1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2013 m h swende <martin at swende.se>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Some lua scripting glue to proxmark core.
9 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
17 #include "scripting.h"
19 #include "nonce2key/nonce2key.h"
20 #include "../common/iso15693tools.h"
21 #include "../common/crc16.h"
22 #include "../common/crc64.h"
23 #include "../common/sha1.h"
26 * The following params expected:
32 static int l_SendCommand(lua_State
*L
){
36 The SendCommand (native) expects the following structure:
39 uint64_t cmd; //8 bytes
40 uint64_t arg[3]; // 8*3 bytes = 24 bytes
42 uint8_t asBytes[USB_CMD_DATA_SIZE]; // 1 byte * 512 = 512 bytes (OR)
43 uint32_t asDwords[USB_CMD_DATA_SIZE/4]; // 4 byte * 128 = 512 bytes
47 ==> A 544 byte buffer will do.
51 const char *data
= luaL_checklstring(L
, 1, &size
);
52 if(size
!= sizeof(UsbCommand
))
54 printf("Got data size %d, expected %d" , (int) size
,(int) sizeof(UsbCommand
));
55 lua_pushstring(L
,"Wrong data size");
59 // UsbCommand c = (*data);
60 SendCommand((UsbCommand
* )data
);
61 return 0; // no return values
64 * @brief The following params expected:
70 static int l_WaitForResponseTimeout(lua_State
*L
){
73 size_t ms_timeout
= -1;
75 //Check number of arguments
76 int n
= lua_gettop(L
);
79 //signal error by returning Nil, errorstring
81 lua_pushstring(L
,"You need to supply at least command to wait for");
82 return 2; // two return values
87 cmd
= luaL_checkunsigned(L
,1);
91 //Did the user send a timeout ?
92 //Check if the current top of stack is an integer
93 ms_timeout
= luaL_checkunsigned(L
,2);
94 //printf("Timeout set to %dms\n" , (int) ms_timeout);
99 if(WaitForResponseTimeout(cmd
, &response
, ms_timeout
))
101 //Push it as a string
102 lua_pushlstring(L
,(const char *)&response
,sizeof(UsbCommand
));
104 return 1;// return 1 to signal one return value
108 return 1;// one return value
112 static int returnToLuaWithError(lua_State
*L
, const char* fmt
, ...)
117 vsnprintf(buffer
, sizeof(buffer
), fmt
,args
);
121 lua_pushstring(L
,buffer
);
125 static int l_nonce2key(lua_State
*L
){
128 const char *p_uid
= luaL_checklstring(L
, 1, &size
);
129 if(size
!= 4) return returnToLuaWithError(L
,"Wrong size of uid, got %d bytes, expected 4", (int) size
);
131 const char *p_nt
= luaL_checklstring(L
, 2, &size
);
132 if(size
!= 4) return returnToLuaWithError(L
,"Wrong size of nt, got %d bytes, expected 4", (int) size
);
134 const char *p_nr
= luaL_checklstring(L
, 3, &size
);
135 if(size
!= 4) return returnToLuaWithError(L
,"Wrong size of nr, got %d bytes, expected 4", (int) size
);
137 const char *p_par_info
= luaL_checklstring(L
, 4, &size
);
138 if(size
!= 8) return returnToLuaWithError(L
,"Wrong size of par_info, got %d bytes, expected 8", (int) size
);
140 const char *p_pks_info
= luaL_checklstring(L
, 5, &size
);
141 if(size
!= 8) return returnToLuaWithError(L
,"Wrong size of ks_info, got %d bytes, expected 8", (int) size
);
144 uint32_t uid
= bytes_to_num(( uint8_t *)p_uid
,4);
145 uint32_t nt
= bytes_to_num(( uint8_t *)p_nt
,4);
147 uint32_t nr
= bytes_to_num(( uint8_t*)p_nr
,4);
148 uint64_t par_info
= bytes_to_num(( uint8_t *)p_par_info
,8);
149 uint64_t ks_info
= bytes_to_num(( uint8_t *)p_pks_info
,8);
153 int retval
= nonce2key(uid
,nt
, nr
, par_info
,ks_info
, &key
);
155 //Push the retval on the stack
156 lua_pushinteger(L
,retval
);
158 //Push the key onto the stack
160 num_to_bytes(key
,sizeof(dest_key
),dest_key
);
162 //printf("Pushing to lua stack: %012"llx"\n",key);
163 lua_pushlstring(L
,(const char *) dest_key
,sizeof(dest_key
));
165 return 2; //Two return values
167 //static int l_PrintAndLog(lua_State *L){ return CmdHF14AMfDump(luaL_checkstring(L, 1));}
168 static int l_clearCommandBuffer(lua_State
*L
){
169 clearCommandBuffer();
173 * @brief l_foobar is a dummy function to test lua-integration with
177 static int l_foobar(lua_State
*L
)
179 //Check number of arguments
180 int n
= lua_gettop(L
);
181 printf("foobar called with %d arguments" , n
);
183 printf("Arguments discarded, stack now contains %d elements", lua_gettop(L
));
185 // todo: this is not used, where was it intended for?
