriteBit(Page); //Page 0
        // Opcode 1[page]
        T55xxWriteBit(1);
        T55xxWriteBit(Page); //Page 0
@@ -1805,8 +1818,8 @@ void T55xxReadBlock (uint16_t arg0, uint8_t Block, uint32_t Pwd) {
        //  downlink mode id set to match the 2 bit as per Tech Sheet
        switch (downlink_mode)
        {
        //  downlink mode id set to match the 2 bit as per Tech Sheet
        switch (downlink_mode)
        {
-               case 0 :        T55xxReadBlockExt                       (arg0, Block, Pwd);     break;
-               case 1 :        T55xxWrite_LLR ();
+               case 0 ://      T55xxReadBlockExt                       (arg0, Block, Pwd);     break;
+               case 1 : //     T55xxWrite_LLR ();
                                        T55xxReadBlockExt                       (arg0, Block, Pwd);
                                    break;
                case 2 :        T55xxReadBlockExt_Leading0      (arg0, Block, Pwd);     break;
                                        T55xxReadBlockExt                       (arg0, Block, Pwd);
                                    break;
                case 2 :        T55xxReadBlockExt_Leading0      (arg0, Block, Pwd);     break;
index da8fc703281281d996119f034ccdaffc2367083f..ed980f9b783f1af639f94c24ca843c13d1ff1029 100644 (file)
@@ -67,7 +67,7 @@ int usage_t55xx_read(){
        PrintAndLog("     p <password> - OPTIONAL password (8 hex characters)");\r
        PrintAndLog("     o            - OPTIONAL override safety check");\r
        PrintAndLog("     1            - OPTIONAL read Page 1 instead of Page 0");\r
        PrintAndLog("     p <password> - OPTIONAL password (8 hex characters)");\r
        PrintAndLog("     o            - OPTIONAL override safety check");\r
        PrintAndLog("     1            - OPTIONAL read Page 1 instead of Page 0");\r
-       PrintAndLog("     e <mode>     - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
+       PrintAndLog("     r <mode>     - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
        PrintAndLog("                                               '2' leading zero,               '3' 1 of 4 coding reference"); \r
        PrintAndLog("     ****WARNING****");\r
        PrintAndLog("     Use of read with password on a tag not configured for a pwd");\r
        PrintAndLog("                                               '2' leading zero,               '3' 1 of 4 coding reference"); \r
        PrintAndLog("     ****WARNING****");\r
        PrintAndLog("     Use of read with password on a tag not configured for a pwd");\r
@@ -88,7 +88,7 @@ int usage_t55xx_write(){
        PrintAndLog("     p <password> - OPTIONAL password 4bytes (8 hex characters)");\r
        PrintAndLog("     1            - OPTIONAL write Page 1 instead of Page 0");\r
        PrintAndLog("     t            - OPTIONAL test mode write - ****DANGER****");   \r
        PrintAndLog("     p <password> - OPTIONAL password 4bytes (8 hex characters)");\r
        PrintAndLog("     1            - OPTIONAL write Page 1 instead of Page 0");\r
        PrintAndLog("     t            - OPTIONAL test mode write - ****DANGER****");   \r
-       PrintAndLog("     e <mode>     - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
+       PrintAndLog("     r <mode>     - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
        PrintAndLog("                                               '2' leading zero,               '3' 1 of 4 coding reference"); \r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
        PrintAndLog("                                               '2' leading zero,               '3' 1 of 4 coding reference"); \r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
@@ -136,7 +136,7 @@ int usage_t55xx_detect(){
        PrintAndLog("Options:");\r
        PrintAndLog("     1             - if set, use Graphbuffer otherwise read data from tag.");\r
        PrintAndLog("     p <password>  - OPTIONAL password (8 hex characters)");\r
        PrintAndLog("Options:");\r
        PrintAndLog("     1             - if set, use Graphbuffer otherwise read data from tag.");\r
        PrintAndLog("     p <password>  - OPTIONAL password (8 hex characters)");\r
-       PrintAndLog("     e <mode>      - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
