git.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3sim.lua

   1 local cmds = require('commands')
   2 local getopt = require('getopt')
   3 local bin = require('bin')
   4 local lib14a = require('read14a')
   5 local utils = require('utils')
   6 local md5 = require('md5')
   7 local toyNames = require('default_toys')
   8
   9 example =[[
  10         1. script run tnp3sim
  11         2. script run tnp3sim -m
  12         3. script run tnp3sim -m -i myfile
  13 ]]
  14 author = "Iceman"
  15 usage = "script run tnp3sim -h -m -i <filename>"
  16 desc =[[
  17 This script will try to load a binary datadump of a Mifare TNP3xxx card.
  18 It vill try to validate all checksums and view some information stored in the dump
  19 For an experimental mode, it tries to manipulate some data.
  20 At last it sends all data to the PM3 device memory where it can be used in the command  "hf mf sim"
  21
  22 Arguments:
  23         -h             : this help
  24         -m             : Maxed out items (experimental)
  25         -i             : filename for the datadump to read (bin)
  26 ]]
  27
  28 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
  29 local DEBUG = true -- the debug flag
  30 ---
  31 -- A debug printout-function
  32 function dbg(args)
  33         if not DEBUG then
  34                 return
  35         end
  36
  37     if type(args) == "table" then
  38                 local i = 1
  39                 while result[i] do
  40                         dbg(result[i])
  41                         i = i+1
  42                 end
  43         else
  44                 print("###", args)
  45         end
  46 end
  47 ---
  48 -- This is only meant to be used when errors occur
  49 function oops(err)
  50         print("ERROR: ",err)
  51 end
  52 ---
  53 -- Usage help
  54 function help()
  55         print(desc)
  56         print("Example usage")
  57         print(example)
  58 end
  59 --
  60 -- Exit message
  61 function ExitMsg(msg)
  62         print( string.rep('--',20) )
  63         print( string.rep('--',20) )
  64         print(msg)
  65         print()
  66 end
  67
  68
  69 local function writedumpfile(infile)
  70          t = infile:read("*all")
  71          len = string.len(t)
  72          local len,hex = bin.unpack(("H%d"):format(len),t)
  73          return hex
  74 end
  75 -- blocks with data
  76 -- there are two dataareas, in block 8 or block 36,   ( 1==8 ,
  77 -- checksum type =  0, 1, 2, 3
  78 local function GetCheckSum(blocks, dataarea, chksumtype)
  79
  80         local crc
  81         local area = 36
  82         if  dataarea == 1 then
  83                 area = 8
  84         end
  85
  86         if chksumtype == 0 then
  87                 crc = blocks[1]:sub(29,32)
  88         elseif chksumtype == 1 then
  89                 crc = blocks[area]:sub(29,32)
  90         elseif chksumtype == 2 then
  91                 crc = blocks[area]:sub(25,28)
  92         elseif chksumtype == 3 then
  93                 crc = blocks[area]:sub(21,24)
  94         end
  95         return utils.SwapEndianness(crc,16)
  96 end
  97
  98 local function SetCheckSum(blocks, chksumtype)
  99
 100         if blocks == nil then return nil, 'Argument \"blocks\" nil' end
 101         local newcrc
 102         local area1 = 8
 103         local area2 = 36
 104
 105         if chksumtype == 0 then
 106                 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,0))
 107                 blocks[1] = blocks[1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
 108         elseif chksumtype == 1 then
 109                 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,1))
 110                 blocks[area1] = blocks[area1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
 111                 newcrc = ('%04X'):format(CalcCheckSum(blocks,2,1))
 112                 blocks[area2] = blocks[area2]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)
 113         elseif chksumtype == 2 then
 114                 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,2))
 115                 blocks[area1] = blocks[area1]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(29,32)
 116                 newcrc = ('%04X'):format(CalcCheckSum(blocks,2,2))
 117                 blocks[area2] = blocks[area2]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(29,32)
 118         elseif chksumtype == 3 then
 119                 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,3))
 120                 blocks[area1] = blocks[area1]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(25,32)
 121                 newcrc = ('%04X'):format(CalcCheckSum(blocks,2,3))
 122                 blocks[area2] = blocks[area2]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(25,32)
 123         end
 124 end
 125
 126 function CalcCheckSum(blocks, dataarea, chksumtype)
 127         local area = 36
 128         if dataarea == 1 then
 129                 area = 8
 130         end
 131
 132         if chksumtype == 0 then
 133                 data = blocks[0]..blocks[1]:sub(1,28)
