#!/usr/bin/env python3
"""
Final aggressive attempt - try all reasonable combinations
"""
import requests
from itertools import product

def lcg_step(seed):
    return (seed * 0x52c6425d + 0xcc52c) % (2**32)

def generate_keys(passcode):
    seed = passcode
    keys = []
    for _ in range(6):
        seed = lcg_step(seed)
        keys.append(seed % 0xffffff)
    return keys

def try_unlock(uid, username, sector22, sector34, passcode):
    keys = generate_keys(passcode)
    key_bytes = []
    for key in keys[4:6]:
        key_bytes.extend([key >> 16, (key >> 8) & 0xFF, key & 0xFF])
    key_hex = ''.join(f'{b:02x}' for b in key_bytes)
    
    auth_code = sector22 + key_hex
    
    data = {
        'uid': uid,
        'username': username,
        'authorization_code': auth_code,
        'access_level': sector34
    }
    
    try:
        r = requests.post('http://154.57.164.61:31938/api', data=data, timeout=3)
        result = r.json()
        if result.get('flag') and len(result.get('flag', '')) > 5:
            print(f"\n{'='*70}")
            print(f"SUCCESS!")
            print(f"{'='*70}")
            print(f"UID: {uid}")
            print(f"Username: {username}")
            print(f"Sector 22: {sector22}")
            print(f"Sector 34: {sector34}")
            print(f"Passcode: {passcode} (0x{passcode:x})")
            print(f"FLAG: {result['flag']}")
            print(f"{'='*70}")
            return True
    except:
        pass
    return False

print("[*] Trying comprehensive patterns...")

uid = '04f6555b'
username = '74657074617374'

# Common MIFARE patterns
patterns = [
    '00' * 16,  # All zeros
    'ff' * 16,  # All ones  
    '00' * 15 + '01',  # Mostly zeros
    'ff' * 15 + '00',  # Mostly ones
]

# Common passcodes
passcodes = [0, 1, 1234, 12345, 0x1337, 0xDEAD, 0xBEEF, 0xCAFE, 0xBABE, 0xDEADBEEF & 0xFFFF]

count = 0
total = len(patterns) * len(patterns) * len(passcodes)

for s22 in patterns:
    for s34 in patterns:
        for pc in passcodes:
            count += 1
            if count % 10 == 0:
                print(f"\r[*] Progress: {count}/{total}", end='', flush=True)
            
            if try_unlock(uid, username, s22, s34, pc):
                exit(0)

print(f"\n[*] Tested {count} combinations without success.")
print("[!] Need actual sector data from Saleae capture.")