X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/060fdaf998d09011610c14de5b27ac597b0660a0..08e11f0a90d5d4360d67dc4a7e96315e794150e6:/client/cmdlft55xx.c
diff --git a/client/cmdlft55xx.c b/client/cmdlft55xx.c
index 91168a02..75c1a1f8 100644
--- a/client/cmdlft55xx.c
+++ b/client/cmdlft55xx.c
@@ -150,15 +150,19 @@ int usage_t55xx_wakup(){
return 0;
}
int usage_t55xx_bruteforce(){
+ PrintAndLog("This command uses A) bruteforce to scan a number range");
+ PrintAndLog(" B) a dictionary attack");
PrintAndLog("Usage: lf t55xx bruteforce <start password> <end password> [i <*.dic>]");
PrintAndLog(" password must be 4 bytes (8 hex symbols)");
PrintAndLog("Options:");
PrintAndLog(" h - this help");
+ PrintAndLog(" <start_pwd> - 4 byte hex value to start pwd search at");
+ PrintAndLog(" <end_pwd> - 4 byte hex value to end pwd search at");
PrintAndLog(" i <*.dic> - loads a default keys dictionary file <*.dic>");
PrintAndLog("");
PrintAndLog("Examples:");
PrintAndLog(" lf t55xx bruteforce aaaaaaaa bbbbbbbb");
- PrintAndLog(" lf t55xx bruteforce i mykeys.dic");
+ PrintAndLog(" lf t55xx bruteforce i default_pwd.dic");
PrintAndLog("");
return 0;
}
@@ -179,7 +183,6 @@ int CmdT55xxSetConfig(const char *Cmd) {
uint8_t bitRate = 0;
uint8_t rates[9] = {8,16,32,40,50,64,100,128,0};
uint8_t cmdp = 0;
- config.Q5 = FALSE;
bool errors = FALSE;
while(param_getchar(Cmd, cmdp) != 0x00 && !errors)
{
@@ -383,17 +386,23 @@ bool DecodeT55xxBlock(){
break;
case DEMOD_PSK1:
// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
+ save_restoreGB(1);
CmdLtrim("160");
snprintf(cmdStr, sizeof(buf),"%d %d 6", bitRate[config.bitrate], config.inverted );
ans = PSKDemod(cmdStr, FALSE);
+ //undo trim samples
+ save_restoreGB(0);
break;
case DEMOD_PSK2: //inverted won't affect this
case DEMOD_PSK3: //not fully implemented
// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
+ save_restoreGB(1);
CmdLtrim("160");
snprintf(cmdStr, sizeof(buf),"%d 0 6", bitRate[config.bitrate] );
ans = PSKDemod(cmdStr, FALSE);
psk1TOpsk2(DemodBuffer, DemodBufferLen);
+ //undo trim samples
+ save_restoreGB(0);
break;
case DEMOD_NRZ:
snprintf(cmdStr, sizeof(buf),"%d %d 1", bitRate[config.bitrate], config.inverted );
@@ -411,7 +420,6 @@ bool DecodeT55xxBlock(){
}
int CmdT55xxDetect(const char *Cmd){
-
bool errors = FALSE;
bool useGB = FALSE;
bool usepwd = FALSE;
@@ -459,7 +467,6 @@ bool tryDetectModulation(){
t55xx_conf_block_t tests[15];
int bitRate=0;
uint8_t fc1 = 0, fc2 = 0, clk=0;
- save_restoreGB(1);
if (GetFskClock("", FALSE, FALSE)){
fskClocks(&fc1, &fc2, &clk, FALSE);
@@ -480,7 +487,6 @@ bool tryDetectModulation(){
tests[hits].modulation = DEMOD_FSK1;
else if (fc1 == 10 && fc2 == 8)
tests[hits].modulation = DEMOD_FSK2a;
-
tests[hits].bitrate = bitRate;
tests[hits].inverted = TRUE;
tests[hits].block0 = PackBits(tests[hits].offset, 32, DemodBuffer);
@@ -519,7 +525,7 @@ bool tryDetectModulation(){
}
}
//undo trim from ask
- save_restoreGB(0);
+ //save_restoreGB(0);
clk = GetNrzClock("", FALSE, FALSE);
if (clk>0) {
if ( NRZrawDemod("0 0 1", FALSE) && test(DEMOD_NRZ, &tests[hits].offset, &bitRate, clk, &tests[hits].Q5)) {
@@ -539,9 +545,9 @@ bool tryDetectModulation(){
