b915fda3 |
1 | local cmds = require('commands') |
2 | local getopt = require('getopt') |
3 | local bin = require('bin') |
4 | local lib14a = require('read14a') |
5 | local utils = require('utils') |
6 | local md5 = require('md5') |
cff17e78 |
7 | local toys = require('default_toys') |
a826cb0d |
8 | local pre = require('precalc') |
9 | |
b915fda3 |
10 | example =[[ |
11 | 1. script run tnp3sim |
12 | 2. script run tnp3sim -m |
13 | 3. script run tnp3sim -m -i myfile |
14 | ]] |
15 | author = "Iceman" |
16 | usage = "script run tnp3sim -h -m -i <filename>" |
17 | desc =[[ |
18 | This script will try to load a binary datadump of a Mifare TNP3xxx card. |
19 | It vill try to validate all checksums and view some information stored in the dump |
20 | For an experimental mode, it tries to manipulate some data. |
21 | At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim" |
22 | |
23 | Arguments: |
24 | -h : this help |
25 | -m : Maxed out items (experimental) |
26 | -i : filename for the datadump to read (bin) |
b915fda3 |
27 | |
1b3c567d |
28 | ]] |
04a6113f |
29 | |
1b3c567d |
30 | local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds |
a826cb0d |
31 | local DEBUG = true -- the debug flag |
1b3c567d |
32 | local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20' |
04a6113f |
33 | |
34 | local band = bit32.band |
35 | local bor = bit32.bor |
36 | local lshift = bit32.lshift |
37 | local rshift = bit32.rshift |
38 | local byte = string.byte |
39 | local char = string.char |
40 | local sub = string.sub |
41 | local format = string.format |
42 | |
b915fda3 |
43 | --- |
44 | -- A debug printout-function |
45 | function dbg(args) |
a826cb0d |
46 | if not DEBUG then return end |
b915fda3 |
47 | |
48 | if type(args) == "table" then |
49 | local i = 1 |
50 | while result[i] do |
51 | dbg(result[i]) |
52 | i = i+1 |
53 | end |
54 | else |
55 | print("###", args) |
56 | end |
57 | end |
58 | --- |
59 | -- This is only meant to be used when errors occur |
60 | function oops(err) |
61 | print("ERROR: ",err) |
3b4fa542 |
62 | return nil,err |
b915fda3 |
63 | end |
64 | --- |
65 | -- Usage help |
66 | function help() |
67 | print(desc) |
68 | print("Example usage") |
69 | print(example) |
70 | end |
71 | -- |
72 | -- Exit message |
73 | function ExitMsg(msg) |
74 | print( string.rep('--',20) ) |
75 | print( string.rep('--',20) ) |
76 | print(msg) |
77 | print() |
78 | end |
79 | |
b915fda3 |
80 | local function writedumpfile(infile) |
81 | t = infile:read("*all") |
82 | len = string.len(t) |
83 | local len,hex = bin.unpack(("H%d"):format(len),t) |
84 | return hex |
85 | end |
86 | -- blocks with data |
87 | -- there are two dataareas, in block 8 or block 36, ( 1==8 , |
88 | -- checksum type = 0, 1, 2, 3 |
89 | local function GetCheckSum(blocks, dataarea, chksumtype) |
90 | |
91 | local crc |
92 | local area = 36 |
93 | if dataarea == 1 then |
94 | area = 8 |
95 | end |
96 | |
97 | if chksumtype == 0 then |
98 | crc = blocks[1]:sub(29,32) |
99 | elseif chksumtype == 1 then |
100 | crc = blocks[area]:sub(29,32) |
101 | elseif chksumtype == 2 then |
102 | crc = blocks[area]:sub(25,28) |
103 | elseif chksumtype == 3 then |
104 | crc = blocks[area]:sub(21,24) |
105 | end |
106 | return utils.SwapEndianness(crc,16) |
107 | end |
108 | |
a826cb0d |
109 | local function SetAllCheckSum(blocks) |
110 | print('Updating all checksums') |
111 | SetCheckSum(blocks, 3) |
112 | SetCheckSum(blocks, 2) |
113 | SetCheckSum(blocks, 1) |
114 | SetCheckSum(blocks, 0) |
