CHG: updated helptext for lf t55xx bruteforce

ADD: a ROL function in util.c
ADD: two pwdgen functions in cmdhfmfu.c,  call them with a 7byte UID and get a 4byte number back. Will see if it can be connected with the "hf mfu info" command,  make data extraction easier later on.
ADD: added some more easy pwd in the dictionary file default_pwd.dic

diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c
index 9c2faa58f06d06ccbadd52b4b0a98ec1d3edf58c..a2f3be20b1489f3a87552a0eb9eda60f6555dd29 100644 (file)
--- a/client/cmdhfmfu.c
+++ b/client/cmdhfmfu.c
@@ -74,6 +74,54 @@ uint8_t UL_MEMORY_ARRAY[MAX_UL_TYPES] = {
                MAX_UL_BLOCKS, MAX_MY_D_NFC, MAX_MY_D_MOVE,
                MAX_MY_D_MOVE, MAX_MY_D_MOVE_LEAN, MAX_UL_BLOCKS};
 
+// Certain pwd generation algo nickname A.
+uint32_t ul_ev1_pwdgenA(uint8_t* uid) { 
+
+       uint8_t pos = (uid[3] ^ uid[4] ^ uid[5] ^ uid[6]) % 32;
+       
+       uint32_t xortable[] = {
+                                               0x4f2711c1, 0x07D7BB83, 0x9636EF07, 0xB5F4460E, 0xF271141C, 0x7D7BB038, 0x636EF871, 0x5F4468E3,
+                                               0x271149C7, 0xD7BB0B8F, 0x36EF8F1E, 0xF446863D, 0x7114947A, 0x7BB0B0F5, 0x6EF8F9EB, 0x44686BD7,
+                                               0x11494fAF, 0xBB0B075F, 0xEF8F96BE, 0x4686B57C, 0x1494F2F9, 0xB0B07DF3, 0xF8F963E6, 0x686B5FCC,
+                                               0x494F2799, 0x0B07D733, 0x8F963667, 0x86B5F4CE, 0x94F2719C, 0xB07D7B38, 0xF9636E70, 0x6B5F44E0
+                                               };
+
+       uint8_t entry[] = {0x00,0x00,0x00,0x00};
+       uint8_t pwd[] = {0x00,0x00,0x00,0x00};
+       
+       num_to_bytes( xortable[pos], 4, entry);
+
+       pwd[0] = entry[0] ^ uid[1] ^ uid[2] ^ uid[3];
+       pwd[1] = entry[1] ^ uid[0] ^ uid[2] ^ uid[4];
+       pwd[2] = entry[2] ^ uid[0] ^ uid[1] ^ uid[5];
+       pwd[3] = entry[3] ^ uid[6];
+
+       return (uint32_t)bytes_to_num(pwd, 4);
+}
+
+// Certain pwd generation algo nickname B. (very simple)
+uint32_t ul_ev1_pwdgenB(uint8_t* uid) {
+
+       uint8_t pwd[] = {0x00,0x00,0x00,0x00};
+       
+       pwd[0] = uid[1] ^ uid[3] ^ 0xAA;
+       pwd[1] = uid[2] ^ uid[4] ^ 0x55;
+       pwd[2] = uid[3] ^ uid[5] ^ 0xAA;
+       pwd[3] = uid[4] ^ uid[6] ^ 0x55;
+       return (uint32_t)bytes_to_num(pwd, 4);
+}
+
+void ul_ev1_pwdgen_selftest(){
+       
+       uint8_t uid1[] = {0x04,0x11,0x12,0x11,0x12,0x11,0x10};
+       uint32_t pwd1 = ul_ev1_pwdgenA(uid1);
+       PrintAndLog("UID | %s | %08X | %s", sprint_hex(uid1,7), pwd1, (pwd1 == 0x8432EB17)?"OK":"->8432EB17<-");
+
+       uint8_t uid2[] = {0x04,0x1f,0x98,0xea,0x1e,0x3e,0x81};          
+       uint32_t pwd2 = ul_ev1_pwdgenB(uid2);
+       PrintAndLog("UID | %s | %08X | %s", sprint_hex(uid2,7), pwd2, (pwd2 == 0x5fd37eca)?"OK":"->5fd37eca<--");
+       return;
+}
 
 static int CmdHelp(const char *Cmd);
 
