This commit is contained in:
Philippe Teuwen 2021-10-10 01:35:38 +02:00
commit 88308ea727
98 changed files with 271 additions and 271 deletions

View file

@ -1,7 +1,7 @@
#!/usr/bin/env -S pm3 -l
--[[
A sampe script file on how to implement at cmd line inteface.
A sampe script file on how to implement at cmd line interface.
It also demonstrates how the script can be used with a shebang.
--]]

View file

@ -29,7 +29,7 @@ arguments = [[
-o do not connect - use this only if you previously used -k to stay connected
-r do not read response
-c calculate and append CRC
-k stay connected - dont inactivate the field
-k stay connected - don't inactivate the field
-x <payload> Data to send (NO SPACES!)
-d Debug flag
-t Topaz mode

View file

@ -83,7 +83,7 @@ local function tablelen(T)
end
---
-- helper function, gives a sorted table from table t,
-- order can be a seperate sorting-order function.
-- order can be a separate sorting-order function.
local function spairs(t, order)
-- collect the keys
local keys = {}

View file

@ -84,7 +84,7 @@ local function tablelen(T)
end
---
-- helper function, gives a sorted table from table t,
-- order can be a seperate sorting-order function.
-- order can be a separate sorting-order function.
local function spairs(t, order)
-- collect the keys
local keys = {}

View file

@ -25,7 +25,7 @@ script run hf_15_magic -h -u <uid>
arguments = [[
-h : this help
-u <UID> : UID (16 hexsymbols)
-a : use offical pm3 repo ISO15 commands instead of iceman fork.
-a : use official pm3 repo ISO15 commands instead of iceman fork.
]]
local DEBUG = true
@ -74,9 +74,9 @@ local function magicUID_iceman(b0, b1)
core.console('hf 15 raw -2 -c -d 022139'..b0)
end
--
--- Set UID on magic command enabled, OFFICAL REPO
local function magicUID_offical(b0, b1)
print('Using backdoor Magic tag function OFFICAL REPO')
--- Set UID on magic command enabled, OFFICIAL REPO
local function magicUID_official(b0, b1)
print('Using backdoor Magic tag function OFFICIAL REPO')
core.console('hf 15 cmd raw -c 02213E00000000')
core.console('hf 15 cmd raw -c 02213F69960000')
core.console('hf 15 cmd raw -c 022138'..b1)
@ -117,7 +117,7 @@ function main(args)
if use_iceman then
magicUID_iceman(block0, block1)
else
magicUID_offical(block0, block1)
magicUID_official(block0, block1)
end
end

View file

@ -136,10 +136,10 @@ it's kinda interactive with following commands in three categories:
lf: 'load file' - load a (xored) binary file (*.bin) from the local Filesystem into the 'virtual inTag'
sf: 'save file' - saves the 'virtual inTag' to the local Filesystem as eml and bin (xored with Tag-MCC)
xf: 'xor file' - saves the 'virtual inTag' to the local Filesystem (xored with choosen MCC - use '00' for plain values)
xf: 'xor file' - saves the 'virtual inTag' to the local Filesystem (xored with chosen MCC - use '00' for plain values)
ct: 'copy tag' - copy the 'virtual Tag' to a second 'virtual TAG' - not usefull yet, but inernally needed
tc: 'copy tag' - copy the 'second virtual Tag' to 'virtual TAG' - not usefull yet, but inernally needed
ct: 'copy tag' - copy the 'virtual Tag' to a second 'virtual TAG' - not useful yet, but inernally needed
tc: 'copy tag' - copy the 'second virtual Tag' to 'virtual TAG' - not useful yet, but inernally needed
tt: 'toggle tag' - copy mainTag to BackupTag and backupTag to mainTag
di: 'dump mainTag' - shows the current content of the 'virtual Tag'
@ -155,7 +155,7 @@ it's kinda interactive with following commands in three categories:
cc: 'check Segment-CRC'- checks & calculates (if check failed) the Segment-CRC of all Segments
ck: 'check KGH-CRC' - checks the and calculates a 'Kaba Group Header' if one was detected
'Kaba Group Header CRC calculation'
tk: 'toggle KGH' - toglle the (script-internal) flag for kgh-calculation for a segment
tk: 'toggle KGH' - toggle the (script-internal) flag for kgh-calculation for a segment
xc: 'etra c' - show string that was used to calculate the kgh-crc of a segment
dlc: 'dump Legic-Cash' - show balance and checksums of a Legic-Cash Segment
@ -359,7 +359,7 @@ function getInputBytes(infile)
local line
local bytes = {}
local fhi,err = io.open(infile,"rb")
if err then oops("faild to read from file ".. infile); return false; end
if err then oops("failed to read from file ".. infile); return false; end
file_data = fhi:read("*a");
for i = 1, #file_data do
@ -767,7 +767,7 @@ local function saveTagMap(map, filename)
local line
local fho,err = io.open(filename, "w")
if err then oops("OOps ... faild to open output-file "..acyellow..filename..acoff) end
if err then oops("OOps ... failed to open output-file "..acyellow..filename..acoff) end
-- write line to new file
for k, v in pairs(map) do
@ -1871,7 +1871,7 @@ function getSegmentStamp(seg, bytes)
-- with stamps smaller 3 bytes (except: Master-Token)
-- WRP -> Read/Write Protection
-- WRC -> Read/Write Condition
-- RD depends on WRC - if WRC > 0 and RD=1: only reader with matching #WRC of Stamp-bytes in thier Database have Read-Access to the Tag
-- RD depends on WRC - if WRC > 0 and RD=1: only reader with matching #WRC of Stamp-bytes in their Database have Read-Access to the Tag
if (seg.WRP<7) then stamp_len=(seg.WRP) end
for i=1, (stamp_len) do
stamp=stamp..seg.data[i-1]
@ -2780,7 +2780,7 @@ function main(args)
bytes=tagToBytes(inTAG)
if (cfs) then
-- xor willl be done in function writeFile
-- xor will be done in function writeFile
-- with the value of byte[5]
bytes[5]=crc
end

