[proxmark3-svn] / client / scripts / tnp3sim.lua

local cmds = require('commands')
local getopt = require('getopt')
local bin = require('bin')
local lib14a = require('read14a')
local utils = require('utils')
local md5 = require('md5')
local toys = require('default_toys')
local pre = require('precalc')
		
example =[[
	1. script run tnp3sim
	2. script run tnp3sim -m
	3. script run tnp3sim -m -i myfile
]]
author = "Iceman"
usage = "script run tnp3sim -h -m -i <filename>"
desc =[[
This script will try to load a binary datadump of a Mifare TNP3xxx card.
It vill try to validate all checksums and view some information stored in the dump
For an experimental mode, it tries to manipulate some data.
At last it sends all data to the PM3 device memory where it can be used in the command  "hf mf sim"

Arguments:
	-h             : this help
	-m             : Maxed out items (experimental)
	-i             : filename for the datadump to read (bin)

	]]

local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
local DEBUG = true -- the debug flag
local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'

local band = bit32.band
local bor = bit32.bor
local lshift = bit32.lshift
local rshift = bit32.rshift
local byte = string.byte
local char = string.char
local sub = string.sub
local format = string.format

--- 
-- A debug printout-function
function dbg(args)
	if not DEBUG then return end
	
    if type(args) == "table" then
		local i = 1
		while result[i] do
			dbg(result[i])
			i = i+1
		end
	else
		print("###", args)
	end	
end	
--- 
-- This is only meant to be used when errors occur
function oops(err)
	print("ERROR: ",err)
	return nil,err
end
--- 
-- Usage help
function help()
	print(desc)
	print("Example usage")
	print(example)
end
--
-- Exit message
function ExitMsg(msg)
	print( string.rep('--',20) )
	print( string.rep('--',20) )
	print(msg)
	print()
end

local function writedumpfile(infile)
	 t = infile:read("*all")
	 len = string.len(t)
	 local len,hex = bin.unpack(("H%d"):format(len),t)
	 return hex
end
-- blocks with data
-- there are two dataareas, in block 8 or block 36,   ( 1==8 ,
-- checksum type =  0, 1, 2, 3
local function GetCheckSum(blocks, dataarea, chksumtype)

	local crc
	local area = 36
	if  dataarea == 1 then
		area = 8
	end
	
	if chksumtype == 0 then
		crc = blocks[1]:sub(29,32)
	elseif chksumtype == 1 then
		crc = blocks[area]:sub(29,32)
	elseif chksumtype == 2 then	
		crc = blocks[area]:sub(25,28)
	elseif chksumtype == 3 then
		crc = blocks[area]:sub(21,24)		
	end
	return utils.SwapEndianness(crc,16)
end

local function SetAllCheckSum(blocks)
	print('Updating all checksums')
	SetCheckSum(blocks, 3)
	SetCheckSum(blocks, 2)
	SetCheckSum(blocks, 1)
	SetCheckSum(blocks, 0)
end

local function SetCheckSum(blocks, chksumtype)

	if blocks == nil then return nil, 'Argument \"blocks\" nil' end
	local newcrc
	local area1 = 8
	local area2 = 36
	
	if chksumtype == 0 then
		newcrc = ('%04X'):format(CalcCheckSum(blocks,1,0))	
		blocks[1] = blocks[1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
	elseif chksumtype == 1 then
		newcrc = ('%04X'):format(CalcCheckSum(blocks,1,1))	
		blocks[area1] = blocks[area1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
		newcrc = ('%04X'):format(CalcCheckSum(blocks,2,1))	
		blocks[area2] = blocks[area2]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
	elseif chksumtype == 2 then	
		newcrc = ('%04X'):format(CalcCheckSum(blocks,1,2))	
		blocks[area1] = blocks[area1]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(29,32)
		newcrc = ('%04X'):format(CalcCheckSum(blocks,2,2))	
		blocks[area2] = blocks[area2]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(29,32)
	elseif chksumtype == 3 then
		newcrc = ('%04X'):format(CalcCheckSum(blocks,1,3))	
		blocks[area1] = blocks[area1]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(25,32)
		newcrc = ('%04X'):format(CalcCheckSum(blocks,2,3))	
		blocks[area2] = blocks[area2]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(25,32)
	end
end

function CalcCheckSum(blocks, dataarea, chksumtype)
	local area = 36
	if dataarea == 1 then
		area = 8
	end
	
