[proxmark3-svn] / client / scripts / tnp3dump.lua

local cmds = require('commands')
local getopt = require('getopt')
local bin = require('bin')
local lib14a = require('read14a')
local utils = require('utils')
local md5 = require('md5')
local dumplib = require('html_dumplib')
local toys = require('default_toys2')

example =[[
	script run tnp3dump
	script run tnp3dump -n
	script run tnp3dump -p
	script run tnp3dump -k aabbccddeeff
	script run tnp3dump -k aabbccddeeff -n
	script run tnp3dump -o myfile 
	script run tnp3dump -n -o myfile 
	script run tnp3dump -p -o myfile 
	script run tnp3dump -k aabbccddeeff -n -o myfile 
]]
author = "Iceman"
usage = "script run tnp3dump -k <key> -n -p -o <filename>"
desc =[[
This script will try to dump the contents of a Mifare TNP3xxx card.
It will need a valid KeyA in order to find the other keys and decode the card.
Arguments:
	-h             : this help
	-k <key>       : Sector 0 Key A.
	-n             : Use the nested cmd to find all keys
	-p             : Use the precalc to find all keys
	-o             : filename for the saved dumps
]]

local HASHCONSTANT = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'

local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
local DEBUG = false -- the debug flag
local numBlocks = 64
local numSectors = 16
--- 
-- A debug printout-function
function dbg(args)
	if not DEBUG then
		return
	end
	
    if type(args) == "table" then
		local i = 1
		while result[i] do
			dbg(result[i])
			i = i+1
		end
	else
		print("###", args)
	end	
end	
--- 
-- This is only meant to be used when errors occur
function oops(err)
	print("ERROR: ",err)
end
--- 
-- Usage help
function help()
	print(desc)
	print("Example usage")
	print(example)
end
--
-- Exit message
function ExitMsg(msg)
	print( string.rep('--',20) )
	print( string.rep('--',20) )
	print(msg)
	print()
end

local function readdumpkeys(infile)
	 t = infile:read("*all")
	 len = string.len(t)
	 local len,hex = bin.unpack(("H%d"):format(len),t)
	 return hex
end

local function waitCmd()
	local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
	if response then
		local count,cmd,arg0 = bin.unpack('LL',response)
		if(arg0==1) then
			local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
			return data:sub(1,32)
		else
			return nil, "Couldn't read block.." 
		end
	end
	return nil, "No response from device"
end

local function computeCrc16(s)
	local hash = core.crc16(utils.ConvertHexToAscii(s))	
	return hash
end

local function reverseCrcBytes(crc)
	crc2 = crc:sub(3,4)..crc:sub(1,2)
	return tonumber(crc2,16)
end

local function main(args)

	print( string.rep('--',20) )
	print( string.rep('--',20) )
	
	local keyA
	local cmd
	local err
	local useNested = false
	local usePreCalc = false
	local cmdReadBlockString = 'hf mf rdbl %d A %s'
	local input = "dumpkeys.bin"
	local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M%S");

	-- Arguments for the script
	for o, a in getopt.getopt(args, 'hk:npo:') do
		if o == "h" then return help() end		
		if o == "k" then keyA = a end
		if o == "n" then useNested = true end
		if o == "p" then usePreCalc = true end
		if o == "o" then outputTemplate = a end		
	end
	
	-- validate input args.
	keyA =  keyA or '4b0b20107ccb'
	if #(keyA) ~= 12 then
		return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
	end

	-- Turn off Debug
	local cmdSetDbgOff = "hf mf dbg 0"
	core.console( cmdSetDbgOff) 
	
	result, err = lib14a.read1443a(false)
	if not result then
		return oops(err)
	end

	core.clearCommandBuffer()
	
	if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
	--	return oops('This is not a TNP3xxx tag. aborting.')
	end	

	-- Show tag info
	print((' Found tag %s'):format(result.name))

	dbg(('Using keyA : %s'):format(keyA))

	--Trying to find the other keys
	if useNested then
	  core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
	end

	core.clearCommandBuffer()
	
	local akeys = ''
	if usePreCalc then
		local pre = require('precalc')
		akeys = pre.GetAll(result.uid)
	else
		print('Loading dumpkeys.bin')
		local hex, err = utils.ReadDumpFile(input)
		if not hex then
			return oops(err)
		end
		akeys = hex:sub(0,12*16)
	end
	
	-- Read block 0
	cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
	err = core.SendCommand(cmd:getBytes())
	if err then return oops(err) end
	local block0, err = waitCmd()
	if err then return oops(err) end
	
