git.zerfleddert.de Git - proxmark3-svn/blob - client/scripts/tnp3sim.lua

1 local cmds = require('commands')

2 local getopt = require('getopt')

3 local bin = require('bin')

4 local lib14a = require('read14a')

5 local utils = require('utils')

6 local md5 = require('md5')

7 local toys = require('default_toys')

9 example =[[

10 1. script run tnp3sim

11 2. script run tnp3sim -m

12 3. script run tnp3sim -m -i myfile

13 ]]

14 author = "Iceman"

15 usage = "script run tnp3sim -h -m -i <filename>"

16 desc =[[

17 This script will try to load a binary datadump of a Mifare TNP3xxx card.

18 It vill try to validate all checksums and view some information stored in the dump

19 For an experimental mode, it tries to manipulate some data.

20 At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim"

22 Arguments:

23 -h : this help

24 -m : Maxed out items (experimental)

25 -i : filename for the datadump to read (bin)

27 ]]

29 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds

30 local DEBUG = false -- the debug flag

31 local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'

33 local band = bit32.band

34 local bor = bit32.bor

35 local lshift = bit32.lshift

36 local rshift = bit32.rshift

37 local byte = string.byte

38 local char = string.char

39 local sub = string.sub

40 local format = string.format

44 local band = bit32.band

45 local bor = bit32.bor

46 local lshift = bit32.lshift

47 local rshift = bit32.rshift

48 local byte = string.byte

49 local char = string.char

50 local sub = string.sub

51 local format = string.format

53 ---

54 -- A debug printout-function

55 function dbg(args)

56 if not DEBUG then

57 return

58 end

60 if type(args) == "table" then

61 local i = 1

62 while result[i] do

63 dbg(result[i])

64 i = i+1

65 end

66 else

67 print("###", args)

68 end

69 end

70 ---

71 -- This is only meant to be used when errors occur

72 function oops(err)

73 print("ERROR: ",err)

74 end

75 ---

76 -- Usage help

77 function help()

78 print(desc)

79 print("Example usage")

80 print(example)

81 end

82 --

83 -- Exit message

84 function ExitMsg(msg)

85 print( string.rep('--',20) )

86 print( string.rep('--',20) )

87 print(msg)

88 print()

89 end

91 local function writedumpfile(infile)

92 t = infile:read("*all")

93 len = string.len(t)

94 local len,hex = bin.unpack(("H%d"):format(len),t)

95 return hex

96 end

97 -- blocks with data

98 -- there are two dataareas, in block 8 or block 36, ( 1==8 ,

99 -- checksum type = 0, 1, 2, 3

100 local function GetCheckSum(blocks, dataarea, chksumtype)

101

102 local crc

103 local area = 36

104 if dataarea == 1 then

105 area = 8

106 end

107

108 if chksumtype == 0 then

109 crc = blocks[1]:sub(29,32)

110 elseif chksumtype == 1 then

111 crc = blocks[area]:sub(29,32)

112 elseif chksumtype == 2 then

113 crc = blocks[area]:sub(25,28)

114 elseif chksumtype == 3 then

115 crc = blocks[area]:sub(21,24)

116 end

117 return utils.SwapEndianness(crc,16)

118 end

119

120 local function SetCheckSum(blocks, chksumtype)

121

122 if blocks == nil then return nil, 'Argument \"blocks\" nil' end

123 local newcrc

124 local area1 = 8

125 local area2 = 36

126

127 if chksumtype == 0 then

128 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,0))

129 blocks[1] = blocks[1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)

130 elseif chksumtype == 1 then

131 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,1))

132 blocks[area1] = blocks[area1]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)

133 newcrc = ('%04X'):format(CalcCheckSum(blocks,2,1))

134 blocks[area2] = blocks[area2]:sub(1,28)..newcrc:sub(3,4)..newcrc:sub(1,2)

135 elseif chksumtype == 2 then

136 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,2))

137 blocks[area1] = blocks[area1]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(29,32)

138 newcrc = ('%04X'):format(CalcCheckSum(blocks,2,2))

139 blocks[area2] = blocks[area2]:sub(1,24)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(29,32)

140 elseif chksumtype == 3 then

141 newcrc = ('%04X'):format(CalcCheckSum(blocks,1,3))

142 blocks[area1] = blocks[area1]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area1]:sub(25,32)

143 newcrc = ('%04X'):format(CalcCheckSum(blocks,2,3))