	if chksumtype == 0 then
		data = blocks[0]..blocks[1]:sub(1,28)
	elseif chksumtype == 1 then
		data = blocks[area]:sub(1,28)..'0500'
	elseif chksumtype == 2 then	
		data =	blocks[area+1]..blocks[area+2]..blocks[area+4]
	elseif chksumtype == 3 then
		data =  blocks[area+5]..blocks[area+6]..blocks[area+8]..string.rep('00',0xe0)	
	end
	return utils.Crc16(data)
end

local function ValidateCheckSums(blocks)
	print(' Validating checksums')
	
	local isOk, crc, calc
	-- Checksum Type 0
	crc = GetCheckSum(blocks,1,0)
	calc = CalcCheckSum(blocks, 1, 0)
	if crc == calc then isOk='Ok' else isOk = 'Error' end
	io.write( ('TYPE 0       : %04x = %04x -- %s\n'):format(crc,calc,isOk))

	-- Checksum Type 1 (DATAAREAHEADER 1)
	crc = GetCheckSum(blocks,1,1)
	calc = CalcCheckSum(blocks,1,1)
	if crc == calc then isOk='Ok' else isOk = 'Error' end
	io.write( ('TYPE 1 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))
	
	-- Checksum Type 1 (DATAAREAHEADER 2)
	crc = GetCheckSum(blocks,2,1)
	calc = CalcCheckSum(blocks,2,1)
	if crc == calc then isOk='Ok' else isOk = 'Error' end
	io.write( ('TYPE 1 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
	
	-- Checksum Type 2 (DATAAREA 1)
	crc = GetCheckSum(blocks,1,2)
	calc = CalcCheckSum(blocks,1,2)
	if crc == calc then isOk='Ok' else isOk = 'Error' end	
	io.write( ('TYPE 2 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))

	-- Checksum Type 2 (DATAAREA 2)
	crc = GetCheckSum(blocks,2,2)
	calc = CalcCheckSum(blocks,2,2)
	if crc == calc then isOk='Ok' else isOk = 'Error' end	
	io.write( ('TYPE 2 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))

	-- Checksum Type 3 (DATAAREA 1)
	crc = GetCheckSum(blocks,1,3)
	calc = CalcCheckSum(blocks,1,3)
	if crc == calc then isOk='Ok' else isOk = 'Error' end	
	io.write( ('TYPE 3 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))

	-- Checksum Type 3 (DATAAREA 2)
	crc = GetCheckSum(blocks,2,3)
	calc = CalcCheckSum(blocks,2,3)
	if crc == calc then isOk='Ok' else isOk = 'Error' end	
	io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))

end

local function AddKey(keys, blockNo, data)
	local pos = (math.floor( blockNo / 4 ) * 12)+1
	local key = keys:sub(pos, pos + 11 )
	return key..data:sub(13)
end

local function LoadEmulator(uid, blocks)
	print('Sending dumpdata to emulator memory')
	local keys = pre.GetAll(uid)
	local cmd, blockdata
	for _,b in pairs(blocks) do 
		
		blockdata = b
		
		if  _%4 ~= 3 then
			if (_ >= 8 and _<=21)  or  (_ >= 36 and _<=49) then
				local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , RANDOM)	
				local baseStr = utils.ConvertHexToAscii(base)
				local key = md5.sumhexa(baseStr)
				local enc = core.aes128_encrypt(key, blockdata)
				blockdata = utils.ConvertAsciiToHex(enc)
				io.write( _..',')
			end
		else		
			-- add keys if not existing..
			if ( blockdata:sub(1,12) == '000000000000' ) then
				blockdata = AddKey(keys, _, blockdata)
			end
		end
		core.clearCommandBuffer()
		cmd = Command:new{cmd = cmds.CMD_MIFARE_EML_MEMSET, arg1 = _ ,arg2 = 1,arg3 = 16, data = blockdata}
		local err = core.SendCommand(cmd:getBytes())
		if err then return err end
	end
	io.write('\n')
end

local function Num2Card(m, l)

	local k = {
		0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,0x42, 0x43, 0x44, 0x46, 0x47, 0x48, 0x4A, 0x4B,
		0x4C, 0x4D, 0x4E, 0x50, 0x51, 0x52, 0x53, 0x54,0x56, 0x57, 0x58, 0x59, 0x5A, 0x00
	}
	local msw = tonumber(utils.SwapEndiannessStr(m,32),16)
	local lsw = tonumber(utils.SwapEndiannessStr(l,32),16)

