REM: removed an unused doublett function "printBits" in util.c

ADD:  added a new string helper function "sprint_hex_ascii" in util.c
ADD:  added "LF AWID BRUTE", a very simple bruteforce command for the awid commands.
      it takes a facility-code,  and iterates all possible 0xFFFF cardnum by sending sim command. It also uses the usb_poll function to stop the bruteforce on keypress and not leaving the pm3 device running the simulation.
the command implements the help parameter.

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index e939259519b7a9a3588ad447facc899cd6463e30..85931aa38e3b7cca58e3649402042205ecba293d 100644 (file)
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -400,7 +400,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
        for(;;) {
                //wait until SSC_CLK goes HIGH
                while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
-                       if(BUTTON_PRESS() || (usb_poll_validate_length() )) {
+                       if(BUTTON_PRESS() || usb_poll_validate_length() ) {
                                DbpString("Stopped");
                                return;
                        }
@@ -417,7 +417,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
                
                //wait until SSC_CLK goes LOW
                while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
-                       if(BUTTON_PRESS()) {
+                       if( BUTTON_PRESS() || usb_poll_validate_length() ) {
                                DbpString("Stopped");
                                return;
                        }
@@ -594,20 +594,10 @@ void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
                }
        }
        Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, invert: %d, n: %d",fcHigh, fcLow, clk, invert, n);
-       /*Dbprintf("DEBUG: First 32:");
-       uint8_t *dest = BigBuf_get_addr();
-       i=0;
-       Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
-       i+=16;
-       Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
-       */
-       if (ledcontrol)
-               LED_A_ON();
 
+       if (ledcontrol) LED_A_ON();
        SimulateTagLowFrequency(n, 0, ledcontrol);
-
-       if (ledcontrol)
-               LED_A_OFF();
+       if (ledcontrol) LED_A_OFF();
 }
 
 // compose ask waveform for one bit(ASK)

diff --git a/client/cmdlfawid.c b/client/cmdlfawid.c
index 7709d75bdd1fcec533298edff8ffeb4aaae19a3b..e7dee935f539698f73edf7d737e4916483a3fb5f 100644 (file)
--- a/client/cmdlfawid.c
+++ b/client/cmdlfawid.c
@@ -19,7 +19,8 @@
 #include "util.h"       // weigandparity
 #include "protocols.h"  // for T55xx config register definitions
 #include "cmdmain.h"
-
+ #include "sleep.h"
+ 
 static int CmdHelp(const char *Cmd);
 
 int usage_lf_awid_fskdemod(void) {
@@ -57,7 +58,7 @@ int usage_lf_awid_clone(void) {
        PrintAndLog("");
        PrintAndLog("Usage:  lf awid clone <Facility-Code> <Card-Number>");
        PrintAndLog("Options :");
-       PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+       PrintAndLog("  <Facility-Code> : 8-bit value AWID facility code");
        PrintAndLog("  <Card Number>   : 16-bit value AWID card number");
        PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
        PrintAndLog("");
@@ -65,6 +66,18 @@ int usage_lf_awid_clone(void) {
        return 0;
 }
 
+int usage_lf_awid_brute(void){
+       PrintAndLog("Enables bruteforce of AWID26 card with specified facility-code.");
+       PrintAndLog("Per AWID26 format, the facility-code (FC) is 8-bit and the card number is 16-bit.");
+       PrintAndLog("");
+       PrintAndLog("Usage:  lf awid brute <Facility-Code>");
+       PrintAndLog("Options :");
+       PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+       PrintAndLog("");
+       PrintAndLog("Sample  : lf awid brute 224");
+       return 0;
+}
+
 int CmdAWIDDemodFSK(const char *Cmd) {
        int findone = 0;
        if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod();
@@ -189,11 +202,57 @@ int CmdAWIDClone(const char *Cmd) {
        return 0;
 }
 
+int CmdAWIDBrute(const char *Cmd){
+       
+       uint8_t fc = 0x00;
+       uint8_t bits[96];
+       uint8_t *bs = bits;
+       size_t size = sizeof(bits);
+       memset(bs, 0x00, size);
+
+       char cmdp = param_getchar(Cmd, 0);
+       if (strlen(Cmd) > 3 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_brute();
+       
+       fc =  param_get8(Cmd, 0);
+       if ( fc == 0) return usage_lf_awid_brute();
+       
+       PrintAndLog("Bruteforceing AWID26");
+       PrintAndLog("Press pm3-button to abort simulation or run another command");
+
+       uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
+       uint64_t arg2 = 50;              // clk RF/50 invert=0
+       UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};  
+
+       for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){
+               if (ukbhit()) {
+                       PrintAndLog("aborted via keyboard!");
+                       c.cmd = CMD_PING;
+                       c.arg[0] = 0x00;
+                       c.arg[1] = 0x00;
+                       c.arg[2] = 0x00;
+                       clearCommandBuffer();
+                       SendCommand(&c);
+                       return 1;
+               }
+                       
+               (void)getAWIDBits(fc, cn, bs);
+               memcpy(c.d.asBytes, bs, size);
+               clearCommandBuffer();
+               SendCommand(&c);
+               
+               PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
+               // pause
+               sleep(1);
+       }
+       return 0;
+}
+
 static command_t CommandTable[] = {
        {"help",      CmdHelp,         1, "This help"},
        {"fskdemod",  CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"},
        {"sim",       CmdAWIDSim,      0, "<Facility-Code> <Card Number> -- AWID tag simulator"},
        {"clone",     CmdAWIDClone,    0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7"},
+       {"brute",         CmdAWIDBrute,    0, "<Facility-Code> -- bruteforce card number"},
        {NULL, NULL, 0, NULL}
 };
 