 134         elseif chksumtype == 1 then
 135                 data = blocks[area]:sub(1,28)..'0500'
 136         elseif chksumtype == 2 then
 137                 data =  blocks[area+1]..blocks[area+2]..blocks[area+4]
 138         elseif chksumtype == 3 then
 139                 data =  blocks[area+5]..blocks[area+6]..blocks[area+8]..string.rep('00',0xe0)
 140         end
 141         return utils.Crc16(data)
 142 end
 143
 144 local function ValidateCheckSums(blocks)
 145
 146         local isOk, crc, calc
 147         -- Checksum Type 0
 148         crc = GetCheckSum(blocks,1,0)
 149         calc = CalcCheckSum(blocks, 1, 0)
 150         if crc == calc then isOk='Ok' else isOk = 'Error' end
 151         io.write( ('TYPE 0       : %04x = %04x -- %s\n'):format(crc,calc,isOk))
 152
 153         -- Checksum Type 1 (DATAAREAHEADER 1)
 154         crc = GetCheckSum(blocks,1,1)
 155         calc = CalcCheckSum(blocks,1,1)
 156         if crc == calc then isOk='Ok' else isOk = 'Error' end
 157         io.write( ('TYPE 1 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 158
 159         -- Checksum Type 1 (DATAAREAHEADER 2)
 160         crc = GetCheckSum(blocks,2,1)
 161         calc = CalcCheckSum(blocks,2,1)
 162         if crc == calc then isOk='Ok' else isOk = 'Error' end
 163         io.write( ('TYPE 1 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 164
 165         -- Checksum Type 2 (DATAAREA 1)
 166         crc = GetCheckSum(blocks,1,2)
 167         calc = CalcCheckSum(blocks,1,2)
 168         if crc == calc then isOk='Ok' else isOk = 'Error' end
 169         io.write( ('TYPE 2 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 170
 171         -- Checksum Type 2 (DATAAREA 2)
 172         crc = GetCheckSum(blocks,2,2)
 173         calc = CalcCheckSum(blocks,2,2)
 174         if crc == calc then isOk='Ok' else isOk = 'Error' end
 175         io.write( ('TYPE 2 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 176
 177         -- Checksum Type 3 (DATAAREA 1)
 178         crc = GetCheckSum(blocks,1,3)
 179         calc = CalcCheckSum(blocks,1,3)
 180         if crc == calc then isOk='Ok' else isOk = 'Error' end
 181         io.write( ('TYPE 3 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 182
 183         -- Checksum Type 3 (DATAAREA 2)
 184         crc = GetCheckSum(blocks,2,3)
 185         calc = CalcCheckSum(blocks,2,3)
 186         if crc == calc then isOk='Ok' else isOk = 'Error' end
 187         io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
 188 end
 189
 190
 191 local function LoadEmulator(blocks)
 192         local HASHCONSTANT = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
 193         local cmd
 194         local blockdata
 195         for _,b in pairs(blocks) do
 196
 197                 blockdata = b
 198
 199                 if  _%4 ~= 3 then
 200                         if (_ >= 8 and _<=21)  or  (_ >= 36 and _<=49) then
 201                                 local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , HASHCONSTANT)
 202                                 local baseStr = utils.ConvertHexToAscii(base)
 203                                 local key = md5.sumhexa(baseStr)
 204                                 local enc = core.aes(key, blockdata)
 205                                 local hex = utils.ConvertAsciiToBytes(enc)
 206                                 hex = utils.ConvertBytesToHex(hex)
 207
 208                                 blockdata = hex
 209                                 io.write( _..',')
 210                         end
 211                 end
 212
 213                 cmd = Command:new{cmd = cmds.CMD_MIFARE_EML_MEMSET, arg1 = _ ,arg2 = 1,arg3 = 0, data = blockdata}
 214                 local err = core.SendCommand(cmd:getBytes())
 215                 if err then
 216                         return err
 217                 end
 218         end
 219         io.write('\n')
 220 end
 221
 222 local function main(args)
 223
 224         print( string.rep('--',20) )
 225         print( string.rep('--',20) )
 226
 227         local result, err, hex
 228         local maxed = false
 229         local inputTemplate = "dumpdata.bin"
 230         local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M");
 231
 232                 -- Arguments for the script
 233         for o, a in getopt.getopt(args, 'hmi:o:') do
 234                 if o == "h" then return help() end
 235                 if o == "m" then maxed = true end
 236                 if o == "o" then outputTemplate = a end
 237                 if o == "i" then inputTemplate = a end
 238         end
 239
 240         -- Turn off Debug
 241         local cmdSetDbgOff = "hf mf dbg 0"
 242         core.console( cmdSetDbgOff)
 243
 244         -- Look for tag present on reader,
 245         result, err = lib14a.read1443a(false)
 246         if not result then return oops(err)     end
 247
 248         core.clearCommandBuffer()
 249
 250         if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
 251                 return oops('This is not a TNP3xxx tag. aborting.')
