Add EM410x bruteforcing error checks

[proxmark3-svn] / client / scripts / tnp3sim.lua

diff --git a/client/scripts/tnp3sim.lua b/client/scripts/tnp3sim.lua
index adc34cce1ca8e84ef54502e9c2ec5f04d5cfbe73..4e10eb75382ac8b4e05f54b2648fb2eb58dd409f 100644 (file)
--- a/client/scripts/tnp3sim.lua
+++ b/client/scripts/tnp3sim.lua
@@ -4,7 +4,7 @@ local bin = require('bin')
 local lib14a = require('read14a')
 local utils = require('utils')
 local md5 = require('md5')
 local lib14a = require('read14a')
 local utils = require('utils')
 local md5 = require('md5')

-local toyNames = require('default_toys')
+local toys = require('default_toys')

 
 example =[[
        1. script run tnp3sim
 
 example =[[
        1. script run tnp3sim


@@ -23,10 +23,33 @@ Arguments:
        -h             : this help
        -m             : Maxed out items (experimental)
        -i             : filename for the datadump to read (bin)
        -h             : this help
        -m             : Maxed out items (experimental)
        -i             : filename for the datadump to read (bin)

-]]
+
+       ]]

 
 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
 
 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds

-local DEBUG = true -- the debug flag
+local DEBUG = false -- the debug flag
+local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
+
+local band = bit32.band
+local bor = bit32.bor
+local lshift = bit32.lshift
+local rshift = bit32.rshift
+local byte = string.byte
+local char = string.char
+local sub = string.sub
+local format = string.format
+
+
+
+local band = bit32.band
+local bor = bit32.bor
+local lshift = bit32.lshift
+local rshift = bit32.rshift
+local byte = string.byte
+local char = string.char
+local sub = string.sub
+local format = string.format
+

 --- 
 -- A debug printout-function
 function dbg(args)
 --- 
 -- A debug printout-function
 function dbg(args)


@@ -65,7 +88,6 @@ function ExitMsg(msg)
        print()
 end
 
        print()
 end
 

-

 local function writedumpfile(infile)
         t = infile:read("*all")
         len = string.len(t)
 local function writedumpfile(infile)
         t = infile:read("*all")
         len = string.len(t)


@@ -187,9 +209,6 @@ local function ValidateCheckSums(blocks)
        io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 end
 
        io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 end
 

-
-local function LoadEmulator(blocks)
-       local HASHCONSTANT = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'

        local cmd
        local blockdata
        for _,b in pairs(blocks) do 
        local cmd
        local blockdata
        for _,b in pairs(blocks) do 


@@ -198,10 +217,10 @@ local function LoadEmulator(blocks)
                
                if  _%4 ~= 3 then
                        if (_ >= 8 and _<=21)  or  (_ >= 36 and _<=49) then
                
                if  _%4 ~= 3 then
                        if (_ >= 8 and _<=21)  or  (_ >= 36 and _<=49) then

-                               local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , HASHCONSTANT)      
+                               local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , RANDOM)    

                                local baseStr = utils.ConvertHexToAscii(base)
                                local key = md5.sumhexa(baseStr)
                                local baseStr = utils.ConvertHexToAscii(base)
                                local key = md5.sumhexa(baseStr)

-                               local enc = core.aes(key, blockdata)
+                               local enc = core.aes128_encrypt(key, blockdata)

                                local hex = utils.ConvertAsciiToBytes(enc)
                                hex = utils.ConvertBytesToHex(hex)
                        
                                local hex = utils.ConvertAsciiToBytes(enc)
                                hex = utils.ConvertBytesToHex(hex)
                        


@@ -219,6 +238,102 @@ local function LoadEmulator(blocks)
        io.write('\n')
 end
 
