b915fda3 |
1 | local cmds = require('commands') |
2 | local getopt = require('getopt') |
3 | local bin = require('bin') |
4 | local lib14a = require('read14a') |
5 | local utils = require('utils') |
6 | local md5 = require('md5') |
7 | local dumplib = require('html_dumplib') |
cff17e78 |
8 | local toys = require('default_toys') |
04a6113f |
9 | |
b915fda3 |
10 | example =[[ |
04a6113f |
11 | script run tnp3dump |
12 | script run tnp3dump -n |
13 | script run tnp3dump -p |
14 | script run tnp3dump -k aabbccddeeff |
15 | script run tnp3dump -k aabbccddeeff -n |
16 | script run tnp3dump -o myfile |
17 | script run tnp3dump -n -o myfile |
18 | script run tnp3dump -p -o myfile |
19 | script run tnp3dump -k aabbccddeeff -n -o myfile |
b915fda3 |
20 | ]] |
21 | author = "Iceman" |
04a6113f |
22 | usage = "script run tnp3dump -k <key> -n -p -o <filename>" |
b915fda3 |
23 | desc =[[ |
24 | This script will try to dump the contents of a Mifare TNP3xxx card. |
25 | It will need a valid KeyA in order to find the other keys and decode the card. |
26 | Arguments: |
27 | -h : this help |
28 | -k <key> : Sector 0 Key A. |
29 | -n : Use the nested cmd to find all keys |
04a6113f |
30 | -p : Use the precalc to find all keys |
b915fda3 |
31 | -o : filename for the saved dumps |
32 | ]] |
9c09e006 |
33 | local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20' |
b915fda3 |
34 | local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds |
35 | local DEBUG = false -- the debug flag |
36 | local numBlocks = 64 |
37 | local numSectors = 16 |
38 | --- |
39 | -- A debug printout-function |
40 | function dbg(args) |
a826cb0d |
41 | if not DEBUG then return end |
b915fda3 |
42 | |
43 | if type(args) == "table" then |
44 | local i = 1 |
45 | while result[i] do |
46 | dbg(result[i]) |
47 | i = i+1 |
48 | end |
49 | else |
50 | print("###", args) |
51 | end |
52 | end |
53 | --- |
54 | -- This is only meant to be used when errors occur |
55 | function oops(err) |
56 | print("ERROR: ",err) |
a826cb0d |
57 | return nil,err |
b915fda3 |
58 | end |
59 | --- |
60 | -- Usage help |
61 | function help() |
62 | print(desc) |
63 | print("Example usage") |
64 | print(example) |
65 | end |
66 | -- |
67 | -- Exit message |
68 | function ExitMsg(msg) |
69 | print( string.rep('--',20) ) |
70 | print( string.rep('--',20) ) |
71 | print(msg) |
72 | print() |
73 | end |
74 | |
75 | local function readdumpkeys(infile) |
76 | t = infile:read("*all") |
77 | len = string.len(t) |
78 | local len,hex = bin.unpack(("H%d"):format(len),t) |
79 | return hex |
80 | end |
81 | |
82 | local function waitCmd() |
83 | local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT) |
84 | if response then |
85 | local count,cmd,arg0 = bin.unpack('LL',response) |
86 | if(arg0==1) then |
87 | local count,arg1,arg2,data = bin.unpack('LLH511',response,count) |
88 | return data:sub(1,32) |
89 | else |
90 | return nil, "Couldn't read block.." |
91 | end |
92 | end |
93 | return nil, "No response from device" |
94 | end |
95 | |
b915fda3 |
96 | local function main(args) |
97 | |
98 | print( string.rep('--',20) ) |
99 | print( string.rep('--',20) ) |
100 | |
101 | local keyA |
102 | local cmd |