	if msw > 0x17ea1 then
		return "too big"
	end

	if msw == 0x17ea1 and lsw > 0x8931fee8 then
		return "out of range"
	end

	local s = ""
	local index
	for i = 1,10 do
		index, msw, lsw = DivideByK( msw, lsw)
		if ( index <= 1 ) then
			s = char(k[index]) .. s
		else
			s = char(k[index-1]) .. s
		end 
		print (index-1, msw, lsw)
	end
    return s
end
--33LRT-LM9Q9
--7, 122, 3474858630
--20, 4, 1008436634
--7, 0, 627182959
--17, 0, 21626998
--16, 0, 745758
--23, 0, 25715
--21, 0, 886
--16, 0, 30
--1, 0, 1
--1, 0, 0

function DivideByK(msw, lsw)

	local lowLSW
	local highLSW
	local remainder = 0
	local RADIX = 29

	--local num = 0 | band( rshift(msw,16), 0xffff)
	local num = band( rshift(msw, 16), 0xffff)
 
	--highLSW = 0 | lshift( (num / RADIX) , 16)
	highLSW = lshift( (num / RADIX) , 16)
	remainder = num % RADIX

	num =  bor( lshift(remainder,16), band(msw, 0xffff))

	--highLSW |= num / RADIX
	highLSW = highLSW or (num / RADIX)
	remainder = num % RADIX

	num =  bor( lshift(remainder,16), ( band(rshift(lsw,16), 0xffff)))

	--lowLSW = 0 | (num / RADIX) << 16
	lowLSW = 0 or (lshift( (num / RADIX), 16))
	remainder = num % RADIX

	num =  bor( lshift(remainder,16) , band(lsw, 0xffff) )

	lowLSW = bor(lowLSW, (num / RADIX))
	remainder = num % RADIX
	return remainder, highLSW, lowLSW
	
	            -- uint num = 0 | (msw >> 16) & 0xffff;
 
            -- highLSW = 0 | (num / RADIX) << 16;
            -- remainder = num % RADIX;

            -- num = (remainder << 16) | (msw & 0xffff);
 
            -- highLSW |= num / RADIX;
            -- remainder = num % RADIX;

            -- num = (remainder << 16) | ((lsw >> 16) & 0xffff);

            -- lowLSW = 0 | (num / RADIX) << 16;
            -- remainder = num % RADIX;

            -- num = (remainder << 16) | (lsw & 0xffff);

            -- lowLSW |= num / RADIX;
            -- remainder = num % RADIX;

end

local function main(args)

	print( string.rep('--',20) )
	print( string.rep('--',20) )
	
	local result, err, hex
	local maxed = false
	local inputTemplate = "dumpdata.bin"
	local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M");
	
		-- Arguments for the script
	for o, a in getopt.getopt(args, 'hmi:o:') do
		if o == "h" then return help() end		
		if o == "m" then maxed = true end
		if o == "o" then outputTemplate = a end		
		if o == "i" then inputTemplate = a end
	end
	
	-- Turn off Debug
	local cmdSetDbgOff = "hf mf dbg 0"
	core.console( cmdSetDbgOff) 
	
	-- Load dump.bin file
	print( (' Load data from %s'):format(inputTemplate))
	hex, err = utils.ReadDumpFile(inputTemplate)
	if not hex then return oops(err) end
	
	local blocks = {}
	local blockindex = 0
	for i = 1, #hex, 32 do
		blocks[blockindex] = hex:sub(i,i+31)
		blockindex = blockindex + 1
	end

	if DEBUG then ValidateCheckSums(blocks)	end
	
	--
	print( string.rep('--',20) )	
	print(' Gathering info')
	local uid = blocks[0]:sub(1,8)
	local toytype = blocks[1]:sub(1,4)
	local cardidLsw = blocks[1]:sub(9,16)
	local cardidMsw = blocks[1]:sub(17,24)
	local subtype  = blocks[1]:sub(25,28)

	-- Show info 
	print( string.rep('--',20) )
	
	local item = toys.Find( toytype, subtype)
	if item then
		local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])
		print(' ITEM TYPE : '..itemStr )
	else
		print( (' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype) )
	end	
	
	print( ('       UID : 0x%s'):format(uid) )
	print( ('    CARDID : 0x%s %s [%s]'):format(
								cardidMsw,cardidLsw, 
								--Num2Card(cardidMsw, cardidLsw))
								'')
								)
	print( string.rep('--',20) )


	-- Experience should be:  	
	local experience = blocks[8]:sub(1,6)
	print(('Experience  : %d'):format(utils.SwapEndianness(experience,16)))
	
	local money = blocks[8]:sub(7,10)
	print(('Money       : %d'):format(utils.SwapEndianness(money,16)))

