]>
Commit | Line | Data |
---|---|---|
1 | local cmds = require('commands') | |
2 | local getopt = require('getopt') | |
3 | local bin = require('bin') | |
4 | local lib14a = require('read14a') | |
5 | local utils = require('utils') | |
6 | local md5 = require('md5') | |
7 | local toyNames = require('default_toys') | |
8 | ||
9 | example =[[ | |
10 | 1. script run tnp3 | |
11 | 2. script run tnp3 -n | |
12 | 3. script run tnp3 -k aabbccddeeff | |
13 | 4. script run tnp3 -k aabbccddeeff -n | |
14 | ]] | |
15 | author = "Iceman" | |
16 | usage = "script run tnp3 -k <key> -n" | |
17 | desc =[[ | |
18 | This script will try to dump the contents of a Mifare TNP3xxx card. | |
19 | It will need a valid KeyA in order to find the other keys and decode the card. | |
20 | Arguments: | |
21 | -h : this help | |
22 | -k <key> : Sector 0 Key A. | |
23 | -n : Use the nested cmd to find all keys | |
24 | ]] | |
25 | ||
26 | -- AES konstant? LEN 0x24 36, | |
27 | -- I dekompilen är det för internal static array = 0x36 54 | |
28 | local hashconstant = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20' | |
29 | ||
30 | local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds | |
31 | local DEBUG = true -- the debug flag | |
32 | local numBlocks = 64 | |
33 | local numSectors = 16 | |
34 | --- | |
35 | -- A debug printout-function | |
36 | function dbg(args) | |
37 | if not DEBUG then | |
38 | return | |
39 | end | |
40 | ||
41 | if type(args) == "table" then | |
42 | local i = 1 | |
43 | while result[i] do | |
44 | dbg(result[i]) | |
45 | i = i+1 | |
46 | end | |
47 | else | |
48 | print("###", args) | |
49 | end | |
50 | end | |
51 | --- | |
52 | -- This is only meant to be used when errors occur | |
53 | function oops(err) | |
54 | print("ERROR: ",err) | |
55 | end | |
56 | --- | |
57 | -- Usage help | |
58 | function help() | |
59 | print(desc) | |
60 | print("Example usage") | |
61 | print(example) | |
62 | end | |
63 | -- | |
64 | -- Exit message | |
65 | function ExitMsg(msg) | |
66 | print( string.rep('--',20) ) | |
67 | print( string.rep('--',20) ) | |
68 | print(msg) | |
69 | print() | |
70 | end | |
71 | ||
72 | local function readdumpkeys(infile) | |
73 | t = infile:read("*all") | |
74 | len = string.len(t) | |
75 | local len,hex = bin.unpack(("H%d"):format(len),t) | |
76 | return hex | |
77 | end | |
78 | ||
79 | local function waitCmd() | |
80 | local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT) | |
81 | if response then | |
82 | local count,cmd,arg0 = bin.unpack('LL',response) | |
83 | if(arg0==1) then | |
84 | local count,arg1,arg2,data = bin.unpack('LLH511',response,count) | |
85 | return data:sub(1,32) | |
86 | else | |
87 | return nil, "Couldn't read block.." | |
88 | end | |
89 | end | |
90 | return nil, "No response from device" | |
91 | end | |
92 | ||
93 | local function main(args) | |
94 | ||
95 | print( string.rep('--',20) ) | |
96 | --print( string.rep('--',20) ) | |
97 | --print() | |
98 | ||
99 | local keyA | |
100 | local cmd | |
101 | local err | |
102 | local useNested = false | |
103 | local cmdReadBlockString = 'hf mf rdbl %d A %s' | |
104 | local input = "dumpkeys.bin" | |
105 | ||
106 | -- Arguments for the script | |
107 | for o, a in getopt.getopt(args, 'hk:n') do | |
108 | if o == "h" then return help() end | |
109 | if o == "k" then keyA = a end | |
110 | if o == "n" then useNested = true end | |
111 | end | |
112 | ||
113 | -- validate input args. | |
114 | keyA = keyA or '4b0b20107ccb' | |
115 | if #(keyA) ~= 12 then | |
116 | return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA)) | |
117 | end | |
118 | ||
119 | -- Turn off Debug | |
120 | local cmdSetDbgOff = "hf mf dbg 0" | |
121 | core.console( cmdSetDbgOff) | |
122 | ||
123 | result, err = lib14a.read1443a(false) | |
124 | if not result then | |
