hello again.
After partial success with HASP dongles I have another topic to debate.

How to obtain iButton passwords ;]

The dongle has 3 user memory bank called Subkey 0, Subkey 1, Subkey 2.
From what I had read the authentication is made by SHA-1 engine computing 20byte MAC from

Internal 8-byte secret
32-byte memory page
13 bytes of constants
Numeric value of selected page - 1 byte
DS 2432 Family code 1 byte
DS2432 48 bit serial number - 6 bytes
3 bytes of scratchpad

scratchpad in this case is random challenge made to compare both host and client MACs to prove authentic.

I will be able to physically do anything with the machine that uses iButton.
My plan was to "overhear" the message between machine and dongle and intercept it.

That would be: random challenge, MAC device ID and basically everything.

Only reading of 1 wire function control and 64 bit lasered ROM are parasite powered by the host so intercepting shouldn't disrupt work of the device (sorry for my bad english).

After interception of the message I believe it is possible to brute force the SHA-1 hash in order to obtain the passwords. If I had 13 bytes of constants and 3 random bytes (or only 3 random bytes which would be significantly harder to break).

Only thing is that I wasn't able find the tool that would do such a trick.

And I'm not sure how exactly I should intercept the message (I have help with building a device for such a thing) and how to "write it down" to be readable.

If there is a way of reversing this using only 1-wire usb adapter and tool it would be great.

One more thing, I know that this had been done before and it is possible I just don't know exactly how.

I'm also not able to contact with someone who's done that.

Thanks for help already ;]

Make log with USBTrace . Simple manual:

1) Download USBTrace
2) Setup and register USBTrace
3) Run USBTrace
4) Press button with label "Capture hot plugged USB devices"
5) Press button with green arrow
6) Insert dongle to USB
7) Press button with red square
8) Save log to file
9) In top left corner (in USBTrace) select your
USB device and check it
10) Press button with green arrow
11) Run your program and work with her
12) Press button with red square
13) Save log to file

he (ds2490) use 3 endpoint and use the bulk transfer for the dongle communication...

For good patching you need:

1- Dongle SDK (Libraries and User Manuals are enough)
2- IDA (+ Flair to make signature)
3- Dongle (to get information from)
4- Hex Editor (to make changes)
5- ollydbg (for testing and debugging)

or

1 get the hasp vusb based source
2 study the log data and communications with the dongle
3 edit the hasp source (by step 1) and insert to him part with the bulk communications from your log
4 compile edited C souce and test this own ds1490/ds2490 emulation driver

you can obtain a mor comprensive log activating in the register the debug level to 9.

it is in HKLU/software/Maxim..../dallas....

doing it, you can obtain a complete log info of the ibutton comunications

=)

thanks, I'll do my best ;]

@FoxB

sorry but it's not 2490 but ds1991 (ds1205)
usbtrace creates infinite log when aplication that uses MicroLAN is started. If no application is used then there is no log at all.

hmm, you can show log?