144 blocks[area2] = blocks[area2]:sub(1,20)..newcrc:sub(3,4)..newcrc:sub(1,2)..blocks[area2]:sub(25,32)

145 end

146 end

147

148 function CalcCheckSum(blocks, dataarea, chksumtype)

149 local area = 36

150 if dataarea == 1 then

151 area = 8

152 end

153

154 if chksumtype == 0 then

155 data = blocks[0]..blocks[1]:sub(1,28)

156 elseif chksumtype == 1 then

157 data = blocks[area]:sub(1,28)..'0500'

158 elseif chksumtype == 2 then

159 data = blocks[area+1]..blocks[area+2]..blocks[area+4]

160 elseif chksumtype == 3 then

161 data = blocks[area+5]..blocks[area+6]..blocks[area+8]..string.rep('00',0xe0)

162 end

163 return utils.Crc16(data)

164 end

165

166 local function ValidateCheckSums(blocks)

167

168 local isOk, crc, calc

169 -- Checksum Type 0

170 crc = GetCheckSum(blocks,1,0)

171 calc = CalcCheckSum(blocks, 1, 0)

172 if crc == calc then isOk='Ok' else isOk = 'Error' end

173 io.write( ('TYPE 0 : %04x = %04x -- %s\n'):format(crc,calc,isOk))

174

175 -- Checksum Type 1 (DATAAREAHEADER 1)

176 crc = GetCheckSum(blocks,1,1)

177 calc = CalcCheckSum(blocks,1,1)

178 if crc == calc then isOk='Ok' else isOk = 'Error' end

179 io.write( ('TYPE 1 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))

180

181 -- Checksum Type 1 (DATAAREAHEADER 2)

182 crc = GetCheckSum(blocks,2,1)

183 calc = CalcCheckSum(blocks,2,1)

184 if crc == calc then isOk='Ok' else isOk = 'Error' end

185 io.write( ('TYPE 1 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))

186

187 -- Checksum Type 2 (DATAAREA 1)

188 crc = GetCheckSum(blocks,1,2)

189 calc = CalcCheckSum(blocks,1,2)

190 if crc == calc then isOk='Ok' else isOk = 'Error' end

191 io.write( ('TYPE 2 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))

192

193 -- Checksum Type 2 (DATAAREA 2)

194 crc = GetCheckSum(blocks,2,2)

195 calc = CalcCheckSum(blocks,2,2)

196 if crc == calc then isOk='Ok' else isOk = 'Error' end

197 io.write( ('TYPE 2 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))

198

199 -- Checksum Type 3 (DATAAREA 1)

200 crc = GetCheckSum(blocks,1,3)

201 calc = CalcCheckSum(blocks,1,3)

202 if crc == calc then isOk='Ok' else isOk = 'Error' end

203 io.write( ('TYPE 3 area 1: %04x = %04x -- %s\n'):format(crc,calc,isOk))

204

205 -- Checksum Type 3 (DATAAREA 2)

206 crc = GetCheckSum(blocks,2,3)

207 calc = CalcCheckSum(blocks,2,3)

208 if crc == calc then isOk='Ok' else isOk = 'Error' end

209 io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))

210 end

211

212 local cmd

213 local blockdata

214 for _,b in pairs(blocks) do

215

216 blockdata = b

217

218 if _%4 ~= 3 then

219 if (_ >= 8 and _<=21) or (_ >= 36 and _<=49) then

220 local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , RANDOM)

221 local baseStr = utils.ConvertHexToAscii(base)

222 local key = md5.sumhexa(baseStr)

223 local enc = core.aes128_encrypt(key, blockdata)

224 local hex = utils.ConvertAsciiToBytes(enc)

225 hex = utils.ConvertBytesToHex(hex)

226

227 blockdata = hex

228 io.write( _..',')

229 end

230 end

231

232 cmd = Command:new{cmd = cmds.CMD_MIFARE_EML_MEMSET, arg1 = _ ,arg2 = 1,arg3 = 0, data = blockdata}

233 local err = core.SendCommand(cmd:getBytes())

234 if err then

235 return err

236 end

237 end

238 io.write('\n')

239 end

240

241 local function Num2Card(m, l)

242

243 local k = {

244 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,0x42, 0x43, 0x44, 0x46, 0x47, 0x48, 0x4A, 0x4B,