186 // UsbCommand response = {CMD_MIFARE_READBL, {1337, 1338, 1339}};
188 printf("Now returning a uint64_t as a string");
189 uint64_t x
= 0xDEADBEEF;
190 uint8_t destination
[8];
191 num_to_bytes(x
,sizeof(x
),destination
);
192 lua_pushlstring(L
,(const char *)&x
,sizeof(x
));
193 lua_pushlstring(L
,(const char *)destination
,sizeof(destination
));
200 * @brief Utility to check if a key has been pressed by the user. This method does not block.
202 * @return boolean, true if kbhit, false otherwise.
204 static int l_ukbhit(lua_State
*L
)
206 lua_pushboolean(L
,ukbhit() ? true : false);
210 * @brief Calls the command line parser to deal with the command. This enables
211 * lua-scripts to do stuff like "core.console('hf mf mifare')"
215 static int l_CmdConsole(lua_State
*L
)
217 CommandReceived((char *)luaL_checkstring(L
, 1));
221 static int l_iso15693_crc(lua_State
*L
)
223 // uint16_t Iso15693Crc(uint8_t *v, int n);
225 const char *v
= luaL_checklstring(L
, 1, &size
);
226 uint16_t retval
= Iso15693Crc((uint8_t *) v
, size
);
227 lua_pushinteger(L
, (int) retval
);
232 Simple AES 128 cbc hook up to OpenSSL.
235 static int l_aes128decrypt_cbc(lua_State
*L
)
237 //Check number of arguments
240 const char *p_key
= luaL_checklstring(L
, 1, &size
);
241 if(size
!= 32) return returnToLuaWithError(L
,"Wrong size of key, got %d bytes, expected 32", (int) size
);
243 const char *p_encTxt
= luaL_checklstring(L
, 2, &size
);
245 unsigned char indata
[16] = {0x00};
246 unsigned char outdata
[16] = {0x00};
247 unsigned char aes_key
[16] = {0x00};
248 unsigned char iv
[16] = {0x00};
250 // convert key to bytearray and convert input to bytearray
251 for (i
= 0; i
< 32; i
+= 2) {
252 sscanf(&p_encTxt
[i
], "%02x", (unsigned int *)&indata
[i
/ 2]);
253 sscanf(&p_key
[i
], "%02x", (unsigned int *)&aes_key
[i
/ 2]);
258 aes_setkey_dec(&ctx
, aes_key
, 128);
259 aes_crypt_cbc(&ctx
,AES_DECRYPT
,sizeof(indata
), iv
, indata
,outdata
);
260 //Push decrypted array as a string
261 lua_pushlstring(L
,(const char *)&outdata
, sizeof(outdata
));
262 return 1;// return 1 to signal one return value
264 static int l_aes128decrypt_ecb(lua_State
*L
)
266 //Check number of arguments
269 const char *p_key
= luaL_checklstring(L
, 1, &size
);
270 if(size
!= 32) return returnToLuaWithError(L
,"Wrong size of key, got %d bytes, expected 32", (int) size
);
272 const char *p_encTxt
= luaL_checklstring(L
, 2, &size
);
274 unsigned char indata
[16] = {0x00};
275 unsigned char outdata
[16] = {0x00};
276 unsigned char aes_key
[16] = {0x00};
278 // convert key to bytearray and convert input to bytearray
279 for (i
= 0; i
< 32; i
+= 2) {
280 sscanf(&p_encTxt
[i
], "%02x", (unsigned int *)&indata
[i
/ 2]);
