From 508b37ba9ce74eed6553ce59deb79f49b5311d11 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Mon, 14 Dec 2015 22:50:54 +0100 Subject: [PATCH] REM: removed an unused doublett function "printBits" in util.c ADD: added a new string helper function "sprint_hex_ascii" in util.c ADD: added "LF AWID BRUTE", a very simple bruteforce command for the awid commands. it takes a facility-code, and iterates all possible 0xFFFF cardnum by sending sim command. It also uses the usb_poll function to stop the bruteforce on keypress and not leaving the pm3 device running the simulation. the command implements the help parameter. --- armsrc/lfops.c | 18 +++---------- client/cmdlfawid.c | 63 ++++++++++++++++++++++++++++++++++++++++++++-- client/cmdlfawid.h | 3 ++- client/util.c | 34 +++++-------------------- client/util.h | 1 - common/usb_cdc.c | 1 - 6 files changed, 73 insertions(+), 47 deletions(-) diff --git a/armsrc/lfops.c b/armsrc/lfops.c index e9392595..85931aa3 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -400,7 +400,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol) for(;;) { //wait until SSC_CLK goes HIGH while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) { - if(BUTTON_PRESS() || (usb_poll_validate_length() )) { + if(BUTTON_PRESS() || usb_poll_validate_length() ) { DbpString("Stopped"); return; } @@ -417,7 +417,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol) //wait until SSC_CLK goes LOW while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) { - if(BUTTON_PRESS()) { + if( BUTTON_PRESS() || usb_poll_validate_length() ) { DbpString("Stopped"); return; } @@ -594,20 +594,10 @@ void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream) } } Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, invert: %d, n: %d",fcHigh, fcLow, clk, invert, n); - /*Dbprintf("DEBUG: First 32:"); - uint8_t *dest = BigBuf_get_addr(); - i=0; - Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]); - i+=16; - Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]); - */ - if (ledcontrol) - LED_A_ON(); + if (ledcontrol) LED_A_ON(); SimulateTagLowFrequency(n, 0, ledcontrol); - - if (ledcontrol) - LED_A_OFF(); + if (ledcontrol) LED_A_OFF(); } // compose ask waveform for one bit(ASK) diff --git a/client/cmdlfawid.c b/client/cmdlfawid.c index 7709d75b..e7dee935 100644 --- a/client/cmdlfawid.c +++ b/client/cmdlfawid.c @@ -19,7 +19,8 @@ #include "util.h" // weigandparity #include "protocols.h" // for T55xx config register definitions #include "cmdmain.h" - + #include "sleep.h" + static int CmdHelp(const char *Cmd); int usage_lf_awid_fskdemod(void) { @@ -57,7 +58,7 @@ int usage_lf_awid_clone(void) { PrintAndLog(""); PrintAndLog("Usage: lf awid clone "); PrintAndLog("Options :"); - PrintAndLog(" : 8-bit value AWID facility code"); + PrintAndLog(" : 8-bit value AWID facility code"); PrintAndLog(" : 16-bit value AWID card number"); PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip"); PrintAndLog(""); @@ -65,6 +66,18 @@ int usage_lf_awid_clone(void) { return 0; } +int usage_lf_awid_brute(void){ + PrintAndLog("Enables bruteforce of AWID26 card with specified facility-code."); + PrintAndLog("Per AWID26 format, the facility-code (FC) is 8-bit and the card number is 16-bit."); + PrintAndLog(""); + PrintAndLog("Usage: lf awid brute "); + PrintAndLog("Options :"); + PrintAndLog(" : 8-bit value AWID facility code"); + PrintAndLog(""); + PrintAndLog("Sample : lf awid brute 224"); + return 0; +} + int CmdAWIDDemodFSK(const char *Cmd) { int findone = 0; if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod(); @@ -189,11 +202,57 @@ int CmdAWIDClone(const char *Cmd) { return 0; } +int CmdAWIDBrute(const char *Cmd){ + + uint8_t fc = 0x00; + uint8_t bits[96]; + uint8_t *bs = bits; + size_t size = sizeof(bits); + memset(bs, 0x00, size); + + char cmdp = param_getchar(Cmd, 0); + if (strlen(Cmd) > 3 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_brute(); + + fc = param_get8(Cmd, 0); + if ( fc == 0) return usage_lf_awid_brute(); + + PrintAndLog("Bruteforceing AWID26"); + PrintAndLog("Press pm3-button to abort simulation or run another command"); + + uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8 + uint64_t arg2 = 50; // clk RF/50 invert=0 + UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}}; + + for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){ + if (ukbhit()) { + PrintAndLog("aborted via keyboard!"); + c.cmd = CMD_PING; + c.arg[0] = 0x00; + c.arg[1] = 0x00; + c.arg[2] = 0x00; + clearCommandBuffer(); + SendCommand(&c); + return 1; + } + + (void)getAWIDBits(fc, cn, bs); + memcpy(c.d.asBytes, bs, size); + clearCommandBuffer(); + SendCommand(&c); + + PrintAndLog("Trying FC: %u; CN: %u", fc, cn); + // pause + sleep(1); + } + return 0; +} + static command_t CommandTable[] = { {"help", CmdHelp, 1, "This help"}, {"fskdemod", CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"}, {"sim", CmdAWIDSim, 0, " -- AWID tag simulator"}, {"clone", CmdAWIDClone, 0, " -- Clone AWID to T55x7"}, + {"brute", CmdAWIDBrute, 0, " -- bruteforce card number"}, {NULL, NULL, 0, NULL} }; diff --git a/client/cmdlfawid.h b/client/cmdlfawid.h index 00622927..2f88e701 100644 --- a/client/cmdlfawid.h +++ b/client/cmdlfawid.h @@ -12,13 +12,14 @@ #define CMDLFAWID_H__ int CmdLFAWID(const char *Cmd); -//int CmdAWIDDemod(const char *Cmd); int CmdAWIDDemodFSK(const char *Cmd); int CmdAWIDSim(const char *Cmd); int CmdAWIDClone(const char *Cmd); +int CmdAWIDBrute(const char *Cmd); int getAWIDBits(unsigned int fc, unsigned int cn, uint8_t *AWIDBits); int usage_lf_awid_fskdemod(void); int usage_lf_awid_clone(void); int usage_lf_awid_sim(void); +int usage_lf_awid_brute(void); #endif diff --git a/client/util.c b/client/util.c index 29914667..de1cbe94 100644 --- a/client/util.c +++ b/client/util.c @@ -159,6 +159,8 @@ char *sprint_bin(const uint8_t *data, const size_t len) { char *sprint_hex_ascii(const uint8_t *data, const size_t len) { static char buf[1024]; memset(buf, 0x00, 1024); + char *tmp = buf; + sprintf(tmp, "%s| %s", sprint_hex(data, len) , data); return buf; } void num_to_bytes(uint64_t n, size_t len, uint8_t* dest) @@ -192,8 +194,8 @@ void num_to_bytebits(uint64_t n, size_t len, uint8_t *dest) { // hh,gg,ff,ee,dd,cc,bb,aa, pp,oo,nn,mm,ll,kk,jj,ii // up to 64 bytes or 512 bits uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize){ - //static uint8_t buf[64]; - uint8_t buf[64]; + static uint8_t buf[64]; + //uint8_t buf[64]; memset(buf, 0x00, 64); uint8_t *tmp = buf; for (uint8_t block=0; block < (uint8_t)(len/blockSize); block++){ @@ -204,28 +206,6 @@ uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockS return tmp; } -//assumes little endian -char * printBits(size_t const size, void const * const ptr) -{ - unsigned char *b = (unsigned char*) ptr; - unsigned char byte; - static char buf[1024]; - char * tmp = buf; - int i, j; - - for (i=size-1;i>=0;i--) - { - for (j=7;j>=0;j--) - { - byte = b[i] & (1<>= j; - sprintf(tmp, "%u", byte); - tmp++; - } - } - return buf; -} - // ------------------------------------------------------------------------- // string parameters lib // ------------------------------------------------------------------------- @@ -344,13 +324,11 @@ int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt) { int bg, en, temp, i; - if (hexcnt % 2) - return 1; + if (hexcnt & 1) return 1; if (param_getptr(line, &bg, &en, paramnum)) return 1; - if (en - bg + 1 != hexcnt) - return 1; + if (en - bg + 1 != hexcnt) return 1; for(i = 0; i < hexcnt; i += 2) { if (!(isxdigit(line[bg + i]) && isxdigit(line[bg + i + 1])) ) return 1; diff --git a/client/util.h b/client/util.h index c57df5c2..7831716a 100644 --- a/client/util.h +++ b/client/util.h @@ -45,7 +45,6 @@ char *sprint_hex_ascii(const uint8_t *data, const size_t len); void num_to_bytes(uint64_t n, size_t len, uint8_t* dest); uint64_t bytes_to_num(uint8_t* src, size_t len); void num_to_bytebits(uint64_t n, size_t len, uint8_t *dest); -char * printBits(size_t const size, void const * const ptr); uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize); char param_getchar(const char *line, int paramnum); diff --git a/common/usb_cdc.c b/common/usb_cdc.c index dbd1c995..049cb8cf 100644 --- a/common/usb_cdc.c +++ b/common/usb_cdc.c @@ -304,7 +304,6 @@ bool usb_poll() **/ bool usb_poll_validate_length() { - if (!usb_check()) return false; if (!(pUdp->UDP_CSR[AT91C_EP_OUT] & btReceiveBank)) return false; return (pUdp->UDP_CSR[AT91C_EP_OUT] >> 16) > 0; -- 2.39.2