git.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3.lua

   1 local cmds = require('commands')
   2 local getopt = require('getopt')
   3 local bin = require('bin')
   4 local lib14a = require('read14a')
   5 local utils = require('utils')
   6 local md5 = require('md5')
   7 local dumplib = require('html_dumplib')
   8 local toyNames = require('default_toys')
   9
  10 example =[[
  11         1. script run tnp3
  12         2. script run tnp3 -n
  13         3. script run tnp3 -k aabbccddeeff
  14         4. script run tnp3 -k aabbccddeeff -n
  15         5. script run tnp3 -o myfile
  16         6. script run tnp3 -n -o myfile
  17         7. script run tnp3 -k aabbccddeeff -n -o myfile
  18 ]]
  19 author = "Iceman"
  20 usage = "script run tnp3 -k <key> -n -o <filename>"
  21 desc =[[
  22 This script will try to dump the contents of a Mifare TNP3xxx card.
  23 It will need a valid KeyA in order to find the other keys and decode the card.
  24 Arguments:
  25         -h             : this help
  26         -k <key>       : Sector 0 Key A.
  27         -n             : Use the nested cmd to find all keys
  28         -o             : filename for the saved dumps
  29 ]]
  30
  31 local hashconstant = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
  32
  33 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
  34 local DEBUG = true -- the debug flag
  35 local numBlocks = 64
  36 local numSectors = 16
  37 ---
  38 -- A debug printout-function
  39 function dbg(args)
  40         if not DEBUG then
  41                 return
  42         end
  43
  44     if type(args) == "table" then
  45                 local i = 1
  46                 while result[i] do
  47                         dbg(result[i])
  48                         i = i+1
  49                 end
  50         else
  51                 print("###", args)
  52         end
  53 end
  54 ---
  55 -- This is only meant to be used when errors occur
  56 function oops(err)
  57         print("ERROR: ",err)
  58 end
  59 ---
  60 -- Usage help
  61 function help()
  62         print(desc)
  63         print("Example usage")
  64         print(example)
  65 end
  66 --
  67 -- Exit message
  68 function ExitMsg(msg)
  69         print( string.rep('--',20) )
  70         print( string.rep('--',20) )
  71         print(msg)
  72         print()
  73 end
  74
  75 local function readdumpkeys(infile)
  76          t = infile:read("*all")
  77          len = string.len(t)
  78          local len,hex = bin.unpack(("H%d"):format(len),t)
  79          return hex
  80 end
  81
  82 local function waitCmd()
  83         local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
  84         if response then
  85                 local count,cmd,arg0 = bin.unpack('LL',response)
  86                 if(arg0==1) then
  87                         local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
  88                         return data:sub(1,32)
  89                 else
  90                         return nil, "Couldn't read block.."
  91                 end
  92         end
  93         return nil, "No response from device"
  94 end
  95
  96 local function main(args)
  97
  98         print( string.rep('--',20) )
  99         print( string.rep('--',20) )
 100
 101         local keyA
 102         local cmd
 103         local err
 104         local useNested = false
 105         local cmdReadBlockString = 'hf mf rdbl %d A %s'
 106         local input = "dumpkeys.bin"
 107         local outputTemplate = os.date("toydump-%Y-%m-%d_%H%M%S");
 108
 109         -- Arguments for the script
 110         for o, a in getopt.getopt(args, 'hk:no:') do
 111                 if o == "h" then return help() end
 112                 if o == "k" then keyA = a end
 113                 if o == "n" then useNested = true end
 114                 if o == "o" then outputTemplate = a end
 115         end
 116
 117         -- validate input args.
 118         keyA =  keyA or '4b0b20107ccb'
 119         if #(keyA) ~= 12 then
 120                 return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
 121         end
 122
 123         -- Turn off Debug
 124         local cmdSetDbgOff = "hf mf dbg 0"
 125         core.console( cmdSetDbgOff)
 126
 127         result, err = lib14a.read1443a(false)
 128         if not result then
 129                 return oops(err)
 130         end
 131
 132         core.clearCommandBuffer()
 133
 134         if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
 135                 return oops('This is not a TNP3xxx tag. aborting.')