	-- Read block 1
	cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
	err = core.SendCommand(cmd:getBytes())
	if err then return oops(err) end
	local block1, err = waitCmd()
	if err then return oops(err) end

	local key
	local pos = 0
	local blockNo
	local blocks = {}

	print('Reading card data')
	core.clearCommandBuffer()
		
	-- main loop
	io.write('Reading blocks > ')
	for blockNo = 0, numBlocks-1, 1 do

		if core.ukbhit() then
			print("aborted by user")
			break
		end
	
		pos = (math.floor( blockNo / 4 ) * 12)+1
		key = akeys:sub(pos, pos + 11 )
		cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
		local err = core.SendCommand(cmd:getBytes())
		if err then return oops(err) end
		local blockdata, err = waitCmd()
		if err then return oops(err) end		


		if  blockNo%4 ~= 3 then
		
			if blockNo < 8 then
				-- Block 0-7 not encrypted
				blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata) 
			else
				local base = ('%s%s%02x%s'):format(block0, block1, blockNo, HASHCONSTANT)	
				local baseStr = utils.ConvertHexToAscii(base)
				local md5hash = md5.sumhexa(baseStr)
				local aestest = core.aes(md5hash, blockdata)

				local hex = utils.ConvertAsciiToBytes(aestest)
				hex = utils.ConvertBytesToHex(hex)

				-- blocks with zero not encrypted.
				if string.find(blockdata, '^0+$') then
					blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata) 
				else
					blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,hex)
					io.write( blockNo..',')
				end		
			end
		else
			-- Sectorblocks, not encrypted
			blocks[blockNo+1] = ('%02d  :: %s%s'):format(blockNo,key,blockdata:sub(13,32)) 
		end
	end
	io.write('\n')
	
	core.clearCommandBuffer()
		
	-- Print results
	local bindata = {}
	local emldata = ''

	for _,s in pairs(blocks) do
		local slice = s:sub(8,#s)
		local str = utils.ConvertBytesToAscii(
				 utils.ConvertHexToBytes(slice)
				)
		emldata = emldata..slice..'\n'
		for c in (str):gmatch('.') do
			bindata[#bindata+1] = c
		end
	end 

	print( string.rep('--',20) )

	
	local uid = block0:sub(1,8)
	local toytype = block1:sub(1,4)
	local cardidLsw = block1:sub(9,16)
	local cardidMsw = block1:sub(16,24)
	local cardid = block1:sub(9,24)
	local subtype = block1:sub(25,28)
	
	-- Write dump to files
	if not DEBUG then
		local foo = dumplib.SaveAsBinary(bindata, outputTemplate..'_uid_'..uid..'.bin')
		print(("Wrote a BIN dump to:  %s"):format(foo))
		local bar = dumplib.SaveAsText(emldata, outputTemplate..'_uid_'..uid..'.eml')
		print(("Wrote a EML dump to:  %s"):format(bar))
	end

	local item = toys.Find(toytype, subtype)
	if item then
		local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])
		print('            ITEM TYPE : '..itemStr )
	else
		print(('            ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype))
	end
	
	-- Show info 
	print( (' Alter ego / traptype : 0x%s'):format(traptype) )
	print( ('                  UID : 0x%s'):format(uid) )
	print( ('               CARDID : 0x%s'):format(cardid ) )
	
	print( string.rep('--',20) )