103 | local err |
104 | local useNested = false |
04a6113f |
105 | local usePreCalc = false |
b915fda3 |
106 | local cmdReadBlockString = 'hf mf rdbl %d A %s' |
107 | local input = "dumpkeys.bin" |
108 | local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M%S"); |
109 | |
110 | -- Arguments for the script |
04a6113f |
111 | for o, a in getopt.getopt(args, 'hk:npo:') do |
b915fda3 |
112 | if o == "h" then return help() end |
113 | if o == "k" then keyA = a end |
114 | if o == "n" then useNested = true end |
04a6113f |
115 | if o == "p" then usePreCalc = true end |
b915fda3 |
116 | if o == "o" then outputTemplate = a end |
117 | end |
c3fe354b |
118 | |
b915fda3 |
119 | -- validate input args. |
120 | keyA = keyA or '4b0b20107ccb' |
121 | if #(keyA) ~= 12 then |
122 | return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA)) |
123 | end |
124 | |
125 | -- Turn off Debug |
126 | local cmdSetDbgOff = "hf mf dbg 0" |
127 | core.console( cmdSetDbgOff) |
128 | |
129 | result, err = lib14a.read1443a(false) |
130 | if not result then |
131 | return oops(err) |
132 | end |
133 | |
134 | core.clearCommandBuffer() |
135 | |
b915fda3 |
136 | -- Show tag info |
04a6113f |
137 | print((' Found tag %s'):format(result.name)) |
138 | |
139 | dbg(('Using keyA : %s'):format(keyA)) |
b915fda3 |
140 | |
141 | --Trying to find the other keys |
142 | if useNested then |
143 | core.console( ('hf mf nested 1 0 A %s d'):format(keyA) ) |
144 | end |
04a6113f |
145 | |
b915fda3 |
146 | core.clearCommandBuffer() |
147 | |
04a6113f |
148 | local akeys = '' |
149 | if usePreCalc then |
150 | local pre = require('precalc') |
151 | akeys = pre.GetAll(result.uid) |
152 | else |
153 | print('Loading dumpkeys.bin') |
154 | local hex, err = utils.ReadDumpFile(input) |
155 | if not hex then |
156 | return oops(err) |
157 | end |
158 | akeys = hex:sub(0,12*16) |
b915fda3 |
159 | end |
04a6113f |
160 | |
b915fda3 |
161 | -- Read block 0 |
162 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA} |
163 | err = core.SendCommand(cmd:getBytes()) |
164 | if err then return oops(err) end |
165 | local block0, err = waitCmd() |
166 | if err then return oops(err) end |
167 | |
a826cb0d |
168 | core.clearCommandBuffer() |
169 | |
b915fda3 |
170 | -- Read block 1 |
171 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA} |
172 | err = core.SendCommand(cmd:getBytes()) |
173 | if err then return oops(err) end |
174 | local block1, err = waitCmd() |
175 | if err then return oops(err) end |
176 | |
a826cb0d |
177 | core.clearCommandBuffer() |
178 | |
9c09e006 |
179 | local tmpHash = block0..block1..'%02x'..RANDOM |
180 | |
b915fda3 |
181 | local key |
182 | local pos = 0 |
183 | local blockNo |
184 | local blocks = {} |
a826cb0d |
185 | |
b915fda3 |
186 | -- main loop |
04a6113f |
187 | io.write('Reading blocks > ') |
b915fda3 |
188 | for blockNo = 0, numBlocks-1, 1 do |
189 | |
190 | if core.ukbhit() then |
191 | print("aborted by user") |
192 | break |
193 | end |
194 | |
a826cb0d |
195 | core.clearCommandBuffer() |
196 | |
b915fda3 |
197 | pos = (math.floor( blockNo / 4 ) * 12)+1 |
198 | key = akeys:sub(pos, pos + 11 ) |