115 | end |
116 | |
b915fda3 |
117 | local function SetCheckSum(blocks, chksumtype) |
118 | |
119 | if blocks == nil then return nil, 'Argument \"blocks\" nil' end |
120 | local newcrc |
121 | local area1 = 8 |
122 | local area2 = 36 |
123 | |
124 | if chksumtype == 0 then |
125 | newcrc = ('%04X'):format(CalcCheckSum(blocks,1,0)) |
126 | blocks[1] = blocks[1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2) |
127 | elseif chksumtype == 1 then |
128 | newcrc = ('%04X'):format(CalcCheckSum(blocks,1,1)) |
129 | blocks[area1] = blocks[area1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2) |
130 | newcrc = ('%04X'):format(CalcCheckSum(blocks,2,1)) |
131 | blocks[area2] = blocks[area2]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2) |
132 | elseif chksumtype == 2 then |
133 | newcrc = ('%04X'):format(CalcCheckSum(blocks,1,2)) |
134 | blocks[area1] = blocks[area1]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(29,32) |
135 | newcrc = ('%04X'):format(CalcCheckSum(blocks,2,2)) |
136 | blocks[area2] = blocks[area2]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(29,32) |
137 | elseif chksumtype == 3 then |
138 | newcrc = ('%04X'):format(CalcCheckSum(blocks,1,3)) |
139 | blocks[area1] = blocks[area1]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(25,32) |
140 | newcrc = ('%04X'):format(CalcCheckSum(blocks,2,3)) |
141 | blocks[area2] = blocks[area2]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(25,32) |
142 | end |
143 | end |
144 | |
145 | function CalcCheckSum(blocks, dataarea, chksumtype) |
146 | local area = 36 |
147 | if dataarea == 1 then |
148 | area = 8 |
149 | end |
150 | |
151 | if chksumtype == 0 then |
152 | data = blocks[0]..blocks[1]:sub(1,28) |
153 | elseif chksumtype == 1 then |
154 | data = blocks[area]:sub(1,28)..'0500' |
155 | elseif chksumtype == 2 then |
156 | data = blocks[area+1]..blocks[area+2]..blocks[area+4] |
157 | elseif chksumtype == 3 then |
158 | data = blocks[area+5]..blocks[area+6]..blocks[area+8]..string.rep('00',0xe0) |
159 | end |
160 | return utils.Crc16(data) |
161 | end |
162 | |
163 | local function ValidateCheckSums(blocks) |
a826cb0d |
164 | print(' Validating checksums') |
165 | |
b915fda3 |
166 | local isOk, crc, calc |
167 | -- Checksum Type 0 |
168 | crc = GetCheckSum(blocks,1,0) |
169 | calc = CalcCheckSum(blocks, 1, 0) |
170 | if crc == calc then isOk='Ok' else isOk = 'Error' end |
171 | io.write( ('TYPE 0 : %04x = %04x -- %s\n'):format(crc,calc,isOk)) |
172 | |
173 | -- Checksum Type 1 (DATAAREAHEADER 1) |
174 | crc = GetCheckSum(blocks,1,1) |
175 | calc = CalcCheckSum(blocks,1,1) |
176 | if crc == calc then isOk='Ok' else isOk = 'Error' end |
177 | io.write( ('TYPE 1 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk)) |
178 | |
179 | -- Checksum Type 1 (DATAAREAHEADER 2) |
180 | crc = GetCheckSum(blocks,2,1) |
181 | calc = CalcCheckSum(blocks,2,1) |
182 | if crc == calc then isOk='Ok' else isOk = 'Error' end |
183 | io.write( ('TYPE 1 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk)) |
184 | |
185 | -- Checksum Type 2 (DATAAREA 1) |
186 | crc = GetCheckSum(blocks,1,2) |
187 | calc = CalcCheckSum(blocks,1,2) |
188 | if crc == calc then isOk='Ok' else isOk = 'Error' end |
189 | io.write( ('TYPE 2 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk)) |
190 | |
191 | -- Checksum Type 2 (DATAAREA 2) |
192 | crc = GetCheckSum(blocks,2,2) |
193 | calc = CalcCheckSum(blocks,2,2) |
194 | if crc == calc then isOk='Ok' else isOk = 'Error' end |
