cvs.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3clone.lua

   1 local cmds = require('commands')
   2 local getopt = require('getopt')
   3 local lib14a = require('read14a')
   4 local utils = require('utils')
   5 local pre = require('precalc')
   6 local toys = require('default_toys2')
   7
   8 local lsh = bit32.lshift
   9 local rsh = bit32.rshift
  10 local bor = bit32.bor
  11 local band = bit32.band
  12
  13 example =[[
  14         script run tnp3clone
  15         script run tnp3clone -h
  16         script run tnp3clone -t aa00 -s 0030
  17
  18 ]]
  19 author = "Iceman"
  20 usage = "script run tnp3clone -t <toytype> -s <subtype>"
  21 desc =[[
  22 This script will try making a barebone clone of a tnp3 tag on to a magic generation1 card.
  23
  24 Arguments:
  25         -h             : this help
  26         -t <data>      : toytype id, 4hex symbols.
  27         -s <data>      : subtype id, 4hex symbols
  28 ]]
  29
  30
  31 -- This is only meant to be used when errors occur
  32 function oops(err)
  33         print("ERROR: ",err)
  34 end
  35 -- Usage help
  36 function help()
  37         print(desc)
  38         print("Example usage")
  39         print(example)
  40 end
  41
  42 local function waitCmd()
  43         local response = core.WaitForResponseTimeout(cmds.CMD_ACK,2000)
  44         if response then
  45                 local count,cmd,arg0 = bin.unpack('LL',response)
  46                 if(arg0==1) then
  47                         local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
  48                         return data:sub(1,32)
  49                 else
  50                         return nil, "Couldn't read block."
  51                 end
  52         end
  53         return nil, "No response from device"
  54 end
  55
  56 local function readblock( blocknum, keyA )
  57         -- Read block 0
  58         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blocknum, arg2 = 0, arg3 = 0, data = keyA}
  59         err = core.SendCommand(cmd:getBytes())
  60         if err then return nil, err end
  61         local block0, err = waitCmd()
  62         if err then return nil, err end
  63         return block0
  64 end
  65 local function readmagicblock( blocknum )
  66         -- Read block 0
  67         local CSETBLOCK_SINGLE_OPERATION = 0x1F
  68         cmd = Command:new{cmd = cmds.CMD_MIFARE_CGETBLOCK, arg1 = CSETBLOCK_SINGLE_OPERATION, arg2 = 0, arg3 = blocknum}
  69         err = core.SendCommand(cmd:getBytes())
  70         if err then return nil, err end
  71         local block0, err = waitCmd()
  72         if err then return nil, err end
  73         return block0
  74 end
  75
  76 local function main(args)
  77
  78         print( string.rep('--',20) )
  79         print( string.rep('--',20) )
  80
  81         local numBlocks = 64
  82     local cset = 'hf mf csetbl '
  83         local csetuid = 'hf mf csetuid '
  84         local cget = 'hf mf cgetbl '
  85         local empty = '00000000000000000000000000000000'
  86         local AccAndKeyB = '7F078869000000000000'
  87         -- Defaults to Gusto
  88         local toytype = 'C201'
  89         local subtype = '0030'
  90         local DEBUG = true
  91
  92         -- Arguments for the script
  93         for o, a in getopt.getopt(args, 'ht:s:') do
  94                 if o == "h" then return help() end
  95                 if o == "t" then toytype = a end
  96                 if o == "s" then subtype = a end
  97         end
  98
  99         if #toytype ~= 4 then return oops('Wrong size - toytype. (4hex symbols)') end
 100         if #subtype ~= 4 then return oops('Wrong size - subtype. (4hex symbols)') end
 101
 102         -- look up type, find & validate types
 103         local item = toys.Find( toytype, subtype)
 104         if item then
 105                 print( (' Looking up input: Found %s - %s (%s)'):format(item[6],item[5], item[4]) )
 106         else
 107                 print('Didn\'t find item type. If you are sure about it, report it in')
 108         end
 109         --15,16
 110         --13-14
 111
 112
 113         -- find tag
 114         result, err = lib14a.read1443a(false)
 115         if not result then return oops(err)     end
 116
 117         -- load keys
 118         local akeys  = pre.GetAll(result.uid)
 119         local  keyA = akeys:sub(1, 12 )
 120
 121         local b0 = readblock(0,keyA)
 122         if not b0 then
 123                 print('failed reading block with factorydefault key.  Trying chinese magic read.')
 124             b0, err = readmagicblock(0)
 125                 if not b0 then
 126                         oops(err)
 127                         return oops('failed reading block with chinese magic command.  quitting...')
 128                 end
 129         end
 130
 131         -- wipe card.
 132         local cmd  = (csetuid..'%s 0004 08 w'):format(result.uid)
 133         core.console(cmd)
 134
 135         local b1 = toytype..'00000000000000000000'..subtype
 136         local calc = utils.Crc16(b0..b1)
 137         local calcEndian = bor(rsh(calc,8), lsh(band(calc, 0xff), 8))
 138
 139         local cmd  = (cset..'1 %s%04x'):format( b1, calcEndian)
 140         core.console(cmd)
 141
 142         local pos, key
 143         for blockNo = 2, numBlocks-1, 1 do
 144                 pos = (math.floor( blockNo / 4 ) * 12)+1
 145                 key = akeys:sub(pos, pos + 11 )
 146                 if  blockNo%4 == 3 then
 147                         cmd =  ('%s %d %s%s'):format(cset,blockNo,key,AccAndKeyB)
 148                         core.console(cmd)
 149                 end
 150         end
 151         core.clearCommandBuffer()
 152 end
 153 main(args)