+       PrintAndLog("     r <mode>      - OPTIONAL downlink encoding '0' fixed bit length (default), '1' long leading reference");\r
        PrintAndLog("                                                '2' leading zero,               '3' 1 of 4 coding reference"); \r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
        PrintAndLog("                                                '2' leading zero,               '3' 1 of 4 coding reference"); \r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
@@ -168,7 +168,7 @@ int usage_t55xx_wakup(){
        PrintAndLog("     <password>  - [required] password 4bytes (8 hex symbols)");\r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
        PrintAndLog("     <password>  - [required] password 4bytes (8 hex symbols)");\r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
-               PrintAndLog("      lf t55xx wakeup 11223344  - send wakeup password");\r
+       PrintAndLog("      lf t55xx wakeup 11223344  - send wakeup password");\r
        return 0;\r
 }\r
 int usage_t55xx_bruteforce(){\r
        return 0;\r
 }\r
 int usage_t55xx_bruteforce(){\r
@@ -178,32 +178,16 @@ int usage_t55xx_bruteforce(){
        PrintAndLog("       password must be 4 bytes (8 hex symbols)");\r
        PrintAndLog("Options:");\r
        PrintAndLog("     h           - this help");\r
        PrintAndLog("       password must be 4 bytes (8 hex symbols)");\r
        PrintAndLog("Options:");\r
        PrintAndLog("     h           - this help");\r
+       PrintAndLog("     r <mode>    - OPTIONAL downlink encoding '0' fixed bit length (default)"); \r
+       PrintAndLog("                                  '1' long leading reference,  '2' leading zero ");\r
+       PrintAndLog("                                  '3' 1 of 4 coding reference, '4' special - try all downlink modes");\r
        PrintAndLog("     <start_pwd> - 4 byte hex value to start pwd search at");\r
        PrintAndLog("     <end_pwd>   - 4 byte hex value to end pwd search at");\r
        PrintAndLog("     i <*.dic>   - loads a default keys dictionary file <*.dic>");\r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
        PrintAndLog("     <start_pwd> - 4 byte hex value to start pwd search at");\r
        PrintAndLog("     <end_pwd>   - 4 byte hex value to end pwd search at");\r
        PrintAndLog("     i <*.dic>   - loads a default keys dictionary file <*.dic>");\r
        PrintAndLog("");\r
        PrintAndLog("Examples:");\r
-       PrintAndLog("       lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r
-       PrintAndLog("       lf t55xx bruteforce i default_pwd.dic");\r
-       PrintAndLog("");\r
-       return 0;\r
-}\r
-int usage_t55xx_bruteforce_downlink(){\r
-       PrintAndLog("This command uses A) bruteforce to scan a number range");\r
-       PrintAndLog("                  B) a dictionary attack");\r
-       PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r
-       PrintAndLog("       password must be 4 bytes (8 hex symbols)");\r
-       PrintAndLog("Options:");\r
-       PrintAndLog("     h                         - this help");\r
-       PrintAndLog("     r <start_pwd> <end_pwd>   - 4 byte hex value to start and end pwd search at");\r
-       PrintAndLog("     i <*.dic>                 - loads a default keys dictionary file <*.dic>");\r
-       PrintAndLog("     e <mode>                  - OPTIONAL downlink encoding '0' fixed bit length (default)"); \r
-       PrintAndLog("                                  '1' long leading reference,  '2' leading zero ");\r
-       PrintAndLog("                                  '3' 1 of 4 coding reference, '4' special - try all downlink modes");\r
-       PrintAndLog("");\r
-       PrintAndLog("Examples:");\r
-       PrintAndLog("       lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r
-       PrintAndLog("       lf t55xx bruteforce i default_pwd.dic");\r
+       PrintAndLog("       lf t55xx bruteforce [r 2] aaaaaaaa bbbbbbbb");\r
+       PrintAndLog("       lf t55xx bruteforce [r 2] i default_pwd.dic");\r
        PrintAndLog("");\r
        return 0;\r
 }\r
        PrintAndLog("");\r
        return 0;\r
 }\r
@@ -399,8 +383,8 @@ int CmdT55xxReadBlock(const char *Cmd) {
                        page1 = true;\r
                        cmdp++;\r
                        break;\r
