REM: removed an unused doublett function "printBits" in util.c

ADD:  added a new string helper function "sprint_hex_ascii" in util.c
ADD:  added "LF AWID BRUTE", a very simple bruteforce command for the awid commands.
      it takes a facility-code,  and iterates all possible 0xFFFF cardnum by sending sim command. It also uses the usb_poll function to stop the bruteforce on keypress and not leaving the pm3 device running the simulation.
the command implements the help parameter.

armsrc/lfops.c

@@ -400,7 +400,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
 	for(;;) {
 		//wait until SSC_CLK goes HIGH
 		while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
-			if(BUTTON_PRESS() || (usb_poll_validate_length() )) {
+			if(BUTTON_PRESS() || usb_poll_validate_length() ) {
 				DbpString("Stopped");
 				return;
 			}
@@ -417,7 +417,7 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
 		
 		//wait until SSC_CLK goes LOW
 		while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
-			if(BUTTON_PRESS()) {
+			if( BUTTON_PRESS() || usb_poll_validate_length() ) {
 				DbpString("Stopped");
 				return;
 			}
@@ -594,20 +594,10 @@ void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
 		}
 	}
 	Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, invert: %d, n: %d",fcHigh, fcLow, clk, invert, n);
-	/*Dbprintf("DEBUG: First 32:");
-	uint8_t *dest = BigBuf_get_addr();
-	i=0;
-	Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
-	i+=16;
-	Dbprintf("%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d", dest[i],dest[i+1],dest[i+2],dest[i+3],dest[i+4],dest[i+5],dest[i+6],dest[i+7],dest[i+8],dest[i+9],dest[i+10],dest[i+11],dest[i+12],dest[i+13],dest[i+14],dest[i+15]);
-	*/
-	if (ledcontrol)
-		LED_A_ON();
 
+	if (ledcontrol)	LED_A_ON();
 	SimulateTagLowFrequency(n, 0, ledcontrol);
-
+	if (ledcontrol)	LED_A_OFF();
-	if (ledcontrol)
-		LED_A_OFF();
 }
 
 // compose ask waveform for one bit(ASK)

client/cmdlfawid.c

@@ -19,7 +19,8 @@
 #include "util.h"       // weigandparity
 #include "protocols.h"  // for T55xx config register definitions
 #include "cmdmain.h"
-
+ #include "sleep.h"
+ 
 static int CmdHelp(const char *Cmd);
 
 int usage_lf_awid_fskdemod(void) {
@@ -57,7 +58,7 @@ int usage_lf_awid_clone(void) {
 	PrintAndLog("");
 	PrintAndLog("Usage:  lf awid clone <Facility-Code> <Card-Number>");
 	PrintAndLog("Options :");
-	PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+	PrintAndLog("  <Facility-Code> : 8-bit value AWID facility code");
 	PrintAndLog("  <Card Number>   : 16-bit value AWID card number");
 	PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
 	PrintAndLog("");
@@ -65,6 +66,18 @@ int usage_lf_awid_clone(void) {
 	return 0;
 }
 
+int usage_lf_awid_brute(void){
+	PrintAndLog("Enables bruteforce of AWID26 card with specified facility-code.");
+	PrintAndLog("Per AWID26 format, the facility-code (FC) is 8-bit and the card number is 16-bit.");
+	PrintAndLog("");
+	PrintAndLog("Usage:  lf awid brute <Facility-Code>");
+	PrintAndLog("Options :");
+	PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
+	PrintAndLog("");
+	PrintAndLog("Sample  : lf awid brute 224");
+	return 0;
+}
+
 int CmdAWIDDemodFSK(const char *Cmd) {
 	int findone = 0;
 	if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod();
@@ -189,11 +202,57 @@ int CmdAWIDClone(const char *Cmd) {
 	return 0;
 }
 
+int CmdAWIDBrute(const char *Cmd){
+	
+	uint8_t fc = 0x00;
+	uint8_t bits[96];
+	uint8_t *bs = bits;
+	size_t size = sizeof(bits);
+	memset(bs, 0x00, size);
+
+	char cmdp = param_getchar(Cmd, 0);
+	if (strlen(Cmd) > 3 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_brute();
+	
+  	fc =  param_get8(Cmd, 0);
+	if ( fc == 0) return usage_lf_awid_brute();
+	
+	PrintAndLog("Bruteforceing AWID26");
+	PrintAndLog("Press pm3-button to abort simulation or run another command");
+
+	uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
+	uint64_t arg2 = 50; 		 // clk RF/50 invert=0
+	UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};  
+
+	for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){
+		if (ukbhit()) {
+			PrintAndLog("aborted via keyboard!");
+			c.cmd = CMD_PING;
+			c.arg[0] = 0x00;
+			c.arg[1] = 0x00;
+			c.arg[2] = 0x00;
+			clearCommandBuffer();
+			SendCommand(&c);
+			return 1;
+		}
+			
+		(void)getAWIDBits(fc, cn, bs);
+		memcpy(c.d.asBytes, bs, size);
+		clearCommandBuffer();
+		SendCommand(&c);
+		
+		PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
+		// pause
+		sleep(1);
+	}
+	return 0;
+}
+
 static command_t CommandTable[] = {
 	{"help",      CmdHelp,         1, "This help"},
 	{"fskdemod",  CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"},
 	{"sim",       CmdAWIDSim,      0, "<Facility-Code> <Card Number> -- AWID tag simulator"},
 	{"clone",     CmdAWIDClone,    0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7"},
+	{"brute",	  CmdAWIDBrute,	   0, "<Facility-Code> -- bruteforce card number"},
 	{NULL, NULL, 0, NULL}
 };
 

