]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // Copyright (C) 2013 m h swende <martin at swende.se> | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // Some lua scripting glue to proxmark core. | |
9 | //----------------------------------------------------------------------------- | |
10 | ||
11 | #include <lua.h> | |
12 | #include <lualib.h> | |
13 | #include <lauxlib.h> | |
14 | #include "proxmark3.h" | |
15 | #include "usb_cmd.h" | |
16 | #include "cmdmain.h" | |
17 | #include "scripting.h" | |
18 | #include "util.h" | |
19 | #include "nonce2key/nonce2key.h" | |
20 | #include "../common/iso15693tools.h" | |
21 | #include <openssl/aes.h> | |
22 | #include "../common/crc16.h" | |
23 | /** | |
24 | * The following params expected: | |
25 | * UsbCommand c | |
26 | *@brief l_SendCommand | |
27 | * @param L | |
28 | * @return | |
29 | */ | |
30 | static int l_SendCommand(lua_State *L){ | |
31 | ||
32 | /* | |
33 | * | |
34 | The SendCommand (native) expects the following structure: | |
35 | ||
36 | typedef struct { | |
37 | uint64_t cmd; //8 bytes | |
38 | uint64_t arg[3]; // 8*3 bytes = 24 bytes | |
39 | union { | |
40 | uint8_t asBytes[USB_CMD_DATA_SIZE]; // 1 byte * 512 = 512 bytes (OR) | |
41 | uint32_t asDwords[USB_CMD_DATA_SIZE/4]; // 4 byte * 128 = 512 bytes | |
42 | } d; | |
43 | } PACKED UsbCommand; | |
44 | ||
45 | ==> A 544 byte buffer will do. | |
46 | **/ | |
47 | //Pop cmd | |
48 | size_t size; | |
49 | const char *data = luaL_checklstring(L, 1, &size); | |
50 | if(size != sizeof(UsbCommand)) | |
51 | { | |
52 | printf("Got data size %d, expected %d" , (int) size,(int) sizeof(UsbCommand)); | |
53 | lua_pushstring(L,"Wrong data size"); | |
54 | return 1; | |
55 | } | |
56 | ||
57 | // UsbCommand c = (*data); | |
58 | SendCommand((UsbCommand* )data); | |
59 | return 0; // no return values | |
60 | } | |
61 | /** | |
62 | * @brief The following params expected: | |
63 | * uint32_t cmd | |
64 | * size_t ms_timeout | |
65 | * @param L | |
66 | * @return | |
67 | */ | |
68 | static int l_WaitForResponseTimeout(lua_State *L){ | |
69 | ||
70 | uint32_t cmd = 0; | |
71 | size_t ms_timeout = -1; | |
72 | ||
73 | //Check number of arguments | |
74 | int n = lua_gettop(L); | |
75 | if(n == 0) | |
76 | { | |
77 | //signal error by returning Nil, errorstring | |
78 | lua_pushnil(L); | |
79 | lua_pushstring(L,"You need to supply at least command to wait for"); | |
80 | return 2; // two return values | |
81 | } | |
82 | if(n >= 1) | |
83 | { | |
84 | //pop cmd | |
85 | cmd = luaL_checkunsigned(L,1); | |
86 | } | |
87 | if(n >= 2) | |
88 | { | |
89 | //Did the user send a timeout ? | |
90 | //Check if the current top of stack is an integer | |
91 | ms_timeout = luaL_checkunsigned(L,2); | |
92 | //printf("Timeout set to %dms\n" , (int) ms_timeout); | |
93 | } | |
94 | ||
95 | UsbCommand response; | |
96 | ||
97 | if(WaitForResponseTimeout(cmd, &response, ms_timeout)) | |
98 | { | |
99 | //Push it as a string | |
100 | lua_pushlstring(L,(const char *)&response,sizeof(UsbCommand)); | |
101 | ||
