]> git.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3clone.lua
cad1ab70088d567ebf665f5b90d71865777ebd46
[proxmark3-svn] / client / scripts / tnp3clone.lua
1 local cmds = require('commands')
2 local getopt = require('getopt')
3 local lib14a = require('read14a')
4 local utils = require('utils')
5 local pre = require('precalc')
6 local toys = require('default_toys')
7
8 local lsh = bit32.lshift
9 local rsh = bit32.rshift
10 local bor = bit32.bor
11 local band = bit32.band
12
13 example =[[
14 script run tnp3clone
15 script run tnp3clone -h
16 script run tnp3clone -t aa00 -s 0030
17
18 ]]
19 author = "Iceman"
20 usage = "script run tnp3clone -t <toytype> -s <subtype>"
21 desc =[[
22 This script will try making a barebone clone of a tnp3 tag on to a magic generation1 card.
23
24 Arguments:
25 -h : this help
26 -t <data> : toytype id, 4hex symbols.
27 -s <data> : subtype id, 4hex symbols
28 ]]
29
30
31 -- This is only meant to be used when errors occur
32 function oops(err)
33 print("ERROR: ",err)
34 end
35 -- Usage help
36 function help()
37 print(desc)
38 print("Example usage")
39 print(example)
40 end
41
42 local function waitCmd()
43 local response = core.WaitForResponseTimeout(cmds.CMD_ACK,2000)
44 if response then
45 local count,cmd,arg0 = bin.unpack('LL',response)
46 if(arg0==1) then
47 local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
48 return data:sub(1,32)
49 else
50 return nil, "Couldn't read block."
51 end
52 end
53 return nil, "No response from device"
54 end
55
56 local function readblock( blocknum, keyA )
57 -- Read block 0
58 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blocknum, arg2 = 0, arg3 = 0, data = keyA}
59 err = core.SendCommand(cmd:getBytes())
60 if err then return nil, err end
61 local block0, err = waitCmd()
62 if err then return nil, err end
63 return block0
64 end
65 local function readmagicblock( blocknum )
66 -- Read block 0
67 local CSETBLOCK_SINGLE_OPERATION = 0x1F
68 cmd = Command:new{cmd = cmds.CMD_MIFARE_CGETBLOCK, arg1 = CSETBLOCK_SINGLE_OPERATION, arg2 = 0, arg3 = blocknum}
69 err = core.SendCommand(cmd:getBytes())
70 if err then return nil, err end
71 local block0, err = waitCmd()
72 if err then return nil, err end
73 return block0
74 end
75
76 local function main(args)
77
78 print( string.rep('--',20) )
79 print( string.rep('--',20) )
80
81 local numBlocks = 64
82 local cset = 'hf mf csetbl '
83 local csetuid = 'hf mf csetuid '
84 local cget = 'hf mf cgetbl '
85 local empty = '00000000000000000000000000000000'
86 local AccAndKeyB = '7F078869000000000000'
87 -- Defaults to Gusto
88 local toytype = 'C201'
89 local subtype = '0030'
90 local DEBUG = true
91
92 -- Arguments for the script
93 for o, a in getopt.getopt(args, 'ht:s:') do
94 if o == "h" then return help() end
95 if o == "t" then toytype = a end
96 if o == "s" then subtype = a end
97 end
98
99 if #toytype ~= 4 then return oops('Wrong size - toytype. (4hex symbols)') end
100 if #subtype ~= 4 then return oops('Wrong size - subtype. (4hex symbols)') end
101
102 -- look up type, find & validate types
103 local item = toys.Find( toytype, subtype)
104 if item then
105 print( (' Looking up input: Found %s - %s (%s)'):format(item[6],item[5], item[4]) )
106 else
107 print('Didn\'t find item type. If you are sure about it, report it in')
108 end
109 --15,16
110 --13-14
111
112
113 -- find tag
114 result, err = lib14a.read1443a(false)
115 if not result then return oops(err) end
116
117 -- load keys
118 local akeys = pre.GetAll(result.uid)
119 local keyA = akeys:sub(1, 12 )
120
121 local b0 = readblock(0,keyA)
122 if not b0 then
123 print('failed reading block with factorydefault key. Trying chinese magic read.')
124 b0, err = readmagicblock(0)
125 if not b0 then
126 oops(err)
127 return oops('failed reading block with chinese magic command. quitting...')
128 end
129 end
130
131 -- wipe card.
132 local cmd = (csetuid..'%s 0004 08 w'):format(result.uid)
133 core.console(cmd)
134
135 local b1 = toytype..'00000000000000000000'..subtype
136 local calc = utils.Crc16(b0..b1)
137 local calcEndian = bor(rsh(calc,8), lsh(band(calc, 0xff), 8))
138
139 local cmd = (cset..'1 %s%04x'):format( b1, calcEndian)
140 core.console(cmd)
141
142 local pos, key
143 for blockNo = 2, numBlocks-1, 1 do
144 pos = (math.floor( blockNo / 4 ) * 12)+1
145 key = akeys:sub(pos, pos + 11 )
146 if blockNo%4 == 3 then
147 cmd = ('%s %d %s%s'):format(cset,blockNo,key,AccAndKeyB)
148 core.console(cmd)
149 end
150 end
151 core.clearCommandBuffer()
152 end
153 main(args)
Impressum, Datenschutz