client/cmdlfawid.h

@@ -12,13 +12,14 @@
 #define CMDLFAWID_H__
 
 int CmdLFAWID(const char *Cmd);
-//int CmdAWIDDemod(const char *Cmd);
 int CmdAWIDDemodFSK(const char *Cmd);
 int CmdAWIDSim(const char *Cmd);
 int CmdAWIDClone(const char *Cmd);
+int CmdAWIDBrute(const char *Cmd);
 int getAWIDBits(unsigned int fc, unsigned int cn, uint8_t *AWIDBits);
 int usage_lf_awid_fskdemod(void);
 int usage_lf_awid_clone(void);
 int usage_lf_awid_sim(void);
+int usage_lf_awid_brute(void);
 
 #endif

client/util.c

@@ -159,6 +159,8 @@ char *sprint_bin(const uint8_t *data, const size_t len) {
 char *sprint_hex_ascii(const uint8_t *data, const size_t len) {
 	static char buf[1024];
 	memset(buf, 0x00, 1024);
+	char *tmp = buf;
+	sprintf(tmp, "%s| %s", sprint_hex(data, len) , data);	
 	return buf;
 }
 void num_to_bytes(uint64_t n, size_t len, uint8_t* dest)
@@ -192,8 +194,8 @@ void num_to_bytebits(uint64_t	n, size_t len, uint8_t *dest) {
 // hh,gg,ff,ee,dd,cc,bb,aa, pp,oo,nn,mm,ll,kk,jj,ii
 // up to 64 bytes or 512 bits
 uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize){
-	//static uint8_t buf[64];
+	static uint8_t buf[64];
-	uint8_t buf[64];
+	//uint8_t buf[64];
 	memset(buf, 0x00, 64);
 	uint8_t *tmp = buf;
 	for (uint8_t block=0; block < (uint8_t)(len/blockSize); block++){
@@ -204,28 +206,6 @@ uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockS
 	return tmp;
 }
 
-//assumes little endian
-char * printBits(size_t const size, void const * const ptr)
-{
-    unsigned char *b = (unsigned char*) ptr;	
-    unsigned char byte;
-	static char buf[1024];
-	char * tmp = buf;
-    int i, j;
-
-    for (i=size-1;i>=0;i--)
-    {
-        for (j=7;j>=0;j--)
-        {
-            byte = b[i] & (1<<j);
-            byte >>= j;
-            sprintf(tmp, "%u", byte);
-			tmp++;
-        }
-    }
-	return buf;
-}
-
 //  -------------------------------------------------------------------------
 //  string parameters lib
 //  -------------------------------------------------------------------------
@@ -344,13 +324,11 @@ int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt)
 {
 	int bg, en, temp, i;
 
-	if (hexcnt % 2)
+	if (hexcnt & 1) return 1;
-		return 1;
 	
 	if (param_getptr(line, &bg, &en, paramnum)) return 1;
 
-	if (en - bg + 1 != hexcnt) 
+	if (en - bg + 1 != hexcnt) return 1;
-		return 1;
 
 	for(i = 0; i < hexcnt; i += 2) {
 		if (!(isxdigit(line[bg + i]) && isxdigit(line[bg + i + 1])) )	return 1;

client/util.h

@@ -45,7 +45,6 @@ char *sprint_hex_ascii(const uint8_t *data, const size_t len);
 void num_to_bytes(uint64_t n, size_t len, uint8_t* dest);
 uint64_t bytes_to_num(uint8_t* src, size_t len);
 void num_to_bytebits(uint64_t	n, size_t len, uint8_t *dest);
-char * printBits(size_t const size, void const * const ptr);
 uint8_t *SwapEndian64(const uint8_t *src, const size_t len, const uint8_t blockSize);
 
 char param_getchar(const char *line, int paramnum);

common/usb_cdc.c

@@ -304,7 +304,6 @@ bool usb_poll()
 **/
 bool usb_poll_validate_length()
 {
-
 	if (!usb_check()) return false;
 	if (!(pUdp->UDP_CSR[AT91C_EP_OUT] & btReceiveBank)) return false;
 	return (pUdp->UDP_CSR[AT91C_EP_OUT] >> 16) >  0;