X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/cff17e78f50c9d7dc4eb8919bf7f13c5352c29bf..45293f1096a2fae3fbdad5f90248929cd9c6f562:/client/scripts/tnp3dump.lua

diff --git a/client/scripts/tnp3dump.lua b/client/scripts/tnp3dump.lua
index f93f9728..f3d377f7 100644
--- a/client/scripts/tnp3dump.lua
+++ b/client/scripts/tnp3dump.lua
@@ -30,9 +30,7 @@ Arguments:
 	-p             : Use the precalc to find all keys
 	-o             : filename for the saved dumps
 ]]
-
-local HASHCONSTANT = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
-
+local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
 local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
 local DEBUG = false -- the debug flag
 local numBlocks = 64
@@ -40,9 +38,7 @@ local numSectors = 16
 --- 
 -- A debug printout-function
 function dbg(args)
-	if not DEBUG then
-		return
-	end
+	if not DEBUG then return end
 	
     if type(args) == "table" then
 		local i = 1
@@ -58,6 +54,7 @@ end
 -- This is only meant to be used when errors occur
 function oops(err)
 	print("ERROR: ",err)
+	return nil,err
 end
 --- 
 -- Usage help
@@ -96,16 +93,6 @@ local function waitCmd()
 	return nil, "No response from device"
 end
 
-local function computeCrc16(s)
-	local hash = core.crc16(utils.ConvertHexToAscii(s))	
-	return hash
-end
-
-local function reverseCrcBytes(crc)
-	crc2 = crc:sub(3,4)..crc:sub(1,2)
-	return tonumber(crc2,16)
-end
-
 local function main(args)
 
 	print( string.rep('--',20) )
@@ -146,10 +133,6 @@ local function main(args)
 
 	core.clearCommandBuffer()
 	
-	if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
-	--	return oops('This is not a TNP3xxx tag. aborting.')
-	end	
-
 	-- Show tag info
 	print((' Found tag %s'):format(result.name))
 
@@ -182,6 +165,8 @@ local function main(args)
 	local block0, err = waitCmd()
 	if err then return oops(err) end
 	
+	core.clearCommandBuffer()
+	
 	-- Read block 1
 	cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1,arg2 = 0,arg3 = 0, data = keyA}
 	err = core.SendCommand(cmd:getBytes())
@@ -189,14 +174,15 @@ local function main(args)
 	local block1, err = waitCmd()
 	if err then return oops(err) end
 
+	core.clearCommandBuffer()
+	
+	local tmpHash = block0..block1..'%02x'..RANDOM
+
 	local key
 	local pos = 0
 	local blockNo
 	local blocks = {}
-
-	print('Reading card data')
-	core.clearCommandBuffer()
-		
+	
 	-- main loop
 	io.write('Reading blocks > ')
 	for blockNo = 0, numBlocks-1, 1 do
@@ -206,6 +192,8 @@ local function main(args)
 			break
 		end
 	
+		core.clearCommandBuffer()
+		
 		pos = (math.floor( blockNo / 4 ) * 12)+1
 		key = akeys:sub(pos, pos + 11 )
 		cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
@@ -219,22 +207,19 @@ local function main(args)
 		
 			if blockNo < 8 then
 				-- Block 0-7 not encrypted
-				blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata) 
+				blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata)
 			else
-				local base = ('%s%s%02x%s'):format(block0, block1, blockNo, HASHCONSTANT)	
-				local baseStr = utils.ConvertHexToAscii(base)
-				local md5hash = md5.sumhexa(baseStr)
-				local aestest = core.aes(md5hash, blockdata)
-
-				local hex = utils.ConvertAsciiToBytes(aestest)
-				hex = utils.ConvertBytesToHex(hex)
-
 				-- blocks with zero not encrypted.
 				if string.find(blockdata, '^0+$') then
-					blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata) 
+					blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,blockdata)
 				else
+					local baseStr = utils.ConvertHexToAscii(tmpHash:format(blockNo))
+					local key = md5.sumhexa(baseStr)
+					local aestest = core.aes128_decrypt(key, blockdata)
+					local hex = utils.ConvertAsciiToHex(aestest)
+					
 					blocks[blockNo+1] = ('%02d  :: %s'):format(blockNo,hex)
-					io.write( blockNo..',')
+					io.write(blockNo..',')
 				end		
 			end
 		else
@@ -252,17 +237,14 @@ local function main(args)
 
 	for _,s in pairs(blocks) do
 		local slice = s:sub(8,#s)
-		local str = utils.ConvertBytesToAscii(
-				 utils.ConvertHexToBytes(slice)
-				)
+		local str = utils.ConvertHexToAscii(slice)
 		emldata = emldata..slice..'\n'
 		for c in (str):gmatch('.') do
 			bindata[#bindata+1] = c
-		end
+		end		
 	end 
 
 	print( string.rep('--',20) )
-
 	
 	local uid = block0:sub(1,8)
 	local toytype = block1:sub(1,4)
@@ -273,26 +255,26 @@ local function main(args)
 	
 	-- Write dump to files
 	if not DEBUG then
-		local foo = dumplib.SaveAsBinary(bindata, outputTemplate..'_uid_'..uid..'.bin')
+		local foo = dumplib.SaveAsBinary(bindata, outputTemplate..'-'..uid..'.bin')
 		print(("Wrote a BIN dump to:  %s"):format(foo))
-		local bar = dumplib.SaveAsText(emldata, outputTemplate..'_uid_'..uid..'.eml')
+		local bar = dumplib.SaveAsText(emldata, outputTemplate..'-'..uid..'.eml')
 		print(("Wrote a EML dump to:  %s"):format(bar))
 	end
+	
+	print( string.rep('--',20) )
+	-- Show info 
 
 	local item = toys.Find(toytype, subtype)
 	if item then
-		local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])
-		print('            ITEM TYPE : '..itemStr )
+		print(('            ITEM TYPE : %s - %s (%s)'):format(item[6],item[5], item[4]) )
 	else
 		print(('            ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype))
 	end
-	
-	-- Show info 
-	print( (' Alter ego / traptype : 0x%s'):format(traptype) )
+
 	print( ('                  UID : 0x%s'):format(uid) )
 	print( ('               CARDID : 0x%s'):format(cardid ) )
-	
 	print( string.rep('--',20) )
-
+	
+	core.clearCommandBuffer()
 end
 main(args)
\ No newline at end of file