 136         end
 137
 138         -- Show tag info
 139         print((' Found tag : %s'):format(result.name))
 140         print(('Using keyA : %s'):format(keyA))
 141
 142         --Trying to find the other keys
 143         if useNested then
 144           core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
 145         end
 146
 147         -- Loading keyfile
 148         print('Loading dumpkeys.bin')
 149         local infile = io.open(input, "rb")
 150         if infile == nil then
 151                 return oops('Could not read file ', input)
 152         end
 153         local akeys = readdumpkeys(infile):sub(0,12*16)
 154
 155         -- Read block 0
 156         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0,arg2 = 0,arg3 = 0, data = keyA}
 157         err = core.SendCommand(cmd:getBytes())
 158         if err then return oops(err) end
 159         local block0, err = waitCmd()
 160         if err then return oops(err) end
 161
 162         -- Read block 1
 163         cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
 164         err = core.SendCommand(cmd:getBytes())
 165         if err then return oops(err) end
 166         local block1, err = waitCmd()
 167         if err then return oops(err) end
 168
 169         local key
 170         local pos = 0
 171         local blockNo
 172         local blocks = {}
 173
 174         print('Reading card data')
 175         core.clearCommandBuffer()
 176
 177         -- main loop
 178         for blockNo = 0, numBlocks-1, 1 do
 179
 180                 if core.ukbhit() then
 181                         print("aborted by user")
 182                         break
 183                 end
 184
 185                 pos = (math.floor( blockNo / 4 ) * 12)+1
 186                 key = akeys:sub(pos, pos + 11 )
 187                 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
 188                 local err = core.SendCommand(cmd:getBytes())
 189                 if err then return oops(err) end
 190                 local blockdata, err = waitCmd()
 191                 if err then return oops(err) end
 192
 193                 if  blockNo%4 ~= 3 then
 194                         if blockNo < 8 then
 195                                 -- Block 0-7 not encrypted
 196                                 blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata)
 197                         else
 198                                 local base = ('%s%s%02d%s'):format(block0, block1, blockNo, hashconstant)
 199                                 local baseArr = utils.ConvertHexStringToBytes(base)
 200                                 local baseStr = utils.ConvertBytesToAsciiString(baseArr)
 201                                 local md5hash = md5.sumhexa(baseStr)
 202                                 local aestest = core.aes(md5hash, blockdata)
 203
 204                                 local hex = utils.ConvertAsciiStringToBytes(aestest)
 205                                 hex = utils.ConvertBytes2HexString(hex)
 206                                 --local _,hex = bin.unpack(("H%d"):format(16),aestest)
 207
 208                                 if string.find(blockdata, '^0+$') then
 209                                         blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata)
 210                                 else
 211                                         blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,hex)
 212                                 end
 213                         end
 214                 else
 215                         -- Sectorblocks, not encrypted
 216                         blocks[blockNo+1] = ('%02d  :: %s%s'):format(blockNo,key,blockdata:sub(13,32))
 217                 end
 218         end
 219
 220         core.clearCommandBuffer()
 221
 222         -- Print results
 223         local bindata = {}
 224         local emldata = ''
 225
 226         for _,s in pairs(blocks) do
 227                 local slice = s:sub(7,#s)
 228                 local str = utils.ConvertBytesToAsciiString(
 229                                  utils.ConvertHexStringToBytes(slice)
 230                                 )
 231                 emldata = emldata..slice..'\n'
 232                 for c in (str):gmatch('.') do
 233                         bindata[#bindata+1] = c
 234                 end
 235         end
 236
 237         -- Write dump to files
 238         local foo = dumplib.SaveAsBinary(bindata, outputTemplate..'.bin')
 239         print(("Wrote a BIN dump to the file %s"):format(foo))
 240         local bar = dumplib.SaveAsText(emldata, outputTemplate..'.eml')
 241     print(("Wrote a EML dump to the file %s"):format(bar))
 242
 243         local uid = block0:sub(1,8)
 244         local itemtype = block1:sub(1,4)
 245         local cardid = block1:sub(9,24)
 246
 247         -- Show info
 248         print( string.rep('--',20) )
 249         print( (' ITEM TYPE : 0x%s - %s'):format(itemtype, toyNames[itemtype]) )
 250         print( ('       UID : 0x%s'):format(uid) )
 251         print( ('    CARDID : 0x%s'):format(cardid ) )
 252         print( string.rep('--',20) )
 253
 254 end
 255
 256 main(args)