This commit is contained in:
iceman1001 2024-10-01 09:52:46 +02:00
commit 01a191f385
3 changed files with 24 additions and 10 deletions

View file

@ -2593,13 +2593,13 @@ static void SendForward(uint8_t fwd_bit_count, bool fast) {
// 32FC * 8us == 256us / 21.3 == 12.018 steps. ok // 32FC * 8us == 256us / 21.3 == 12.018 steps. ok
// 16FC * 8us == 128us / 21.3 == 6.009 steps. ok // 16FC * 8us == 128us / 21.3 == 6.009 steps. ok
#ifndef EM_START_GAP #ifndef EM_START_GAP
#define EM_START_GAP 55*8 #define EM_START_GAP (55 * 8)
#endif #endif
fwd_write_ptr = forwardLink_data; fwd_write_ptr = forwardLink_data;
fwd_bit_sz = fwd_bit_count; fwd_bit_sz = fwd_bit_count;
if (! fast) { if (fast == false) {
// Set up FPGA, 125kHz or 95 divisor // Set up FPGA, 125kHz or 95 divisor
LFSetupFPGAForADC(LF_DIVISOR_125, true); LFSetupFPGAForADC(LF_DIVISOR_125, true);
} }
@ -2639,16 +2639,21 @@ void EM4xBruteforce(uint32_t start_pwd, uint32_t n, bool ledcontrol) {
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
WaitMS(20); WaitMS(20);
if (ledcontrol) LED_A_ON(); if (ledcontrol) LED_A_ON();
LFSetupFPGAForADC(LF_DIVISOR_125, true); LFSetupFPGAForADC(LF_DIVISOR_125, true);
uint32_t candidates_found = 0; uint32_t candidates_found = 0;
for (uint32_t pwd = start_pwd; pwd < 0xFFFFFFFF; pwd++) { for (uint32_t pwd = start_pwd; pwd < 0xFFFFFFFF; pwd++) {
if (((pwd - start_pwd) & 0x3F) == 0x00) { if (((pwd - start_pwd) & 0x3F) == 0x00) {
WDT_HIT(); WDT_HIT();
if (BUTTON_PRESS() || data_available()) { if (BUTTON_PRESS() || data_available()) {
Dbprintf("EM4x05 Bruteforce Interrupted"); Dbprintf("EM4x05 Bruteforce Interrupted");
break; break;
} }
} }
// Report progress every 256 attempts // Report progress every 256 attempts
if (((pwd - start_pwd) & 0xFF) == 0x00) { if (((pwd - start_pwd) & 0xFF) == 0x00) {
Dbprintf("Trying: %06Xxx", pwd >> 8); Dbprintf("Trying: %06Xxx", pwd >> 8);
@ -2662,7 +2667,9 @@ void EM4xBruteforce(uint32_t start_pwd, uint32_t n, bool ledcontrol) {
WaitUS(400); WaitUS(400);
DoPartialAcquisition(0, false, 350, 1000, ledcontrol); DoPartialAcquisition(0, false, 350, 1000, ledcontrol);
uint8_t *mem = BigBuf_get_addr(); uint8_t *mem = BigBuf_get_addr();
if (mem[334] < 128) { if (mem[334] < 128) {
candidates_found++; candidates_found++;
Dbprintf("Password candidate: " _GREEN_("%08X"), pwd); Dbprintf("Password candidate: " _GREEN_("%08X"), pwd);
@ -2671,6 +2678,7 @@ void EM4xBruteforce(uint32_t start_pwd, uint32_t n, bool ledcontrol) {
break; break;
} }
} }
// Beware: if smaller, tag might not have time to be back in listening state yet // Beware: if smaller, tag might not have time to be back in listening state yet
WaitMS(1); WaitMS(1);
} }
@ -2719,7 +2727,9 @@ void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd, bool ledcontrol) {
* 0000 1010 ok * 0000 1010 ok
* 0000 0001 fail * 0000 0001 fail
**/ **/
if (usepwd) EM4xLoginEx(pwd); if (usepwd) {
EM4xLoginEx(pwd);
}
forward_ptr = forwardLink_data; forward_ptr = forwardLink_data;
uint8_t len = Prepare_Cmd(FWD_CMD_READ); uint8_t len = Prepare_Cmd(FWD_CMD_READ);
@ -2754,7 +2764,9 @@ void EM4xWriteWord(uint8_t addr, uint32_t data, uint32_t pwd, uint8_t usepwd, bo
* 0000 1010 ok. * 0000 1010 ok.
* 0000 0001 fail * 0000 0001 fail
**/ **/
if (usepwd) EM4xLoginEx(pwd); if (usepwd) {
EM4xLoginEx(pwd);
}
forward_ptr = forwardLink_data; forward_ptr = forwardLink_data;
uint8_t len = Prepare_Cmd(FWD_CMD_WRITE); uint8_t len = Prepare_Cmd(FWD_CMD_WRITE);
@ -2797,7 +2809,9 @@ void EM4xProtectWord(uint32_t data, uint32_t pwd, uint8_t usepwd, bool ledcontro
* 0000 1010 ok. * 0000 1010 ok.
* 0000 0001 fail * 0000 0001 fail
**/ **/
if (usepwd) EM4xLoginEx(pwd); if (usepwd) {
EM4xLoginEx(pwd);
}
forward_ptr = forwardLink_data; forward_ptr = forwardLink_data;
uint8_t len = Prepare_Cmd(FWD_CMD_PROTECT); uint8_t len = Prepare_Cmd(FWD_CMD_PROTECT);

