]> git.zerfleddert.de Git - proxmark3-svn/blame - client/scripts/tnp3clone.lua
CHG: Added the parameters -fdata-sections -ffunction-sections to common/Makefile...
[proxmark3-svn] / client / scripts / tnp3clone.lua
CommitLineData
40762506 1local cmds = require('commands')
2local getopt = require('getopt')
3local lib14a = require('read14a')
4local utils = require('utils')
5local pre = require('precalc')
6
7local lsh = bit32.lshift
8local rsh = bit32.rshift
9local bor = bit32.bor
10local band = bit32.band
11
12example =[[
13 script run tnp3dump
14 script run tnp3dump -h
15 script run tnp3dump -t aa00
16
17]]
18author = "Iceman"
19usage = "script run tnp3clone -t <toytype>"
20desc =[[
21This script will try making a barebone clone of a tnp3 tag on to a magic generation1 card.
22
23Arguments:
24 -h : this help
25 -k <key> : toytype id, 4 hex symbols.
26]]
27
28
29-- This is only meant to be used when errors occur
30function oops(err)
31 print("ERROR: ",err)
32end
33-- Usage help
34function help()
35 print(desc)
36 print("Example usage")
37 print(example)
38end
39
40local function waitCmd()
41 local response = core.WaitForResponseTimeout(cmds.CMD_ACK,2000)
42 if response then
43 local count,cmd,arg0 = bin.unpack('LL',response)
44 if(arg0==1) then
45 local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
46 return data:sub(1,32)
47 else
48 return nil, "Couldn't read block."
49 end
50 end
51 return nil, "No response from device"
52end
53
54local function readblock( keyA )
55 -- Read block 0
56 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
57 err = core.SendCommand(cmd:getBytes())
58 if err then return oops(err) end
59 local block0, err = waitCmd()
60 if err then return oops(err) end
61 return block0
62end
63
64local function main(args)
65
66 local numBlocks = 64
67 local cset = 'hf mf csetbl'
68 local empty = '00000000000000000000000000000000'
69 local AccAndKeyB = '7F078869000000000000'
70 -- Defaults to Gusto
71 local toytype = 'C201'
72
73 -- Arguments for the script
74 for o, a in getopt.getopt(args, 'ht:') do
75 if o == "h" then return help() end
76 if o == "t" then toytype = a end
77 end
78
79 if #toytype ~= 4 then return oops('Wrong size in toytype. (4hex symbols)') end
80
81 -- find tag
82 result, err = lib14a.read1443a(false)
83 if not result then return oops(err) end
84
85 -- Show tag info
86 print((' Found tag %s'):format(result.name))
87
88 -- load keys
89 local akeys = pre.GetAll(result.uid)
90 local keyA = akeys:sub(1, 12 )
91
92 local b0 = readblock(keyA)
93 local b1 = toytype..'000000000000000000000000'
94
95 local calc = utils.Crc16(b0..b1)
96 local calcEndian = bor(rsh(calc,8), lsh(band(calc, 0xff), 8))
97
98 local cmd = ('hf mf csetbl 1 %s%04x'):format( b1, calcEndian)
99 core.console( cmd)
100
101 local pos, key
102 for blockNo = 2, numBlocks-1, 1 do
103 pos = (math.floor( blockNo / 4 ) * 12)+1
104 key = akeys:sub(pos, pos + 11 )
105 if blockNo%4 ~= 3 then
106 cmd = ('%s %d %s'):format(cset,blockNo,empty)
107 else
108 cmd = ('%s %d %s%s'):format(cset,blockNo,key,AccAndKeyB)
109 end
110 core.console(cmd)
111 end
112end
113main(args)
Impressum, Datenschutz