]> git.zerfleddert.de Git - proxmark3-svn/blame - client/scripts/didump.lua
chg: @piwi's code cleanup and some more.
[proxmark3-svn] / client / scripts / didump.lua
CommitLineData
7142c87e 1local cmds = require('commands')
2local getopt = require('getopt')
3local utils = require('utils')
4local lib14a = require('read14a')
5
6example =[[
7 script run didump
8 script run didump -k aabbccddeeff
9]]
10author = "Iceman"
11usage = "script run didump -k <key> "
12desc = [[
13This is a script to dump and decrypt the data of a specific type of Mifare Mini token.
14
15Arguments:
16 -h : this help
af3b8b2d 17 -t : selftest
7142c87e 18 -k <key> : Mifare Key A.
19]]
20
21local band=bit32.band
22local bor=bit32.bor
23local bnot=bit32.bnot
24local bxor=bit32.bxor
25local lshift=bit32.lshift
26local rshift=bit32.rshift
27
28local FOO = 'AF62D2EC0491968CC52A1A7165F865FE'
29local BAR = '286329204469736E65792032303133'
30local RANDOM = FOO..BAR
31local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M%S");
32local TIMEOUT = 2000
33local DEBUG = false
34local numBlocks = 20
35local numSectors = 5
36local CHECKSUM_OFFSET = 12; -- +1???
37---
38-- A debug printout-function
39function dbg(args)
40 if DEBUG then
41 print("###", args)
42 end
43end
44---
45-- This is only meant to be used when errors occur
46function oops(err)
47 print("ERROR: ",err)
48 core.clearCommandBuffer()
49end
50---
51-- Usage help
52function help()
53 print(desc)
54 print("Example usage")
55 print(example)
56end
57---
58-- Get checksum,
59-- called: data is string (32 hex digits)
60-- returns: number
61local function getChecksum(data)
62 local chksum = data:sub(25,32)
63 return tonumber(chksum,16)
64end
65---
66-- calculate checksum
67-- called: data is bytes (24 hex digits)
68-- returns: number
69local function calculateChecksum(data)
70
71 -- Generate table
72 local _tbl = {}
73_tbl[0] = { 0x0 }
74_tbl[1] = { 0x77073096 }
75_tbl[2] = { 0xEE0E612C }
76_tbl[3] = { 0x990951BA }
77_tbl[4] = { 0x76DC419 }
78_tbl[5] = { 0x706AF48F }
79_tbl[6] = { 0xE963A535 }
80_tbl[7] = { 0x9E6495A3 }
81_tbl[8] = { 0xEDB8832 }
82_tbl[9] = { 0x79DCB8A4 }
83_tbl[10] = { 0xE0D5E91E }
84_tbl[11] = { 0x97D2D988 }
85_tbl[12] = { 0x9B64C2B }
86_tbl[13] = { 0x7EB17CBD }
87_tbl[14] = { 0xE7B82D07 }
88_tbl[15] = { 0x90BF1D91 }
89_tbl[16] = { 0x1DB71064 }
90_tbl[17] = { 0x6AB020F2 }
91_tbl[18] = { 0xF3B97148 }
92_tbl[19] = { 0x84BE41DE }
93_tbl[20] = { 0x1ADAD47D }
94_tbl[21] = { 0x6DDDE4EB }
95_tbl[22] = { 0xF4D4B551 }
96_tbl[23] = { 0x83D385C7 }
97_tbl[24] = { 0x136C9856 }
98_tbl[25] = { 0x646BA8C0 }
99_tbl[26] = { 0xFD62F97A }