diff --git a/client/cmdlfawid.h b/client/cmdlfawid.h
index 006229273ae597796a58763f82d7667000910d85..2f88e7016d423dcc7a2c8186f80af0ea1da80b57 100644 (file)
--- a/client/cmdlfawid.h
+++ b/client/cmdlfawid.h
@@ -12,13 +12,14 @@
 #define CMDLFAWID_H__
 
 int CmdLFAWID(const char *Cmd);
-//int CmdAWIDDemod(const char *Cmd);
 int CmdAWIDDemodFSK(const char *Cmd);
 int CmdAWIDSim(const char *Cmd);
 int CmdAWIDClone(const char *Cmd);
+int CmdAWIDBrute(const char *Cmd);
 int getAWIDBits(unsigned int fc, unsigned int cn, uint8_t *AWIDBits);
 int usage_lf_awid_fskdemod(void);
 int usage_lf_awid_clone(void);
 int usage_lf_awid_sim(void);
+int usage_lf_awid_brute(void);
 
 #endif

diff --git a/client/util.c b/client/util.c
index 29914667b23f6538ea92467be8d5011687ef4a2f..de1cbe94571a18cc0cbe0d8e534f083a76d6f54e 100644 (file)
--- a/client/util.c
+++ b/client/util.c
@@ -159,6 +159,8 @@ char *sprint_bin(const uint8_t *data, const size_t len) {
 char *sprint_hex_ascii(const uint8_t *data, const size_t len) {
        static char buf[1024];
        memset(buf, 0x00, 1024);
+       char *tmp = buf;
+       sprintf(tmp, "%s| %s", sprint_hex(data, len) , data);   
        return buf;
 }
 void num_to_bytes(uint64_t n, size_t len, uint8_t* dest)
@@ -192,8 +194,8 @@ void num_to_bytebits(uint64_t       n, size_t len, uint8_t *dest) {
 // hh,gg,ff,ee,dd,cc,bb,aa, pp,oo,nn,mm,ll,kk,jj,ii
 // up to 64 bytes or 512 bits
 uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize){
-       //static uint8_t buf[64];
-       uint8_t buf[64];
+       static uint8_t buf[64];
+       //uint8_t buf[64];
        memset(buf, 0x00, 64);
        uint8_t *tmp = buf;
        for (uint8_t block=0; block < (uint8_t)(len/blockSize); block++){
@@ -204,28 +206,6 @@ uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockS
        return tmp;
 }
 
-//assumes little endian
-char * printBits(size_t const size, void const * const ptr)
-{
-    unsigned char *b = (unsigned char*) ptr;   
-    unsigned char byte;
-       static char buf[1024];
-       char * tmp = buf;
-    int i, j;
-
-    for (i=size-1;i>=0;i--)
-    {
-        for (j=7;j>=0;j--)
-        {
-            byte = b[i] & (1<<j);
-            byte >>= j;
-            sprintf(tmp, "%u", byte);
-                       tmp++;
-        }
-    }
-       return buf;
-}
-
 //  -------------------------------------------------------------------------
 //  string parameters lib
 //  -------------------------------------------------------------------------
@@ -344,13 +324,11 @@ int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt)
 {
        int bg, en, temp, i;
 
-       if (hexcnt % 2)
-               return 1;
+       if (hexcnt & 1) return 1;
        
        if (param_getptr(line, &bg, &en, paramnum)) return 1;
 
-       if (en - bg + 1 != hexcnt) 
-               return 1;
+       if (en - bg + 1 != hexcnt) return 1;
 
        for(i = 0; i < hexcnt; i += 2) {
                if (!(isxdigit(line[bg + i]) && isxdigit(line[bg + i + 1])) )   return 1;

diff --git a/client/util.h b/client/util.h
index c57df5c231897a614d9973a78d113c82c5f70170..7831716ac56c138242f3eeca54bd4c42b1325856 100644 (file)
--- a/client/util.h
+++ b/client/util.h
@@ -45,7 +45,6 @@ char *sprint_hex_ascii(const uint8_t *data, const size_t len);
 void num_to_bytes(uint64_t n, size_t len, uint8_t* dest);
 uint64_t bytes_to_num(uint8_t* src, size_t len);
 void num_to_bytebits(uint64_t  n, size_t len, uint8_t *dest);
-char * printBits(size_t const size, void const * const ptr);
 uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize);
 
 char param_getchar(const char *line, int paramnum);

diff --git a/common/usb_cdc.c b/common/usb_cdc.c
index dbd1c995af35fb025ec3a40602dd07dfc6839e74..049cb8cf03de52eec8eb95c77bd93cbc47b4b6c6 100644 (file)
--- a/common/usb_cdc.c
+++ b/common/usb_cdc.c
@@ -304,7 +304,6 @@ bool usb_poll()
 **/\r
 bool usb_poll_validate_length()\r
 {\r
-\r
        if (!usb_check()) return false;\r
        if (!(pUdp->UDP_CSR[AT91C_EP_OUT] & btReceiveBank)) return false;\r
        return (pUdp->UDP_CSR[AT91C_EP_OUT] >> 16) >  0;\r