102 | return 1;// return 1 to signal one return value | |
103 | }else{ | |
104 | //Push a Nil instead | |
105 | lua_pushnil(L); | |
106 | return 1;// one return value | |
107 | } | |
108 | } | |
109 | ||
110 | static int returnToLuaWithError(lua_State *L, const char* fmt, ...) | |
111 | { | |
112 | char buffer[200]; | |
113 | va_list args; | |
114 | va_start(args,fmt); | |
115 | vsnprintf(buffer, sizeof(buffer), fmt,args); | |
116 | va_end(args); | |
117 | ||
118 | lua_pushnil(L); | |
119 | lua_pushstring(L,buffer); | |
120 | return 2; | |
121 | } | |
122 | ||
123 | static int l_nonce2key(lua_State *L){ | |
124 | ||
125 | size_t size; | |
126 | const char *p_uid = luaL_checklstring(L, 1, &size); | |
127 | if(size != 4) return returnToLuaWithError(L,"Wrong size of uid, got %d bytes, expected 4", (int) size); | |
128 | ||
129 | const char *p_nt = luaL_checklstring(L, 2, &size); | |
130 | if(size != 4) return returnToLuaWithError(L,"Wrong size of nt, got %d bytes, expected 4", (int) size); | |
131 | ||
132 | const char *p_nr = luaL_checklstring(L, 3, &size); | |
133 | if(size != 4) return returnToLuaWithError(L,"Wrong size of nr, got %d bytes, expected 4", (int) size); | |
134 | ||
135 | const char *p_par_info = luaL_checklstring(L, 4, &size); | |
136 | if(size != 8) return returnToLuaWithError(L,"Wrong size of par_info, got %d bytes, expected 8", (int) size); | |
137 | ||
138 | const char *p_pks_info = luaL_checklstring(L, 5, &size); | |
139 | if(size != 8) return returnToLuaWithError(L,"Wrong size of ks_info, got %d bytes, expected 8", (int) size); | |
140 | ||
141 | ||
142 | uint32_t uid = bytes_to_num(( uint8_t *)p_uid,4); | |
143 | uint32_t nt = bytes_to_num(( uint8_t *)p_nt,4); | |
144 | ||
145 | uint32_t nr = bytes_to_num(( uint8_t*)p_nr,4); | |
146 | uint64_t par_info = bytes_to_num(( uint8_t *)p_par_info,8); | |
147 | uint64_t ks_info = bytes_to_num(( uint8_t *)p_pks_info,8); | |
148 | ||
149 | uint64_t key = 0; | |
150 | ||
151 | int retval = nonce2key(uid,nt, nr, par_info,ks_info, &key); | |
152 | ||
153 | //Push the retval on the stack | |
154 | lua_pushinteger(L,retval); | |
155 | ||
156 | //Push the key onto the stack | |
157 | uint8_t dest_key[8]; | |
158 | num_to_bytes(key,sizeof(dest_key),dest_key); | |
159 | ||
160 | //printf("Pushing to lua stack: %012"llx"\n",key); | |
161 | lua_pushlstring(L,(const char *) dest_key,sizeof(dest_key)); | |
162 | ||
163 | return 2; //Two return values | |
164 | } | |
165 | //static int l_PrintAndLog(lua_State *L){ return CmdHF14AMfDump(luaL_checkstring(L, 1));} | |
166 | static int l_clearCommandBuffer(lua_State *L){ | |
167 | clearCommandBuffer(); | |
168 | return 0; | |
169 | } | |
170 | /** | |
171 | * @brief l_foobar is a dummy function to test lua-integration with | |
172 | * @param L | |
173 | * @return | |
174 | */ | |
175 | static int l_foobar(lua_State *L) | |
176 | { | |
177 | //Check number of arguments | |
178 | int n = lua_gettop(L); | |
179 | printf("foobar called with %d arguments" , n); | |
180 | lua_settop(L, 0); | |