100_tbl[27] = { 0x8A65C9EC }
101_tbl[28] = { 0x14015C4F }
102_tbl[29] = { 0x63066CD9 }
103_tbl[30] = { 0xFA0F3D63 }
104_tbl[31] = { 0x8D080DF5 }
105_tbl[32] = { 0x3B6E20C8 }
106_tbl[33] = { 0x4C69105E }
107_tbl[34] = { 0xD56041E4 }
108_tbl[35] = { 0xA2677172 }
109_tbl[36] = { 0x3C03E4D1 }
110_tbl[37] = { 0x4B04D447 }
111_tbl[38] = { 0xD20D85FD }
112_tbl[39] = { 0xA50AB56B }
113_tbl[40] = { 0x35B5A8FA }
114_tbl[41] = { 0x42B2986C }
115_tbl[42] = { 0xDBBBC9D6 }
116_tbl[43] = { 0xACBCF940 }
117_tbl[44] = { 0x32D86CE3 }
118_tbl[45] = { 0x45DF5C75 }
119_tbl[46] = { 0xDCD60DCF }
120_tbl[47] = { 0xABD13D59 }
121_tbl[48] = { 0x26D930AC }
122_tbl[49] = { 0x51DE003A }
123_tbl[50] = { 0xC8D75180 }
124_tbl[51] = { 0xBFD06116 }
125_tbl[52] = { 0x21B4F4B5 }
126_tbl[53] = { 0x56B3C423 }
127_tbl[54] = { 0xCFBA9599 }
128_tbl[55] = { 0xB8BDA50F }
129_tbl[56] = { 0x2802B89E }
130_tbl[57] = { 0x5F058808 }
131_tbl[58] = { 0xC60CD9B2 }
132_tbl[59] = { 0xB10BE924 }
133_tbl[60] = { 0x2F6F7C87 }
134_tbl[61] = { 0x58684C11 }
135_tbl[62] = { 0xC1611DAB }
136_tbl[63] = { 0xB6662D3D }
137_tbl[64] = { 0x76DC4190 }
138_tbl[65] = { 0x1DB7106 }
139_tbl[66] = { 0x98D220BC }
140_tbl[67] = { 0xEFD5102A }
141_tbl[68] = { 0x71B18589 }
142_tbl[69] = { 0x6B6B51F }
143_tbl[70] = { 0x9FBFE4A5 }
144_tbl[71] = { 0xE8B8D433 }
145_tbl[72] = { 0x7807C9A2 }
146_tbl[73] = { 0xF00F934 }
147_tbl[74] = { 0x9609A88E }
148_tbl[75] = { 0xE10E9818 }
149_tbl[76] = { 0x7F6A0DBB }
150_tbl[77] = { 0x86D3D2D }
151_tbl[78] = { 0x91646C97 }
152_tbl[79] = { 0xE6635C01 }
153_tbl[80] = { 0x6B6B51F4 }
154_tbl[81] = { 0x1C6C6162 }
155_tbl[82] = { 0x856530D8 }
156_tbl[83] = { 0xF262004E }
157_tbl[84] = { 0x6C0695ED }
158_tbl[85] = { 0x1B01A57B }
159_tbl[86] = { 0x8208F4C1 }
160_tbl[87] = { 0xF50FC457 }
161_tbl[88] = { 0x65B0D9C6 }
162_tbl[89] = { 0x12B7E950 }
163_tbl[90] = { 0x8BBEB8EA }
164_tbl[91] = { 0xFCB9887C }
165_tbl[92] = { 0x62DD1DDF }
166_tbl[93] = { 0x15DA2D49 }
167_tbl[94] = { 0x8CD37CF3 }
168_tbl[95] = { 0xFBD44C65 }
169_tbl[96] = { 0x4DB26158 }
170_tbl[97] = { 0x3AB551CE }
171_tbl[98] = { 0xA3BC0074 }
172_tbl[99] = { 0xD4BB30E2 }
173_tbl[100] = { 0x4ADFA541 }
174_tbl[101] = { 0x3DD895D7 }
175_tbl[102] = { 0xA4D1C46D }
176_tbl[103] = { 0xD3D6F4FB }
177_tbl[104] = { 0x4369E96A }
178_tbl[105] = { 0x346ED9FC }
179_tbl[106] = { 0xAD678846 }
180_tbl[107] = { 0xDA60B8D0 }
181_tbl[108] = { 0x44042D73 }
182_tbl[109] = { 0x33031DE5 }
183_tbl[110] = { 0xAA0A4C5F }
184_tbl[111] = { 0xDD0D7CC9 }
185_tbl[112] = { 0x5005713C }
186_tbl[113] = { 0x270241AA }
187_tbl[114] = { 0xBE0B1010 }
188_tbl[115] = { 0xC90C2086 }