	-- 
	
	-- Sequence number
	local seqnum = blocks[8]:sub(18,19)
	print(('Sequence number : %d'):format( tonumber(seqnum,16)))
	
	local fairy = blocks[9]:sub(1,8)
	--FD0F = Left, FF0F = Right
	local path = 'not choosen'
	if fairy:sub(2,2) == 'D' then
		path = 'Left'
	elseif fairy:sub(2,2) == 'F' then
		path = 'Right'
	end
	print(('Fairy       : %d [Path: %s] '):format(utils.SwapEndianness(fairy,24),path))
	
	local hat = blocks[9]:sub(8,11)
	print(('Hat         : %d'):format(utils.SwapEndianness(hat,16)))

	local level = blocks[13]:sub(27,28)
	print(('LEVEL : %d'):format( tonumber(level,16)))

	--local health = blocks[]:sub();
	--print(('Health : %d'):format( tonumber(health,16))
	
	--0x0D    0x29    0x0A    0x02    16-bit hero points value. Maximum 100.
	local heropoints = blocks[13]:sub(20,23)
	print(('Hero points : %d'):format(utils.SwapEndianness(heropoints,16)))

	--0x10    0x2C    0x0C    0x04    32 bit flag value indicating heroic challenges completed.
	local challenges = blocks[16]:sub(25,32)
	print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32)))
	
	-- Character Name
	local name1 = blocks[10]:sub(1,32)
	local name2 = blocks[12]:sub(1,32)
	print('Custom name : '..utils.ConvertHexToAscii(name1..name2))
	
	if maxed then
		print('Lets try to max out some values')
		-- max out money, experience
		--print (blocks[8])
		blocks[8] = 'FFFFFF'..'FFFF'..blocks[8]:sub(11,32)
		blocks[36] = 'FFFFFF'..'FFFF'..blocks[36]:sub(11,32)
		--print (blocks[8])
	
		-- max out hero challenges
		--print (blocks[16])
		blocks[16] = blocks[16]:sub(1,24)..'FFFFFFFF'
		blocks[44] = blocks[44]:sub(1,24)..'FFFFFFFF'
		--print (blocks[16])
		
		-- max out heropoints
		--print (blocks[13])
		blocks[13] = blocks[13]:sub(1,19)..'0064'..blocks[13]:sub(24,32)
		blocks[41] = blocks[41]:sub(1,19)..'0064'..blocks[41]:sub(24,32)
		--print (blocks[13])
	
		-- Update Checksums
		SetAllCheckSum(blocks)