View file

@ -224,7 +224,7 @@ end
-- write to file
local function writeOutputBytes(bytes, outfile)
local fho,err = io.open(outfile, "wb")
if err then print("OOps ... faild to open output-file ".. outfile); return false; end
if err then print("OOps ... failed to open output-file ".. outfile); return false; end
for i = 1, #bytes do
fho:write(string.char(tonumber(bytes[i], 16)))

View file

@ -434,7 +434,7 @@ local function main(args)
local fairy = blocks[9]:sub(1,8)
--FD0F = Left, FF0F = Right
local path = 'not choosen'
local path = 'not chosen'
if fairy:sub(2,2) == 'D' then
path = 'Left'
elseif fairy:sub(2,2) == 'F' then

View file

@ -367,7 +367,7 @@ local function write_version(data)
end
end
---
-- writen TYPE which card is based on.
-- write TYPE which card is based on.
-- 00 = 213, 01 = 215, 02 = 216
local function write_type(data)
-- type string checks
@ -390,7 +390,7 @@ end
---
-- Set tag type. Predefinde version data together with magic type set.
-- Since cmd always gives 10 bytes len (data+crc) we can impersonate the following types
-- we only truely be three types NTAG 213,215 and 216
-- we only truly be three types NTAG 213,215 and 216
local function set_type(tagtype)
-- tagtype checks

View file

@ -15,7 +15,7 @@ It also write the dump to an eml-file <uid>.eml.
(The difference between an .eml-file and a .bin-file is that the eml file contains
ASCII representation of the hex-data, with linebreaks between 'rows'. A .bin-file contains the
raw data, but when saving into that for, we lose the infromation about how the memory is structured.
raw data, but when saving into that for, we lose the information about how the memory is structured.
For example: 24 bytes could be 6 blocks of 4 bytes, or vice versa.
Therefore, the .eml is better to use file when saving dumps.)

View file

@ -83,7 +83,7 @@ local function main(args)
2. lf em 4x05_write
3. lf em 4x05_read
The first two commands dont need a feedback from the system, so going with core.console commands.
The first two commands don't need a feedback from the system, so going with core.console commands.
Since the read needs demodulation of signal I opted to add that function from cmdlfem4x.c to the core lua scripting
core.em4x05_read(addr, password)

View file

@ -26,7 +26,7 @@ It uses both LF and HF simulations.
-- Author note
-- I wrote this as i was doing a PACS audit. This is far from complete, but is easily expandable.
-- The idea was based on proxbrute, but i needed more options, and support for different readers.
-- I dont know LUA, so I used Brian Redbeards lf_hid_bulkclone.lua script as a starting point, sorry if its kludgy.
-- I don't know LUA, so I used Brian Redbeards lf_hid_bulkclone.lua script as a starting point, sorry if its kludgy.
]]
example = [[