                        page1 = true;\r
                        cmdp++;\r
                        break;\r
-               case 'e':\r
-               case 'E':\r
+               case 'r':\r
+               case 'R':\r
                        downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
                        if (downlink_mode > 3) downlink_mode = 0;\r
                        cmdp +=2;\r
                        downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
                        if (downlink_mode > 3) downlink_mode = 0;\r
                        cmdp +=2;\r
@@ -516,8 +500,8 @@ int CmdT55xxDetect(const char *Cmd){
                        useGB = true;\r
                        cmdp++;\r
                        break;\r
                        useGB = true;\r
                        cmdp++;\r
                        break;\r
-               case 'e':\r
-               case 'E':\r
+               case 'r':\r
+               case 'R':\r
                        downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
                        if (downlink_mode > 3) downlink_mode = 0;\r
                        cmdp +=2;\r
                        downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
                        if (downlink_mode > 3) downlink_mode = 0;\r
                        cmdp +=2;\r
@@ -540,13 +524,10 @@ int CmdT55xxDetect(const char *Cmd){
        else {\r
                // Add downlink mode to reference.\r
                switch (downlink_mode) {\r
        else {\r
                // Add downlink mode to reference.\r
                switch (downlink_mode) {\r
-                       case  0 :       PrintAndLog ("Downlink   : e 0 - Default/Fixed Bit Length"); break;\r
-                       case  1 :   PrintAndLog ("Downlink   : e 1 - Long Leading Reference"); break;\r
-                       case  2 :   PrintAndLog ("Downlink   : e 2 - Leading Zero Reference"); break;\r
-                       case  3 :   PrintAndLog ("Downlink   : e 3 - 1 of 4 Coding"); break;\r
-       //              default:\r
-                               \r
-                               // No default action\r
+                       case  0 :       PrintAndLog ("Downlink   : r 0 - default/fixed bit length"); break;\r
+                       case  1 :   PrintAndLog ("Downlink   : r 1 - long leading reference"); break;\r
+                       case  2 :   PrintAndLog ("Downlink   : r 2 - leading zero reference"); break;\r
+                       case  3 :   PrintAndLog ("Downlink   : r 3 - 1 of 4 coding reference"); break;\r
                }\r
        }\r
        return 1;\r
                }\r
        }\r
        return 1;\r
@@ -988,8 +969,8 @@ int CmdT55xxWriteBlock(const char *Cmd) {
                        page1 = true;\r
                        cmdp++;\r
                        break;\r
                        page1 = true;\r
                        cmdp++;\r
                        break;\r
-               case 'e':\r
-               case 'E':\r
+               case 'r':\r
+               case 'R':\r
                        downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
                        if (downlink_mode > 3) downlink_mode = 0;\r
                        cmdp +=2;\r
                        downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
                        if (downlink_mode > 3) downlink_mode = 0;\r
                        cmdp +=2;\r
@@ -1459,16 +1440,29 @@ int CmdT55xxBruteForce(const char *Cmd) {
        char buf[9];\r
        char filename[FILE_PATH_SIZE]={0};\r
        int keycnt = 0;\r
        char buf[9];\r
        char filename[FILE_PATH_SIZE]={0};\r
        int keycnt = 0;\r
-       uint8_t downlink_mode = 0;\r
        int ch;\r
        uint8_t stKeyBlock = 20;\r
        uint8_t *keyBlock = NULL, *p = NULL;\r
        uint32_t start_password = 0x00000000; //start password\r
        uint32_t end_password   = 0xFFFFFFFF; //end   password\r
        bool found = false;\r
        int ch;\r
        uint8_t stKeyBlock = 20;\r
        uint8_t *keyBlock = NULL, *p = NULL;\r
        uint32_t start_password = 0x00000000; //start password\r
        uint32_t end_password   = 0xFFFFFFFF; //end   password\r
        bool found = false;\r
-\r
+       uint8_t downlink_mode = 0;\r
