X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/a126332a7b3c85274a9988f8a6994fba930b5f52..089f91dc9da296f3dfcd95d01553e5ad7fcff99f:/client/cmdlfawid.c

diff --git a/client/cmdlfawid.c b/client/cmdlfawid.c
index 7709d75b..4a200139 100644
--- a/client/cmdlfawid.c
+++ b/client/cmdlfawid.c
@@ -19,7 +19,8 @@
 #include "util.h"       // weigandparity
 #include "protocols.h"  // for T55xx config register definitions
 #include "cmdmain.h"
-
+#include "sleep.h"
+ 
 static int CmdHelp(const char *Cmd);
 
 int usage_lf_awid_fskdemod(void) {
@@ -57,7 +58,7 @@ int usage_lf_awid_clone(void) {
 	PrintAndLog("");
 	PrintAndLog("Usage:  lf awid clone <Facility-Code> <Card-Number>");
 	PrintAndLog("Options :");
-	PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+	PrintAndLog("  <Facility-Code> : 8-bit value AWID facility code");
 	PrintAndLog("  <Card Number>   : 16-bit value AWID card number");
 	PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
 	PrintAndLog("");
@@ -65,6 +66,19 @@ int usage_lf_awid_clone(void) {
 	return 0;
 }
 
+int usage_lf_awid_brute(void){
+	PrintAndLog("Enables bruteforce of AWID26 reader with specified facility-code.");
+	PrintAndLog("Per AWID26 format, the facility-code (FC) is 8-bit and the card number is 16-bit.");
+	PrintAndLog("This is a incremental attack against reader.");
+	PrintAndLog("");
+	PrintAndLog("Usage:  lf awid brute <Facility-Code>");
+	PrintAndLog("Options :");
+	PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+	PrintAndLog("");
+	PrintAndLog("Sample  : lf awid brute 224");
+	return 0;
+}
+
 int CmdAWIDDemodFSK(const char *Cmd) {
 	int findone = 0;
 	if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod();
@@ -88,23 +102,20 @@ int getAWIDBits(uint32_t fc, uint32_t cn, uint8_t	*AWIDBits) {
 	num_to_bytebits(cn, 16, wiegand+8);
 
 	wiegand_add_parity(pre+8, wiegand, 24);
-
 	size_t bitLen = addParity(pre, AWIDBits+8, 66, 4, 1);
+
 	if (bitLen != 88) return 0;
-	//for (uint8_t i = 0; i<3; i++){
-	//	PrintAndLog("DEBUG: %08X", bytebits_to_byte(AWIDBits+(32*i),32));
-	//}
 	return 1;
 }
 
 int CmdAWIDSim(const char *Cmd) {
-	uint32_t fcode = 0, cnum = 0, fc=0, cn=0;
+	uint32_t fcode = 0, cnum = 0, fc = 0, cn = 0;
 	uint8_t bits[96];
 	uint8_t *bs = bits;
 	size_t size = sizeof(bits);
-	memset(bs, 0, size);
+	memset(bs, 0x00, size);
 
-	uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
+	uint64_t arg1 = ( 10 << 8 ) + 8; // fcHigh = 10, fcLow = 8
 	uint64_t arg2 = 50; // clk RF/50 invert=0
   
 	if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_sim();
@@ -112,8 +123,8 @@ int CmdAWIDSim(const char *Cmd) {
 	fcode = (fc & 0x000000FF);
 	cnum = (cn & 0x0000FFFF);
 	
-	if (fc!=fcode) PrintAndLog("Facility-Code (%u) truncated to 8-bits: %u", fc, fcode);
-	if (cn!=cnum)  PrintAndLog("Card number (%u) truncated to 16-bits: %u", cn, cnum);
+	if (fc != fcode) PrintAndLog("Facility-Code (%u) truncated to 8-bits: %u", fc, fcode);
+	if (cn != cnum)  PrintAndLog("Card number (%u) truncated to 16-bits: %u", cn, cnum);
 	
 	PrintAndLog("Emulating AWID26 -- FC: %u; CN: %u\n", fcode, cnum);
 	PrintAndLog("Press pm3-button to abort simulation or run another command");
@@ -189,11 +200,57 @@ int CmdAWIDClone(const char *Cmd) {
 	return 0;
 }
 
+int CmdAWIDBrute(const char *Cmd){
+	
+	uint8_t fc = 0x00;
+	uint8_t bits[96];
+	uint8_t *bs = bits;
+	size_t size = sizeof(bits);
+	memset(bs, 0x00, size);
+
+	char cmdp = param_getchar(Cmd, 0);
+	if (strlen(Cmd) > 3 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_brute();
+	
+  	fc =  param_get8(Cmd, 0);
+	if ( fc == 0) return usage_lf_awid_brute();
+	
+	PrintAndLog("Bruteforceing AWID26 Reader");
+	PrintAndLog("Press pm3-button to abort simulation or run another command");
+
+	uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
+	uint64_t arg2 = 50; 		 // clk RF/50 invert=0
+	UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};  
+
+	for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){
+		if (ukbhit()) {
+			PrintAndLog("aborted via keyboard!");
+			c.cmd = CMD_PING;
+			c.arg[0] = 0x00;
+			c.arg[1] = 0x00;
+			c.arg[2] = 0x00;
+			clearCommandBuffer();
+			SendCommand(&c);
+			return 1;
+		}
+			
+		(void)getAWIDBits(fc, cn, bs);
+		memcpy(c.d.asBytes, bs, size);
+		clearCommandBuffer();
+		SendCommand(&c);
+		
+		PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
+		// pause
+		sleep(1);
+	}
+	return 0;
+}
+
 static command_t CommandTable[] = {
 	{"help",      CmdHelp,         1, "This help"},
 	{"fskdemod",  CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"},
 	{"sim",       CmdAWIDSim,      0, "<Facility-Code> <Card Number> -- AWID tag simulator"},
 	{"clone",     CmdAWIDClone,    0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7"},
+	{"brute",	  CmdAWIDBrute,	   0, "<Facility-Code> -- bruteforce card number"},
 	{NULL, NULL, 0, NULL}
 };