        io.write('\n')
 end
 

+local function Num2Card(m, l)
+
+       local k = {
+               0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,0x42, 0x43, 0x44, 0x46, 0x47, 0x48, 0x4A, 0x4B,
+               0x4C, 0x4D, 0x4E, 0x50, 0x51, 0x52, 0x53, 0x54,0x56, 0x57, 0x58, 0x59, 0x5A, 0x00
+       }
+       local msw = tonumber(utils.SwapEndiannessStr(m,32),16)
+       local lsw = tonumber(utils.SwapEndiannessStr(l,32),16)
+
+       if msw > 0x17ea1 then
+               return "too big"
+       end
+
+       if msw == 0x17ea1 and lsw > 0x8931fee8 then
+               return "out of range"
+       end
+
+       local s = ""
+       local index
+       for i = 1,10 do
+               index, msw, lsw = DivideByK( msw, lsw)
+               if ( index <= 1 ) then
+                       s = char(k[index]) .. s
+               else
+                       s = char(k[index-1]) .. s
+               end 
+               print (index-1, msw, lsw)
+       end
+    return s
+end
+--33LRT-LM9Q9
+--7, 122, 3474858630
+--20, 4, 1008436634
+--7, 0, 627182959
+--17, 0, 21626998
+--16, 0, 745758
+--23, 0, 25715
+--21, 0, 886
+--16, 0, 30
+--1, 0, 1
+--1, 0, 0
+
+function DivideByK(msw, lsw)
+
+       local lowLSW
+       local highLSW
+       local remainder = 0
+       local RADIX = 29
+
+       --local num = 0 | band( rshift(msw,16), 0xffff)
+       local num = band( rshift(msw, 16), 0xffff)
+ 
+       --highLSW = 0 | lshift( (num / RADIX) , 16)
+       highLSW = lshift( (num / RADIX) , 16)
+       remainder = num % RADIX
+
+       num =  bor( lshift(remainder,16), band(msw, 0xffff))
+
+       --highLSW |= num / RADIX
+       highLSW = highLSW or (num / RADIX)
+       remainder = num % RADIX
+
+       num =  bor( lshift(remainder,16), ( band(rshift(lsw,16), 0xffff)))
+
+       --lowLSW = 0 | (num / RADIX) << 16
+       lowLSW = 0 or (lshift( (num / RADIX), 16))
+       remainder = num % RADIX
+
+       num =  bor( lshift(remainder,16) , band(lsw, 0xffff) )
+
+       lowLSW = bor(lowLSW, (num / RADIX))
+       remainder = num % RADIX
+       return remainder, highLSW, lowLSW
+       
+                   -- uint num = 0 | (msw >> 16) & 0xffff;
+ 
+            -- highLSW = 0 | (num / RADIX) << 16;
+            -- remainder = num % RADIX;
+
+            -- num = (remainder << 16) | (msw & 0xffff);
+ 
+            -- highLSW |= num / RADIX;
+            -- remainder = num % RADIX;
+
+            -- num = (remainder << 16) | ((lsw >> 16) & 0xffff);
+
+            -- lowLSW = 0 | (num / RADIX) << 16;
+            -- remainder = num % RADIX;
+
+            -- num = (remainder << 16) | (lsw & 0xffff);
+
+            -- lowLSW |= num / RADIX;
+            -- remainder = num % RADIX;
+
+end
+

 local function main(args)
 
        print( string.rep('--',20) )
 local function main(args)
 
        print( string.rep('--',20) )


@@ -241,21 +356,6 @@ local function main(args)
        local cmdSetDbgOff = "hf mf dbg 0"
        core.console( cmdSetDbgOff) 
        
        local cmdSetDbgOff = "hf mf dbg 0"
        core.console( cmdSetDbgOff) 
        

-       -- if not loadFromDump then
-               -- -- Look for tag present on reader,
-               -- result, err = lib14a.read1443a(false)
-               -- if not result then return oops(err)  end
-
-               -- core.clearCommandBuffer()
-       
-               -- if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
-                       -- return oops('This is not a TNP3xxx tag. aborting.')
-               -- end  
-
-               -- -- Show tag info
-               -- print((' Found tag : %s'):format(result.name))
-       -- end
-       

        -- Load dump.bin file
        print( (' Load data from %s'):format(inputTemplate))
        hex, err = utils.ReadDumpFile(inputTemplate)
        -- Load dump.bin file
        print( (' Load data from %s'):format(inputTemplate))
        hex, err = utils.ReadDumpFile(inputTemplate)


@@ -269,7 +369,7 @@ local function main(args)
        end
 
        if DEBUG then
        end
 
        if DEBUG then

-               print('Validating checksums in the loaded datadump')
+               print(' Validating checksums')

                ValidateCheckSums(blocks)
        end
        
                ValidateCheckSums(blocks)
        end
        


@@ -277,22 +377,44 @@ local function main(args)
        print( string.rep('--',20) )    
        print(' Gathering info')
        local uid = blocks[0]:sub(1,8)
        print( string.rep('--',20) )    
        print(' Gathering info')
        local uid = blocks[0]:sub(1,8)

