Wiki / Protocols

1-Wire

Single-data-line bus where every device carries a unique 64-bit ROM ID. iButton access tokens trust that ID, so cloning it clones the key.

1-wire ibutton ds1990 flipper ds18b20 romid cloning
Master (reader/adapter) Device (iButton/sensor) DQ GND DQ GND
A single open-drain data line DQ carries commands, data, and (in parasite-power mode) energy, referenced to GND. The master pulls DQ low in timed slots; the device answers on the same wire. Every device holds a unique 64-bit ROM ID.

1-Wire is a low-speed bus that carries data, and optionally power, over a single line (DQ) plus ground. Every device holds a factory-programmed, globally unique 64-bit ROM ID. That ID is the whole story for security: iButton access tokens are trusted by their ID alone, so reproducing the ID reproduces the credential.

What it is

1-Wire is a master/slave bus with an open-drain DQ line idling HIGH through a pull-up. The master owns all timing: it pulls DQ low for precisely shaped time slots to send bits and to sample the device's response on the same wire. Many devices can share DQ; the master singles one out with its ROM ID. In parasite-power mode the device even harvests its operating energy from DQ during the idle-HIGH periods, needing only two physical contacts.

Element Role
DQ single open-drain data line
GND common reference
ROM ID unique 64-bit: 8-bit family + 48-bit serial + 8-bit CRC
Parasite power device runs off DQ, no separate VCC

The 64-bit ROM ID breaks down as an 8-bit family code (0x01 for a DS1990 iButton, 0x28 for a DS18B20 temperature sensor), a 48-bit serial number, and an 8-bit CRC.

Why it matters

1-Wire runs temperature sensors, small EEPROMs, and, most interesting to an attacker, iButton contact tokens (DS1990A) used for door and elevator access. These readers typically authenticate on the ROM ID and nothing else, no challenge, no secret. Read the ID once and you can write it to a blank, turning a physical-presence control into a trivial clone. (Secured variants such as the DS1961S/DS1963S add SHA-1 challenge/response and are not clonable this way.)

How to work it

  1. Read a token's ROM ID with a flipper-zero in iButton mode (or a DS9490 USB adapter). Hold the contact steady until the ID appears.
  2. Enumerate a multi-device bus with the Search ROM algorithm to list every ID present.
  3. On Linux with a supported adapter, the kernel w1 subsystem exposes devices directly:
# each attached 1-Wire device shows up by its ID under sysfs
ls /sys/bus/w1/devices/
cat /sys/bus/w1/devices/28-*/w1_slave    # e.g. read a DS18B20 temperature
  1. Clone a DS1990 ID onto a writable RW1990 blank (the Flipper's "Save" then "Write" flow, or a dedicated iButton writer).
  2. Present the clone at the reader to replay the identity and bypass the access control.

Pitfalls

  • Timing is unforgiving: 1-Wire slots are microsecond-scale. Bit-banging it off a slow or interrupt-heavy host produces flaky reads; a dedicated master chip or the Flipper is more reliable.
  • Not every iButton is clonable: SHA-1 secured parts (DS1961S and similar) will not yield to an ID copy.
  • The family code matters. Writing a DS18B20-family ID onto an iButton blank will not fool a reader expecting a 0x01 token.
  • A bad CRC byte means a misread ID; re-seat the contact and read again before trusting it.

Further reading

Related tools

MULTIFlipper Zero