		-- Validate Checksums
		ValidateCheckSums(blocks)
	end

	--Load dumpdata to emulator memory
	if DEBUG then
		err = LoadEmulator(uid, blocks)
		if err then return oops(err) end	
		core.clearCommandBuffer()
		print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..'\" <--')
	end
end
main(args)
Commit	Line	Data
b915fda3	1	local cmds = require('commands')
	2	local getopt = require('getopt')
	3	local bin = require('bin')
	4	local lib14a = require('read14a')
	5	local utils = require('utils')
	6	local md5 = require('md5')
cff17e78	7	local toys = require('default_toys')
a826cb0d	8	local pre = require('precalc')
a826cb0d	9
b915fda3	10	example =[[
	11	1. script run tnp3sim
	12	2. script run tnp3sim -m
	13	3. script run tnp3sim -m -i myfile
	14	]]
	15	author = "Iceman"
	16	usage = "script run tnp3sim -h -m -i <filename>"
	17	desc =[[
	18	This script will try to load a binary datadump of a Mifare TNP3xxx card.
	19	It vill try to validate all checksums and view some information stored in the dump
	20	For an experimental mode, it tries to manipulate some data.
	21	At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim"
	22
	23	Arguments:
	24	-h : this help
	25	-m : Maxed out items (experimental)
	26	-i : filename for the datadump to read (bin)
b915fda3	27
1b3c567d	28	]]
04a6113f	29
1b3c567d	30	local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
a826cb0d	31	local DEBUG = true -- the debug flag
1b3c567d	32	local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
04a6113f	33
	34	local band = bit32.band
	35	local bor = bit32.bor
	36	local lshift = bit32.lshift
	37	local rshift = bit32.rshift
	38	local byte = string.byte
	39	local char = string.char
	40	local sub = string.sub
	41	local format = string.format
	42
b915fda3	43	---
	44	-- A debug printout-function
	45	function dbg(args)
a826cb0d	46	if not DEBUG then return end
b915fda3	47
	48	if type(args) == "table" then
	49	local i = 1
	50	while result[i] do
	51	dbg(result[i])
	52	i = i+1
	53	end
	54	else
	55	print("###", args)
	56	end
	57	end
	58	---
	59	-- This is only meant to be used when errors occur
	60	function oops(err)
	61	print("ERROR: ",err)
3b4fa542	62	return nil,err
b915fda3	63	end
	64	---
	65	-- Usage help
	66	function help()
	67	print(desc)
	68	print("Example usage")
	69	print(example)
	70	end
	71	--
	72	-- Exit message
	73	function ExitMsg(msg)
	74	print( string.rep('--',20) )
	75	print( string.rep('--',20) )
	76	print(msg)
	77	print()
	78	end
	79
b915fda3	80	local function writedumpfile(infile)
	81	t = infile:read("*all")
	82	len = string.len(t)
	83	local len,hex = bin.unpack(("H%d"):format(len),t)
	84	return hex
	85	end
	86	-- blocks with data
	87	-- there are two dataareas, in block 8 or block 36, ( 1==8 ,
	88	-- checksum type = 0, 1, 2, 3
	89	local function GetCheckSum(blocks, dataarea, chksumtype)
	90
	91	local crc
	92	local area = 36
	93	if dataarea == 1 then
	94	area = 8
	95	end
	96
	97	if chksumtype == 0 then
	98	crc = blocks[1]:sub(29,32)
	99	elseif chksumtype == 1 then
	100	crc = blocks[area]:sub(29,32)
	101	elseif chksumtype == 2 then
	102	crc = blocks[area]:sub(25,28)
	103	elseif chksumtype == 3 then
	104	crc = blocks[area]:sub(21,24)
	105	end
	106	return utils.SwapEndianness(crc,16)
	107	end
	108
a826cb0d	109	local function SetAllCheckSum(blocks)
	110	print('Updating all checksums')
	111	SetCheckSum(blocks, 3)
	112	SetCheckSum(blocks, 2)
	113	SetCheckSum(blocks, 1)
	114	SetCheckSum(blocks, 0)
	115	end
	116
b915fda3	117	local function SetCheckSum(blocks, chksumtype)
	118
	119	if blocks == nil then return nil, 'Argument \"blocks\" nil' end
	120	local newcrc
	121	local area1 = 8
	122	local area2 = 36
	123
	124	if chksumtype == 0 then
	125	newcrc = ('%04X'):format(CalcCheckSum(blocks,1,0))
	126	blocks[1] = blocks[1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
	127	elseif chksumtype == 1 then
	128	newcrc = ('%04X'):format(CalcCheckSum(blocks,1,1))
	129	blocks[area1] = blocks[area1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
	130	newcrc = ('%04X'):format(CalcCheckSum(blocks,2,1))