+       bool try_all_dl_modes = false;\r
+       uint8_t dl_mode = 0;\r
+       uint8_t cmd_offset = 0;\r
+       int cmd_opt = 0;\r
+               \r
        char cmdp = param_getchar(Cmd, 0);\r
        char cmdp = param_getchar(Cmd, 0);\r
+       \r
        if (cmdp == 'h' || cmdp == 'H') return usage_t55xx_bruteforce();\r
        if (cmdp == 'h' || cmdp == 'H') return usage_t55xx_bruteforce();\r
+       if (cmdp == 'r' || cmdp == 'R') {\r
+               downlink_mode = param_getchar(Cmd, 1) - '0'; // get 2nd option, as this is fixed order.\r
+               if (downlink_mode == 4) try_all_dl_modes = true;\r
+               if (downlink_mode > 3) downlink_mode = 0;\r
+               cmd_opt += 2;    // To help start/end passwords for range to be found\r
+               cmd_offset += 4; // r <sp> x <sp> To help the string offset for filename start position in cmd\r
+               cmdp = param_getchar(Cmd, 2); // get 3rd option, as this is fixed order.\r
+       }\r
 \r
        keyBlock = calloc(stKeyBlock, 6);\r
        if (keyBlock == NULL) return 1;\r
 \r
        keyBlock = calloc(stKeyBlock, 6);\r
        if (keyBlock == NULL) return 1;\r
@@ -1477,7 +1471,7 @@ int CmdT55xxBruteForce(const char *Cmd) {
 \r
                int len = strlen(Cmd+2);\r
                if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r
 \r
                int len = strlen(Cmd+2);\r
                if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r
-               memcpy(filename, Cmd+2, len);\r
+               memcpy(filename, Cmd+2+cmd_offset, len);\r
 \r
                FILE * f = fopen( filename , "r");\r
 \r
 \r
                FILE * f = fopen( filename , "r");\r
 \r
@@ -1542,20 +1536,32 @@ int CmdT55xxBruteForce(const char *Cmd) {
                        testpwd = bytes_to_num(keyBlock + 4*c, 4);\r
 \r
                        PrintAndLog("Testing %08X", testpwd);\r
                        testpwd = bytes_to_num(keyBlock + 4*c, 4);\r
 \r
                        PrintAndLog("Testing %08X", testpwd);\r
+                       \r
+                       // Try each downlink_mode if asked to \r
+                       // donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3\r
+                       for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++){\r
+                               if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd, dl_mode)) {\r
+                                       PrintAndLog("Aquireing data from device failed. Quitting");\r
+                                       free(keyBlock);\r
+                                       return 0;\r
+                               }\r
 \r
 \r
-                       if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,downlink_mode)) {\r
-                               PrintAndLog("Aquireing data from device failed. Quitting");\r
-                               free(keyBlock);\r
-                               return 0;\r
-                       }\r
-\r
-                       found = tryDetectModulation();\r
+                               found = tryDetectModulation();\r
 \r
 \r
-                       if ( found ) {\r
-                               PrintAndLog("Found valid password: [%08X]", testpwd);\r
-                               free(keyBlock);\r
-                               return 0;\r
-                       }\r
+                               if ( found ) {\r
+                                       PrintAndLog("Found valid password: [%08X]", testpwd);\r
+                                       free(keyBlock);\r
+                                       switch (dl_mode) {\r
+                                               case  0 :       PrintAndLog ("Downlink   : r 0 - default/fixed bit length"); break;\r
+                                               case  1 :   PrintAndLog ("Downlink   : r 1 - long leading reference"); break;\r
+                                               case  2 :   PrintAndLog ("Downlink   : r 2 - leading zero reference"); break;\r
+                                               case  3 :   PrintAndLog ("Downlink   : r 3 - 1 of 4 coding reference"); break;\r
+                                       }                                       \r
+                                       return 0;\r
+                               }\r
