Merge branch 'master' of https://github.com/iceman1001/proxmark3

[proxmark3-svn] / client / cmdlfawid.c

diff --git a/client/cmdlfawid.c b/client/cmdlfawid.c
index 7709d75bdd1fcec533298edff8ffeb4aaae19a3b..4a2001391851e0bffe26011360aea17ef7d7df32 100644 (file)
--- a/client/cmdlfawid.c
+++ b/client/cmdlfawid.c
@@ -19,7 +19,8 @@
 #include "util.h"       // weigandparity
 #include "protocols.h"  // for T55xx config register definitions
 #include "cmdmain.h"
-
+#include "sleep.h"
+ 
 static int CmdHelp(const char *Cmd);
 
 int usage_lf_awid_fskdemod(void) {
@@ -57,7 +58,7 @@ int usage_lf_awid_clone(void) {
        PrintAndLog("");
        PrintAndLog("Usage:  lf awid clone <Facility-Code> <Card-Number>");
        PrintAndLog("Options :");
-       PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+       PrintAndLog("  <Facility-Code> : 8-bit value AWID facility code");
        PrintAndLog("  <Card Number>   : 16-bit value AWID card number");
        PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
        PrintAndLog("");
@@ -65,6 +66,19 @@ int usage_lf_awid_clone(void) {
        return 0;
 }
 
+int usage_lf_awid_brute(void){
+       PrintAndLog("Enables bruteforce of AWID26 reader with specified facility-code.");
+       PrintAndLog("Per AWID26 format, the facility-code (FC) is 8-bit and the card number is 16-bit.");
+       PrintAndLog("This is a incremental attack against reader.");
+       PrintAndLog("");
+       PrintAndLog("Usage:  lf awid brute <Facility-Code>");
+       PrintAndLog("Options :");
+       PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+       PrintAndLog("");
+       PrintAndLog("Sample  : lf awid brute 224");
+       return 0;
+}
+
 int CmdAWIDDemodFSK(const char *Cmd) {
        int findone = 0;
        if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod();
@@ -88,23 +102,20 @@ int getAWIDBits(uint32_t fc, uint32_t cn, uint8_t  *AWIDBits) {
        num_to_bytebits(cn, 16, wiegand+8);
 
        wiegand_add_parity(pre+8, wiegand, 24);
-
        size_t bitLen = addParity(pre, AWIDBits+8, 66, 4, 1);
+
        if (bitLen != 88) return 0;
-       //for (uint8_t i = 0; i<3; i++){
-       //      PrintAndLog("DEBUG: %08X", bytebits_to_byte(AWIDBits+(32*i),32));
-       //}
        return 1;
 }
 
 int CmdAWIDSim(const char *Cmd) {
-       uint32_t fcode = 0, cnum = 0, fc=0, cn=0;
+       uint32_t fcode = 0, cnum = 0, fc = 0, cn = 0;
        uint8_t bits[96];
        uint8_t *bs = bits;
        size_t size = sizeof(bits);
-       memset(bs, 0, size);
+       memset(bs, 0x00, size);
 
-       uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
+       uint64_t arg1 = ( 10 << 8 ) + 8; // fcHigh = 10, fcLow = 8
        uint64_t arg2 = 50; // clk RF/50 invert=0
   
        if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_sim();
@@ -112,8 +123,8 @@ int CmdAWIDSim(const char *Cmd) {
        fcode = (fc & 0x000000FF);
        cnum = (cn & 0x0000FFFF);
        
-       if (fc!=fcode) PrintAndLog("Facility-Code (%u) truncated to 8-bits: %u", fc, fcode);
-       if (cn!=cnum)  PrintAndLog("Card number (%u) truncated to 16-bits: %u", cn, cnum);
+       if (fc != fcode) PrintAndLog("Facility-Code (%u) truncated to 8-bits: %u", fc, fcode);
+       if (cn != cnum)  PrintAndLog("Card number (%u) truncated to 16-bits: %u", cn, cnum);
        
        PrintAndLog("Emulating AWID26 -- FC: %u; CN: %u\n", fcode, cnum);
        PrintAndLog("Press pm3-button to abort simulation or run another command");
@@ -189,11 +200,57 @@ int CmdAWIDClone(const char *Cmd) {
        return 0;
 }
 
+int CmdAWIDBrute(const char *Cmd){
+       
+       uint8_t fc = 0x00;
+       uint8_t bits[96];
+       uint8_t *bs = bits;
+       size_t size = sizeof(bits);
+       memset(bs, 0x00, size);
+
+       char cmdp = param_getchar(Cmd, 0);
+       if (strlen(Cmd) > 3 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_brute();
+       
+       fc =  param_get8(Cmd, 0);
+       if ( fc == 0) return usage_lf_awid_brute();
+       
+       PrintAndLog("Bruteforceing AWID26 Reader");
+       PrintAndLog("Press pm3-button to abort simulation or run another command");
+
+       uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
+       uint64_t arg2 = 50;              // clk RF/50 invert=0
+       UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};  
+
+       for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){
+               if (ukbhit()) {
+                       PrintAndLog("aborted via keyboard!");
+                       c.cmd = CMD_PING;
+                       c.arg[0] = 0x00;
+                       c.arg[1] = 0x00;
+                       c.arg[2] = 0x00;
+                       clearCommandBuffer();
+                       SendCommand(&c);
+                       return 1;
+               }
+                       
+               (void)getAWIDBits(fc, cn, bs);
+               memcpy(c.d.asBytes, bs, size);
+               clearCommandBuffer();
+               SendCommand(&c);
+               
+               PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
+               // pause
+               sleep(1);
+       }
+       return 0;
+}
+
 static command_t CommandTable[] = {
        {"help",      CmdHelp,         1, "This help"},
        {"fskdemod",  CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"},
        {"sim",       CmdAWIDSim,      0, "<Facility-Code> <Card Number> -- AWID tag simulator"},
        {"clone",     CmdAWIDClone,    0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7"},
+       {"brute",         CmdAWIDBrute,    0, "<Facility-Code> -- bruteforce card number"},
        {NULL, NULL, 0, NULL}
 };