github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 05:43:48 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Update tnp3clone.lua

Browse source 
According to post http://www.proxmark.org/forum/viewtopic.php?pid=34046#p34046
Set that ATQA / SAK,  set Sector 0 accessrights
This commit is contained in:
Iceman 2019-01-20 23:46:03 +01:00 • committed by GitHub
commit 49fc2a56ab
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 42 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

50
client/scripts/tnp3clone.lua
View file

@ -37,13 +37,12 @@ Arguments:
0020 - Swapforce 0020 - Swapforce
]] ]]
-- This is only meant to be used when errors occur -- This is only meant to be used when errors occur
function oops(err) local function oops(err)
print("ERROR: ",err) print("ERROR: ",err)
end end
-- Usage help -- Usage help
function help() local function help()
print(desc) print(desc)
print("Example usage") print("Example usage")
print(example) print(example)
@ -64,7 +63,7 @@ local function waitCmd()
end end
local function readblock( blocknum, keyA ) local function readblock( blocknum, keyA )
-- Read block 0 -- Read block N
cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blocknum, arg2 = 0, arg3 = 0, data = keyA} cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blocknum, arg2 = 0, arg3 = 0, data = keyA}
err = core.SendCommand(cmd:getBytes()) err = core.SendCommand(cmd:getBytes())
if err then return nil, err end if err then return nil, err end
@ -72,8 +71,9 @@ local function readblock( blocknum, keyA )
if err then return nil, err end if err then return nil, err end
return block0 return block0
end end
local function readmagicblock( blocknum ) local function readmagicblock( blocknum )
-- Read block 0 -- Read block N
local CSETBLOCK_SINGLE_OPERATION = 0x1F local CSETBLOCK_SINGLE_OPERATION = 0x1F
cmd = Command:new{cmd = cmds.CMD_MIFARE_CGETBLOCK, arg1 = CSETBLOCK_SINGLE_OPERATION, arg2 = 0, arg3 = blocknum} cmd = Command:new{cmd = cmds.CMD_MIFARE_CGETBLOCK, arg1 = CSETBLOCK_SINGLE_OPERATION, arg2 = 0, arg3 = blocknum}
err = core.SendCommand(cmd:getBytes()) err = core.SendCommand(cmd:getBytes())
@ -93,7 +93,9 @@ local function main(args)
local csetuid = 'hf mf csetuid ' local csetuid = 'hf mf csetuid '
local cget = 'hf mf cgetbl ' local cget = 'hf mf cgetbl '
local empty = '00000000000000000000000000000000' local empty = '00000000000000000000000000000000'
local AccAndKeyB = '7F078869000000000000' local AccAndKeyB = '7F070869000000000000'
local atqa = '0F01'
local sak = '81'
-- Defaults to Gusto -- Defaults to Gusto
local toytype = 'C201' local toytype = 'C201'
local subtype = '0030' local subtype = '0030'
@ -107,20 +109,19 @@ local function main(args)
if o == "l" then return toys.List() end if o == "l" then return toys.List() end
end end
if #toytype ~= 4 then return oops('Wrong size - toytype. (4hex symbols)') end if #toytype ~= 4 then return oops('[!] Wrong size - toytype. (4hex symbols)') end
if #subtype ~= 4 then return oops('Wrong size - subtype. (4hex symbols)') end if #subtype ~= 4 then return oops('[!] Wrong size - subtype. (4hex symbols)') end
-- look up type, find & validate types -- look up type, find & validate types
local item = toys.Find( toytype, subtype) local item = toys.Find( toytype, subtype)
if item then if item then
print( (' Looking up input: Found %s - %s (%s)'):format(item[6],item[5], item[4]) ) print( ('[+] Looking up input: Found %s - %s (%s)'):format(item[6],item[5], item[4]) )
else else
print('Didn\'t find item type. If you are sure about it, report it in') print('[-] Didn\'t find item type. If you are sure about it, post on forum')
end end
--15,16 --15,16
--13-14 --13-14
-- find tag -- find tag
result, err = lib14a.read(false, true) result, err = lib14a.read(false, true)
if not result then return oops(err) end if not result then return oops(err) end
@ -131,17 +132,30 @@ local function main(args)
local b0 = readblock(0, keyA) local b0 = readblock(0, keyA)
if not b0 then if not b0 then
print('failed reading block with factorydefault key. Trying chinese magic read.') print('[-] failed reading block with factorydefault key. Trying chinese magic read.')
b0, err = readmagicblock(0) b0, err = readmagicblock(0)
if not b0 then if not b0 then
oops(err) oops('[!] '..err)
return oops('failed reading block with chinese magic command. quitting...') return oops('[!] failed reading block with chinese magic command. Quitting...')
end end
end end
core.clearCommandBuffer()
local b3 = readblock(3, keyA)
if not b3 then
print('[-] failed reading block with factorydefault key. Trying chinese magic read.')
b3, err = readmagicblock(0)
if not b3 then
oops('[!] '..err)
return oops('[!] failed reading block with chinese magic command. Quitting...')
end
end
core.clearCommandBuffer()
-- wipe card. -- wipe card.
local cmd = (csetuid..'%s 0004 08 w'):format(result.uid) local cmd = (csetuid..'%s %s %s w'):format(result.uid, atqa, sak)
core.console(cmd) core.console(cmd)
core.clearCommandBuffer()
local b1 = toytype..string.rep('00',10)..subtype local b1 = toytype..string.rep('00',10)..subtype
@ -150,6 +164,7 @@ local function main(args)
local cmd = (cset..'1 %s%04x'):format( b1, calcEndian) local cmd = (cset..'1 %s%04x'):format( b1, calcEndian)
core.console(cmd) core.console(cmd)
core.clearCommandBuffer()
local pos, key local pos, key
for blockNo = 2, numBlocks-1, 1 do for blockNo = 2, numBlocks-1, 1 do
@ -161,5 +176,10 @@ local function main(args)
end end
end end
core.clearCommandBuffer() core.clearCommandBuffer()
-- Set sector trailer S0, since it has different access rights
cmd = ('%s 3 %s%s'):format(cset, keyA, b3:sub(13) )
core.console(cmd)
core.clearCommandBuffer()
end end
main(args) main(args)