195 | io.write( ('TYPE 2 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk)) |
196 | |
197 | -- Checksum Type 3 (DATAAREA 1) |
198 | crc = GetCheckSum(blocks,1,3) |
199 | calc = CalcCheckSum(blocks,1,3) |
200 | if crc == calc then isOk='Ok' else isOk = 'Error' end |
201 | io.write( ('TYPE 3 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk)) |
202 | |
203 | -- Checksum Type 3 (DATAAREA 2) |
204 | crc = GetCheckSum(blocks,2,3) |
205 | calc = CalcCheckSum(blocks,2,3) |
206 | if crc == calc then isOk='Ok' else isOk = 'Error' end |
207 | io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk)) |
b915fda3 |
208 | |
d8a3b6c1 |
209 | end |
a826cb0d |
210 | |
211 | local function AddKey(keys, blockNo, data) |
212 | local pos = (math.floor( blockNo / 4 ) * 12)+1 |
213 | local key = keys:sub(pos, pos + 11 ) |
214 | return key..data:sub(13) |
215 | end |
216 | |
217 | local function LoadEmulator(uid, blocks) |
218 | print('Sending dumpdata to emulator memory') |
219 | local keys = pre.GetAll(uid) |
220 | local cmd, blockdata |
b915fda3 |
221 | for _,b in pairs(blocks) do |
222 | |
223 | blockdata = b |
224 | |
225 | if _%4 ~= 3 then |
226 | if (_ >= 8 and _<=21) or (_ >= 36 and _<=49) then |
1b3c567d |
227 | local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , RANDOM) |
b915fda3 |
228 | local baseStr = utils.ConvertHexToAscii(base) |
229 | local key = md5.sumhexa(baseStr) |
1b3c567d |
230 | local enc = core.aes128_encrypt(key, blockdata) |
a826cb0d |
231 | blockdata = utils.ConvertAsciiToHex(enc) |
b915fda3 |
232 | io.write( _..',') |
233 | end |
a826cb0d |
234 | else |
235 | -- add keys if not existing.. |
236 | if ( blockdata:sub(1,12) == '000000000000' ) then |
237 | blockdata = AddKey(keys, _, blockdata) |
238 | end |
b915fda3 |
239 | end |
a826cb0d |
240 | core.clearCommandBuffer() |
f14c9bf9 |
241 | cmd = Command:new{cmd = cmds.CMD_MIFARE_EML_MEMSET, arg1 = _ ,arg2 = 1,arg3 = 16, data = blockdata} |
b915fda3 |
242 | local err = core.SendCommand(cmd:getBytes()) |
f14c9bf9 |
243 | if err then return err end |
b915fda3 |
244 | end |
245 | io.write('\n') |
246 | end |
247 | |
04a6113f |
248 | local function Num2Card(m, l) |
249 | |
250 | local k = { |
251 | 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,0x42, 0x43, 0x44, 0x46, 0x47, 0x48, 0x4A, 0x4B, |
252 | 0x4C, 0x4D, 0x4E, 0x50, 0x51, 0x52, 0x53, 0x54,0x56, 0x57, 0x58, 0x59, 0x5A, 0x00 |
253 | } |
254 | local msw = tonumber(utils.SwapEndiannessStr(m,32),16) |
255 | local lsw = tonumber(utils.SwapEndiannessStr(l,32),16) |
256 | |
257 | if msw > 0x17ea1 then |
258 | return "too big" |
259 | end |
260 | |
261 | if msw == 0x17ea1 and lsw > 0x8931fee8 then |
262 | return "out of range" |
263 | end |
264 | |
265 | local s = "" |
266 | local index |
267 | for i = 1,10 do |
268 | index, msw, lsw = DivideByK( msw, lsw) |
269 | if ( index <= 1 ) then |
270 | s = char(k[index]) .. s |
271 | else |
272 | s = char(k[index-1]) .. s |
273 | end |
274 | print (index-1, msw, lsw) |
275 | end |
276 | return s |
277 | end |
278 | --33LRT-LM9Q9 |
279 | --7, 122, 3474858630 |
280 | --20, 4, 1008436634 |
281 | --7, 0, 627182959 |
282 | --17, 0, 21626998 |
283 | --16, 0, 745758 |
284 | --23, 0, 25715 |
285 | --21, 0, 886 |
286 | --16, 0, 30 |
287 | --1, 0, 1 |
288 | --1, 0, 0 |
289 | |
290 | function DivideByK(msw, lsw) |
291 | |
292 | local lowLSW |
293 | local highLSW |
294 | local remainder = 0 |
295 | local RADIX = 29 |
296 | |
297 | --local num = 0 | band( rshift(msw,16), 0xffff) |