+                               if (!try_all_dl_modes) // Exit loop if not trying all downlink modes\r
+                                       dl_mode = 4;\r
+                       }       \r
                }\r
                PrintAndLog("Password NOT found.");\r
                free(keyBlock);\r
                }\r
                PrintAndLog("Password NOT found.");\r
                free(keyBlock);\r
@@ -1565,8 +1571,8 @@ int CmdT55xxBruteForce(const char *Cmd) {
        // Try to read Block 7, first :)\r
 \r
        // incremental pwd range search\r
        // Try to read Block 7, first :)\r
 \r
        // incremental pwd range search\r
-       start_password = param_get32ex(Cmd, 0, 0, 16);\r
-       end_password = param_get32ex(Cmd, 1, 0, 16);\r
+       start_password = param_get32ex(Cmd, cmd_opt , 0, 16);\r
+       end_password = param_get32ex(Cmd, cmd_opt+1 , 0, 16);\r
 \r
        if ( start_password >= end_password ) {\r
                free(keyBlock);\r
 \r
        if ( start_password >= end_password ) {\r
                free(keyBlock);\r
@@ -1587,225 +1593,10 @@ int CmdT55xxBruteForce(const char *Cmd) {
                        free(keyBlock);\r
                        return 0;\r
                }\r
                        free(keyBlock);\r
                        return 0;\r
                }\r
-\r
-               if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r
-                       PrintAndLog("Aquireing data from device failed. Quitting");\r
-                       free(keyBlock);\r
-                       return 0;\r
-               }\r
-               found = tryDetectModulation();\r
-\r
-               if (found) break;\r
-               i++;\r
-       }\r
-\r
-       PrintAndLog("");\r
-\r
-       if (found)\r
-               PrintAndLog("Found valid password: [%08x]", i);\r
-       else\r
-               PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r
-\r
-       free(keyBlock);\r
-       return 0;\r
-}\r
-\r
-int CmdT55xxBruteForce_downlink(const char *Cmd) {\r
-\r
-       // load a default pwd file.\r
-       char buf[9];\r
-       char filename[FILE_PATH_SIZE]={0};\r
-       int keycnt = 0;\r
-       uint8_t downlink_mode = 0;\r
-       int ch;\r
-       uint8_t stKeyBlock = 20;\r
-       uint8_t *keyBlock = NULL, *p = NULL;\r
-       uint32_t start_password = 0x00000000; //start password\r
-       uint32_t end_password   = 0xFFFFFFFF; //end   password\r
-       bool found = false;\r
-       uint8_t cmdp = 0;\r
-       int     cmd_offset = 0;\r
-       int errors = 0;\r
-       int len;\r
-       bool use_file = false;\r
-       bool use_range = false;\r
-       bool try_all_dl_modes = false;\r
-       uint8_t dl_mode = 0;\r
-       \r
-       keyBlock = calloc(stKeyBlock, 6);\r
-       if (keyBlock == NULL) return 1;\r
-\r
-       while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {\r
-               switch(param_getchar(Cmd, cmdp)) {\r
-               case 'h':\r
-               case 'H':\r
-                                       return usage_t55xx_bruteforce_downlink();\r
-               case 'e':\r
-               case 'E':\r
-                                       downlink_mode = param_getchar(Cmd, cmdp+1) - '0';\r
-                                       if (downlink_mode == 4) try_all_dl_modes = true;\r
-                                       if (downlink_mode > 3) downlink_mode = 0;\r
-                                       cmdp +=2;\r
-                                       cmd_offset += 4;\r
-                                       break;\r
-               case 'i':\r
-               case 'I':\r
-                                       if (use_range) {\r
-                                               PrintAndLog ("use Range or File");\r
-                                               return 0;\r
-                                       }\r
-                                       use_file = true;\r
-                                       len = strlen(Cmd+2);\r
-                                       if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;\r
-                                       memcpy(filename, Cmd+cmd_offset+2, len);\r
-                                       // Drop any characters after space\r
-                                       char *p = strstr(filename," ");\r