281 sscanf(&p_key
[i
], "%02x", (unsigned int *)&aes_key
[i
/ 2]);
285 aes_setkey_dec(&ctx
, aes_key
, 128);
286 aes_crypt_ecb(&ctx
, AES_DECRYPT
, indata
, outdata
);
288 //Push decrypted array as a string
289 lua_pushlstring(L
,(const char *)&outdata
, sizeof(outdata
));
290 return 1;// return 1 to signal one return value
293 static int l_aes128encrypt_cbc(lua_State
*L
)
295 //Check number of arguments
298 const char *p_key
= luaL_checklstring(L
, 1, &size
);
299 if(size
!= 32) return returnToLuaWithError(L
,"Wrong size of key, got %d bytes, expected 32", (int) size
);
301 const char *p_txt
= luaL_checklstring(L
, 2, &size
);
303 unsigned char indata
[16] = {0x00};
304 unsigned char outdata
[16] = {0x00};
305 unsigned char aes_key
[16] = {0x00};
306 unsigned char iv
[16] = {0x00};
308 for (i
= 0; i
< 32; i
+= 2) {
309 sscanf(&p_txt
[i
], "%02x", (unsigned int *)&indata
[i
/ 2]);
310 sscanf(&p_key
[i
], "%02x", (unsigned int *)&aes_key
[i
/ 2]);
315 aes_setkey_enc(&ctx
, aes_key
, 128);
316 aes_crypt_cbc(&ctx
, AES_ENCRYPT
, sizeof(indata
), iv
, indata
, outdata
);
317 //Push encrypted array as a string
318 lua_pushlstring(L
,(const char *)&outdata
, sizeof(outdata
));
319 return 1;// return 1 to signal one return value
322 static int l_aes128encrypt_ecb(lua_State
*L
)
324 //Check number of arguments
327 const char *p_key
= luaL_checklstring(L
, 1, &size
);
328 if(size
!= 32) return returnToLuaWithError(L
,"Wrong size of key, got %d bytes, expected 32", (int) size
);
330 const char *p_txt
= luaL_checklstring(L
, 2, &size
);
332 unsigned char indata
[16] = {0x00};
333 unsigned char outdata
[16] = {0x00};
334 unsigned char aes_key
[16] = {0x00};
336 for (i
= 0; i
< 32; i
+= 2) {
337 sscanf(&p_txt
[i
], "%02x", (unsigned int *)&indata
[i
/ 2]);
338 sscanf(&p_key
[i
], "%02x", (unsigned int *)&aes_key
[i
/ 2]);
342 aes_setkey_enc(&ctx
, aes_key
, 128);
343 aes_crypt_ecb(&ctx
, AES_ENCRYPT
, indata
, outdata
);
344 //Push encrypted array as a string
345 lua_pushlstring(L
,(const char *)&outdata
, sizeof(outdata
));
346 return 1;// return 1 to signal one return value
349 static int l_crc16(lua_State
*L
)
352 const char *p_str
= luaL_checklstring(L
, 1, &size
);
354 uint16_t retval
= crc16_ccitt( (uint8_t*) p_str
, size
);
355 lua_pushinteger(L
, (int) retval
);
359 static int l_crc64(lua_State
*L
)
363 unsigned char outdata
[8] = {0x00};
365 const char *p_str
= luaL_checklstring(L
, 1, &size
);
367 crc64( (uint8_t*) p_str
, size
, &crc
);
369 outdata
[0] = (uint8_t)(crc
>> 56) & 0xff;
370 outdata
[1] = (uint8_t)(crc
>> 48) & 0xff;
371 outdata
[2] = (uint8_t)(crc
>> 40) & 0xff;
372 outdata
[3] = (uint8_t)(crc
>> 32) & 0xff;
373 outdata
[4] = (uint8_t)(crc
>> 24) & 0xff;