125 | return oops(err) | |
126 | end | |
127 | ||
128 | core.clearCommandBuffer() | |
129 | ||
130 | if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx | |
131 | return oops('This is not a TNP3xxx tag. aborting.') | |
132 | end | |
133 | ||
134 | print((' Found tag : %s'):format(result.name)) | |
135 | ||
136 | -- Show info | |
137 | print(('Using keyA : %s'):format(keyA)) | |
138 | print( string.rep('--',20) ) | |
139 | ||
140 | --Trying to find the other keys | |
141 | if useNested then | |
142 | core.console( ('hf mf nested 1 0 A %s d'):format(keyA) ) | |
143 | end | |
144 | ||
145 | -- Loading keyfile | |
146 | print('Loading dumpkeys.bin') | |
147 | local infile = io.open(input, "rb") | |
148 | if infile == nil then | |
149 | return oops('Could not read file ', input) | |
150 | end | |
151 | local akeys = readdumpkeys(infile):sub(0,12*16) | |
152 | ||
153 | -- Read block 0 | |
154 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA} | |
155 | err = core.SendCommand(cmd:getBytes()) | |
156 | if err then return oops(err) end | |
157 | local block0, err = waitCmd() | |
158 | if err then return oops(err) end | |
159 | ||
160 | -- Read block 1 | |
161 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA} | |
162 | err = core.SendCommand(cmd:getBytes()) | |
163 | if err then return oops(err) end | |
164 | local block1, err = waitCmd() | |
165 | if err then return oops(err) end | |
166 | ||
167 | local key | |
168 | local pos = 0 | |
169 | local blockNo | |
170 | local blocks = {} | |
171 | ||
172 | print('Reading card data') | |
173 | ||
174 | -- main loop | |
175 | for blockNo = 0, numBlocks-1, 1 do | |
176 | ||
177 | if core.ukbhit() then | |
178 | print("aborted by user") | |
179 | break | |
180 | end | |
181 | ||
182 | pos = (math.floor( blockNo / 4 ) * 12)+1 | |
183 | key = akeys:sub(pos, pos + 11 ) | |
184 | cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key} | |
185 | local err = core.SendCommand(cmd:getBytes()) | |
186 | if err then return oops(err) end | |
187 | local blockdata, err = waitCmd() | |
188 | if err then return oops(err) end | |
189 | ||
190 | local b = blockNo%4 | |
191 | ||
192 | if b ~= 3 then | |
193 | if blockNo < 8 then | |
194 | -- Block 0-7 not encrypted | |
195 | blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,blockdata) | |
196 | else | |
197 | local base = ('%s%s%d%s'):format(block0, block1, blockNo, hashconstant) local md5hash = md5.sumhexa(base) | |
198 | local aestest = core.aes(md5hash, blockdata) | |
199 | ||
200 | local _,hex = bin.unpack(("H%d"):format(16),aestest) | |
201 | ||
202 | -- local hexascii = string.gsub(hex, '(%x%x)', | |
203 | -- function(value) | |
204 | -- return string.char(tonumber(value, 16)) | |
205 | -- end | |
206 | -- ) | |
207 | ||
208 | if string.find(blockdata, '^0+$') then | |
209 | blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,blockdata) | |
210 | else | |
211 | --blocks[blockNo+1] = ('%02d :: %s :: %s :: %s '):format(blockNo,key,md5hash,hex) | |
212 | blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,hex) | |
213 | end | |
214 | end | |
215 | ||
216 | else | |
217 | -- Sectorblocks, not encrypted | |
218 | blocks[blockNo+1] = ('%02d :: %s :: %s'):format(blockNo,blockdata,blockdata) | |
219 | end | |
220 | end | |
221 | ||
222 | -- Print results | |
223 | local uid = block0:sub(1,8) | |
224 | local itemtype = block1:sub(1,4) | |
225 | local cardid = block1:sub(9,24) | |
226 | print( (' UID : %s'):format(uid) ) | |
227 | print( (' ITEM TYPE : %s - %s'):format(itemtype, toyNames[itemtype]) ) | |
228 | print( (' CARDID : %s'):format(cardid ) ) | |
229 | print('BLK :: DATA DECRYPTED' ) | |
230 | print( string.rep('--',36) ) | |
231 | for _,s in pairs(blocks) do | |
232 | print( s ) | |
233 | end | |
234 | end | |
235 | ||
236 | main(args) |