-                                       if (p) *p = 0;\r
-                                       cmdp += 2;\r
-                                       // PrintAndLog (" File : [%s]",filename);\r
-                                       break;\r
-               case 'r':\r
-               case 'R':\r
-                                       if (use_file) {\r
-                                               PrintAndLog ("use Range or File");\r
-                                               return 0;\r
-                                       }\r
-                                       use_range       = true; \r
-                                       start_password  = param_get32ex(Cmd, cmdp+1, 0, 16);\r
-                                       end_password    = param_get32ex(Cmd, cmdp+2, 0, 16);\r
-                                       cmdp += 3;\r
-                                       cmd_offset += 20; \r
-                                       break;\r
-               default:\r
-                       PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));\r
-                       errors = true;\r
-                       break;\r
-               }\r
-       }\r
-\r
-       if (use_file)\r
-       {\r
-                               FILE * f = fopen( filename , "r");\r
-\r
-                               if ( !f ) {\r
-                                       PrintAndLog("File: %s: not found or locked.", filename);\r
-                                       free(keyBlock);\r
-                                       return 1;\r
-                               }\r
-\r
-                               while( fgets(buf, sizeof(buf), f) ) {\r
-                                       if (strlen(buf) < 8 || buf[7] == '\n') continue;\r
-\r
-                                       while (fgetc(f) != '\n' && !feof(f)) ;  //goto next line\r
-\r
-                                       //The line start with # is comment, skip\r
-                                       if( buf[0]=='#' ) continue;\r
-\r
-                                       if (!isxdigit((unsigned char)buf[0])) {\r
-                                               PrintAndLog("File content error. '%s' must include 8 HEX symbols", buf);\r
-                                               continue;\r
-                                       }\r
-                       \r
-                                       buf[8] = 0;\r
-\r
-                                       if ( stKeyBlock - keycnt < 2) {\r
-                                               p = realloc(keyBlock, 6*(stKeyBlock+=10));\r
-                                               if (!p) {\r
-                                                       PrintAndLog("Cannot allocate memory for defaultKeys");\r
-                                                       free(keyBlock);\r
-                                                       fclose(f);\r
-                                                       return 2;\r
-                                               }\r
-                                               keyBlock = p;\r
-                                       }\r
-                                       memset(keyBlock + 4 * keycnt, 0, 4);\r
-                                       num_to_bytes(strtoll(buf, NULL, 16), 4, keyBlock + 4*keycnt);\r
-                                       PrintAndLog("chk custom pwd[%2d] %08X", keycnt, bytes_to_num(keyBlock + 4*keycnt, 4));\r
-                                       keycnt++;\r
-                                       memset(buf, 0, sizeof(buf));\r
-                               }\r
-                               fclose(f);\r
-               \r
-                               if (keycnt == 0) {\r
-                                       PrintAndLog("No keys found in file");\r
-                                       free(keyBlock);\r
-                                       return 1;\r
-                               }\r
-                               PrintAndLog("Loaded %d keys", keycnt);\r
-               \r
-               // loop\r
-               uint64_t testpwd = 0x00;\r
-               for (uint16_t c = 0; c < keycnt; ++c ) {\r
-\r
-                       if (ukbhit()) {\r
-                               ch = getchar();\r
-                               (void)ch;\r