245 0x4C, 0x4D, 0x4E, 0x50, 0x51, 0x52, 0x53, 0x54,0x56, 0x57, 0x58, 0x59, 0x5A, 0x00

246 }

247 local msw = tonumber(utils.SwapEndiannessStr(m,32),16)

248 local lsw = tonumber(utils.SwapEndiannessStr(l,32),16)

249

250 if msw > 0x17ea1 then

251 return "too big"

252 end

253

254 if msw == 0x17ea1 and lsw > 0x8931fee8 then

255 return "out of range"

256 end

257

258 local s = ""

259 local index

260 for i = 1,10 do

261 index, msw, lsw = DivideByK( msw, lsw)

262 if ( index <= 1 ) then

263 s = char(k[index]) .. s

264 else

265 s = char(k[index-1]) .. s

266 end

267 print (index-1, msw, lsw)

268 end

269 return s

270 end

271 --33LRT-LM9Q9

272 --7, 122, 3474858630

273 --20, 4, 1008436634

274 --7, 0, 627182959

275 --17, 0, 21626998

276 --16, 0, 745758

277 --23, 0, 25715

278 --21, 0, 886

279 --16, 0, 30

280 --1, 0, 1

281 --1, 0, 0

282

283 function DivideByK(msw, lsw)

284

285 local lowLSW

286 local highLSW

287 local remainder = 0

288 local RADIX = 29

289

290 --local num = 0 | band( rshift(msw,16), 0xffff)

291 local num = band( rshift(msw, 16), 0xffff)

292

293 --highLSW = 0 | lshift( (num / RADIX) , 16)

294 highLSW = lshift( (num / RADIX) , 16)

295 remainder = num % RADIX

296

297 num = bor( lshift(remainder,16), band(msw, 0xffff))

298

299 --highLSW |= num / RADIX

300 highLSW = highLSW or (num / RADIX)

301 remainder = num % RADIX

302

303 num = bor( lshift(remainder,16), ( band(rshift(lsw,16), 0xffff)))

304

305 --lowLSW = 0 | (num / RADIX) << 16

306 lowLSW = 0 or (lshift( (num / RADIX), 16))

307 remainder = num % RADIX

308

309 num = bor( lshift(remainder,16) , band(lsw, 0xffff) )

310

311 lowLSW = bor(lowLSW, (num / RADIX))

312 remainder = num % RADIX

313 return remainder, highLSW, lowLSW

314

315 -- uint num = 0 | (msw >> 16) & 0xffff;

316

317 -- highLSW = 0 | (num / RADIX) << 16;

318 -- remainder = num % RADIX;

319

320 -- num = (remainder << 16) | (msw & 0xffff);

321

322 -- highLSW |= num / RADIX;

323 -- remainder = num % RADIX;

324

325 -- num = (remainder << 16) | ((lsw >> 16) & 0xffff);

326

327 -- lowLSW = 0 | (num / RADIX) << 16;

328 -- remainder = num % RADIX;

329

330 -- num = (remainder << 16) | (lsw & 0xffff);

331

332 -- lowLSW |= num / RADIX;

333 -- remainder = num % RADIX;

334

335 end

336

337 local function main(args)

338

339 print( string.rep('--',20) )

340 print( string.rep('--',20) )

341

342 local result, err, hex

343 local maxed = false

344 local inputTemplate = "dumpdata.bin"

345 local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M");

346

347 -- Arguments for the script

348 for o, a in getopt.getopt(args, 'hmi:o:') do

349 if o == "h" then return help() end

350 if o == "m" then maxed = true end

351 if o == "o" then outputTemplate = a end

352 if o == "i" then inputTemplate = a end

353 end

354

355 -- Turn off Debug

356 local cmdSetDbgOff = "hf mf dbg 0"

357 core.console( cmdSetDbgOff)

358

359 -- Load dump.bin file

360 print( (' Load data from %s'):format(inputTemplate))

361 hex, err = utils.ReadDumpFile(inputTemplate)

362 if not hex then return oops(err) end

363

364 local blocks = {}

365 local blockindex = 0

366 for i = 1, #hex, 32 do

367 blocks[blockindex] = hex:sub(i,i+31)

368 blockindex = blockindex + 1

369 end

370

371 if DEBUG then

372 print(' Validating checksums')

373 ValidateCheckSums(blocks)

374 end

375

376 --

377 print( string.rep('--',20) )

378 print(' Gathering info')