@@ -237,16 +285,6 @@ static int ulev1_getVersion( uint8_t *response, uint16_t responseLength ){
        return len;
 }
 
-// static int ulev1_fastRead( uint8_t startblock, uint8_t endblock, uint8_t *response ){
-       
-       // uint8_t cmd[] = {MIFARE_ULEV1_FASTREAD, startblock, endblock};
-       
-       // if ( !ul_send_cmd_raw(cmd, sizeof(cmd), response)){
-               // return -1;
-       // }
-       // return 0;
-// }
-
 static int ulev1_readCounter( uint8_t counter, uint8_t *response, uint16_t responseLength ){
 
        uint8_t cmd[] = {MIFARE_ULEV1_READ_CNT, counter};
@@ -268,7 +306,6 @@ static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){
        return len;
 }
 
-
 // Fudan check checks for which error is given for a command with incorrect crc
 // NXP UL chip responds with 01, fudan 00.
 // other possible checks:
@@ -338,12 +375,12 @@ static int ul_print_default( uint8_t *data){
 
        PrintAndLog("      Lock : %s - %s",
                                sprint_hex(data+10, 2),
-                               printBits(2, data+10)
+                               sprint_bin(data+10, 2)
                );
 
        PrintAndLog("OneTimePad : %s - %s\n",
                                sprint_hex(data + 12, 4),
-                               printBits(4, data+12)
+                               sprint_bin(data+12, 4)
                );
 
        return 0;
@@ -434,8 +471,8 @@ static int ulc_print_3deskey( uint8_t *data){
 static int ulc_print_configuration( uint8_t *data){
 
        PrintAndLog("--- UL-C Configuration");
-       PrintAndLog(" Higher Lockbits [40/0x28] : %s - %s", sprint_hex(data, 4), printBits(2, data));
-       PrintAndLog("         Counter [41/0x29] : %s - %s", sprint_hex(data+4, 4), printBits(2, data+4));
+       PrintAndLog(" Higher Lockbits [40/0x28] : %s - %s", sprint_hex(data, 4), sprint_bin(data, 2));
+       PrintAndLog("         Counter [41/0x29] : %s - %s", sprint_hex(data+4, 4), sprint_bin(data+4, 2));
 
        bool validAuth = (data[8] >= 0x03 && data[8] <= 0x30);
        if ( validAuth )
@@ -1829,15 +1866,8 @@ int CmdHF14AMfuGenDiverseKeys(const char *Cmd){
        return 0;
 }
 
-// static uint8_t * diversify_key(uint8_t * key){
-       
-
- // return key;
-// }
-
 // static void GenerateUIDe( uint8_t *uid, uint8_t len){
        // for (int i=0; i<len; ++i){
-                       
        // }
        // return;
 // }
@@ -1931,10 +1961,6 @@ int CmdHF14AMfuELoad(const char *Cmd)
        return 0;
 }
 
-
-//------------------------------------
-// Menu Stuff
-//------------------------------------
 static command_t CommandTable[] =
 {
        {"help",        CmdHelp,                        1, "This help"},

diff --git a/client/cmdhfmfu.h b/client/cmdhfmfu.h
index 1cda8db0310cfe2fe7d10b9a5faa03c5699a0804..2fc55ae944ad826c9aeee807949011242e062360 100644 (file)
--- a/client/cmdhfmfu.h
+++ b/client/cmdhfmfu.h
@@ -28,6 +28,8 @@ int usage_hf_mfu_eload(void);
 
 int CmdHFMFUltra(const char *Cmd);
 
+uint32_t ul_ev1_pwdgenA(uint8_t* uid);
+
 typedef enum TAGTYPE_UL {
        UNKNOWN       = 0x000000,
        UL            = 0x000001,

