PCF7931: improved read code and implemented a simple password bruteforce (#745)

[proxmark3-svn] / armsrc / lfops.c

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 7ad4dabe130dbe8e863fd5ce2bd007498158788b..1816bdcaf600f8f7e398a2108377b7083b2dc579 100644 (file)
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -876,7 +876,6 @@ void CmdHIDdemodFSK(int findone, int *high2, int *high, int *low, int ledcontrol
        BigBuf_Clear_keep_EM();
 
        while(!BUTTON_PRESS() && !usb_poll_validate_length()) {
        BigBuf_Clear_keep_EM();
 
        while(!BUTTON_PRESS() && !usb_poll_validate_length()) {

-

                WDT_HIT();
                if (ledcontrol) LED_A_ON();
 
                WDT_HIT();
                if (ledcontrol) LED_A_ON();
 


@@ -887,13 +886,67 @@ void CmdHIDdemodFSK(int findone, int *high2, int *high, int *low, int ledcontrol
                idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo, &dummyIdx);
                
                if (idx>0 && lo>0 && (size==96 || size==192)){
                idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo, &dummyIdx);
                
                if (idx>0 && lo>0 && (size==96 || size==192)){

+                       uint8_t bitlen = 0;
+                       uint32_t fc = 0;
+                       uint32_t cardnum = 0;
+                       bool decoded = false;
+

                        // go over previously decoded manchester data and decode into usable tag ID
                        // go over previously decoded manchester data and decode into usable tag ID

-                       if (hi2 != 0){ //extra large HID tags  88/192 bits
-                               Dbprintf("TAG ID: %x%08x%08x (%d)",
-                                 (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
-                       } else {  //standard HID tags 44/96 bits
-                               Dbprintf("TAG ID: %x%08x (%d)",(unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF); //old print cmd
+                       if ((hi2 & 0x000FFFF) != 0){ //extra large HID tags  88/192 bits
+                               uint32_t bp = hi2 & 0x000FFFFF;
+                               bitlen = 63;
+                               while (bp > 0) {
+                                       bp = bp >> 1;
+                                       bitlen++;
+                               }
+                       } else if ((hi >> 6) > 0) {
+                               uint32_t bp = hi;
+                               bitlen = 31;
+                               while (bp > 0) {
+                                       bp = bp >> 1;
+                                       bitlen++;
+                               }
+                       } else if (((hi >> 5) & 1) == 0) {
+                               bitlen = 37;
+                       } else if ((hi & 0x0000001F) > 0 ) {
+                               uint32_t bp = (hi & 0x0000001F);
+                               bitlen = 31;
+                               while (bp > 0) {
+                                       bp = bp >> 1;
+                                       bitlen++;
+                               }
+                       } else {
+                               uint32_t bp = lo;
+                               bitlen = 0;
+                               while (bp > 0) {
+                                       bp = bp >> 1;
+                                       bitlen++;
+                               }
+                       }
+                       switch (bitlen){
+                               case 26:
+                                       cardnum = (lo>>1)&0xFFFF;
+                                       fc = (lo>>17)&0xFF;
+                                       decoded = true;
+                                       break;
+                               case 35:
+                                       cardnum = (lo>>1)&0xFFFFF;
+                                       fc = ((hi&1)<<11)|(lo>>21);
+                                       decoded = true;
+                                       break;

                        }
                        }

+                               
+                       if (hi2 != 0) //extra large HID tags  88/192 bits
+                               Dbprintf("TAG ID: %x%08x%08x (%d)",
+                                       (unsigned int) hi2, (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+                       else 
+                               Dbprintf("TAG ID: %x%08x (%d)",
+                                       (unsigned int) hi, (unsigned int) lo, (unsigned int) (lo>>1) & 0xFFFF);
+                       
+                       if (decoded)
+                               Dbprintf("Format Len: %dbits - FC: %d - Card: %d",
+                                       (unsigned int) bitlen, (unsigned int) fc, (unsigned int) cardnum);
+

