cvs.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3.lua

   1 local cmds = require('commands')
   2 local getopt = require('getopt')
   3 local bin = require('bin')
   4 local lib14a = require('read14a')
   5 local utils = require('utils')
   6 local md5 = require('md5')
   7
   8 example =[[
   9         1. script run tnp3
  10         2. script run tnp3 -n
  11         3. script run tnp3 -k aabbccddeeff
  12         4. script run tnp3 -k aabbccddeeff -n
  13 ]]
  14 author = "Iceman"
  15 usage = "script run tnp3 -k <key> -n"
  16 desc =[[
  17 This script will try to dump the contents of a Mifare TNP3xxx card.
  18 It will need a valid KeyA in order to find the other keys and decode the card.
  19 Arguments:
  20         -h             : this help
  21         -k <key>       : Sector 0 Key A.
  22         -n             : Use the nested cmd to find all keys
  23 ]]
  24
  25 -- AES konstant?  LEN 0x24 36,
  26 -- I dekompilen är det för internal static array = 0x36 54
  27 local hashconstant = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
  28
  29 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
  30 local DEBUG = true -- the debug flag
  31 local numBlocks = 64
  32 local numSectors = 16
  33 ---
  34 -- A debug printout-function
  35 function dbg(args)
  36         if not DEBUG then
  37                 return
  38         end
  39
  40     if type(args) == "table" then
  41                 local i = 1
  42                 while result[i] do
  43                         dbg(result[i])
  44                         i = i+1
  45                 end
  46         else
  47                 print("###", args)
  48         end
  49 end
  50 ---
  51 -- This is only meant to be used when errors occur
  52 function oops(err)
  53         print("ERROR: ",err)
  54 end
  55 ---
  56 -- Usage help
  57 function help()
  58         print(desc)
  59         print("Example usage")
  60         print(example)
  61 end
  62 --
  63 -- Exit message
  64 function ExitMsg(msg)
  65         print( string.rep('--',20) )
  66         print( string.rep('--',20) )
  67         print(msg)
  68         print()
  69 end
  70
  71 local function readdumpkeys(infile)
  72          t = infile:read("*all")
  73          len = string.len(t)
  74          local len,hex = bin.unpack(("H%d"):format(len),t)
  75          return hex
  76 end
  77
  78 local function waitCmd()
  79         local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
  80         if response then
  81                 local count,cmd,arg0 = bin.unpack('LL',response)
  82                 if(arg0==1) then
  83                         local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
  84                         return data:sub(1,32)
  85                 else
  86                         return nil, "Couldn't read block.."
  87                 end
  88         end
  89         return nil, "No response from device"
  90 end
  91
  92 local function main(args)
  93
  94         print( string.rep('--',20) )
  95         print( string.rep('--',20) )
  96         print()
  97
  98         local keyA
  99         local cmd
 100         local err
 101         local useNested = false
 102         local cmdReadBlockString = 'hf mf rdbl %d A %s'
 103         local input = "dumpkeys.bin"
 104
 105         -- Arguments for the script
 106         for o, a in getopt.getopt(args, 'hk:n') do
 107                 if o == "h" then return help() end
 108                 if o == "k" then keyA = a end
 109                 if o == "n" then useNested = true end
 110         end
 111
 112         -- validate input args.
 113         keyA =  keyA or '4b0b20107ccb'
 114         if #(keyA) ~= 12 then
 115                 return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
 116         end
 117
 118         result, err = lib14a.read1443a(false)
 119         if not result then
 120                 return oops(err)
 121         end
 122
 123         print((' Found tag : %s'):format(result.name))
 124
 125         core.clearCommandBuffer()
 126
 127         if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
 128                 return oops('This is not a TNP3xxx tag. aborting.')
 129         end
 130
 131         -- Show info
 132         print(('Using keyA : %s'):format(keyA))
 133         print( string.rep('--',20) )
 134
 135
 136         if useNested then
 137           print('Trying to find keys.')
 138           core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
 139         end
 140
 141         -- Loading keyfile
 142         print('Loading dumpkeys.bin')
 143         local infile = io.open(input, "rb")
 144         if infile == nil then
 145                 return oops('Could not read file ', input)
 146         end
 147         local akeys = readdumpkeys(infile):sub(0,12*16)
 148
 149         -- Read block 0
 150         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
 151         err = core.SendCommand(cmd:getBytes())
 152         if err then return oops(err) end
 153         local block0, err = waitCmd()
 154         if err then return oops(err) end
 155
 156         -- Read block 1
 157         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
 158         err = core.SendCommand(cmd:getBytes())
 159         if err then return oops(err) end
 160         local block1, err = waitCmd()
 161         if err then return oops(err) end
 162
 163         local key
 164         local pos = 0
 165         local blockNo
 166         local blocks = {}
 167
 168         -- main loop
 169         for blockNo = 0, numBlocks-1, 1 do
 170
 171                 if core.ukbhit() then
 172                         print("aborted by user")
 173                         break
 174                 end
 175
 176                 pos = (math.floor( blockNo / 4 ) * 12)+1
 177                 key = akeys:sub(pos, pos + 11 )
 178                 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
 179                 local err = core.SendCommand(cmd:getBytes())
 180                 if err then return oops(err) end
 181                 local blockdata, err = waitCmd()
 182                 if err then return oops(err) end
 183
 184                 local b = blockNo%4
 185
 186                 if b ~= 3 then
 187                         if blockNo < 8 then
 188                                 -- Block 0-7 not encrypted
 189                                 blocks[blockNo+1] = ('%02d  :: %s :: %s'):format(blockNo,blockdata,blockdata)
 190                         else
 191                                 local base = ('%s%s%d%s'):format(block0, block1, blockNo, hashconstant)
 192                                 local md5hash = md5.sumhexa(base)
 193                                 local aestest = core.aes(md5hash, blockdata)
 194
 195                                 local _,hex = bin.unpack(("H%d"):format(16),aestest)
 196
 197                                 -- local hexascii = string.gsub(hex, '(%x%x)',
 198                                                                 -- function(value)
 199                                                                         -- return string.char(tonumber(value, 16))
 200                                                                 -- end
 201                                                         -- )
 202
 203                                 if string.find(blockdata, '^0+$') then
 204                                         blocks[blockNo+1] = ('%02d  :: %s :: %s'):format(blockNo,blockdata,blockdata)
 205                                 else
 206                                         --blocks[blockNo+1] = ('%02d :: %s :: %s :: %s '):format(blockNo,key,md5hash,hex)
 207                                         blocks[blockNo+1] = ('%02d  :: %s :: %s'):format(blockNo,blockdata,hex)
 208                                 end
 209                         end
 210
 211                 else
 212                         -- Sectorblocks, not encrypted
 213                         blocks[blockNo+1] = ('%02d  :: %s :: %s'):format(blockNo,blockdata,blockdata)
 214                 end
 215         end
 216
 217         -- Print results
 218         print('BLK :: DATA                                DECRYPTED' )
 219         print( string.rep('--',36) )
 220         for _,s in pairs(blocks) do
 221                 print( s )
 222         end
 223 end
 224
 225 main(args)