]> git.zerfleddert.de Git - proxmark3-svn/blame - client/scripts/tnp3clone.lua
ADD: another default key: VIGIK1
[proxmark3-svn] / client / scripts / tnp3clone.lua
CommitLineData
40762506 1local cmds = require('commands')
2local getopt = require('getopt')
3local lib14a = require('read14a')
4local utils = require('utils')
5local pre = require('precalc')
cff17e78 6local toys = require('default_toys')
40762506 7
8local lsh = bit32.lshift
9local rsh = bit32.rshift
10local bor = bit32.bor
11local band = bit32.band
12
13example =[[
c3fe354b 14 script run tnp3clone
15 script run tnp3clone -h
16 script run tnp3clone -t aa00 -s 0030
40762506 17
18]]
19author = "Iceman"
c3fe354b 20usage = "script run tnp3clone -t <toytype> -s <subtype>"
40762506 21desc =[[
22This script will try making a barebone clone of a tnp3 tag on to a magic generation1 card.
23
24Arguments:
25 -h : this help
c3fe354b 26 -t <data> : toytype id, 4hex symbols.
27 -s <data> : subtype id, 4hex symbols
26b8f38b 28
29 For fun, try the following subtype id:
30 0612 - Lightcore
31 0118 - Series 1
32 0138 - Series 2
33 0234 - Special
34 023c - Special
bb84c381 35 0020 - Swapforce
40762506 36]]
37
38
39-- This is only meant to be used when errors occur
40function oops(err)
41 print("ERROR: ",err)
42end
43-- Usage help
44function help()
45 print(desc)
46 print("Example usage")
47 print(example)
48end
49
50local function waitCmd()
51 local response = core.WaitForResponseTimeout(cmds.CMD_ACK,2000)
52 if response then
53 local count,cmd,arg0 = bin.unpack('LL',response)
54 if(arg0==1) then
55 local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
56 return data:sub(1,32)
57 else
58 return nil, "Couldn't read block."
59 end
60 end
61 return nil, "No response from device"
62end
63
7b47fa9b 64local function readblock( blocknum, keyA )
40762506 65 -- Read block 0
7b47fa9b 66 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blocknum, arg2 = 0, arg3 = 0, data = keyA}
40762506 67 err = core.SendCommand(cmd:getBytes())
7b47fa9b 68 if err then return nil, err end
40762506 69 local block0, err = waitCmd()
7b47fa9b 70 if err then return nil, err end
71 return block0
72end
73local function readmagicblock( blocknum )
74 -- Read block 0
75 local CSETBLOCK_SINGLE_OPERATION = 0x1F
76 cmd = Command:new{cmd = cmds.CMD_MIFARE_CGETBLOCK, arg1 = CSETBLOCK_SINGLE_OPERATION, arg2 = 0, arg3 = blocknum}
77 err = core.SendCommand(cmd:getBytes())
78 if err then return nil, err end
79 local block0, err = waitCmd()
80 if err then return nil, err end
40762506 81 return block0
82end
83
84local function main(args)
85
c3fe354b 86 print( string.rep('--',20) )
87 print( string.rep('--',20) )
88
40762506 89 local numBlocks = 64
7b47fa9b 90 local cset = 'hf mf csetbl '
c3fe354b 91 local csetuid = 'hf mf csetuid '
7b47fa9b 92 local cget = 'hf mf cgetbl '
40762506 93 local empty = '00000000000000000000000000000000'
94 local AccAndKeyB = '7F078869000000000000'
95 -- Defaults to Gusto
96 local toytype = 'C201'
c3fe354b 97 local subtype = '0030'
98 local DEBUG = true
40762506 99
100 -- Arguments for the script
c3fe354b 101 for o, a in getopt.getopt(args, 'ht:s:') do
40762506 102 if o == "h" then return help() end
103 if o == "t" then toytype = a end
c3fe354b 104 if o == "s" then subtype = a end
40762506 105 end
106
c3fe354b 107 if #toytype ~= 4 then return oops('Wrong size - toytype. (4hex symbols)') end
108 if #subtype ~= 4 then return oops('Wrong size - subtype. (4hex symbols)') end
109
110 -- look up type, find & validate types
111 local item = toys.Find( toytype, subtype)
112 if item then
113 print( (' Looking up input: Found %s - %s (%s)'):format(item[6],item[5], item[4]) )
114 else
115 print('Didn\'t find item type. If you are sure about it, report it in')
116 end
117 --15,16
118 --13-14
119
40762506 120
121 -- find tag
122 result, err = lib14a.read1443a(false)
123 if not result then return oops(err) end
124
40762506 125 -- load keys
126 local akeys = pre.GetAll(result.uid)
127 local keyA = akeys:sub(1, 12 )
128
7b47fa9b 129 local b0 = readblock(0,keyA)
130 if not b0 then
131 print('failed reading block with factorydefault key. Trying chinese magic read.')
132 b0, err = readmagicblock(0)
133 if not b0 then
134 oops(err)
135 return oops('failed reading block with chinese magic command. quitting...')
136 end
137 end
40762506 138
6c81ae55 139 -- wipe card.
c3fe354b 140 local cmd = (csetuid..'%s 0004 08 w'):format(result.uid)
6c81ae55 141 core.console(cmd)
6c81ae55 142
c3fe354b 143 local b1 = toytype..'00000000000000000000'..subtype
40762506 144 local calc = utils.Crc16(b0..b1)
145 local calcEndian = bor(rsh(calc,8), lsh(band(calc, 0xff), 8))
146
7b47fa9b 147 local cmd = (cset..'1 %s%04x'):format( b1, calcEndian)
6c81ae55 148 core.console(cmd)
40762506 149
150 local pos, key
151 for blockNo = 2, numBlocks-1, 1 do
152 pos = (math.floor( blockNo / 4 ) * 12)+1
153 key = akeys:sub(pos, pos + 11 )
6c81ae55 154 if blockNo%4 == 3 then
40762506 155 cmd = ('%s %d %s%s'):format(cset,blockNo,key,AccAndKeyB)
6c81ae55 156 core.console(cmd)
157 end
40762506 158 end
6c81ae55 159 core.clearCommandBuffer()
40762506 160end
161main(args)
Impressum, Datenschutz