	131	blocks[area2] = blocks[area2]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
	132	elseif chksumtype == 2 then
	133	newcrc = ('%04X'):format(CalcCheckSum(blocks,1,2))
	134	blocks[area1] = blocks[area1]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(29,32)
	135	newcrc = ('%04X'):format(CalcCheckSum(blocks,2,2))
	136	blocks[area2] = blocks[area2]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(29,32)
	137	elseif chksumtype == 3 then
	138	newcrc = ('%04X'):format(CalcCheckSum(blocks,1,3))
	139	blocks[area1] = blocks[area1]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(25,32)
	140	newcrc = ('%04X'):format(CalcCheckSum(blocks,2,3))
	141	blocks[area2] = blocks[area2]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(25,32)
	142	end
	143	end
	144
	145	function CalcCheckSum(blocks, dataarea, chksumtype)
	146	local area = 36
	147	if dataarea == 1 then
	148	area = 8
	149	end
	150
	151	if chksumtype == 0 then
	152	data = blocks[0]..blocks[1]:sub(1,28)
	153	elseif chksumtype == 1 then
	154	data = blocks[area]:sub(1,28)..'0500'
	155	elseif chksumtype == 2 then
	156	data = blocks[area+1]..blocks[area+2]..blocks[area+4]
	157	elseif chksumtype == 3 then
	158	data = blocks[area+5]..blocks[area+6]..blocks[area+8]..string.rep('00',0xe0)
	159	end
	160	return utils.Crc16(data)
	161	end
	162
	163	local function ValidateCheckSums(blocks)
a826cb0d	164	print(' Validating checksums')
a826cb0d	165
b915fda3	166	local isOk, crc, calc
	167	-- Checksum Type 0
	168	crc = GetCheckSum(blocks,1,0)
	169	calc = CalcCheckSum(blocks, 1, 0)
	170	if crc == calc then isOk='Ok' else isOk = 'Error' end
	171	io.write( ('TYPE 0 : %04x = %04x -- %s\n'):format(crc,calc,isOk))
	172
	173	-- Checksum Type 1 (DATAAREAHEADER 1)
	174	crc = GetCheckSum(blocks,1,1)
	175	calc = CalcCheckSum(blocks,1,1)
	176	if crc == calc then isOk='Ok' else isOk = 'Error' end
	177	io.write( ('TYPE 1 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))
	178
	179	-- Checksum Type 1 (DATAAREAHEADER 2)
	180	crc = GetCheckSum(blocks,2,1)
	181	calc = CalcCheckSum(blocks,2,1)
	182	if crc == calc then isOk='Ok' else isOk = 'Error' end
	183	io.write( ('TYPE 1 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
	184
	185	-- Checksum Type 2 (DATAAREA 1)
	186	crc = GetCheckSum(blocks,1,2)
	187	calc = CalcCheckSum(blocks,1,2)
	188	if crc == calc then isOk='Ok' else isOk = 'Error' end
	189	io.write( ('TYPE 2 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))
	190
	191	-- Checksum Type 2 (DATAAREA 2)
	192	crc = GetCheckSum(blocks,2,2)
	193	calc = CalcCheckSum(blocks,2,2)
	194	if crc == calc then isOk='Ok' else isOk = 'Error' end
	195	io.write( ('TYPE 2 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
	196
	197	-- Checksum Type 3 (DATAAREA 1)
	198	crc = GetCheckSum(blocks,1,3)
	199	calc = CalcCheckSum(blocks,1,3)
	200	if crc == calc then isOk='Ok' else isOk = 'Error' end
	201	io.write( ('TYPE 3 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))
	202
	203	-- Checksum Type 3 (DATAAREA 2)
	204	crc = GetCheckSum(blocks,2,3)
	205	calc = CalcCheckSum(blocks,2,3)
	206	if crc == calc then isOk='Ok' else isOk = 'Error' end
	207	io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
b915fda3	208
d8a3b6c1	209	end
a826cb0d	210
	211	local function AddKey(keys, blockNo, data)
	212	local pos = (math.floor( blockNo / 4 ) * 12)+1
	213	local key = keys:sub(pos, pos + 11 )
	214	return key..data:sub(13)
	215	end
	216
	217	local function LoadEmulator(uid, blocks)
	218	print('Sending dumpdata to emulator memory')
	219	local keys = pre.GetAll(uid)
	220	local cmd, blockdata
b915fda3	221	for _,b in pairs(blocks) do
	222
	223	blockdata = b
	224
	225	if _%4 ~= 3 then
	226	if (_ >= 8 and _<=21) or (_ >= 36 and _<=49) then
1b3c567d	227	local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , RANDOM)
b915fda3	228	local baseStr = utils.ConvertHexToAscii(base)
b915fda3	229	local key = md5.sumhexa(baseStr)
1b3c567d	230	local enc = core.aes128_encrypt(key, blockdata)
a826cb0d	231	blockdata = utils.ConvertAsciiToHex(enc)
b915fda3	232	io.write( _..',')