181 | printf("Arguments discarded, stack now contains %d elements", lua_gettop(L)); | |
182 | ||
183 | // todo: this is not used, where was it intended for? | |
184 | // UsbCommand response = {CMD_MIFARE_READBL, {1337, 1338, 1339}}; | |
185 | ||
186 | printf("Now returning a uint64_t as a string"); | |
187 | uint64_t x = 0xDEADBEEF; | |
188 | uint8_t destination[8]; | |
189 | num_to_bytes(x,sizeof(x),destination); | |
190 | lua_pushlstring(L,(const char *)&x,sizeof(x)); | |
191 | lua_pushlstring(L,(const char *)destination,sizeof(destination)); | |
192 | ||
193 | return 2; | |
194 | } | |
195 | ||
196 | ||
197 | /** | |
198 | * @brief Utility to check if a key has been pressed by the user. This method does not block. | |
199 | * @param L | |
200 | * @return boolean, true if kbhit, false otherwise. | |
201 | */ | |
202 | static int l_ukbhit(lua_State *L) | |
203 | { | |
204 | lua_pushboolean(L,ukbhit() ? true : false); | |
205 | return 1; | |
206 | } | |
207 | /** | |
208 | * @brief Calls the command line parser to deal with the command. This enables | |
209 | * lua-scripts to do stuff like "core.console('hf mf mifare')" | |
210 | * @param L | |
211 | * @return | |
212 | */ | |
213 | static int l_CmdConsole(lua_State *L) | |
214 | { | |
215 | CommandReceived((char *)luaL_checkstring(L, 1)); | |
216 | return 0; | |
217 | } | |
218 | ||
219 | static int l_iso15693_crc(lua_State *L) | |
220 | { | |
221 | // uint16_t Iso15693Crc(uint8_t *v, int n); | |
222 | size_t size; | |
223 | const char *v = luaL_checklstring(L, 1, &size); | |
224 | uint16_t retval = Iso15693Crc((uint8_t *) v, size); | |
225 | lua_pushinteger(L, (int) retval); | |
226 | return 1; | |
227 | } | |
228 | ||
229 | /* | |
230 | Simple AES 128 cbc hook up to OpenSSL. | |
231 | params: key, input | |
232 | */ | |
233 | static int l_aes(lua_State *L) | |
234 | { | |
235 | //Check number of arguments | |
236 | int i; | |
237 | size_t size; | |
238 | const char *p_key = luaL_checklstring(L, 1, &size); | |
239 | if(size != 32) return returnToLuaWithError(L,"Wrong size of key, got %d bytes, expected 32", (int) size); | |
240 | ||
241 | const char *p_encTxt = luaL_checklstring(L, 2, &size); | |
242 | ||
243 | unsigned char indata[AES_BLOCK_SIZE] = {0x00}; | |
244 | unsigned char outdata[AES_BLOCK_SIZE] = {0x00}; | |
245 | unsigned char aes_key[AES_BLOCK_SIZE] = {0x00}; | |
246 | unsigned char iv[AES_BLOCK_SIZE] = {0x00}; | |
247 | ||
248 | // convert key to bytearray | |
249 | for (i = 0; i < 32; i += 2) { | |
250 | sscanf(&p_encTxt[i], "%02x", (unsigned int *)&indata[i / 2]); | |
251 | } | |
252 | ||
253 | // convert input to bytearray | |
254 | for (i = 0; i < 32; i += 2) { | |
255 | sscanf(&p_key[i], "%02x", (unsigned int *)&aes_key[i / 2]); | |
256 | } | |
257 | ||
258 | AES_KEY key; | |
259 | AES_set_decrypt_key(aes_key, 128, &key); | |
260 | AES_cbc_encrypt(indata, outdata, sizeof(indata), &key, iv, AES_DECRYPT); | |
261 | ||
262 | //Push decrypted array as a string | |
263 | lua_pushlstring(L,(const char *)&outdata, sizeof(outdata)); | |