189_tbl[116] = { 0x5768B525 }
190_tbl[117] = { 0x206F85B3 }
191_tbl[118] = { 0xB966D409 }
192_tbl[119] = { 0xCE61E49F }
193_tbl[120] = { 0x5EDEF90E }
194_tbl[121] = { 0x29D9C998 }
195_tbl[122] = { 0xB0D09822 }
196_tbl[123] = { 0xC7D7A8B4 }
197_tbl[124] = { 0x59B33D17 }
198_tbl[125] = { 0x2EB40D81 }
199_tbl[126] = { 0xB7BD5C3B }
200_tbl[127] = { 0xC0BA6CAD }
201_tbl[128] = { 0xEDB88320 }
202_tbl[129] = { 0x9ABFB3B6 }
203_tbl[130] = { 0x3B6E20C }
204_tbl[131] = { 0x74B1D29A }
205_tbl[132] = { 0xEAD54739 }
206_tbl[133] = { 0x9DD277AF }
207_tbl[134] = { 0x4DB2615 }
208_tbl[135] = { 0x73DC1683 }
209_tbl[136] = { 0xE3630B12 }
210_tbl[137] = { 0x94643B84 }
211_tbl[138] = { 0xD6D6A3E }
212_tbl[139] = { 0x7A6A5AA8 }
213_tbl[140] = { 0xE40ECF0B }
214_tbl[141] = { 0x9309FF9D }
215_tbl[142] = { 0xA00AE27 }
216_tbl[143] = { 0x7D079EB1 }
217_tbl[144] = { 0xF00F9344 }
218_tbl[145] = { 0x8708A3D2 }
219_tbl[146] = { 0x1E01F268 }
220_tbl[147] = { 0x6906C2FE }
221_tbl[148] = { 0xF762575D }
222_tbl[149] = { 0x806567CB }
223_tbl[150] = { 0x196C3671 }
224_tbl[151] = { 0x6E6B06E7 }
225_tbl[152] = { 0xFED41B76 }
226_tbl[153] = { 0x89D32BE0 }
227_tbl[154] = { 0x10DA7A5A }
228_tbl[155] = { 0x67DD4ACC }
229_tbl[156] = { 0xF9B9DF6F }
230_tbl[157] = { 0x8EBEEFF9 }
231_tbl[158] = { 0x17B7BE43 }
232_tbl[159] = { 0x60B08ED5 }
233_tbl[160] = { 0xD6D6A3E8 }
234_tbl[161] = { 0xA1D1937E }
235_tbl[162] = { 0x38D8C2C4 }
236_tbl[163] = { 0x4FDFF252 }
237_tbl[164] = { 0xD1BB67F1 }
238_tbl[165] = { 0xA6BC5767 }
239_tbl[166] = { 0x3FB506DD }
240_tbl[167] = { 0x48B2364B }
241_tbl[168] = { 0xD80D2BDA }
242_tbl[169] = { 0xAF0A1B4C }
243_tbl[170] = { 0x36034AF6 }
244_tbl[171] = { 0x41047A60 }
245_tbl[172] = { 0xDF60EFC3 }
246_tbl[173] = { 0xA867DF55 }
247_tbl[174] = { 0x316E8EEF }
248_tbl[175] = { 0x4669BE79 }
249_tbl[176] = { 0xCB61B38C }
250_tbl[177] = { 0xBC66831A }
251_tbl[178] = { 0x256FD2A0 }
252_tbl[179] = { 0x5268E236 }
253_tbl[180] = { 0xCC0C7795 }
254_tbl[181] = { 0xBB0B4703 }
255_tbl[182] = { 0x220216B9 }
256_tbl[183] = { 0x5505262F }
257_tbl[184] = { 0xC5BA3BBE }
258_tbl[185] = { 0xB2BD0B28 }
259_tbl[186] = { 0x2BB45A92 }
260_tbl[187] = { 0x5CB36A04 }
261_tbl[188] = { 0xC2D7FFA7 }
262_tbl[189] = { 0xB5D0CF31 }
263_tbl[190] = { 0x2CD99E8B }
264_tbl[191] = { 0x5BDEAE1D }
265_tbl[192] = { 0x9B64C2B0 }
266_tbl[193] = { 0xEC63F226 }
267_tbl[194] = { 0x756AA39C }
268_tbl[195] = { 0x26D930A }
269_tbl[196] = { 0x9C0906A9 }
270_tbl[197] = { 0xEB0E363F }
271_tbl[198] = { 0x72076785 }
272_tbl[199] = { 0x5005713 }
273_tbl[200] = { 0x95BF4A82 }
274_tbl[201] = { 0xE2B87A14 }