298 | local num = band( rshift(msw, 16), 0xffff) |
299 | |
300 | --highLSW = 0 | lshift( (num / RADIX) , 16) |
301 | highLSW = lshift( (num / RADIX) , 16) |
302 | remainder = num % RADIX |
303 | |
304 | num = bor( lshift(remainder,16), band(msw, 0xffff)) |
305 | |
306 | --highLSW |= num / RADIX |
307 | highLSW = highLSW or (num / RADIX) |
308 | remainder = num % RADIX |
309 | |
310 | num = bor( lshift(remainder,16), ( band(rshift(lsw,16), 0xffff))) |
311 | |
312 | --lowLSW = 0 | (num / RADIX) << 16 |
313 | lowLSW = 0 or (lshift( (num / RADIX), 16)) |
314 | remainder = num % RADIX |
315 | |
316 | num = bor( lshift(remainder,16) , band(lsw, 0xffff) ) |
317 | |
318 | lowLSW = bor(lowLSW, (num / RADIX)) |
319 | remainder = num % RADIX |
320 | return remainder, highLSW, lowLSW |
321 | |
40762506 |
322 | -- uint num = 0 | (msw >> 16) & 0xffff; |
04a6113f |
323 | |
40762506 |
324 | -- highLSW = 0 | (num / RADIX) << 16; |
325 | -- remainder = num % RADIX; |
04a6113f |
326 | |
40762506 |
327 | -- num = (remainder << 16) | (msw & 0xffff); |
04a6113f |
328 | |
40762506 |
329 | -- highLSW |= num / RADIX; |
330 | -- remainder = num % RADIX; |
04a6113f |
331 | |
40762506 |
332 | -- num = (remainder << 16) | ((lsw >> 16) & 0xffff); |
04a6113f |
333 | |
40762506 |
334 | -- lowLSW = 0 | (num / RADIX) << 16; |
335 | -- remainder = num % RADIX; |
04a6113f |
336 | |
40762506 |
337 | -- num = (remainder << 16) | (lsw & 0xffff); |
04a6113f |
338 | |
40762506 |
339 | -- lowLSW |= num / RADIX; |
340 | -- remainder = num % RADIX; |
04a6113f |
341 | |
342 | end |
343 | |
b915fda3 |
344 | local function main(args) |
345 | |
346 | print( string.rep('--',20) ) |
347 | print( string.rep('--',20) ) |
348 | |
349 | local result, err, hex |
350 | local maxed = false |
351 | local inputTemplate = "dumpdata.bin" |
352 | local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M"); |
353 | |
354 | -- Arguments for the script |
355 | for o, a in getopt.getopt(args, 'hmi:o:') do |
356 | if o == "h" then return help() end |
357 | if o == "m" then maxed = true end |
358 | if o == "o" then outputTemplate = a end |
359 | if o == "i" then inputTemplate = a end |
360 | end |
361 | |
362 | -- Turn off Debug |
363 | local cmdSetDbgOff = "hf mf dbg 0" |
364 | core.console( cmdSetDbgOff) |
365 | |
b915fda3 |
366 | -- Load dump.bin file |
367 | print( (' Load data from %s'):format(inputTemplate)) |
368 | hex, err = utils.ReadDumpFile(inputTemplate) |
369 | if not hex then return oops(err) end |
370 | |
371 | local blocks = {} |
372 | local blockindex = 0 |
373 | for i = 1, #hex, 32 do |
374 | blocks[blockindex] = hex:sub(i,i+31) |
375 | blockindex = blockindex + 1 |
376 | end |
377 | |
a826cb0d |
378 | if DEBUG then ValidateCheckSums(blocks) end |
b915fda3 |
379 | |
380 | -- |
381 | print( string.rep('--',20) ) |
382 | print(' Gathering info') |
383 | local uid = blocks[0]:sub(1,8) |
c3fe354b |
384 | local toytype = blocks[1]:sub(1,4) |
04a6113f |
385 | local cardidLsw = blocks[1]:sub(9,16) |
386 | local cardidMsw = blocks[1]:sub(17,24) |
c3fe354b |
387 | local subtype = blocks[1]:sub(25,28) |
b915fda3 |
388 | |
389 | -- Show info |
390 | print( string.rep('--',20) ) |
c3fe354b |
391 | |
392 | local item = toys.Find( toytype, subtype) |
393 | if item then |
394 | local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4]) |
1b3c567d |
395 | print(' ITEM TYPE : '..itemStr ) |
c3fe354b |
396 | else |
397 | print( (' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype) ) |