264 | return 1;// return 1 to signal one return value | |
265 | } | |
266 | ||
267 | static int l_crc16(lua_State *L) | |
268 | { | |
269 | size_t size; | |
270 | const char *p_str = luaL_checklstring(L, 1, &size); | |
271 | ||
272 | uint16_t retval = crc16_ccitt( (uint8_t*) p_str, size); | |
273 | lua_pushinteger(L, (int) retval); | |
274 | return 1; | |
275 | } | |
276 | ||
277 | /** | |
278 | * @brief Sets the lua path to include "./lualibs/?.lua", in order for a script to be | |
279 | * able to do "require('foobar')" if foobar.lua is within lualibs folder. | |
280 | * Taken from http://stackoverflow.com/questions/4125971/setting-the-global-lua-path-variable-from-c-c | |
281 | * @param L | |
282 | * @param path | |
283 | * @return | |
284 | */ | |
285 | int setLuaPath( lua_State* L, const char* path ) | |
286 | { | |
287 | lua_getglobal( L, "package" ); | |
288 | lua_getfield( L, -1, "path" ); // get field "path" from table at top of stack (-1) | |
289 | const char* cur_path = lua_tostring( L, -1 ); // grab path string from top of stack | |
290 | int requiredLength = strlen(cur_path)+ strlen(path)+10; //A few bytes too many, whatever we can afford it | |
291 | char * buf = malloc(requiredLength); | |
292 | snprintf(buf, requiredLength, "%s;%s", cur_path, path); | |
293 | lua_pop( L, 1 ); // get rid of the string on the stack we just pushed on line 5 | |
294 | lua_pushstring( L, buf ); // push the new one | |
295 | lua_setfield( L, -2, "path" ); // set the field "path" in table at -2 with value at top of stack | |
296 | lua_pop( L, 1 ); // get rid of package table from top of stack | |
297 | return 0; // all done! | |
298 | } | |
299 | ||
300 | ||
301 | int set_pm3_libraries(lua_State *L) | |
302 | { | |
303 | ||
304 | static const luaL_Reg libs[] = { | |
305 | {"SendCommand", l_SendCommand}, | |
306 | {"WaitForResponseTimeout", l_WaitForResponseTimeout}, | |
307 | {"nonce2key", l_nonce2key}, | |
308 | //{"PrintAndLog", l_PrintAndLog}, | |
309 | {"foobar", l_foobar}, | |
310 | {"ukbhit", l_ukbhit}, | |
311 | {"clearCommandBuffer", l_clearCommandBuffer}, | |
312 | {"console", l_CmdConsole}, | |
313 | {"iso15693_crc", l_iso15693_crc}, | |
314 | {"aes", l_aes}, | |
315 | {"crc16", l_crc16}, | |
316 | {NULL, NULL} | |
317 | }; | |
318 | ||
319 | lua_pushglobaltable(L); | |
320 | // Core library is in this table. Contains ' | |
321 | //this is 'pm3' table | |
322 | lua_newtable(L); | |
323 | ||
324 | //Put the function into the hash table. | |
325 | for (int i = 0; libs[i].name; i++) { | |
326 | lua_pushcfunction(L, libs[i].func); | |
327 | lua_setfield(L, -2, libs[i].name);//set the name, pop stack | |
328 | } | |
329 | //Name of 'core' | |
330 | lua_setfield(L, -2, "core"); | |
331 | ||
332 | //-- remove the global environment table from the stack | |
333 | lua_pop(L, 1); | |
334 | ||
335 | //-- Last but not least, add to the LUA_PATH (package.path in lua) | |
336 | // so we can load libraries from the ./lualib/ - directory | |
337 | setLuaPath(L,"./lualibs/?.lua"); | |
338 | ||
339 | return 1; | |
340 | } |