git.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3.lua

   1 local cmds = require('commands')
   2 local getopt = require('getopt')
   3 local bin = require('bin')
   4 local lib14a = require('read14a')
   5 local utils = require('utils')
   6 local md5 = require('md5')
   7 local toyNames = require('default_toys')
   8
   9 example =[[
  10         1. script run tnp3
  11         2. script run tnp3 -n
  12         3. script run tnp3 -k aabbccddeeff
  13         4. script run tnp3 -k aabbccddeeff -n
  14 ]]
  15 author = "Iceman"
  16 usage = "script run tnp3 -k <key> -n"
  17 desc =[[
  18 This script will try to dump the contents of a Mifare TNP3xxx card.
  19 It will need a valid KeyA in order to find the other keys and decode the card.
  20 Arguments:
  21         -h             : this help
  22         -k <key>       : Sector 0 Key A.
  23         -n             : Use the nested cmd to find all keys
  24 ]]
  25
  26 -- AES konstant?  LEN 0x24 36,
  27 -- I dekompilen är det för internal static array = 0x36 54
  28 local hashconstant = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
  29
  30 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
  31 local DEBUG = true -- the debug flag
  32 local numBlocks = 64
  33 local numSectors = 16
  34 ---
  35 -- A debug printout-function
  36 function dbg(args)
  37         if not DEBUG then
  38                 return
  39         end
  40
  41     if type(args) == "table" then
  42                 local i = 1
  43                 while result[i] do
  44                         dbg(result[i])
  45                         i = i+1
  46                 end
  47         else
  48                 print("###", args)
  49         end
  50 end
  51 ---
  52 -- This is only meant to be used when errors occur
  53 function oops(err)
  54         print("ERROR: ",err)
  55 end
  56 ---
  57 -- Usage help
  58 function help()
  59         print(desc)
  60         print("Example usage")
  61         print(example)
  62 end
  63 --
  64 -- Exit message
  65 function ExitMsg(msg)
  66         print( string.rep('--',20) )
  67         print( string.rep('--',20) )
  68         print(msg)
  69         print()
  70 end
  71
  72 local function readdumpkeys(infile)
  73          t = infile:read("*all")
  74          len = string.len(t)
  75          local len,hex = bin.unpack(("H%d"):format(len),t)
  76          return hex
  77 end
  78
  79 local function waitCmd()
  80         local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
  81         if response then
  82                 local count,cmd,arg0 = bin.unpack('LL',response)
  83                 if(arg0==1) then
  84                         local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
  85                         return data:sub(1,32)
  86                 else
  87                         return nil, "Couldn't read block.."
  88                 end
  89         end
  90         return nil, "No response from device"
  91 end
  92
  93 local function main(args)
  94
  95         print( string.rep('--',20) )
  96         print( string.rep('--',20) )
  97         --print()
  98
  99         local keyA
 100         local cmd
 101         local err
 102         local useNested = false
 103         local cmdReadBlockString = 'hf mf rdbl %d A %s'
 104         local input = "dumpkeys.bin"
 105
 106         -- Arguments for the script
 107         for o, a in getopt.getopt(args, 'hk:n') do
 108                 if o == "h" then return help() end
 109                 if o == "k" then keyA = a end
 110                 if o == "n" then useNested = true end
 111         end
 112
 113         -- validate input args.
 114         keyA =  keyA or '4b0b20107ccb'
 115         if #(keyA) ~= 12 then
 116                 return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
 117         end
 118
 119         -- Turn off Debug
 120         local cmdSetDbgOff = "hf mf dbg 0"
 121         core.console( cmdSetDbgOff)
 122
 123         result, err = lib14a.read1443a(false)
 124         if not result then
 125                 return oops(err)
 126         end
 127
 128         core.clearCommandBuffer()
 129
 130         if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
 131                 return oops('This is not a TNP3xxx tag. aborting.')
 132         end
 133
 134         print((' Found tag : %s'):format(result.name))
 135
 136         -- Show info
 137         print(('Using keyA : %s'):format(keyA))
 138         print( string.rep('--',20) )
 139
 140         --Trying to find the other keys
 141         if useNested then
 142           core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
 143         end
 144
 145         -- Loading keyfile
 146         print('Loading dumpkeys.bin')
 147         local infile = io.open(input, "rb")
 148         if infile == nil then
 149                 return oops('Could not read file ', input)
 150         end
 151         local akeys = readdumpkeys(infile):sub(0,12*16)
 152
 153         -- Read block 0
 154         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
 155         err = core.SendCommand(cmd:getBytes())
 156         if err then return oops(err) end
 157         local block0, err = waitCmd()
 158         if err then return oops(err) end
 159
 160         -- Read block 1
 161         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
 162         err = core.SendCommand(cmd:getBytes())
 163         if err then return oops(err) end
 164         local block1, err = waitCmd()
 165         if err then return oops(err) end
 166
 167         local key
 168         local pos = 0
 169         local blockNo
 170         local blocks = {}
 171
 172         print('Reading card data')
 173
 174         -- main loop
 175         for blockNo = 0, numBlocks-1, 1 do
 176
 177                 if core.ukbhit() then
 178                         print("aborted by user")
 179                         break
 180                 end
 181
 182                 pos = (math.floor( blockNo / 4 ) * 12)+1
 183                 key = akeys:sub(pos, pos + 11 )
 184                 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
 185                 local err = core.SendCommand(cmd:getBytes())
 186                 if err then return oops(err) end
 187                 local blockdata, err = waitCmd()
 188                 if err then return oops(err) end
 189
 190                 if  blockNo%4 ~= 3 then
 191                         if blockNo < 8 then
 192                                 -- Block 0-7 not encrypted
 193                                 blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata)
 194                         else
 195                                 local base = ('%s%s%02d%s'):format(block0, block1, blockNo, hashconstant)
 196                                 local baseArr = utils.ConvertHexStringToBytes(base)
 197                                 local baseStr = utils.ConvertBytesToAsciiString(baseArr)
 198                                 local md5hash = md5.sumhexa(baseStr)
 199                                 local aestest = core.aes(md5hash, blockdata)
 200                                 --print(aestest, type(aestest))
 201                                 local hex = utils.ConvertAsciiStringToBytes(aestest)
 202                                 hex = utils.ConvertBytes2HexString(hex)
 203                                 --local _,hex = bin.unpack(("H%d"):format(16),aestest)
 204
 205                                 if string.find(blockdata, '^0+$') then
 206                                         blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata)
 207                                 else
 208                                         blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,hex)
 209                                 end
 210                         end
 211                 else
 212                         -- Sectorblocks, not encrypted
 213                         blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata)
 214                 end
 215         end
 216
 217         -- Print results
 218         local uid = block0:sub(1,8)
 219         local itemtype = block1:sub(1,4)
 220         local cardid = block1:sub(9,24)
 221         print( ('        UID : %s'):format(uid) )
 222         print( ('  ITEM TYPE : %s - %s'):format(itemtype, toyNames[itemtype]) )
 223         print( ('     CARDID : %s'):format(cardid ) )
 224         print('BLK :: Decrypted                        Ascii' )
 225         print( string.rep('--',36) )
 226         for _,s in pairs(blocks) do
 227                 local arr = utils.ConvertHexStringToBytes(s:sub(7,#s))
 228                 print( s, utils.ConvertBytesToAsciiString(arr) )
 229         end
 230 end
 231
 232 main(args)