- PrintAndLog("Enables cloning of AWID26 card with specified facility-code and card number onto T55x7.");
- PrintAndLog("The T55x7 must be on the antenna when issuing this command. T55x7 blocks are calculated and printed in the process.");
- PrintAndLog("Per AWID26 format, the facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.");
- PrintAndLog("");
- PrintAndLog("Usage: lf awid clone <Facility-Code> <Card-Number>");
- PrintAndLog("Options :");
- PrintAndLog(" <Facility-Code> : 8-bit value AWID facility code");
- PrintAndLog(" <Card Number> : 16-bit value AWID card number");
- PrintAndLog("");
- PrintAndLog("sample : lf awid clone 224 1337");
- return 0;
+ PrintAndLog("Enables cloning of AWID card with specified facility-code and card number onto T55x7.");
+ PrintAndLog("The T55x7 must be on the antenna when issuing this command. T55x7 blocks are calculated and printed in the process.");
+ PrintAndLog("");
+ PrintAndLog("Usage: lf awid clone [h] <format> <facility-code> <card-number> [Q5]");
+ PrintAndLog("Options:");
+ PrintAndLog(" h : This help");
+ PrintAndLog(" <format> : format length 26|50");
+ PrintAndLog(" <facility-code> : 8|16bit value facility code");
+ PrintAndLog(" <card number> : 16|32-bit value card number");
+ PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
+ PrintAndLog("");
+ PrintAndLog("Samples:");
+ PrintAndLog(" lf awid clone 26 224 1337");
+ PrintAndLog(" lf awid clone 50 2001 13371337");
+ return 0;
+}
+
+int usage_lf_awid_brute(void){
+ PrintAndLog("Enables bruteforce of AWID reader with specified facility-code.");
+ PrintAndLog("This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step");
+ PrintAndLog("if cardnumber is not given, it starts with 1 and goes up to 65535");
+ PrintAndLog("");
+ PrintAndLog("Usage: lf awid brute [h] a <format> f <facility-code> c <cardnumber> d <delay>");
+ PrintAndLog("Options:");
+ PrintAndLog(" h : This help");
+ PrintAndLog(" a <format> : format length 26|50");
+ PrintAndLog(" f <facility-code> : 8|16bit value facility code");
+ PrintAndLog(" c <cardnumber> : (optional) cardnumber to start with, max 65535");
+ PrintAndLog(" d <delay> : delay betweens attempts in ms. Default 1000ms");
+ PrintAndLog("");
+ PrintAndLog("Samples:");
+ PrintAndLog(" lf awid brute a 26 f 224");
+ PrintAndLog(" lf awid brute a 50 f 2001 d 2000");
+ PrintAndLog(" lf awid brute a 50 f 2001 c 200 d 2000");
+ return 0;
+}
+
+static int sendPing(void){
+ UsbCommand ping = {CMD_PING, {1, 2, 3}};
+ SendCommand(&ping);
+ SendCommand(&ping);
+ SendCommand(&ping);
+ clearCommandBuffer();
+ UsbCommand resp;
+ if (WaitForResponseTimeout(CMD_ACK, &resp, 1000))
+ return 0;
+ return 1;
+}
+
+static bool sendTry(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint32_t delay, uint8_t *bs, size_t bs_len){
+
+ PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
+ if ( !getAWIDBits(fmtlen, fc, cn, bs)) {
+ PrintAndLog("Error with tag bitstream generation.");
+ return FALSE;
+ }
+
+ uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
+ uint64_t arg2 = 50; // clk RF/50 invert=0
+ UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, bs_len}};
+ memcpy(c.d.asBytes, bs, bs_len);
+ clearCommandBuffer();
+ SendCommand(&c);
+ msleep(delay);
+ sendPing();
+ return TRUE;
projects / proxmark3-svn / blobdiff