end
main(args)
Commit	Line	Data
b915fda3	1	local cmds = require('commands')
	2	local getopt = require('getopt')
	3	local bin = require('bin')
	4	local lib14a = require('read14a')
	5	local utils = require('utils')
	6	local md5 = require('md5')
	7	local dumplib = require('html_dumplib')
c3fe354b	8	local toys = require('default_toys2')
04a6113f	9
b915fda3	10	example =[[
04a6113f	11	script run tnp3dump
	12	script run tnp3dump -n
	13	script run tnp3dump -p
	14	script run tnp3dump -k aabbccddeeff
	15	script run tnp3dump -k aabbccddeeff -n
	16	script run tnp3dump -o myfile
	17	script run tnp3dump -n -o myfile
	18	script run tnp3dump -p -o myfile
	19	script run tnp3dump -k aabbccddeeff -n -o myfile
b915fda3	20	]]
b915fda3	21	author = "Iceman"
04a6113f	22	usage = "script run tnp3dump -k <key> -n -p -o <filename>"
b915fda3	23	desc =[[
	24	This script will try to dump the contents of a Mifare TNP3xxx card.
	25	It will need a valid KeyA in order to find the other keys and decode the card.
	26	Arguments:
	27	-h : this help
	28	-k <key> : Sector 0 Key A.
	29	-n : Use the nested cmd to find all keys
04a6113f	30	-p : Use the precalc to find all keys
b915fda3	31	-o : filename for the saved dumps
	32	]]
	33
	34	local HASHCONSTANT = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
	35
	36	local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
	37	local DEBUG = false -- the debug flag
	38	local numBlocks = 64
	39	local numSectors = 16
	40	---
	41	-- A debug printout-function
	42	function dbg(args)
	43	if not DEBUG then
	44	return
	45	end
	46
	47	if type(args) == "table" then
	48	local i = 1
	49	while result[i] do
	50	dbg(result[i])
	51	i = i+1
	52	end
	53	else
	54	print("###", args)
	55	end
	56	end
	57	---
	58	-- This is only meant to be used when errors occur
	59	function oops(err)
	60	print("ERROR: ",err)
	61	end
	62	---
	63	-- Usage help
	64	function help()
	65	print(desc)
	66	print("Example usage")
	67	print(example)
	68	end
	69	--
	70	-- Exit message
	71	function ExitMsg(msg)
	72	print( string.rep('--',20) )
	73	print( string.rep('--',20) )
	74	print(msg)
	75	print()
	76	end
	77
	78	local function readdumpkeys(infile)
	79	t = infile:read("*all")
	80	len = string.len(t)
	81	local len,hex = bin.unpack(("H%d"):format(len),t)
	82	return hex
	83	end
	84
	85	local function waitCmd()
	86	local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
	87	if response then
	88	local count,cmd,arg0 = bin.unpack('LL',response)
	89	if(arg0==1) then
	90	local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
	91	return data:sub(1,32)
	92	else
	93	return nil, "Couldn't read block.."
	94	end
95	end
96	return nil, "No response from device"
97	end
98
99	local function computeCrc16(s)
100	local hash = core.crc16(utils.ConvertHexToAscii(s))
101	return hash
102	end
103
104	local function reverseCrcBytes(crc)
105	crc2 = crc:sub(3,4)..crc:sub(1,2)
106	return tonumber(crc2,16)
107	end
108
109	local function main(args)
110
111	print( string.rep('--',20) )
112	print( string.rep('--',20) )
113
114	local keyA
115	local cmd
116	local err
117	local useNested = false
04a6113f	118	local usePreCalc = false
b915fda3	119	local cmdReadBlockString = 'hf mf rdbl %d A %s'
	120	local input = "dumpkeys.bin"
	121	local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M%S");
	122
	123	-- Arguments for the script
04a6113f	124	for o, a in getopt.getopt(args, 'hk:npo:') do
b915fda3	125	if o == "h" then return help() end
	126	if o == "k" then keyA = a end
	127	if o == "n" then useNested = true end
04a6113f	128	if o == "p" then usePreCalc = true end
b915fda3	129	if o == "o" then outputTemplate = a end
b915fda3	130	end
c3fe354b	131
b915fda3	132	-- validate input args.
	133	keyA = keyA or '4b0b20107ccb'
	134	if #(keyA) ~= 12 then
	135	return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
	136	end
	137
	138	-- Turn off Debug
	139	local cmdSetDbgOff = "hf mf dbg 0"
	140	core.console( cmdSetDbgOff)
	141
	142	result, err = lib14a.read1443a(false)
	143	if not result then
	144	return oops(err)
	145	end
	146
	147	core.clearCommandBuffer()
	148
	149	if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
40762506	150	-- return oops('This is not a TNP3xxx tag. aborting.')
b915fda3	151	end
	152
	153	-- Show tag info
04a6113f	154	print((' Found tag %s'):format(result.name))
	155
	156	dbg(('Using keyA : %s'):format(keyA))