                        if (findone){
                                if (ledcontrol) LED_A_OFF();
                                *high2 = hi2;
                        if (findone){
                                if (ledcontrol) LED_A_OFF();
                                *high2 = hi2;


@@ -1364,8 +1417,8 @@ void WriteT55xx(uint32_t *blockdata, uint8_t startblock, uint8_t numblocks) {
        }
 }
 
        }
 }
 

-// Copy HID id to card and setup block 0 config
-void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT) {
+// Copy a HID-like card (e.g. HID Proximity, Paradox) to a T55x7 compatible card
+void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT, uint8_t preamble) {

        uint32_t data[] = {0,0,0,0,0,0,0};
        uint8_t last_block = 0;
 
        uint32_t data[] = {0,0,0,0,0,0,0};
        uint8_t last_block = 0;
 


@@ -1377,15 +1430,15 @@ void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT) {
                }
                // Build the 6 data blocks for supplied 84bit ID
                last_block = 6;
                }
                // Build the 6 data blocks for supplied 84bit ID
                last_block = 6;

-               // load preamble (1D) & long format identifier (9E manchester encoded)
-               data[1] = 0x1D96A900 | (manchesterEncode2Bytes((hi2 >> 16) & 0xF) & 0xFF);
+               // load preamble & long format identifier (9E manchester encoded)
+               data[1] = (preamble << 24) | 0x96A900 | (manchesterEncode2Bytes((hi2 >> 16) & 0xF) & 0xFF);

                // load raw id from hi2, hi, lo to data blocks (manchester encoded)
                data[2] = manchesterEncode2Bytes(hi2 & 0xFFFF);
                data[3] = manchesterEncode2Bytes(hi >> 16);
                data[4] = manchesterEncode2Bytes(hi & 0xFFFF);
                data[5] = manchesterEncode2Bytes(lo >> 16);
                data[6] = manchesterEncode2Bytes(lo & 0xFFFF);
                // load raw id from hi2, hi, lo to data blocks (manchester encoded)
                data[2] = manchesterEncode2Bytes(hi2 & 0xFFFF);
                data[3] = manchesterEncode2Bytes(hi >> 16);
                data[4] = manchesterEncode2Bytes(hi & 0xFFFF);
                data[5] = manchesterEncode2Bytes(lo >> 16);
                data[6] = manchesterEncode2Bytes(lo & 0xFFFF);

-       }       else {
+       } else {

                // Ensure no more than 44 bits supplied
                if (hi>0xFFF) {
                        DbpString("Tags can only have 44 bits.");
                // Ensure no more than 44 bits supplied
                if (hi>0xFFF) {
                        DbpString("Tags can only have 44 bits.");


@@ -1394,7 +1447,7 @@ void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT) {
                // Build the 3 data blocks for supplied 44bit ID
                last_block = 3;
                // load preamble
                // Build the 3 data blocks for supplied 44bit ID
                last_block = 3;
                // load preamble

-               data[1] = 0x1D000000 | (manchesterEncode2Bytes(hi) & 0xFFFFFF);
+               data[1] = (preamble << 24) | (manchesterEncode2Bytes(hi) & 0xFFFFFF);

                data[2] = manchesterEncode2Bytes(lo >> 16);
                data[3] = manchesterEncode2Bytes(lo & 0xFFFF);
        }
                data[2] = manchesterEncode2Bytes(lo >> 16);
                data[3] = manchesterEncode2Bytes(lo & 0xFFFF);
        }


@@ -1796,7 +1849,7 @@ void Cotag(uint32_t arg0) {
        SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
 
        // Now set up the SSC to get the ADC samples that are now streaming at us.
        SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
 
        // Now set up the SSC to get the ADC samples that are now streaming at us.

-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_LF_ADC);

 
        // start clock - 1.5ticks is 1us
        StartTicks();
 
        // start clock - 1.5ticks is 1us
        StartTicks();