275_tbl[202] = { 0x7BB12BAE }
276_tbl[203] = { 0xCB61B38 }
277_tbl[204] = { 0x92D28E9B }
278_tbl[205] = { 0xE5D5BE0D }
279_tbl[206] = { 0x7CDCEFB7 }
280_tbl[207] = { 0xBDBDF21 }
281_tbl[208] = { 0x86D3D2D4 }
282_tbl[209] = { 0xF1D4E242 }
283_tbl[210] = { 0x68DDB3F8 }
284_tbl[211] = { 0x1FDA836E }
285_tbl[212] = { 0x81BE16CD }
286_tbl[213] = { 0xF6B9265B }
287_tbl[214] = { 0x6FB077E1 }
288_tbl[215] = { 0x18B74777 }
289_tbl[216] = { 0x88085AE6 }
290_tbl[217] = { 0xFF0F6A70 }
291_tbl[218] = { 0x66063BCA }
292_tbl[219] = { 0x11010B5C }
293_tbl[220] = { 0x8F659EFF }
294_tbl[221] = { 0xF862AE69 }
295_tbl[222] = { 0x616BFFD3 }
296_tbl[223] = { 0x166CCF45 }
297_tbl[224] = { 0xA00AE278 }
298_tbl[225] = { 0xD70DD2EE }
299_tbl[226] = { 0x4E048354 }
300_tbl[227] = { 0x3903B3C2 }
301_tbl[228] = { 0xA7672661 }
302_tbl[229] = { 0xD06016F7 }
303_tbl[230] = { 0x4969474D }
304_tbl[231] = { 0x3E6E77DB }
305_tbl[232] = { 0xAED16A4A }
306_tbl[233] = { 0xD9D65ADC }
307_tbl[234] = { 0x40DF0B66 }
308_tbl[235] = { 0x37D83BF0 }
309_tbl[236] = { 0xA9BCAE53 }
310_tbl[237] = { 0xDEBB9EC5 }
311_tbl[238] = { 0x47B2CF7F }
312_tbl[239] = { 0x30B5FFE9 }
313_tbl[240] = { 0xBDBDF21C }
314_tbl[241] = { 0xCABAC28A }
315_tbl[242] = { 0x53B39330 }
316_tbl[243] = { 0x24B4A3A6 }
317_tbl[244] = { 0xBAD03605 }
318_tbl[245] = { 0xCDD70693 }
319_tbl[246] = { 0x54DE5729 }
320_tbl[247] = { 0x23D967BF }
321_tbl[248] = { 0xB3667A2E }
322_tbl[249] = { 0xC4614AB8 }
323_tbl[250] = { 0x5D681B02 }
324_tbl[251] = { 0x2A6F2B94 }
325_tbl[252] = { 0xB40BBE37 }
326_tbl[253] = { 0xC30C8EA1 }
327_tbl[254] = { 0x5A05DF1B }
328_tbl[255] = { 0x2D02EF8D }
329
330
331 -- Calculate it
332 local ret = 0
333 for i,item in pairs(data) do
334 local tmp = band(ret, 0xFF)
335 local index = band( bxor(tmp, item), 0xFF)
336 ret = bxor(rshift(ret,8), _tbl[index][1])
337 end
338 return ret
339end
340---
341-- update checksum
342-- called: data is string, ( >= 24 hex digits )
343-- returns: string, (data concat new checksum)
344local function updateChecksum(data)
345 local part = data:sub(1,24)
346 local chksum = calculateChecksum( utils.ConvertHexToBytes(part))
347 return string.format("%s%X", part, chksum)
348end
349---
350-- receives the answer from deviceside, used with a readblock command
351local function waitCmd()
352 local response = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
353 if response then
354 local count,cmd,arg0 = bin.unpack('LL',response)
355 if(arg0==1) then
356 local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
357 return data:sub(1,32)
358 else
359 return nil, "Couldn't read block.."
