]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3.lua
5b3da98f0b7111b815fb8a770f1a9fc6ad935a8a
[proxmark3-svn] / client / scripts / tnp3.lua
1 local cmds = require('commands')
2 local getopt = require('getopt')
3 local bin = require('bin')
4 local lib14a = require('read14a')
5 local utils = require('utils')
6 local md5 = require('md5')
7
8 example =[[
9 1. script run tnp3
10 2. script run tnp3 -n
11 3. script run tnp3 -k aabbccddeeff
12 4. script run tnp3 -k aabbccddeeff -n
13 ]]
14 author = "Iceman"
15 usage = "script run tnp3 -k <key> -n"
16 desc =[[
17 This script will try to dump the contents of a Mifare TNP3xxx card.
18 It will need a valid KeyA in order to find the other keys and decode the card.
19 Arguments:
20 -h : this help
21 -k <key> : Sector 0 Key A.
22 -n : Use the nested cmd to find all keys
23 ]]
24
25 -- AES konstant? LEN 0x24 36,
26 -- I dekompilen är det för internal static array = 0x36 54
27 local hashconstant = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
28
29 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
30 local DEBUG = true -- the debug flag
31 local numBlocks = 64
32 local numSectors = 16
33 ---
34 -- A debug printout-function
35 function dbg(args)
36 if not DEBUG then
37 return
38 end
39
40 if type(args) == "table" then
41 local i = 1
42 while result[i] do
43 dbg(result[i])
44 i = i+1
45 end
46 else
47 print("###", args)
48 end
49 end
50 ---
51 -- This is only meant to be used when errors occur
52 function oops(err)
53 print("ERROR: ",err)
54 end
55 ---
56 -- Usage help
57 function help()
58 print(desc)
59 print("Example usage")
60 print(example)
61 end
62 --
63 -- Exit message
64 function ExitMsg(msg)
65 print( string.rep('--',20) )
66 print( string.rep('--',20) )
67 print(msg)
68 print()
69 end
70
71 local function readdumpkeys(infile)
72 t = infile:read("*all")
73 len = string.len(t)
74 local len,hex = bin.unpack(("H%d"):format(len),t)
75 return hex
76 end
77
78 local function waitCmd()
79 local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
80 if response then
81 local count,cmd,arg0 = bin.unpack('LL',response)
82 if(arg0==1) then
83 local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
84 return data:sub(1,32)
85 else
86 return nil, "Couldn't read block.."
87 end
88 end
89 return nil, "No response from device"
90 end
91
92 local function main(args)
93
94 print( string.rep('--',20) )
95 print( string.rep('--',20) )
96 print()
97
98 local keyA
99 local cmd
100 local err
101 local useNested = false
102 local cmdReadBlockString = 'hf mf rdbl %d A %s'
103 local input = "dumpkeys.bin"
104
105 -- Arguments for the script
106 for o, a in getopt.getopt(args, 'hk:n') do
107 if o == "h" then return help() end
108 if o == "k" then keyA = a end
109 if o == "n" then useNested = true end
110 end
111
112 -- validate input args.
113 keyA = keyA or '4b0b20107ccb'
114 if #(keyA) ~= 12 then
115 return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
116 end
117
118 result, err = lib14a.read1443a(false)
119 if not result then
120 return oops(err)
121 end
122
123 print((' Found tag : %s'):format(result.name))
124
125 core.clearCommandBuffer()
126
127 if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
128 return oops('This is not a TNP3xxx tag. aborting.')
129 end
130
131 -- Show info
132 print(('Using keyA : %s'):format(keyA))
133 print( string.rep('--',20) )
134
135
136 if useNested then
137 print('Trying to find keys.')
138 core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
139 end
140
141 -- Loading keyfile
142 print('Loading dumpkeys.bin')
143 local infile = io.open(input, "rb")
144 if infile == nil then
145 return oops('Could not read file ', input)
146 end
147 local akeys = readdumpkeys(infile):sub(0,12*16)
148
149 -- Read block 0
150 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
151 err = core.SendCommand(cmd:getBytes())
152 if err then return oops(err) end
153 local block0, err = waitCmd()
154 if err then return oops(err) end
155
156 -- Read block 1
157 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
158 err = core.SendCommand(cmd:getBytes())
159 if err then return oops(err) end
160 local block1, err = waitCmd()
161 if err then return oops(err) end
162
163 local key
164 local pos = 0
165 local blockNo
166 local blocks = {}
167
168 -- main loop
169 for blockNo = 0, numBlocks-1, 1 do
170
171 if core.ukbhit() then
172 print("aborted by user")
173 break
174 end
175
176 pos = (math.floor( blockNo / 4 ) * 12)+1
177 key = akeys:sub(pos, pos + 12 )
178 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
179 local err = core.SendCommand(cmd:getBytes())
180 if err then return oops(err) end
181 local blockdata, err = waitCmd()
182 if err then return oops(err) end
183
184 local b = blockNo%4
185
186 if b ~= 3 then
187 if blockNo < 8 then
188 -- Block 0-7 not encrypted
189 blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,blockdata)
190 else
191 local base = ('%s%s%d%s'):format(block0, block1, blockNo, hashconstant)
192 local md5hash = md5.sumhexa(base)
193 local aestest = core.aes(md5hash, blockdata)
194
195 local _,hex = bin.unpack(("H%d"):format(16),aestest)
196
197 -- local hexascii = string.gsub(hex, '(%x%x)',
198 -- function(value)
199 -- return string.char(tonumber(value, 16))
200 -- end
201 -- )
202
203 if string.find(blockdata, '^0+$') then
204 blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,blockdata)
205 else
206 --blocks[blockNo+1] = ('%02d :: %s :: %s :: %s '):format(blockNo,key,md5hash,hex)
207 blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,hex)
208 end
209 end
210
211 else
212 -- Sectorblocks, not encrypted
213 blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,blockdata)
214 end
215 end
216
217 -- Print results
218 print('BLK :: DATA DECRYPTED' )
219 print( string.rep('--',36) )
220 for _,s in pairs(blocks) do
221 print( s )
222 end
223 end
224
225 main(args)
Impressum, Datenschutz