-                               printf("\naborted via keyboard!\n");\r
-                               free(keyBlock);\r
-                               return 0;\r
-                       }\r
-\r
-                       testpwd = bytes_to_num(keyBlock + 4*c, 4);\r
-\r
-                       PrintAndLog("Testing %08X", testpwd);\r
-            \r
-                       // Try each downlink_mode if asked to \r
-                       // donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3\r
-                       for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++)\r
-                       {\r
-                               if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, testpwd,dl_mode)) {\r
-                                       PrintAndLog("Aquireing data from device failed. Quitting");\r
-                                       free(keyBlock);\r
-                                       return 0;\r
-                               }\r
-\r
-                               found = tryDetectModulation();\r
-\r
-                               if ( found ) {\r
-                                       PrintAndLog("Found valid password: [%08X]", testpwd);\r
-                                       free(keyBlock);\r
-                                       // Add downlink mode for reference.\r
-                                       switch (dl_mode) {\r
-                                               case  0 :       PrintAndLog ("Downlink   : e 0 - Default/Fixed Bit Length"); break;\r
-                                               case  1 :   PrintAndLog ("Downlink   : e 1 - Long Leading Reference"); break;\r
-                                               case  2 :   PrintAndLog ("Downlink   : e 2 - Leading Zero Reference"); break;\r
-                                               case  3 :   PrintAndLog ("Downlink   : e 3 - 1 of 4 Coding"); break;\r
-                                       }\r
-                               return 0;\r
-                               }\r
-                               if (!try_all_dl_modes) // Exit loop\r
-                                       dl_mode = 4;\r
-                       }\r
-               }\r
-               PrintAndLog("Password NOT found.");\r
-               free(keyBlock);\r
-               return 0;\r
-       }\r
-\r
-       if (use_range)\r
-       {\r
-\r
-               if ( start_password >= end_password ) {\r
-                       free(keyBlock);\r
-                       return usage_t55xx_bruteforce_downlink();\r
-               }\r
-               PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);\r
-\r
-               uint32_t i = start_password;\r
-\r
-               while ((!found) && (i <= end_password)) {\r
-\r
-                       printf(".");\r
-                       fflush(stdout);\r
-                       if (ukbhit()) {\r
-                               ch = getchar();\r
-                               (void)ch;\r
-                               printf("\naborted via keyboard!\n");\r
-                               free(keyBlock);\r
-                               return 0;\r
-                       }\r
-\r
-                       if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,downlink_mode)) {\r
+               // Try each downlink_mode if asked to \r
+               // donwlink_mode will = 0 if > 3 or set to 0, so loop from 0 - 3\r
+               for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++){\r
+                       if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, i,dl_mode)) {\r
                                PrintAndLog("Aquireing data from device failed. Quitting");\r
                                free(keyBlock);\r
                                return 0;\r
                                PrintAndLog("Aquireing data from device failed. Quitting");\r
                                free(keyBlock);\r
                                return 0;\r
@@ -1813,29 +1604,30 @@ int CmdT55xxBruteForce_downlink(const char *Cmd) {
                        found = tryDetectModulation();\r
 \r
                        if (found) break;\r
                        found = tryDetectModulation();\r
 \r
                        if (found) break;\r
-                       i++;\r
+                       if (!try_all_dl_modes) // Exit loop if not trying all downlink modes\r
