]>
Commit | Line | Data |
---|---|---|
c15d2bdc | 1 | local cmds = require('commands') |
2 | local getopt = require('getopt') | |
3 | local bin = require('bin') | |
4 | local lib14a = require('read14a') | |
5 | local utils = require('utils') | |
6 | local md5 = require('md5') | |
f595de25 | 7 | local dumplib = require('html_dumplib') |
22f1c577 | 8 | local toyNames = require('default_toys') |
c15d2bdc | 9 | |
10 | example =[[ | |
11 | 1. script run tnp3 | |
8aa79dee | 12 | 2. script run tnp3 -n |
13 | 3. script run tnp3 -k aabbccddeeff | |
14 | 4. script run tnp3 -k aabbccddeeff -n | |
f595de25 | 15 | 5. script run tnp3 -o myfile |
16 | 6. script run tnp3 -n -o myfile | |
17 | 7. script run tnp3 -k aabbccddeeff -n -o myfile | |
c15d2bdc | 18 | ]] |
19 | author = "Iceman" | |
f595de25 | 20 | usage = "script run tnp3 -k <key> -n -o <filename>" |
c15d2bdc | 21 | desc =[[ |
22 | This script will try to dump the contents of a Mifare TNP3xxx card. | |
23 | It will need a valid KeyA in order to find the other keys and decode the card. | |
24 | Arguments: | |
8aa79dee | 25 | -h : this help |
26 | -k <key> : Sector 0 Key A. | |
27 | -n : Use the nested cmd to find all keys | |
f595de25 | 28 | -o : filename for the saved dumps |
c15d2bdc | 29 | ]] |
30 | ||
31 | local hashconstant = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20' | |
32 | ||
33 | local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds | |
34 | local DEBUG = true -- the debug flag | |
35 | local numBlocks = 64 | |
36 | local numSectors = 16 | |
37 | --- | |
38 | -- A debug printout-function | |
39 | function dbg(args) | |
40 | if not DEBUG then | |
41 | return | |
42 | end | |
43 | ||
44 | if type(args) == "table" then | |
45 | local i = 1 | |
46 | while result[i] do | |
47 | dbg(result[i]) | |
48 | i = i+1 | |
49 | end | |
50 | else | |
51 | print("###", args) | |
52 | end | |
53 | end | |
54 | --- | |
55 | -- This is only meant to be used when errors occur | |
56 | function oops(err) | |
57 | print("ERROR: ",err) | |
58 | end | |
59 | --- | |
60 | -- Usage help | |
61 | function help() | |
62 | print(desc) | |
63 | print("Example usage") | |
64 | print(example) | |
65 | end | |
66 | -- | |
67 | -- Exit message | |
68 | function ExitMsg(msg) | |
69 | print( string.rep('--',20) ) | |
70 | print( string.rep('--',20) ) | |
71 | print(msg) | |
72 | print() | |
73 | end | |
74 | ||
c70cef97 | 75 | local function readdumpkeys(infile) |
76 | t = infile:read("*all") | |
77 | len = string.len(t) | |
78 | local len,hex = bin.unpack(("H%d"):format(len),t) | |
c70cef97 | 79 | return hex |
80 | end | |
81 | ||
82 | local function waitCmd() | |
c15d2bdc | 83 | local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT) |
84 | if response then | |
85 | local count,cmd,arg0 = bin.unpack('LL',response) | |
86 | if(arg0==1) then | |
87 | local count,arg1,arg2,data = bin.unpack('LLH511',response,count) | |
88 | return data:sub(1,32) | |
89 | else | |
90 | return nil, "Couldn't read block.." | |
91 | end | |
92 | end | |
93 | return nil, "No response from device" | |
94 | end | |
95 | ||
47cbb2d4 | 96 | local function computeCrc16(s) |
97 | local hash = core.crc16(utils.ConvertHexToAscii(s)) | |
98 | return hash | |
99 | end | |
100 | ||
101 | local function reverseCrcBytes(crc) | |
102 | crc2 = crc:sub(3,4)..crc:sub(1,2) | |
103 | return tonumber(crc2,16) | |
104 | end | |
105 | ||
c15d2bdc | 106 | local function main(args) |
107 | ||
108 | print( string.rep('--',20) ) | |
cd5767d4 | 109 | print( string.rep('--',20) ) |
c15d2bdc | 110 | |
111 | local keyA | |
112 | local cmd | |
113 | local err | |
8aa79dee | 114 | local useNested = false |
c15d2bdc | 115 | local cmdReadBlockString = 'hf mf rdbl %d A %s' |
c70cef97 | 116 | local input = "dumpkeys.bin" |
47cbb2d4 | 117 | local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M%S"); |
