git.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/mfkeys.lua

   1 --[[
   2         This is an example of Lua-scripting within proxmark3. This is a lua-side
   3         implementation of hf mf chk
   4
   5         This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6         at your option, any later version. See the LICENSE.txt file for the text of
   7         the license.
   8
   9         Copyright (C) 2013 m h swende <martin at swende.se>
  10 --]]
  11 -- Loads the commands-library
  12 local cmds = require('commands')
  13 -- Load the default keys
  14 local keys = require('mf_default_keys')
  15 -- Ability to read what card is there
  16 local reader = require('read14a')
  17 -- Asks the user for input
  18 local utils = require('utils')
  19
  20
  21 local desc = ("This script implements check keys. \
  22 It utilises a large list of default keys (currently %d keys).\
  23 If you want to add more, just put them inside mf_default_keys.lua. "):format(#keys)
  24
  25 local TIMEOUT = 10000 -- 10 seconds
  26
  27
  28 local function checkCommand(command)
  29
  30         --print("Sending this command : " .. tostring(command))
  31         local usbcommand = command:getBytes()
  32         core.SendCommand(usbcommand)
  33         local result = core.WaitForResponseTimeout(cmds.CMD_ACK,TIMEOUT)
  34         if result then
  35                 local count,cmd,arg0 = bin.unpack('LL',result)
  36                 if(arg0==1) then
  37                         local count,arg1,arg2,data = bin.unpack('LLH511',result,count)
  38                         key = data:sub(1,12)
  39                         return key
  40                 else
  41                         --print("Key not found...")
  42                         return nil
  43                 end
  44         else
  45                 print("Timeout while waiting for response. Increase TIMEOUT in keycheck.lua to wait longer")
  46                 return nil, "Timeout while waiting for device to respond"
  47         end
  48 end
  49
  50
  51 function checkBlock(blockNo, keys, keyType)
  52         -- The command data is only 512 bytes, each key is 6 bytes, meaning that we can send max 85 keys in one go.
  53         -- If there's more, we need to split it up
  54         local start, remaining= 1, #keys
  55         local arg1 = bit32.bor(bit32.lshift(keyType, 8), blockNo)
  56         local packets = {}
  57         while remaining > 0 do
  58                 local n,data = remaining, nil
  59                 if remaining > 85 then n = 85 end
  60                 local data = table.concat(keys,"",start,n)
  61                 --print("data",data)
  62                 --print("data len", #data)
  63                 print(("Testing block %d, keytype %d, with %d keys"):format(blockNo, keyType, n))
  64                 local command = Command:new{cmd = cmds.CMD_MIFARE_CHKKEYS,
  65                                                                 arg1 = arg1,
  66                                                                 arg2 = 1,
  67                                                                 arg3 = n,
  68                                                                 data = data}
  69                 local status = checkCommand(command)
  70                 if status then return status, blockNo end
  71                 start = start+n+1
  72                 remaining = remaining - n
  73         end
  74         return nil
  75 end
  76
  77 -- A function to display the results
  78 local function displayresults(results)
  79         local sector, blockNo, keyA, keyB,_
  80
  81         print("________________________________________")
  82         print("|Sector|Block|     A      |      B     |")
  83         print("|--------------------------------------|")
  84
  85         for sector,_ in pairs(results) do
  86                 blockNo, keyA, keyB = unpack(_)
  87
  88                 print(("| %3d  | %3d |%s|%s|"):format(sector, blockNo, keyA, keyB ))
  89         end
  90         print("|--------------------------------------|")
  91
  92 end
  93 -- A little helper to place an item first in the list
  94 local function placeFirst(akey, list)
  95         akey  = akey:lower()
  96         if list[1] == akey then
  97                 -- Already at pole position
  98                 return list
  99         end
 100         local result = {akey}
 101         --print(("Putting '%s' first"):format(akey))
 102         for i,v in ipairs(list) do
 103                 if v ~= akey then
 104                         result[#result+1] = v
 105                 end
 106         end
 107         return result
 108 end
 109 local function dumptofile(results)
 110         local sector, blockNo, keyA, keyB,_
 111
 112         if utils.confirm("Do you wish to save the keys to dumpfile?") then
 113                 local destination = utils.input("Select a filename to store to", "dumpkeys.bin")
 114                 local file = io.open(destination, "w")
 115                 if file == nil then
 116                         print("Could not write to file ", destination)
 117                         return
 118                 end
 119
 120                 local key_a = ""
 121                 local key_b = ""
 122
 123                 for sector,_ in pairs(results) do
 124                         blockNo, keyA, keyB = unpack(_)
 125                         key_a = key_a .. bin.pack("H",keyA);
 126                         key_b = key_b .. bin.pack("H",keyB);
 127                 end
 128                 file:write(key_a)
 129                 file:write(key_b)
 130                 file:close()
 131         end
 132 end
 133
 134
 135 local function main( args)
 136
 137         print(desc);
 138
 139         result, err = reader.read14443a(false, true)
 140         if not result then
 141                 print(err)
 142                 return
 143         end
 144         print(("Found a %s tag"):format(result.name))
 145
 146
 147         core.clearCommandBuffer()
 148         local blockNo
 149         local keyType = 0 -- A=0, B=1
 150         local numSectors = 16
 151
 152         if 0x18 == result.sak then --NXP MIFARE Classic 4k | Plus 4k
 153                 -- IFARE Classic 4K offers 4096 bytes split into forty sectors,
 154                 -- of which 32 are same size as in the 1K with eight more that are quadruple size sectors.
 155                 numSectors = 40
 156         elseif 0x08 == result.sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
 157                 -- 1K offers 1024 bytes of data storage, split into 16 sector
 158                 numSectors = 16
 159         elseif 0x09 == result.sak then -- NXP MIFARE Mini 0.3k
 160                 -- MIFARE Classic mini offers 320 bytes split into five sectors.
 161                 numSectors = 5
 162         elseif  0x10 == result.sak then-- "NXP MIFARE Plus 2k"
 163                 numSectors = 32
 164         else
 165                 print("I don't know how many sectors there are on this type of card, defaulting to 16")
 166         end
 167
 168         result = {}
 169         for sector=1,numSectors,1 do
 170
 171                 --[[
 172                 The mifare Classic 1k card has 16 sectors of 4 data blocks each.
 173                 The first 32 sectors of a mifare Classic 4k card consists of 4 data blocks and the remaining
 174                 8 sectors consist of 16 data blocks.
 175                 --]]
 176                 local blockNo = sector * 4 -1
 177
 178                 if sector > 32 then
 179                         blockNo = 32*4+ (sector-32)*16 -1
 180                 end
 181
 182                 local keyA = checkBlock(blockNo, keys, 0)
 183                 if keyA then keys  = placeFirst(keyA, keys) end
 184                 keyA = keyA or ""
 185
 186                 local keyB = checkBlock(blockNo, keys, 1)
 187                 if keyB then keys  = placeFirst(keyB, keys) end
 188                 keyB = keyB or ""
 189
 190                 result[sector] = {blockNo, keyA, keyB }
 191
 192                 -- Check if user aborted
 193                 if core.ukbhit() then
 194                         print("Aborted by user")
 195                         break
 196                 end
 197         end
 198         displayresults(result)
 199         dumptofile(result)
 200 end
 201
 202 main( args)
 203