}
}
- //undo trim from nrz
- save_restoreGB(0);
+ // allow undo
// skip first 160 samples to allow antenna to settle in (psk gets inverted occasionally otherwise)
+ save_restoreGB(1);
CmdLtrim("160");
clk = GetPskClock("", FALSE, FALSE);
if (clk>0) {
@@ -582,14 +588,16 @@ bool tryDetectModulation(){
}
} // inverse waves does not affect this demod
}
+ //undo trim samples
+ save_restoreGB(0);
}
- save_restoreGB(0);
if ( hits == 1) {
config.modulation = tests[0].modulation;
config.bitrate = tests[0].bitrate;
config.inverted = tests[0].inverted;
config.offset = tests[0].offset;
config.block0 = tests[0].block0;
+ config.Q5 = tests[0].Q5;
printConfiguration( config );
return TRUE;
}
@@ -665,6 +673,15 @@ bool testQ5Modulation(uint8_t mode, uint8_t modread){
return FALSE;
}
+int convertQ5bitRate(uint8_t bitRateRead) {
+ uint8_t expected[] = {8, 16, 32, 40, 50, 64, 100, 128};
+ for (int i=0; i<8; i++)
+ if (expected[i] == bitRateRead)
+ return i;
+
+ return -1;
+}
+
bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){
if ( DemodBufferLen < 64 ) return FALSE;
@@ -676,12 +693,12 @@ bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){
uint8_t safer = PackBits(si, 4, DemodBuffer); si += 4; //master key
uint8_t resv = PackBits(si, 8, DemodBuffer); si += 8;
// 2nibble must be zeroed.
- if (safer != 0x6) continue;
+ if (safer != 0x6 && safer != 0x9) continue;
if ( resv > 0x00) continue;
//uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;
//uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;
si += 1+1;
- int bitRate = PackBits(si, 5, DemodBuffer)*2 + 2; si += 5; //bit rate
+ int bitRate = PackBits(si, 6, DemodBuffer)*2 + 2; si += 6; //bit rate
if (bitRate > 128 || bitRate < 8) continue;
//uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1;
@@ -696,7 +713,8 @@ bool testQ5(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk){
//test modulation
if (!testQ5Modulation(mode, modread)) continue;
if (bitRate != clk) continue;
- *fndBitRate = bitRate;
+ *fndBitRate = convertQ5bitRate(bitRate);
+ if (*fndBitRate < 0) continue;
*offset = idx;
return TRUE;
@@ -1009,8 +1027,14 @@ int CmdT55xxInfo(const char *Cmd){
if (!DecodeT55xxBlock()) return 1;
+ // too little space to start with
if ( DemodBufferLen < 32) return 1;
+ //
+ PrintAndLog("Offset+32 ==%d\n DemodLen == %d", config.offset + 32,DemodBufferLen );
+
+
+
uint8_t si = config.offset;
uint32_t bl0 = PackBits(si, 32, DemodBuffer);
@@ -1105,35 +1129,16 @@ char * GetBitRateStr(uint32_t id){
char *retStr = buf;
switch (id){
- case 0:
- snprintf(retStr,sizeof(buf),"%d - RF/8",id);
- break;
- case 1:
- snprintf(retStr,sizeof(buf),"%d - RF/16",id);
- break;
- case 2:
- snprintf(retStr,sizeof(buf),"%d - RF/32",id);
- break;
- case 3:
- snprintf(retStr,sizeof(buf),"%d - RF/40",id);
- break;
- case 4:
- snprintf(retStr,sizeof(buf),"%d - RF/50",id);
- break;
- case 5:
- snprintf(retStr,sizeof(buf),"%d - RF/64",id);
- break;
- case 6:
- snprintf(retStr,sizeof(buf),"%d - RF/100",id);
- break;
- case 7:
- snprintf(retStr,sizeof(buf),"%d - RF/128",id);
- break;
- default:
- snprintf(retStr,sizeof(buf),"%d - (Unknown)",id);
- break;