379 local uid = blocks[0]:sub(1,8)

380 local toytype = blocks[1]:sub(1,4)

381 local cardidLsw = blocks[1]:sub(9,16)

382 local cardidMsw = blocks[1]:sub(17,24)

383 local subtype = blocks[1]:sub(25,28)

384

385 -- Show info

386 print( string.rep('--',20) )

387

388 local item = toys.Find( toytype, subtype)

389 if item then

390 local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])

391 print(' ITEM TYPE : '..itemStr )

392 else

393 print( (' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype) )

394 end

395

396 print( (' UID : 0x%s'):format(uid) )

397 print( (' CARDID : 0x%s %s [%s]'):format(

398 cardidMsw,cardidLsw,

399 --Num2Card(cardidMsw, cardidLsw))

400 '')

401 )

402 print( string.rep('--',20) )

403

404

405 -- Experience should be:

406 local experience = blocks[8]:sub(1,6)

407 print(('Experience : %d'):format(utils.SwapEndianness(experience,16)))

408

409 local money = blocks[8]:sub(7,10)

410 print(('Money : %d'):format(utils.SwapEndianness(money,16)))

411

412 --

413

414 -- Sequence number

415 local seqnum = blocks[8]:sub(18,19)

416 print(('Sequence number : %d'):format( tonumber(seqnum,16)))

417

418 local fairy = blocks[9]:sub(1,8)

419 --FD0F = Left, FF0F = Right

420 local path = 'not choosen'

421 if fairy:sub(2,2) == 'D' then

422 path = 'Left'

423 elseif fairy:sub(2,2) == 'F' then

424 path = 'Right'

425 end

426 print(('Fairy : %d [Path: %s] '):format(utils.SwapEndianness(fairy,24),path))

427

428 local hat = blocks[9]:sub(8,11)

429 print(('Hat : %d'):format(utils.SwapEndianness(hat,16)))

430

431 local level = blocks[13]:sub(27,28)

432 print(('LEVEL : %d'):format( tonumber(level,16)))

433 --hälsa: 667 029b

434 --local health = blocks[]:sub();

435 --print(('Health : %d'):format( tonumber(health,16))

436

437 --0x0D 0x29 0x0A 0x02 16-bit hero points value. Maximum 100.

438 local heropoints = blocks[13]:sub(20,23)

439 print(('Hero points : %d'):format(utils.SwapEndianness(heropoints,16)))

440

441 --0x10 0x2C 0x0C 0x04 32 bit flag value indicating heroic challenges completed.

442 local challenges = blocks[16]:sub(25,32)

443 print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32)))

444

445 -- Character Name

446 local name1 = blocks[10]:sub(1,32)

447 local name2 = blocks[12]:sub(1,32)

448 print('Custom name : '..utils.ConvertHexToAscii(name1..name2))

449

450 if maxed then

451 print('Lets try to max out some values')

452 -- max out money, experience

453 --print (blocks[8])

454 blocks[8] = 'FFFFFF'..'FFFF'..blocks[8]:sub(11,32)

455 blocks[36] = 'FFFFFF'..'FFFF'..blocks[36]:sub(11,32)

456 --print (blocks[8])

457

458 -- max out hero challenges

459 --print (blocks[16])

460 blocks[16] = blocks[16]:sub(1,24)..'FFFFFFFF'

461 blocks[44] = blocks[44]:sub(1,24)..'FFFFFFFF'

462 --print (blocks[16])

463

464 -- max out heropoints

465 --print (blocks[13])

466 blocks[13] = blocks[13]:sub(1,19)..'0064'..blocks[13]:sub(24,32)

467 blocks[41] = blocks[41]:sub(1,19)..'0064'..blocks[41]:sub(24,32)

468 --print (blocks[13])

469

470 -- Update Checksums

471 print('Updating all checksums')

472 SetCheckSum(blocks, 3)

473 SetCheckSum(blocks, 2)

474 SetCheckSum(blocks, 1)

475 SetCheckSum(blocks, 0)

476

477 print('Validating all checksums')

478 ValidateCheckSums(blocks)

479 end

480

481 --Load dumpdata to emulator memory

482 if DEBUG then

483 print('Sending dumpdata to emulator memory')

484 err = LoadEmulator(blocks)

485 if err then return oops(err) end

486 core.clearCommandBuffer()

487 print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..'\" <--')

488 end

489 end

490 main(args)