+                               dl_mode = 4;                    \r
                }\r
                }\r
+               if (found) break;\r
+               i++;\r
+       }\r
 \r
 \r
-               PrintAndLog("");\r
-       \r
-               if (found) {\r
-                       PrintAndLog("Found valid password: [%08x]", i);\r
-                       // Add downlink mode for reference.\r
-                       switch (downlink_mode) {\r
-                               case  0 :       PrintAndLog ("Downlink   : e 0 - Default/Fixed Bit Length"); break;\r
-                               case  1 :   PrintAndLog ("Downlink   : e 1 - Long Leading Reference"); break;\r
-                               case  2 :   PrintAndLog ("Downlink   : e 2 - Leading Zero Reference"); break;\r
-                               case  3 :   PrintAndLog ("Downlink   : e 3 - 1 of 4 Coding"); break;\r
-                       }\r
+       if (found){\r
+               PrintAndLog("Found valid password: [%08x]", i);\r
+               switch (dl_mode) {\r
+                       case  0 :       PrintAndLog ("Downlink   : r 0 - default/fixed bit length"); break;\r
+                       case  1 :   PrintAndLog ("Downlink   : r 1 - long leading reference"); break;\r
+                       case  2 :   PrintAndLog ("Downlink   : r 2 - leading Zero reference"); break;\r
+                       case  3 :   PrintAndLog ("Downlink   : r 3 - 1 of 4 coding reference"); break;\r
                }\r
                }\r
-               else\r
-                       PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r
-\r
-               free(keyBlock);\r
        }\r
        }\r
+       else{\r
+               PrintAndLog("");\r
+               PrintAndLog("Password NOT found. Last tried: [%08x]", --i);\r
+       }\r
+\r
+       free(keyBlock);\r
        return 0;\r
 }\r
        return 0;\r
 }\r
-\r
 // note length of data returned is different for different chips.  \r
 //   some return all page 1 (64 bits) and others return just that block (32 bits) \r
 //   unfortunately the 64 bits makes this more likely to get a false positive...\r
 // note length of data returned is different for different chips.  \r
 //   some return all page 1 (64 bits) and others return just that block (32 bits) \r
 //   unfortunately the 64 bits makes this more likely to get a false positive...\r
@@ -1987,7 +1779,6 @@ int CmdT55xxDetectPage1(const char *Cmd){
 static command_t CommandTable[] = {\r
   {"help",      CmdHelp,           1, "This help"},\r
   {"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},\r
 static command_t CommandTable[] = {\r
   {"help",      CmdHelp,           1, "This help"},\r
   {"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},\r
-  {"bruteforcedl",CmdT55xxBruteForce_downlink,0, "r <start password> <end password> [i <*.dic>] [e <downlink>] Simple bruteforce attack to find password"},\r
   {"config",    CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},\r
   {"detect",    CmdT55xxDetect,    1, "[1] Try detecting the tag modulation from reading the configuration block."},\r
   {"p1detect",  CmdT55xxDetectPage1,1, "[1] Try detecting if this is a t55xx tag by reading page 1"},\r
   {"config",    CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},\r
   {"detect",    CmdT55xxDetect,    1, "[1] Try detecting the tag modulation from reading the configuration block."},\r
   {"p1detect",  CmdT55xxDetectPage1,1, "[1] Try detecting if this is a t55xx tag by reading page 1"},\r
index 1ba4dca409ac1c641af20f9926d2a786ff2b5bb3..4541bd3a6742c1149269dacb1d376002a6d668dd 100644 (file)
@@ -74,7 +74,6 @@ void Set_t55xx_Config(t55xx_conf_block_t conf);
 \r
 extern int CmdLFT55XX(const char *Cmd);\r
 extern int CmdT55xxBruteForce(const char *Cmd);\r
 \r
 extern int CmdLFT55XX(const char *Cmd);\r
 extern int CmdT55xxBruteForce(const char *Cmd);\r
-extern int CmdT55xxBruteForce_downlink(const char *Cmd);\r
 extern int CmdT55xxSetConfig(const char *Cmd);\r
 extern int CmdT55xxReadBlock(const char *Cmd);\r
 extern int CmdT55xxWriteBlock(const char *Cmd);\r
 extern int CmdT55xxSetConfig(const char *Cmd);\r
 extern int CmdT55xxReadBlock(const char *Cmd);\r
 extern int CmdT55xxWriteBlock(const char *Cmd);\r
Impressum, Datenschutz