199 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key} |
200 | local err = core.SendCommand(cmd:getBytes()) |
201 | if err then return oops(err) end |
202 | local blockdata, err = waitCmd() |
203 | if err then return oops(err) end |
204 | |
40762506 |
205 | |
b915fda3 |
206 | if blockNo%4 ~= 3 then |
40762506 |
207 | |
b915fda3 |
208 | if blockNo < 8 then |
209 | -- Block 0-7 not encrypted |
0beb94e6 |
210 | blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata) |
b915fda3 |
211 | else |
b915fda3 |
212 | -- blocks with zero not encrypted. |
213 | if string.find(blockdata, '^0+$') then |
0beb94e6 |
214 | blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata) |
b915fda3 |
215 | else |
9c09e006 |
216 | local baseStr = utils.ConvertHexToAscii(tmpHash:format(blockNo)) |
217 | local key = md5.sumhexa(baseStr) |
218 | local aestest = core.aes128_decrypt(key, blockdata) |
8977988f |
219 | local hex = utils.ConvertAsciiToHex(aestest) |
a826cb0d |
220 | |
0beb94e6 |
221 | blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,hex) |
222 | io.write(blockNo..',') |
b915fda3 |
223 | end |
224 | end |
225 | else |
226 | -- Sectorblocks, not encrypted |
227 | blocks[blockNo+1] = ('%02d :: %s%s'):format(blockNo,key,blockdata:sub(13,32)) |
228 | end |
229 | end |
230 | io.write('\n') |
231 | |
232 | core.clearCommandBuffer() |
233 | |
234 | -- Print results |
235 | local bindata = {} |
236 | local emldata = '' |
237 | |
238 | for _,s in pairs(blocks) do |
239 | local slice = s:sub(8,#s) |
a826cb0d |
240 | local str = utils.ConvertHexToAscii(slice) |
b915fda3 |
241 | emldata = emldata..slice..'\n' |
242 | for c in (str):gmatch('.') do |
243 | bindata[#bindata+1] = c |
9c09e006 |
244 | end |
b915fda3 |
245 | end |
c3fe354b |
246 | |
247 | print( string.rep('--',20) ) |
b915fda3 |
248 | |
5149e37e |
249 | local uid = block0:sub(1,8) |
c3fe354b |
250 | local toytype = block1:sub(1,4) |
04a6113f |
251 | local cardidLsw = block1:sub(9,16) |
252 | local cardidMsw = block1:sub(16,24) |
5149e37e |
253 | local cardid = block1:sub(9,24) |
c3fe354b |
254 | local subtype = block1:sub(25,28) |
5149e37e |
255 | |
b915fda3 |
256 | -- Write dump to files |
257 | if not DEBUG then |
9c09e006 |
258 | local foo = dumplib.SaveAsBinary(bindata, outputTemplate..'-'..uid..'.bin') |
04a6113f |
259 | print(("Wrote a BIN dump to: %s"):format(foo)) |
9c09e006 |
260 | local bar = dumplib.SaveAsText(emldata, outputTemplate..'-'..uid..'.eml') |
04a6113f |
261 | print(("Wrote a EML dump to: %s"):format(bar)) |
b915fda3 |
262 | end |
9c09e006 |
263 | |
264 | print( string.rep('--',20) ) |
265 | -- Show info |
b915fda3 |
266 | |
c3fe354b |
267 | local item = toys.Find(toytype, subtype) |
268 | if item then |
9c09e006 |
269 | print((' ITEM TYPE : %s - %s (%s)'):format(item[6],item[5], item[4]) ) |
c3fe354b |
270 | else |
271 | print((' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype)) |
04a6113f |
272 | end |
9c09e006 |
273 | |
a8d4906b |
274 | print( (' UID : 0x%s'):format(uid) ) |
275 | print( (' CARDID : 0x%s'):format(cardid ) ) |
b915fda3 |
276 | print( string.rep('--',20) ) |
0beb94e6 |
277 | |
278 | core.clearCommandBuffer() |
b915fda3 |
279 | end |
280 | main(args) |