f595de25 | 118 | |
c15d2bdc | 119 | -- Arguments for the script |
f595de25 | 120 | for o, a in getopt.getopt(args, 'hk:no:') do |
c15d2bdc | 121 | if o == "h" then return help() end |
122 | if o == "k" then keyA = a end | |
8aa79dee | 123 | if o == "n" then useNested = true end |
f595de25 | 124 | if o == "o" then outputTemplate = a end |
c15d2bdc | 125 | end |
126 | ||
127 | -- validate input args. | |
128 | keyA = keyA or '4b0b20107ccb' | |
129 | if #(keyA) ~= 12 then | |
130 | return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA)) | |
131 | end | |
22f1c577 | 132 | |
133 | -- Turn off Debug | |
134 | local cmdSetDbgOff = "hf mf dbg 0" | |
135 | core.console( cmdSetDbgOff) | |
c15d2bdc | 136 | |
137 | result, err = lib14a.read1443a(false) | |
138 | if not result then | |
8aa79dee | 139 | return oops(err) |
c15d2bdc | 140 | end |
8aa79dee | 141 | |
c15d2bdc | 142 | core.clearCommandBuffer() |
143 | ||
144 | if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx | |
8aa79dee | 145 | return oops('This is not a TNP3xxx tag. aborting.') |
c15d2bdc | 146 | end |
f595de25 | 147 | |
148 | -- Show tag info | |
22f1c577 | 149 | print((' Found tag : %s'):format(result.name)) |
c15d2bdc | 150 | print(('Using keyA : %s'):format(keyA)) |
c15d2bdc | 151 | |
22f1c577 | 152 | --Trying to find the other keys |
8aa79dee | 153 | if useNested then |
154 | core.console( ('hf mf nested 1 0 A %s d'):format(keyA) ) | |
155 | end | |
c70cef97 | 156 | |
8aa79dee | 157 | -- Loading keyfile |
1a5ff2c2 | 158 | print('Loading dumpkeys.bin') |
c70cef97 | 159 | local infile = io.open(input, "rb") |
160 | if infile == nil then | |
161 | return oops('Could not read file ', input) | |
162 | end | |
163 | local akeys = readdumpkeys(infile):sub(0,12*16) | |
9b989c45 | 164 | |
c15d2bdc | 165 | -- Read block 0 |
166 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA} | |
167 | err = core.SendCommand(cmd:getBytes()) | |
168 | if err then return oops(err) end | |
169 | local block0, err = waitCmd() | |
170 | if err then return oops(err) end | |
171 | ||
172 | -- Read block 1 | |
173 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA} | |
8aa79dee | 174 | err = core.SendCommand(cmd:getBytes()) |
c15d2bdc | 175 | if err then return oops(err) end |
176 | local block1, err = waitCmd() | |
177 | if err then return oops(err) end | |
178 | ||
8aa79dee | 179 | local key |
180 | local pos = 0 | |
181 | local blockNo | |
182 | local blocks = {} | |
c15d2bdc | 183 | |
22f1c577 | 184 | print('Reading card data') |
f595de25 | 185 | core.clearCommandBuffer() |
186 | ||
c15d2bdc | 187 | -- main loop |
47cbb2d4 | 188 | io.write('Decrypting blocks > ') |
1a5ff2c2 | 189 | for blockNo = 0, numBlocks-1, 1 do |
190 | ||
191 | if core.ukbhit() then | |
192 | print("aborted by user") | |
193 | break | |
194 | end | |
195 | ||
196 | pos = (math.floor( blockNo / 4 ) * 12)+1 | |
9b989c45 | 197 | key = akeys:sub(pos, pos + 11 ) |
1a5ff2c2 | 198 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key} |
199 | local err = core.SendCommand(cmd:getBytes()) | |
200 | if err then return oops(err) end | |
201 | local blockdata, err = waitCmd() | |
202 | if err then return oops(err) end | |
203 | ||
cd5767d4 | 204 | if blockNo%4 ~= 3 then |
1a5ff2c2 | 205 | if blockNo < 8 then |
206 | -- Block 0-7 not encrypted | |
cd5767d4 | 207 | blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata) |
8aa79dee | 208 | else |
47cbb2d4 | 209 | local base = ('%s%s%02x%s'):format(block0, block1, blockNo, hashconstant) |
210 | local baseStr = utils.ConvertHexToAscii(base) | |
cd5767d4 | 211 | local md5hash = md5.sumhexa(baseStr) |
1a5ff2c2 | 212 | local aestest = core.aes(md5hash, blockdata) |
f595de25 | 213 | |
cd5767d4 | 214 | local hex = utils.ConvertAsciiStringToBytes(aestest) |
215 | hex = utils.ConvertBytes2HexString(hex) | |