+ case 0: snprintf(retStr,sizeof(buf),"%d - RF/8",id); break;
+ case 1: snprintf(retStr,sizeof(buf),"%d - RF/16",id); break;
+ case 2: snprintf(retStr,sizeof(buf),"%d - RF/32",id); break;
+ case 3: snprintf(retStr,sizeof(buf),"%d - RF/40",id); break;
+ case 4: snprintf(retStr,sizeof(buf),"%d - RF/50",id); break;
+ case 5: snprintf(retStr,sizeof(buf),"%d - RF/64",id); break;
+ case 6: snprintf(retStr,sizeof(buf),"%d - RF/100",id); break;
+ case 7: snprintf(retStr,sizeof(buf),"%d - RF/128",id); break;
+ default: snprintf(retStr,sizeof(buf),"%d - (Unknown)",id); break;
}
-
return buf;
}
@@ -1315,7 +1320,7 @@ int CmdT55xxWipe(const char *Cmd) {
if (!CmdT55xxWriteBlock(ptrData))
PrintAndLog("Error writing blk %d", blk);
- memset(writeData, sizeof(writeData), 0x00);
+ memset(writeData,0x00, sizeof(writeData));
}
return 0;
}
@@ -1394,16 +1399,26 @@ int CmdT55xxBruteForce(const char *Cmd) {
uint64_t testpwd = 0x00;
for (uint16_t c = 0; c < keycnt; ++c ) {
+ if (ukbhit()) {
+ getchar();
+ printf("\naborted via keyboard!\n");
+ return 0;
+ }
+
testpwd = bytes_to_num(keyBlock + 4*c, 4);
PrintAndLog("Testing %08X", testpwd);
- AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, TRUE, testpwd);
+ if ( !AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, TRUE, testpwd)) {
+ PrintAndLog("Aquireing data from device failed. Quitting");
+ return 0;
+ }
+
found = tryDetectModulation();
if ( found ) {
- PrintAndLog("Found valid password:[%08X]", testpwd);
+ PrintAndLog("Found valid password: [%08X]", testpwd);
return 0;
}
}
@@ -1419,20 +1434,27 @@ int CmdT55xxBruteForce(const char *Cmd) {
if ( start_password >= end_password ) return usage_t55xx_bruteforce();
- PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);
+ PrintAndLog("Search password range [%08X -> %08X]", start_password, end_password);
uint32_t i = start_password;
while ((!found) && (i <= end_password)){
- AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, TRUE, i);
+ printf(".");
+ fflush(stdout);
+ if (ukbhit()) {
+ getchar();
+ printf("\naborted via keyboard!\n");
+ return 0;
+ }
+
+ if (!AquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, TRUE, i)) {
+ PrintAndLog("Aquireing data from device failed. Quitting");
+ return 0;
+ }
found = tryDetectModulation();
- if (found)
- break;
-
- if ((i % 0x100) == 0) printf("[%08x], ",i);
-
+ if (found) break;
i++;
}
@@ -1441,13 +1463,13 @@ int CmdT55xxBruteForce(const char *Cmd) {
if (found)
PrintAndLog("Found valid password: [%08x]", i);
else
- PrintAndLog("Password NOT found. Last tried: [%08x]", i);
+ PrintAndLog("Password NOT found. Last tried: [%08x]", --i);
return 0;
}
static command_t CommandTable[] = {
{"help", CmdHelp, 1, "This help"},
- {"bruteforce", CmdT55xxBruteForce,0, "Simple bruteforce attack to find password"},
+ {"bruteforce",CmdT55xxBruteForce,0, "<start password> <end password> [i <*.dic>] Simple bruteforce attack to find password"},
{"config", CmdT55xxSetConfig, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
{"detect", CmdT55xxDetect, 1, "[1] Try detecting the tag modulation from reading the configuration block."},
{"dump", CmdT55xxDump, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},