IC Card Crack.cpp

/* run this program using the console pauser or add your own getch, system("pause") or input loop */
#include <iostream>
#include <windows.h>
#include <stdio.h>
#include <conio.h>
#include <fstream>
#include <io.h>

//控制字定义
#define BLOCK0_EN  0x01
#define BLOCK1_EN  0x02
#define BLOCK2_EN  0x04
#define NEEDSERIAL 0x08
#define EXTERNKEY  0x10
#define NEEDHALT   0x20


int main(int argc, char** argv) {
	int i,i0,i1,i2,i3,i4,i5,j;
	long long start=0x4411,now;// Define start value. 0x4411 means 0x441100
	unsigned char status;//存放返回值
    unsigned char myareano;//区号
    unsigned char authmode;//密码类型，用A密码或B密码
    unsigned char myctrlword;//控制字
	unsigned char mypicckey[6];//密码
    unsigned char mypiccserial[4];//卡序列号
    unsigned char mypiccdata[48]; //卡数据缓
    void beep(unsigned long xms=1);

    unsigned char (__stdcall *piccreadex)(unsigned char ctrlword,unsigned char *serial,unsigned char area,unsigned char keyA1B0,unsigned char *picckey,unsigned char *piccdata0_2);
		
	unsigned char devno[4];//设备编号

	HINSTANCE hDll;
    hDll=LoadLibrary("OUR_MIFARE.dll");
    
	/*    
    DWORD ret1 = GetLastError();
    std::cout << ret1 << "\n";
    */
    
    if(!hDll)
    {
    	printf("Error! Can't open dll!");
    	return 1;
    }

	//提取函数  
	piccreadex = (unsigned char (__stdcall *)(unsigned char,unsigned char *,unsigned char,unsigned char,unsigned char *,unsigned char *))GetProcAddress(hDll,"piccreadex");
	
    //控制字指定,控制字的含义请查看本公司网站提供的动态库说明
    myctrlword = BLOCK0_EN + BLOCK1_EN + BLOCK2_EN + EXTERNKEY;
	
	//指定区号
    myareano = 10;//指定为第10区
    
	//批定密码模式
    authmode = 1;//大于0表示用A密码认证，推荐用A密码认证

    //指定密码
    mypicckey[0] = 0xff;
    mypicckey[1] = 0xff;
    mypicckey[2] = 0xff;
    mypicckey[3] = 0xff;
    mypicckey[4] = 0xff;
    mypicckey[5] = 0xff;
    
    for (i0=0x0;i0<=0xff;i0++) {
    	mypicckey[0]=i0;
    	for (i1=0x0;i1<=0xff;i1++) {	
    		mypicckey[1]=i1;
    		for (i2=0x0;i2<=0xff;i2++) {	
    			mypicckey[2]=i2;
    			for (i3=0x0;i3<=0xff;i3++) {	
    				mypicckey[3]=i3;
    				for (i4=0x0;i4<=0xff;i4++) {	
    					// if ((i0==0x0 and i1==0x0 and i2==0x0) and (i3<0xf or (i3==0xf and i4<0x34))) continue;
						now=((((i0*0x100+i1)*0x100+i2)*0x100)+i3)*0x100+i4;
    					if (now < start) continue;
    					mypicckey[4]=i4;
						for (j=0;j<5;j++)
						{
							std::cout << std::hex << (int)mypicckey[j];
							std::cout << " ";
						}
						std::cout << ": " << (int)status << "\n";
						for (i5=0x0;i5<=0xff;i5++) {	
    						mypicckey[5]=i5;
    						  		    	
					    	status = piccreadex(myctrlword,mypiccserial,myareano,authmode,mypicckey,mypiccdata);
							// beep();
														
							if (status==0) {
								for (j=0;j<6;j++)
								{
									std::cout << std::hex << (int)mypicckey[j];
									std::cout << " ";
								}								
								std::cout << ": ";
								std::cout << (int)status << "\n";
								return 0;
							} else if (status==8) {
								beep(1000);
								return 1;
							}
						}
					}
				}
			}
		}
	}
    	
	/*
	DWORD ret1 = GetLastError();
    std::cout << ret1 << "\n";
    */

    //输出卡数据
    /*
    std::cout << "Sector: " << (int)myareano << "\n";
    for(i = 0;i<48;i++)
    {
        std::cout << std::hex << (int)mypiccdata[i];
       	std::cout << " ";
    }	
	*/
	return 0;
}

void beep(unsigned long xms)
{
	unsigned char (__stdcall *pcdbeep)(unsigned long xms);
	HINSTANCE hDll;
    hDll=LoadLibrary("OUR_MIFARE.dll");	
	pcdbeep = (unsigned char (__stdcall *)(unsigned long))GetProcAddress(hDll,"pcdbeep");
    pcdbeep(xms);
}