diff --git a/client/cmdlft55xx.c b/client/cmdlft55xx.c
index 92e6f745a213a085a71d3f5a726310d9f7d3ac42..b967936b46af49de2f5eb4123f3370f8796f0ca4 100644 (file)
--- a/client/cmdlft55xx.c
+++ b/client/cmdlft55xx.c
@@ -152,13 +152,15 @@ int usage_t55xx_wakup(){
 int usage_t55xx_bruteforce(){\r
     PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");\r
     PrintAndLog("       password must be 4 bytes (8 hex symbols)");\r
+       PrintAndLog("This command uses A) bruteforce to scan a number range");\r
+       PrintAndLog("                  B) a dictionary attack");\r
        PrintAndLog("Options:");\r
        PrintAndLog("     h                     - this help");\r
     PrintAndLog("     i <*.dic>        - loads a default keys dictionary file <*.dic>");\r
     PrintAndLog("");\r
     PrintAndLog("Examples:");\r
     PrintAndLog("       lf t55xx bruteforce aaaaaaaa bbbbbbbb");\r
-       PrintAndLog("       lf t55xx bruteforce i mykeys.dic");\r
+       PrintAndLog("       lf t55xx bruteforce i default_pwd.dic");\r
     PrintAndLog("");\r
     return 0;\r
 }\r

diff --git a/client/default_pwd.dic b/client/default_pwd.dic
index 5edb83effa82a035a4135fe2b57f5bf01954fc02..94cd46319bbba7aac8828adb5882ea71b0365915 100644 (file)
--- a/client/default_pwd.dic
+++ b/client/default_pwd.dic
@@ -72,4 +72,36 @@ AABBCCDD,
 BBCCDDEE,
 CCDDEEFF,
 0CB7E7FC,  //rfidler?
-FABADA11,  //china?
\ No newline at end of file
+FABADA11,  //china?
+# 20 most common len==8
+#12345678,
+#11111111,
+#88888888,
+87654321,
+#00000000,
+12341234,
+69696969,
+12121212,
+#11223344,
+12344321,
+#77777777,
+#99999999,
+#22222222,
+#55555555,
+#33333333,
+#44444444,
+#66666666,
+11112222,
+13131313,
+10041004,
+##
+31415926, //pii
+abcd1234,
+20002000,
+19721972,
+aa55aa55, //amiboo
+55aa55aa, //rev amiboo
+4f271149, // seeds ul-ev1
+07d7bb0b, // seeds ul-ev1
+9636ef8f, // seeds ul-ev1
+b5f44686, // seeds ul-ev1

diff --git a/client/util.c b/client/util.c
index 118912339bcd212072e25dbc2fa5d42200c17ab6..860193e7b0cbfe79d509c270ad62115c3edda055 100644 (file)
--- a/client/util.c
+++ b/client/util.c
@@ -481,17 +481,25 @@ int32_t le24toh (uint8_t data[3]) {
     return (data[2] << 16) | (data[1] << 8) | data[0];
 }
 
-
 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits) {
+
+       if (len > 32) return 0;
        
        int i = start;
        int j = len-1;
-
-       if (len > 32) return 0;
-
        uint32_t tmp = 0;
+
        for (; j >= 0; --j, ++i)
                tmp     |= bits[i] << j;
 
        return tmp;
 }
+
+// RotateLeft - Ultralight, Desfire
+void rol(uint8_t *data, const size_t len){
+    uint8_t first = data[0];
+    for (size_t i = 0; i < len-1; i++) {
+        data[i] = data[i+1];
+    }
+    data[len-1] = first;
+}
\ No newline at end of file

diff --git a/client/util.h b/client/util.h
index eead10ec3770342caf2af7f94be746bdeb64e3c5..5ba5eb6aa42a19f33ea0a802d1bf80899a47a749 100644 (file)
--- a/client/util.h
+++ b/client/util.h
@@ -59,9 +59,9 @@ int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt);
 int param_gethex_ex(const char *line, int paramnum, uint8_t * data, int *hexcnt);
 int param_getstr(const char *line, int paramnum, char * str);
 
- int hextobinarray( char *target,  char *source);
- int hextobinstring( char *target,  char *source);
- int binarraytohex( char *target,  char *source,  int length);
+int hextobinarray( char *target,  char *source);
+int hextobinstring( char *target,  char *source);
+int binarraytohex( char *target,  char *source,  int length);
 void binarraytobinstring(char *target,  char *source,  int length);
 uint8_t GetParity( uint8_t *string, uint8_t type,  int length);
 void wiegand_add_parity(uint8_t *target, uint8_t *source, uint8_t length);
@@ -69,3 +69,4 @@ void wiegand_add_parity(uint8_t *target, uint8_t *source, uint8_t length);
 void xor(unsigned char * dst, unsigned char * src, size_t len);
 int32_t le24toh (uint8_t data[3]);
 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits);
+void rol(uint8_t *data, const size_t len);
\ No newline at end of file