cvs.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3.lua

   1 local cmds = require('commands')
   2 local getopt = require('getopt')
   3 local bin = require('bin')
   4 local lib14a = require('read14a')
   5 local utils = require('utils')
   6 local md5 = require('md5')
   7
   8 example =[[
   9         1. script run tnp3
  10         2. script run tnp3 -n
  11         3. script run tnp3 -k aabbccddeeff
  12         4. script run tnp3 -k aabbccddeeff -n
  13 ]]
  14 author = "Iceman"
  15 usage = "script run tnp3 -k <key> -n"
  16 desc =[[
  17 This script will try to dump the contents of a Mifare TNP3xxx card.
  18 It will need a valid KeyA in order to find the other keys and decode the card.
  19 Arguments:
  20         -h             : this help
  21         -k <key>       : Sector 0 Key A.
  22         -n             : Use the nested cmd to find all keys
  23 ]]
  24
  25 -- AES konstant?  LEN 0x24 36,
  26 -- I dekompilen är det för internal static array = 0x36 54
  27 local hashconstant = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
  28
  29 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
  30 local DEBUG = true -- the debug flag
  31 local numBlocks = 64
  32 local numSectors = 16
  33 ---
  34 -- A debug printout-function
  35 function dbg(args)
  36         if not DEBUG then
  37                 return
  38         end
  39
  40     if type(args) == "table" then
  41                 local i = 1
  42                 while result[i] do
  43                         dbg(result[i])
  44                         i = i+1
  45                 end
  46         else
  47                 print("###", args)
  48         end
  49 end
  50 ---
  51 -- This is only meant to be used when errors occur
  52 function oops(err)
  53         print("ERROR: ",err)
  54 end
  55 ---
  56 -- Usage help
  57 function help()
  58         print(desc)
  59         print("Example usage")
  60         print(example)
  61 end
  62 --
  63 -- Exit message
  64 function ExitMsg(msg)
  65         print( string.rep('--',20) )
  66         print( string.rep('--',20) )
  67         print(msg)
  68         print()
  69 end
  70
  71 local function readdumpkeys(infile)
  72          t = infile:read("*all")
  73          len = string.len(t)
  74          local len,hex = bin.unpack(("H%d"):format(len),t)
  75          return hex
  76 end
  77
  78 local function waitCmd()
  79         local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
  80         if response then
  81                 local count,cmd,arg0 = bin.unpack('LL',response)
  82                 if(arg0==1) then
  83                         local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
  84                         return data:sub(1,32)
  85                 else
  86                         return nil, "Couldn't read block.."
  87                 end
  88         end
  89         return nil, "No response from device"
  90 end
  91
  92 local function main(args)
  93
  94         print( string.rep('--',20) )
  95         print( string.rep('--',20) )
  96         print()
  97
  98         local keyA
  99         local cmd
 100         local err
 101         local useNested = false
 102         local cmdReadBlockString = 'hf mf rdbl %d A %s'
 103         local input = "dumpkeys.bin"
 104
 105         -- Arguments for the script
 106         for o, a in getopt.getopt(args, 'hk:n') do
 107                 if o == "h" then return help() end
 108                 if o == "k" then keyA = a end
 109                 if o == "n" then useNested = true end
 110         end
 111
 112         -- validate input args.
 113         keyA =  keyA or '4b0b20107ccb'
 114         if #(keyA) ~= 12 then
 115                 return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
 116         end
 117
 118         result, err = lib14a.read1443a(false)
 119         if not result then
 120                 return oops(err)
 121         end
 122
 123         print((' Found tag : %s'):format(result.name))
 124
 125         core.clearCommandBuffer()
 126
 127         if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
 128                 return oops('This is not a TNP3xxx tag. aborting.')
 129         end
 130
 131         -- Show info
 132         print(('Using keyA : %s'):format(keyA))
 133         print( string.rep('--',20) )
 134
 135         print('Trying to find other keys.')
 136         if useNested then
 137           core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
 138         end
 139
 140         -- Loading keyfile
 141         local infile = io.open(input, "rb")
 142         if infile == nil then
 143                 return oops('Could not read file ', input)
 144         end
 145         local akeys = readdumpkeys(infile):sub(0,12*16)
 146
 147         -- Read block 0
 148         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
 149         err = core.SendCommand(cmd:getBytes())
 150         if err then return oops(err) end
 151         local block0, err = waitCmd()
 152         if err then return oops(err) end
 153
 154         -- Read block 1
 155         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
 156         err = core.SendCommand(cmd:getBytes())
 157         if err then return oops(err) end
 158         local block1, err = waitCmd()
 159         if err then return oops(err) end
 160
 161         local key
 162         local pos = 0
 163         local blockNo
 164         local blocks = {}
 165
 166         -- main loop
 167         for blockNo = 8, numBlocks-1, 1 do
 168                 local b = blockNo%4
 169                 if b ~= 3 then
 170                         pos = (math.floor( blockNo / 4 ) * 12)+1
 171                         key = akeys:sub(pos, pos + 12 )
 172                         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
 173                         local err = core.SendCommand(cmd:getBytes())
 174                         if err then return oops(err) end
 175                         local blockdata, err = waitCmd()
 176                         if err then return oops(err) end
 177
 178                         local base = ('%s%s%d%s'):format(block0, block1, blockNo, hashconstant)
 179                         local md5hash = md5.sumhexa(base)
 180                         local aestest = core.aes(md5hash, blockdata)
 181
 182                         local _,hex = bin.unpack(("H%d"):format(16),aestest)
 183
 184                         -- local hexascii = string.gsub(hex, '(%x%x)',
 185                                                         -- function(value)
 186                                                                 -- return string.char(tonumber(value, 16))
 187                                                         -- end
 188                                                 -- )
 189
 190                 if string.find(blockdata, '^0+$') then
 191                                 blocks[blockNo] = ('%02d  :: %s :: %s'):format(blockNo,blockdata,blockdata)
 192                         else
 193                                 --blocks[blockNo] = ('%02d :: %s :: %s :: %s '):format(blockNo,key,md5hash,hex)
 194                                 blocks[blockNo] = ('%02d  :: %s :: %s'):format(blockNo,blockdata,blockdata)
 195                         end
 196
 197                         if core.ukbhit() then
 198                                 print("aborted by user")
 199                                 break
 200                         end
 201                 end
 202         end
 203
 204         -- Print results
 205         print('BLK :: DATA                                DECRYPTED' )
 206         print( string.rep('--',36) )
 207         for _,s in pairs(blocks) do
 208                 print( s )
 209         end
 210 end
 211
 212 main(args)