360 end
361 end
362 return nil, "No response from device"
363end
364
365local function selftest()
366 local testdata = '000F42430D0A14000001D11F'..'5D738517'
367 local chksum = getChecksum(testdata)
af3b8b2d 368 local calc = calculateChecksum( utils.ConvertHexToBytes(testdata:sub(1,24)))
369 local isValid = false
370 local validStr = "FAIL"
371 if calc == chksum then
372 isValid = true
373 validStr = "OK"
374 end
375 local newtestdata = updateChecksum(testdata)
376 local revalidated = "FAIL"
377 if newtestdata == testdata then
378 revalidated = "OK"
379 end
380 print ('TESTDATA :: '..testdata)
381 print ('DATA :: '..testdata:sub(1,24))
382 print (('VALID CHKSUM :: %s'):format(validStr ))
383 print (('UPDATE CHKSUM :: %s'):format(revalidated))
7142c87e 384end
385---
386-- The main entry point
387-- -d decrypt
388-- -e encrypt
389-- -v validate
390function main(args)
391
392 local cmd, result, err, blockNo, keyA
393 local blocks = {}
af3b8b2d 394 local magic = ''
7142c87e 395
396 -- Read the parameters
af3b8b2d 397 for o, a in getopt.getopt(args, 'hk:t') do
7142c87e 398 if o == "h" then help() return end
399 if o == "k" then keyA = a end
af3b8b2d 400 if o == "t" then return selftest() end
7142c87e 401 end
402
7142c87e 403 -- validate input args.
404 keyA = keyA or '6dd747e86975'
405 if #(keyA) ~= 12 then
406 return oops( string.format('Wrong length of write key (was %d) expected 12', #keyA))
407 end
408
409 -- Turn off Debug
410 local cmdSetDbgOff = "hf mf dbg 0"
411 core.console( cmdSetDbgOff)
412
413 -- GET TAG UID
414
415 result, err = lib14a.read1443a(false)
416 if not result then
417 return oops(err)
418 end
7142c87e 419 core.clearCommandBuffer()
7142c87e 420
421 -- Show tag info
422 print((' Found tag %s'):format(result.name))
423
424 local longrandom = RANDOM..result.uid
425 local res = utils.Sha1Hex(longrandom)
426 res = utils.ConvertBytesToHex(utils.ConvertAsciiToBytes(res:sub(1,16)))
af3b8b2d 427 magic = utils.SwapEndiannessStr(res:sub(1,8) , 32)
428 magic = magic..utils.SwapEndiannessStr( res:sub(9,16),32)
429 magic = magic..utils.SwapEndiannessStr( res:sub(17,24),32)
430 magic = magic..utils.SwapEndiannessStr( res:sub(25,32),32)
7142c87e 431 print('Reading card data')
432 print('Raw','Decrypted')
433 for blockNo = 0, numBlocks-1, 1 do
434
435 if core.ukbhit() then
436 print("aborted by user")
437 break
438 end
439
440 cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = keyA}
441 local err = core.SendCommand(cmd:getBytes())
442 if err then return oops(err) end
443 local blockdata, err = waitCmd()
444 if err then return oops(err) end
445
446 if blockNo%4 ~= 3 then
447
448 -- blocks with zero not encrypted.
449 if string.find(blockdata, '^0+$') then
450 print(blockdata, blockdata)
451 else
af3b8b2d 452 local aes = core.aes128_decrypt_ecb(magic, blockdata)
7142c87e 453 local bytes = utils.ConvertAsciiToBytes(aes)
454 local hex = utils.ConvertBytesToHex(bytes)
455 print(blockdata , hex)
456 end
457 elseif blockNo == 0 then
458 print(blockdata,blockdata)
459 else
460 -- Sectorblocks, not encrypted
461 local sectortrailer = keyA..blockdata:sub(13,20)..keyA
462 print(sectortrailer, sectortrailer, blockdata:sub(13,20))
463 end
464 end
7142c87e 465end
466
467main(args)
Impressum, Datenschutz