-       local itemtype = blocks[1]:sub(1,4)
-       local cardid = blocks[1]:sub(9,24)
+       local toytype = blocks[1]:sub(1,4)
+       local cardidLsw = blocks[1]:sub(9,16)
+       local cardidMsw = blocks[1]:sub(17,24)
+       local subtype  = blocks[1]:sub(25,28)

 
        -- Show info 
        print( string.rep('--',20) )
 
        -- Show info 
        print( string.rep('--',20) )

-       print( (' ITEM TYPE : 0x%s - %s'):format(itemtype, toyNames[itemtype]) )
+       
+       local item = toys.Find( toytype, subtype)
+       if item then
+               local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])
+               print(' ITEM TYPE : '..itemStr )
+       else
+               print( (' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype) )
+       end     
+       

        print( ('       UID : 0x%s'):format(uid) )
        print( ('       UID : 0x%s'):format(uid) )

-       print( ('    CARDID : 0x%s'):format(cardid ) )  
+       print( ('    CARDID : 0x%s %s [%s]'):format(
+                                                               cardidMsw,cardidLsw, 
+                                                               --Num2Card(cardidMsw, cardidLsw))
+                                                               '')
+                                                               )

        print( string.rep('--',20) )
 
        print( string.rep('--',20) )
 

-       -- lets do something.
-       -- 
+
+       -- Experience should be:        

        local experience = blocks[8]:sub(1,6)
        local experience = blocks[8]:sub(1,6)

-       print(('Experience  : %d'):format(utils.SwapEndianness(experience,24)))
+       print(('Experience  : %d'):format(utils.SwapEndianness(experience,16)))
+       

        local money = blocks[8]:sub(7,10)
        print(('Money       : %d'):format(utils.SwapEndianness(money,16)))
        local money = blocks[8]:sub(7,10)
        print(('Money       : %d'):format(utils.SwapEndianness(money,16)))

+
+       -- 
+       
+       -- Sequence number
+       local seqnum = blocks[8]:sub(18,19)
+       print(('Sequence number : %d'):format( tonumber(seqnum,16)))
+       

        local fairy = blocks[9]:sub(1,8)
        --FD0F = Left, FF0F = Right
        local path = 'not choosen'
        local fairy = blocks[9]:sub(1,8)
        --FD0F = Left, FF0F = Right
        local path = 'not choosen'


@@ -305,6 +427,12 @@ local function main(args)
        
        local hat = blocks[9]:sub(8,11)
        print(('Hat         : %d'):format(utils.SwapEndianness(hat,16)))
        
        local hat = blocks[9]:sub(8,11)
        print(('Hat         : %d'):format(utils.SwapEndianness(hat,16)))

+
+       local level = blocks[13]:sub(27,28)
+       print(('LEVEL : %d'):format( tonumber(level,16)))
+       --hälsa: 667 029b  
+       --local health = blocks[]:sub();
+       --print(('Health : %d'):format( tonumber(health,16))

        
        --0x0D    0x29    0x0A    0x02    16-bit hero points value. Maximum 100.
        local heropoints = blocks[13]:sub(20,23)
        
        --0x0D    0x29    0x0A    0x02    16-bit hero points value. Maximum 100.
        local heropoints = blocks[13]:sub(20,23)


@@ -314,6 +442,11 @@ local function main(args)
        local challenges = blocks[16]:sub(25,32)
        print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32)))
        
        local challenges = blocks[16]:sub(25,32)
        print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32)))
        

+       -- Character Name
+       local name1 = blocks[10]:sub(1,32)
+       local name2 = blocks[12]:sub(1,32)
+       print('Custom name : '..utils.ConvertHexToAscii(name1..name2))
+       

        if maxed then
                print('Lets try to max out some values')
                -- max out money, experience
        if maxed then
                print('Lets try to max out some values')
                -- max out money, experience


@@ -351,7 +484,7 @@ local function main(args)
                err = LoadEmulator(blocks)
                if err then return oops(err) end        
                core.clearCommandBuffer()
                err = LoadEmulator(blocks)
                if err then return oops(err) end        
                core.clearCommandBuffer()

-               print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..' x\" <--')
+               print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..'\" <--')

        end
 end
 main(args)
\ No newline at end of file
        end
 end
 main(args)
\ No newline at end of file