b915fda3	233	end
a826cb0d	234	else
	235	-- add keys if not existing..
	236	if ( blockdata:sub(1,12) == '000000000000' ) then
	237	blockdata = AddKey(keys, _, blockdata)
	238	end
b915fda3	239	end
a826cb0d	240	core.clearCommandBuffer()
f14c9bf9	241	cmd = Command:new{cmd = cmds.CMD_MIFARE_EML_MEMSET, arg1 = _ ,arg2 = 1,arg3 = 16, data = blockdata}
b915fda3	242	local err = core.SendCommand(cmd:getBytes())
f14c9bf9	243	if err then return err end
b915fda3	244	end
	245	io.write('\n')
	246	end
	247
04a6113f	248	local function Num2Card(m, l)
	249
	250	local k = {
	251	0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,0x42, 0x43, 0x44, 0x46, 0x47, 0x48, 0x4A, 0x4B,
	252	0x4C, 0x4D, 0x4E, 0x50, 0x51, 0x52, 0x53, 0x54,0x56, 0x57, 0x58, 0x59, 0x5A, 0x00
	253	}
	254	local msw = tonumber(utils.SwapEndiannessStr(m,32),16)
	255	local lsw = tonumber(utils.SwapEndiannessStr(l,32),16)
	256
	257	if msw > 0x17ea1 then
	258	return "too big"
	259	end
	260
	261	if msw == 0x17ea1 and lsw > 0x8931fee8 then
	262	return "out of range"
	263	end
	264
	265	local s = ""
	266	local index
	267	for i = 1,10 do
	268	index, msw, lsw = DivideByK( msw, lsw)
	269	if ( index <= 1 ) then
	270	s = char(k[index]) .. s
	271	else
	272	s = char(k[index-1]) .. s
	273	end
	274	print (index-1, msw, lsw)
	275	end
	276	return s
	277	end
	278	--33LRT-LM9Q9
	279	--7, 122, 3474858630
	280	--20, 4, 1008436634
	281	--7, 0, 627182959
	282	--17, 0, 21626998
	283	--16, 0, 745758
	284	--23, 0, 25715
	285	--21, 0, 886
	286	--16, 0, 30
	287	--1, 0, 1
	288	--1, 0, 0
	289
	290	function DivideByK(msw, lsw)
	291
	292	local lowLSW
	293	local highLSW
	294	local remainder = 0
	295	local RADIX = 29
	296
	297	--local num = 0 \| band( rshift(msw,16), 0xffff)
	298	local num = band( rshift(msw, 16), 0xffff)
	299
	300	--highLSW = 0 \| lshift( (num / RADIX) , 16)
	301	highLSW = lshift( (num / RADIX) , 16)
	302	remainder = num % RADIX
	303
	304	num = bor( lshift(remainder,16), band(msw, 0xffff))
	305
	306	--highLSW \|= num / RADIX
	307	highLSW = highLSW or (num / RADIX)
	308	remainder = num % RADIX
	309
	310	num = bor( lshift(remainder,16), ( band(rshift(lsw,16), 0xffff)))
	311
312	--lowLSW = 0 \| (num / RADIX) << 16
313	lowLSW = 0 or (lshift( (num / RADIX), 16))
314	remainder = num % RADIX
315
316	num = bor( lshift(remainder,16) , band(lsw, 0xffff) )
317
318	lowLSW = bor(lowLSW, (num / RADIX))
319	remainder = num % RADIX
320	return remainder, highLSW, lowLSW
321
40762506	322	-- uint num = 0 \| (msw >> 16) & 0xffff;
04a6113f	323
40762506	324	-- highLSW = 0 \| (num / RADIX) << 16;
40762506	325	-- remainder = num % RADIX;
04a6113f	326
40762506	327	-- num = (remainder << 16) \| (msw & 0xffff);
04a6113f	328
40762506	329	-- highLSW \|= num / RADIX;
40762506	330	-- remainder = num % RADIX;
04a6113f	331
40762506	332	-- num = (remainder << 16) \| ((lsw >> 16) & 0xffff);
04a6113f	333
40762506	334	-- lowLSW = 0 \| (num / RADIX) << 16;
40762506	335	-- remainder = num % RADIX;
04a6113f	336
40762506	337	-- num = (remainder << 16) \| (lsw & 0xffff);
04a6113f	338
40762506	339	-- lowLSW \|= num / RADIX;
40762506	340	-- remainder = num % RADIX;
04a6113f	341
	342	end
	343
b915fda3	344	local function main(args)
	345
	346	print( string.rep('--',20) )
	347	print( string.rep('--',20) )
	348
	349	local result, err, hex
	350	local maxed = false
	351	local inputTemplate = "dumpdata.bin"
	352	local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M");
	353
	354	-- Arguments for the script
	355	for o, a in getopt.getopt(args, 'hmi:o:') do
	356	if o == "h" then return help() end
	357	if o == "m" then maxed = true end
	358	if o == "o" then outputTemplate = a end
	359	if o == "i" then inputTemplate = a end
	360	end
	361
	362	-- Turn off Debug
	363	local cmdSetDbgOff = "hf mf dbg 0"
	364	core.console( cmdSetDbgOff)
	365
b915fda3	366	-- Load dump.bin file
	367	print( (' Load data from %s'):format(inputTemplate))
	368	hex, err = utils.ReadDumpFile(inputTemplate)
	369	if not hex then return oops(err) end
	370
	371	local blocks = {}
	372	local blockindex = 0