b915fda3	157
	158	--Trying to find the other keys
	159	if useNested then
	160	core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
	161	end
04a6113f	162
b915fda3	163	core.clearCommandBuffer()
b915fda3	164
04a6113f	165	local akeys = ''
	166	if usePreCalc then
	167	local pre = require('precalc')
	168	akeys = pre.GetAll(result.uid)
	169	else
	170	print('Loading dumpkeys.bin')
	171	local hex, err = utils.ReadDumpFile(input)
	172	if not hex then
	173	return oops(err)
	174	end
	175	akeys = hex:sub(0,12*16)
b915fda3	176	end
04a6113f	177
b915fda3	178	-- Read block 0
	179	cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
	180	err = core.SendCommand(cmd:getBytes())
	181	if err then return oops(err) end
	182	local block0, err = waitCmd()
	183	if err then return oops(err) end
	184
	185	-- Read block 1
	186	cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
	187	err = core.SendCommand(cmd:getBytes())
	188	if err then return oops(err) end
	189	local block1, err = waitCmd()
	190	if err then return oops(err) end
	191
	192	local key
	193	local pos = 0
	194	local blockNo
	195	local blocks = {}
	196
	197	print('Reading card data')
	198	core.clearCommandBuffer()
	199
	200	-- main loop
04a6113f	201	io.write('Reading blocks > ')
b915fda3	202	for blockNo = 0, numBlocks-1, 1 do
	203
	204	if core.ukbhit() then
	205	print("aborted by user")
	206	break
	207	end
	208
	209	pos = (math.floor( blockNo / 4 ) * 12)+1
	210	key = akeys:sub(pos, pos + 11 )
	211	cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
	212	local err = core.SendCommand(cmd:getBytes())
	213	if err then return oops(err) end
	214	local blockdata, err = waitCmd()
	215	if err then return oops(err) end
	216
40762506	217
b915fda3	218	if blockNo%4 ~= 3 then
40762506	219
b915fda3	220	if blockNo < 8 then
	221	-- Block 0-7 not encrypted
	222	blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata)
	223	else
	224	local base = ('%s%s%02x%s'):format(block0, block1, blockNo, HASHCONSTANT)
	225	local baseStr = utils.ConvertHexToAscii(base)
	226	local md5hash = md5.sumhexa(baseStr)
	227	local aestest = core.aes(md5hash, blockdata)
	228
	229	local hex = utils.ConvertAsciiToBytes(aestest)
	230	hex = utils.ConvertBytesToHex(hex)
	231
	232	-- blocks with zero not encrypted.
	233	if string.find(blockdata, '^0+$') then
	234	blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata)
	235	else
	236	blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,hex)
	237	io.write( blockNo..',')
	238	end
	239	end
	240	else
	241	-- Sectorblocks, not encrypted
	242	blocks[blockNo+1] = ('%02d :: %s%s'):format(blockNo,key,blockdata:sub(13,32))
	243	end
	244	end
	245	io.write('\n')
	246
	247	core.clearCommandBuffer()
	248
	249	-- Print results
	250	local bindata = {}
	251	local emldata = ''
	252
	253	for _,s in pairs(blocks) do
	254	local slice = s:sub(8,#s)
	255	local str = utils.ConvertBytesToAscii(
	256	utils.ConvertHexToBytes(slice)
	257	)
	258	emldata = emldata..slice..'\n'
	259	for c in (str):gmatch('.') do
	260	bindata[#bindata+1] = c
	261	end
	262	end
c3fe354b	263
	264	print( string.rep('--',20) )
	265
b915fda3	266
5149e37e	267	local uid = block0:sub(1,8)
c3fe354b	268	local toytype = block1:sub(1,4)
04a6113f	269	local cardidLsw = block1:sub(9,16)
04a6113f	270	local cardidMsw = block1:sub(16,24)
5149e37e	271	local cardid = block1:sub(9,24)
c3fe354b	272	local subtype = block1:sub(25,28)
5149e37e	273
b915fda3	274	-- Write dump to files
b915fda3	275	if not DEBUG then
5149e37e	276	local foo = dumplib.SaveAsBinary(bindata, outputTemplate..'_uid_'..uid..'.bin')
04a6113f	277	print(("Wrote a BIN dump to: %s"):format(foo))
5149e37e	278	local bar = dumplib.SaveAsText(emldata, outputTemplate..'_uid_'..uid..'.eml')
04a6113f	279	print(("Wrote a EML dump to: %s"):format(bar))
b915fda3	280	end
b915fda3	281
c3fe354b	282	local item = toys.Find(toytype, subtype)
	283	if item then
	284	local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])
	285	print(' ITEM TYPE : '..itemStr )
	286	else
	287	print((' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype))
04a6113f	288	end
c3fe354b	289
b915fda3	290	-- Show info
a8d4906b	291	print( (' Alter ego / traptype : 0x%s'):format(traptype) )
	292	print( (' UID : 0x%s'):format(uid) )
	293	print( (' CARDID : 0x%s'):format(cardid ) )
	294
b915fda3	295	print( string.rep('--',20) )
	296
	297	end
	298	main(args)