398 | end |
399 | |
b915fda3 |
400 | print( (' UID : 0x%s'):format(uid) ) |
04a6113f |
401 | print( (' CARDID : 0x%s %s [%s]'):format( |
402 | cardidMsw,cardidLsw, |
40762506 |
403 | --Num2Card(cardidMsw, cardidLsw)) |
404 | '') |
04a6113f |
405 | ) |
b915fda3 |
406 | print( string.rep('--',20) ) |
407 | |
04a6113f |
408 | |
1b3c567d |
409 | -- Experience should be: |
b915fda3 |
410 | local experience = blocks[8]:sub(1,6) |
1b3c567d |
411 | print(('Experience : %d'):format(utils.SwapEndianness(experience,16))) |
412 | |
b915fda3 |
413 | local money = blocks[8]:sub(7,10) |
414 | print(('Money : %d'):format(utils.SwapEndianness(money,16))) |
1b3c567d |
415 | |
416 | -- |
417 | |
418 | -- Sequence number |
419 | local seqnum = blocks[8]:sub(18,19) |
420 | print(('Sequence number : %d'):format( tonumber(seqnum,16))) |
421 | |
b915fda3 |
422 | local fairy = blocks[9]:sub(1,8) |
423 | --FD0F = Left, FF0F = Right |
424 | local path = 'not choosen' |
425 | if fairy:sub(2,2) == 'D' then |
426 | path = 'Left' |
427 | elseif fairy:sub(2,2) == 'F' then |
428 | path = 'Right' |
429 | end |
430 | print(('Fairy : %d [Path: %s] '):format(utils.SwapEndianness(fairy,24),path)) |
431 | |
432 | local hat = blocks[9]:sub(8,11) |
433 | print(('Hat : %d'):format(utils.SwapEndianness(hat,16))) |
1b3c567d |
434 | |
435 | local level = blocks[13]:sub(27,28) |
436 | print(('LEVEL : %d'):format( tonumber(level,16))) |
a826cb0d |
437 | |
1b3c567d |
438 | --local health = blocks[]:sub(); |
439 | --print(('Health : %d'):format( tonumber(health,16)) |
b915fda3 |
440 | |
441 | --0x0D 0x29 0x0A 0x02 16-bit hero points value. Maximum 100. |
442 | local heropoints = blocks[13]:sub(20,23) |
443 | print(('Hero points : %d'):format(utils.SwapEndianness(heropoints,16))) |
444 | |
445 | --0x10 0x2C 0x0C 0x04 32 bit flag value indicating heroic challenges completed. |
446 | local challenges = blocks[16]:sub(25,32) |
447 | print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32))) |
448 | |
1b3c567d |
449 | -- Character Name |
450 | local name1 = blocks[10]:sub(1,32) |
451 | local name2 = blocks[12]:sub(1,32) |
452 | print('Custom name : '..utils.ConvertHexToAscii(name1..name2)) |
453 | |
b915fda3 |
454 | if maxed then |
455 | print('Lets try to max out some values') |
456 | -- max out money, experience |
457 | --print (blocks[8]) |
458 | blocks[8] = 'FFFFFF'..'FFFF'..blocks[8]:sub(11,32) |
459 | blocks[36] = 'FFFFFF'..'FFFF'..blocks[36]:sub(11,32) |
460 | --print (blocks[8]) |
461 | |
462 | -- max out hero challenges |
463 | --print (blocks[16]) |
464 | blocks[16] = blocks[16]:sub(1,24)..'FFFFFFFF' |
465 | blocks[44] = blocks[44]:sub(1,24)..'FFFFFFFF' |
466 | --print (blocks[16]) |
467 | |
468 | -- max out heropoints |
469 | --print (blocks[13]) |
470 | blocks[13] = blocks[13]:sub(1,19)..'0064'..blocks[13]:sub(24,32) |
471 | blocks[41] = blocks[41]:sub(1,19)..'0064'..blocks[41]:sub(24,32) |
472 | --print (blocks[13]) |
473 | |
474 | -- Update Checksums |
a826cb0d |
475 | SetAllCheckSum(blocks) |
476 | |
477 | -- Validate Checksums |
b915fda3 |
478 | ValidateCheckSums(blocks) |
479 | end |
a826cb0d |
480 | |
b915fda3 |
481 | --Load dumpdata to emulator memory |
482 | if DEBUG then |
a826cb0d |
483 | err = LoadEmulator(uid, blocks) |
b915fda3 |
484 | if err then return oops(err) end |
485 | core.clearCommandBuffer() |
8e726f6c |
486 | print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..'\" <--') |
b915fda3 |
487 | end |
488 | end |
489 | main(args) |