 252         end
 253
 254         -- Show tag info
 255         print((' Found tag : %s'):format(result.name))
 256
 257         -- Load dump.bin file
 258         print( (' Load data from %s'):format(inputTemplate))
 259         hex, err = utils.ReadDumpFile(inputTemplate)
 260         if not hex then return oops(err) end
 261
 262         local blocks = {}
 263         local blockindex = 0
 264         for i = 1, #hex, 32 do
 265                 blocks[blockindex] = hex:sub(i,i+31)
 266                 blockindex = blockindex + 1
 267         end
 268
 269         if DEBUG then
 270                 print('Validating checksums in the loaded datadump')
 271                 ValidateCheckSums(blocks)
 272         end
 273
 274         --
 275         print( string.rep('--',20) )
 276         print(' Gathering info')
 277         local uid = blocks[0]:sub(1,8)
 278         local itemtype = blocks[1]:sub(1,4)
 279         local cardid = blocks[1]:sub(9,24)
 280
 281         -- Show info
 282         print( string.rep('--',20) )
 283         print( (' ITEM TYPE : 0x%s - %s'):format(itemtype, toyNames[itemtype]) )
 284         print( ('       UID : 0x%s'):format(uid) )
 285         print( ('    CARDID : 0x%s'):format(cardid ) )
 286         print( string.rep('--',20) )
 287
 288         -- lets do something.
 289         --
 290         local experience = blocks[8]:sub(1,6)
 291         print(('Experience  : %d'):format(utils.SwapEndianness(experience,24)))
 292         local money = blocks[8]:sub(7,10)
 293         print(('Money       : %d'):format(utils.SwapEndianness(money,16)))
 294         local fairy = blocks[9]:sub(1,8)
 295         --FD0F = Left, FF0F = Right
 296         local path = 'not choosen'
 297         if fairy:sub(2,2) == 'D' then
 298                 path = 'Left'
 299         elseif fairy:sub(2,2) == 'F' then
 300                 path = 'Right'
 301         end
 302         print(('Fairy       : %d [Path: %s] '):format(utils.SwapEndianness(fairy,24),path))
 303
 304         local hat = blocks[9]:sub(8,11)
 305         print(('Hat         : %d'):format(utils.SwapEndianness(hat,16)))
 306
 307         --0x0D    0x29    0x0A    0x02    16-bit hero points value. Maximum 100.
 308         local heropoints = blocks[13]:sub(20,23)
 309         print(('Hero points : %d'):format(utils.SwapEndianness(heropoints,16)))
 310
 311         --0x10    0x2C    0x0C    0x04    32 bit flag value indicating heroic challenges completed.
 312         local challenges = blocks[16]:sub(25,32)
 313         print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32)))
 314
 315         if maxed then
 316                 print('Lets try to max out some values')
 317                 -- max out money, experience
 318                 --print (blocks[8])
 319                 blocks[8] = 'FFFFFF'..'FFFF'..blocks[8]:sub(11,32)
 320                 blocks[36] = 'FFFFFF'..'FFFF'..blocks[36]:sub(11,32)
 321                 --print (blocks[8])
 322
 323                 -- max out hero challenges
 324                 --print (blocks[16])
 325                 blocks[16] = blocks[16]:sub(1,24)..'FFFFFFFF'
 326                 blocks[44] = blocks[44]:sub(1,24)..'FFFFFFFF'
 327                 --print (blocks[16])
 328
 329                 -- max out heropoints
 330                 --print (blocks[13])
 331                 blocks[13] = blocks[13]:sub(1,19)..'0064'..blocks[13]:sub(24,32)
 332                 blocks[41] = blocks[41]:sub(1,19)..'0064'..blocks[41]:sub(24,32)
 333                 --print (blocks[13])
 334
 335                 -- Update Checksums
 336                 print('Updating all checksums')
 337                 SetCheckSum(blocks, 3)
 338                 SetCheckSum(blocks, 2)
 339                 SetCheckSum(blocks, 1)
 340                 SetCheckSum(blocks, 0)
 341
 342                 print('Validating all checksums')
 343                 ValidateCheckSums(blocks)
 344         end
 345
 346         --Load dumpdata to emulator memory
 347         if DEBUG then
 348                 print('Sending dumpdata to emulator memory')
 349                 err = LoadEmulator(blocks)
 350                 if err then return oops(err) end
 351                 core.clearCommandBuffer()
 352                 print('The simulation is now prepared.\n --> run \"hf mf sim 5 '..uid..'\" <--')
 353         end
 354 end
 355 main(args)