374 outdata
[5] = (uint8_t)(crc
>> 16) & 0xff;
375 outdata
[6] = (uint8_t)(crc
>> 8) & 0xff;
376 outdata
[7] = crc
& 0xff;
377 lua_pushlstring(L
,(const char *)&outdata
, sizeof(outdata
));
381 static int l_sha1(lua_State
*L
)
384 const char *p_str
= luaL_checklstring(L
, 1, &size
);
385 unsigned char outdata
[20] = {0x00};
386 sha1( (uint8_t*) p_str
, size
, outdata
);
387 lua_pushlstring(L
,(const char *)&outdata
, sizeof(outdata
));
392 * @brief Sets the lua path to include "./lualibs/?.lua", in order for a script to be
393 * able to do "require('foobar')" if foobar.lua is within lualibs folder.
394 * Taken from http://stackoverflow.com/questions/4125971/setting-the-global-lua-path-variable-from-c-c
399 int setLuaPath( lua_State
* L
, const char* path
)
401 lua_getglobal( L
, "package" );
402 lua_getfield( L
, -1, "path" ); // get field "path" from table at top of stack (-1)
403 const char* cur_path
= lua_tostring( L
, -1 ); // grab path string from top of stack
404 int requiredLength
= strlen(cur_path
)+ strlen(path
)+10; //A few bytes too many, whatever we can afford it
405 char * buf
= malloc(requiredLength
);
406 snprintf(buf
, requiredLength
, "%s;%s", cur_path
, path
);
407 lua_pop( L
, 1 ); // get rid of the string on the stack we just pushed on line 5
408 lua_pushstring( L
, buf
); // push the new one
409 lua_setfield( L
, -2, "path" ); // set the field "path" in table at -2 with value at top of stack
410 lua_pop( L
, 1 ); // get rid of package table from top of stack
412 return 0; // all done!
416 int set_pm3_libraries(lua_State
*L
)
419 static const luaL_Reg libs
[] = {
420 {"SendCommand", l_SendCommand
},
421 {"WaitForResponseTimeout", l_WaitForResponseTimeout
},
422 {"nonce2key", l_nonce2key
},
423 //{"PrintAndLog", l_PrintAndLog},
424 {"foobar", l_foobar
},
425 {"ukbhit", l_ukbhit
},
426 {"clearCommandBuffer", l_clearCommandBuffer
},
427 {"console", l_CmdConsole
},
428 {"iso15693_crc", l_iso15693_crc
},
429 {"aes128_decrypt", l_aes128decrypt_cbc
},
430 {"aes128_decrypt_ecb", l_aes128decrypt_ecb
},
431 {"aes128_encrypt", l_aes128encrypt_cbc
},
432 {"aes128_encrypt_ecb", l_aes128encrypt_ecb
},
439 lua_pushglobaltable(L
);
440 // Core library is in this table. Contains '
441 //this is 'pm3' table
444 //Put the function into the hash table.
445 for (int i
= 0; libs
[i
].name
; i
++) {
446 lua_pushcfunction(L
, libs
[i
].func
);
447 lua_setfield(L
, -2, libs
[i
].name
);//set the name, pop stack
450 lua_setfield(L
, -2, "core");
452 //-- remove the global environment table from the stack
455 //-- Last but not least, add to the LUA_PATH (package.path in lua)
456 // so we can load libraries from the ./lualib/ - directory
457 setLuaPath(L
,"./lualibs/?.lua");