View file

@ -295,9 +295,9 @@ static int generate_config_card(const iclass_config_card_item_t *o, uint8_t *ke
memcpy(&configcard.conf, "\xFF\xFF\xFF\xFF\xF9\xFF\xFF\xBC", 8); memcpy(&configcard.conf, "\xFF\xFF\xFF\xFF\xF9\xFF\xFF\xBC", 8);
memcpy(&configcard.epurse, "\xFE\xFF\xFF\xFF\xFF\xFF\xFF\xFF", 8); memcpy(&configcard.epurse, "\xFE\xFF\xFF\xFF\xFF\xFF\xFF\xFF", 8);
if(got_krki){ if (got_krki) {
HFiClassCalcDivKey(configcard.csn, card_key, configcard.key_d, use_elite); HFiClassCalcDivKey(configcard.csn, card_key, configcard.key_d, use_elite);
}else if (!got_krki){ } else if (!got_krki) {
// defaulting to AA1 ki 0 // defaulting to AA1 ki 0
HFiClassCalcDivKey(configcard.csn, iClass_Key_Table[0], configcard.key_d, use_elite); HFiClassCalcDivKey(configcard.csn, iClass_Key_Table[0], configcard.key_d, use_elite);
} }
@ -311,9 +311,9 @@ static int generate_config_card(const iclass_config_card_item_t *o, uint8_t *ke
if (res == PM3_SUCCESS) { if (res == PM3_SUCCESS) {
cc = &iclass_last_known_card; cc = &iclass_last_known_card;
// calc diversified key for selected card // calc diversified key for selected card
if(got_krki){ if (got_krki) {
HFiClassCalcDivKey(cc->csn, card_key, cc->key_d, use_elite); HFiClassCalcDivKey(cc->csn, card_key, cc->key_d, use_elite);
}else if (!got_krki){ } else if (!got_krki) {
// defaulting to AA1 ki 0 // defaulting to AA1 ki 0
HFiClassCalcDivKey(cc->csn, iClass_Key_Table[0], cc->key_d, false); HFiClassCalcDivKey(cc->csn, iClass_Key_Table[0], cc->key_d, false);
} }

View file

@ -12956,6 +12956,6 @@
"metadata": { "metadata": {
"commands_extracted": 747, "commands_extracted": 747,
"extracted_by": "PM3Help2JSON v1.00", "extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2024-09-30T08:35:18" "extracted_on": "2024-10-01T07:52:00"
} }
} }