	373	for i = 1, #hex, 32 do
	374	blocks[blockindex] = hex:sub(i,i+31)
	375	blockindex = blockindex + 1
	376	end
	377
a826cb0d	378	if DEBUG then ValidateCheckSums(blocks) end
b915fda3	379
	380	--
	381	print( string.rep('--',20) )
	382	print(' Gathering info')
	383	local uid = blocks[0]:sub(1,8)
c3fe354b	384	local toytype = blocks[1]:sub(1,4)
04a6113f	385	local cardidLsw = blocks[1]:sub(9,16)
04a6113f	386	local cardidMsw = blocks[1]:sub(17,24)
c3fe354b	387	local subtype = blocks[1]:sub(25,28)
b915fda3	388
	389	-- Show info
	390	print( string.rep('--',20) )
c3fe354b	391
	392	local item = toys.Find( toytype, subtype)
	393	if item then
	394	local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])
1b3c567d	395	print(' ITEM TYPE : '..itemStr )
c3fe354b	396	else
	397	print( (' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype) )
	398	end
	399
b915fda3	400	print( (' UID : 0x%s'):format(uid) )
04a6113f	401	print( (' CARDID : 0x%s %s [%s]'):format(
04a6113f	402	cardidMsw,cardidLsw,
40762506	403	--Num2Card(cardidMsw, cardidLsw))
40762506	404	'')
04a6113f	405	)
b915fda3	406	print( string.rep('--',20) )
b915fda3	407
04a6113f	408
1b3c567d	409	-- Experience should be:
b915fda3	410	local experience = blocks[8]:sub(1,6)
1b3c567d	411	print(('Experience : %d'):format(utils.SwapEndianness(experience,16)))
1b3c567d	412
b915fda3	413	local money = blocks[8]:sub(7,10)
b915fda3	414	print(('Money : %d'):format(utils.SwapEndianness(money,16)))
1b3c567d	415
	416	--
	417
	418	-- Sequence number
	419	local seqnum = blocks[8]:sub(18,19)
	420	print(('Sequence number : %d'):format( tonumber(seqnum,16)))
	421
b915fda3	422	local fairy = blocks[9]:sub(1,8)
	423	--FD0F = Left, FF0F = Right
	424	local path = 'not choosen'
	425	if fairy:sub(2,2) == 'D' then
	426	path = 'Left'
	427	elseif fairy:sub(2,2) == 'F' then
	428	path = 'Right'
	429	end
	430	print(('Fairy : %d [Path: %s] '):format(utils.SwapEndianness(fairy,24),path))
	431
	432	local hat = blocks[9]:sub(8,11)
	433	print(('Hat : %d'):format(utils.SwapEndianness(hat,16)))
1b3c567d	434
	435	local level = blocks[13]:sub(27,28)
	436	print(('LEVEL : %d'):format( tonumber(level,16)))
a826cb0d	437
1b3c567d	438	--local health = blocks[]:sub();
1b3c567d	439	--print(('Health : %d'):format( tonumber(health,16))
b915fda3	440
	441	--0x0D 0x29 0x0A 0x02 16-bit hero points value. Maximum 100.
	442	local heropoints = blocks[13]:sub(20,23)
	443	print(('Hero points : %d'):format(utils.SwapEndianness(heropoints,16)))
	444
	445	--0x10 0x2C 0x0C 0x04 32 bit flag value indicating heroic challenges completed.
	446	local challenges = blocks[16]:sub(25,32)
	447	print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32)))
	448
1b3c567d	449	-- Character Name
	450	local name1 = blocks[10]:sub(1,32)
	451	local name2 = blocks[12]:sub(1,32)
	452	print('Custom name : '..utils.ConvertHexToAscii(name1..name2))
	453
b915fda3	454	if maxed then
	455	print('Lets try to max out some values')
	456	-- max out money, experience
	457	--print (blocks[8])
	458	blocks[8] = 'FFFFFF'..'FFFF'..blocks[8]:sub(11,32)
	459	blocks[36] = 'FFFFFF'..'FFFF'..blocks[36]:sub(11,32)
	460	--print (blocks[8])
	461
	462	-- max out hero challenges
	463	--print (blocks[16])
	464	blocks[16] = blocks[16]:sub(1,24)..'FFFFFFFF'
	465	blocks[44] = blocks[44]:sub(1,24)..'FFFFFFFF'
	466	--print (blocks[16])
	467
	468	-- max out heropoints
	469	--print (blocks[13])
	470	blocks[13] = blocks[13]:sub(1,19)..'0064'..blocks[13]:sub(24,32)
	471	blocks[41] = blocks[41]:sub(1,19)..'0064'..blocks[41]:sub(24,32)
	472	--print (blocks[13])
	473
	474	-- Update Checksums
a826cb0d	475	SetAllCheckSum(blocks)
	476
	477	-- Validate Checksums
b915fda3	478	ValidateCheckSums(blocks)
b915fda3	479	end
a826cb0d	480
b915fda3	481	--Load dumpdata to emulator memory
b915fda3	482	if DEBUG then
a826cb0d	483	err = LoadEmulator(uid, blocks)
b915fda3	484	if err then return oops(err) end
b915fda3	485	core.clearCommandBuffer()
8e726f6c	486	print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..'\" <--')
b915fda3	487	end
	488	end
	489	main(args)