216 | --local _,hex = bin.unpack(("H%d"):format(16),aestest) | |
1a5ff2c2 | 217 | |
47cbb2d4 | 218 | -- blocks with zero not encrypted. |
1a5ff2c2 | 219 | if string.find(blockdata, '^0+$') then |
cd5767d4 | 220 | blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata) |
1a5ff2c2 | 221 | else |
47cbb2d4 | 222 | blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,hex) |
223 | io.write( blockNo..',') | |
1a5ff2c2 | 224 | end |
c70cef97 | 225 | end |
1a5ff2c2 | 226 | else |
227 | -- Sectorblocks, not encrypted | |
f595de25 | 228 | blocks[blockNo+1] = ('%02d :: %s%s'):format(blockNo,key,blockdata:sub(13,32)) |
c70cef97 | 229 | end |
c15d2bdc | 230 | end |
47cbb2d4 | 231 | io.write('\n') |
8aa79dee | 232 | |
f595de25 | 233 | core.clearCommandBuffer() |
234 | ||
8aa79dee | 235 | -- Print results |
f595de25 | 236 | local bindata = {} |
237 | local emldata = '' | |
238 | ||
239 | for _,s in pairs(blocks) do | |
47cbb2d4 | 240 | local slice = s:sub(8,#s) |
f595de25 | 241 | local str = utils.ConvertBytesToAsciiString( |
242 | utils.ConvertHexStringToBytes(slice) | |
243 | ) | |
244 | emldata = emldata..slice..'\n' | |
245 | for c in (str):gmatch('.') do | |
246 | bindata[#bindata+1] = c | |
247 | end | |
248 | end | |
249 | ||
250 | -- Write dump to files | |
47cbb2d4 | 251 | if not DEBUG then |
252 | local foo = dumplib.SaveAsBinary(bindata, outputTemplate..'.bin') | |
253 | print(("Wrote a BIN dump to the file %s"):format(foo)) | |
254 | local bar = dumplib.SaveAsText(emldata, outputTemplate..'.eml') | |
255 | print(("Wrote a EML dump to the file %s"):format(bar)) | |
256 | end | |
f595de25 | 257 | |
22f1c577 | 258 | local uid = block0:sub(1,8) |
259 | local itemtype = block1:sub(1,4) | |
260 | local cardid = block1:sub(9,24) | |
f595de25 | 261 | |
262 | -- Show info | |
263 | print( string.rep('--',20) ) | |
264 | print( (' ITEM TYPE : 0x%s - %s'):format(itemtype, toyNames[itemtype]) ) | |
265 | print( (' UID : 0x%s'):format(uid) ) | |
266 | print( (' CARDID : 0x%s'):format(cardid ) ) | |
267 | print( string.rep('--',20) ) | |
268 | ||
47cbb2d4 | 269 | print('Validating checksums') |
270 | -- Checksum Typ 0 | |
271 | local test1 = ('%s%s'):format(block0, block1:sub(1,28)) | |
272 | local crc = block1:sub(29,32) | |
273 | local revcrc = reverseCrcBytes(crc) | |
c15d2bdc | 274 | |
47cbb2d4 | 275 | io.write( ('BLOCK 0-1 : %04x = %04x \n'):format(revcrc,computeCrc16(test1))) |
276 | ||
277 | -- Checksum Typ 1 BLOCK 9 | |
278 | local block9 = blocks[9]:sub(8,35) | |
279 | test1 = ('%s0500'):format(block9) | |
280 | crc = blocks[9]:sub(36,39) | |
281 | revcrc = reverseCrcBytes(crc) | |
282 | io.write( ('BLOCK 8 : %04x = %04x \n'):format(revcrc,computeCrc16(test1))) | |
283 | ||
284 | -- Checksum Typ 1 BLOCK 37 | |
285 | local block37 = blocks[37]:sub(8,35) | |
286 | test1 = ('%s0500'):format(block37) | |
287 | crc = blocks[37]:sub(36,39) | |
288 | revcrc = reverseCrcBytes(crc) | |
289 | io.write( ('BLOCK 36 : %04x = %04x \n'):format(revcrc,computeCrc16(test1))) | |
290 | ||
291 | -- Checksum Typ 2 | |
292 | -- 10,11,13 | |
293 | test1 = blocks[10]:sub(8,39).. | |
294 | blocks[11]:sub(8,39).. | |
295 | blocks[13]:sub(8,39) | |
296 | ||
297 | crc = blocks[9]:sub(32,35) | |
298 | revcrc = reverseCrcBytes(crc) | |
299 | io.write( ('BLOCK 10-11-13 :%04x = %04x \n'):format(revcrc,computeCrc16(test1))) | |
300 | -- Checksum Typ 3 | |
301 | -- 15,17,18,19 | |
302 | crc = blocks[9]:sub(28,31) | |
303 | revcrc = reverseCrcBytes(crc) | |
304 | test1 = blocks[14]:sub(8,39).. | |
305 | blocks[15]:sub(8,39).. | |
306 | blocks[17]:sub(8,39) | |
307 | ||
308 | local tohash = test1..string.rep('00',0xe0) | |
309 | local hashed = computeCrc16(tohash) | |
310 | io.write( ('BLOCK 14-15-17 %04x = %04x \n'):format(revcrc,hashed)) | |
311 | end | |
c15d2bdc | 312 | main(args) |