mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-08-19 21:03:23 -07:00
Merge remote-tracking branch 'origin/master' into PenturaLabs-iclass-research
This commit is contained in:
Martin Holst Swende
commit
e6ee6c4cd1
15 changed files with 1249 additions and 734 deletions
|
|
@ -183,27 +183,29 @@ void iso14a_set_timeout(uint32_t timeout) {
|
|||
|
||||
int CmdHF14AReader(const char *Cmd)
|
||||
{
|
||||
UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
|
||||
UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}};
|
||||
SendCommand(&c);
|
||||
|
||||
UsbCommand resp;
|
||||
WaitForResponse(CMD_ACK,&resp);
|
||||
|
||||
iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes;
|
||||
iso14a_card_select_t card;
|
||||
memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
|
||||
|
||||
if(resp.arg[0] == 0) {
|
||||
uint64_t select_status = resp.arg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS
|
||||
|
||||
if(select_status == 0) {
|
||||
PrintAndLog("iso14443a card select failed");
|
||||
return 0;
|
||||
}
|
||||
|
||||
PrintAndLog("ATQA : %02x %02x", card->atqa[0], card->atqa[1]);
|
||||
PrintAndLog(" UID : %s", sprint_hex(card->uid, card->uidlen));
|
||||
PrintAndLog(" SAK : %02x [%d]", card->sak, resp.arg[0]);
|
||||
PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
|
||||
PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen));
|
||||
PrintAndLog(" SAK : %02x [%d]", card.sak, resp.arg[0]);
|
||||
|
||||
switch (card->sak) {
|
||||
switch (card.sak) {
|
||||
case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
|
||||
case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
|
||||
|
||||
case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
|
||||
case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
|
||||
case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
|
||||
|
|
@ -217,67 +219,107 @@ int CmdHF14AReader(const char *Cmd)
|
|||
case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
|
||||
default: ;
|
||||
}
|
||||
if(resp.arg[0] == 1) {
|
||||
|
||||
|
||||
// try to request ATS even if tag claims not to support it
|
||||
if (select_status == 2) {
|
||||
uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
|
||||
c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT;
|
||||
c.arg[1] = 2;
|
||||
c.arg[2] = 0;
|
||||
memcpy(c.d.asBytes, rats, 2);
|
||||
SendCommand(&c);
|
||||
WaitForResponse(CMD_ACK,&resp);
|
||||
|
||||
memcpy(&card.ats, resp.d.asBytes, resp.arg[0]);
|
||||
card.ats_len = resp.arg[0]; // note: ats_len includes CRC Bytes
|
||||
}
|
||||
|
||||
// disconnect
|
||||
c.arg[0] = 0;
|
||||
c.arg[1] = 0;
|
||||
c.arg[2] = 0;
|
||||
SendCommand(&c);
|
||||
|
||||
|
||||
if(card.ats_len >= 3) { // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
|
||||
bool ta1 = 0, tb1 = 0, tc1 = 0;
|
||||
int pos;
|
||||
|
||||
PrintAndLog(" ATS : %s", sprint_hex(card->ats, card->ats_len));
|
||||
if (card->ats_len > 0) {
|
||||
PrintAndLog(" - TL : length is %d bytes", card->ats[0]);
|
||||
if (select_status == 2) {
|
||||
PrintAndLog("SAK incorrectly claims that card doesn't support RATS");
|
||||
}
|
||||
if (card->ats_len > 1) {
|
||||
ta1 = (card->ats[1] & 0x10) == 0x10;
|
||||
tb1 = (card->ats[1] & 0x20) == 0x20;
|
||||
tc1 = (card->ats[1] & 0x40) == 0x40;
|
||||
PrintAndLog(" ATS : %s", sprint_hex(card.ats, card.ats_len));
|
||||
PrintAndLog(" - TL : length is %d bytes", card.ats[0]);
|
||||
if (card.ats[0] != card.ats_len - 2) {
|
||||
PrintAndLog("ATS may be corrupted. Length of ATS (%d bytes incl. 2 Bytes CRC) doesn't match TL", card.ats_len);
|
||||
}
|
||||
|
||||
if (card.ats[0] > 1) { // there is a format byte (T0)
|
||||
ta1 = (card.ats[1] & 0x10) == 0x10;
|
||||
tb1 = (card.ats[1] & 0x20) == 0x20;
|
||||
tc1 = (card.ats[1] & 0x40) == 0x40;
|
||||
int16_t fsci = card.ats[1] & 0x0f;
|
||||
PrintAndLog(" - T0 : TA1 is%s present, TB1 is%s present, "
|
||||
"TC1 is%s present, FSCI is %d",
|
||||
"TC1 is%s present, FSCI is %d (FSC = %ld)",
|
||||
(ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
|
||||
(card->ats[1] & 0x0f));
|
||||
fsci,
|
||||
fsci < 5 ? (fsci - 2) * 8 :
|
||||
fsci < 8 ? (fsci - 3) * 32 :
|
||||
fsci == 8 ? 256 :
|
||||
-1
|
||||
);
|
||||
}
|
||||
pos = 2;
|
||||
if (ta1 && card->ats_len > pos) {
|
||||
if (ta1) {
|
||||
char dr[16], ds[16];
|
||||
dr[0] = ds[0] = '\0';
|
||||
if (card->ats[pos] & 0x10) strcat(ds, "2, ");
|
||||
if (card->ats[pos] & 0x20) strcat(ds, "4, ");
|
||||
if (card->ats[pos] & 0x40) strcat(ds, "8, ");
|
||||
if (card->ats[pos] & 0x01) strcat(dr, "2, ");
|
||||
if (card->ats[pos] & 0x02) strcat(dr, "4, ");
|
||||
if (card->ats[pos] & 0x04) strcat(dr, "8, ");
|
||||
if (card.ats[pos] & 0x10) strcat(ds, "2, ");
|
||||
if (card.ats[pos] & 0x20) strcat(ds, "4, ");
|
||||
if (card.ats[pos] & 0x40) strcat(ds, "8, ");
|
||||
if (card.ats[pos] & 0x01) strcat(dr, "2, ");
|
||||
if (card.ats[pos] & 0x02) strcat(dr, "4, ");
|
||||
if (card.ats[pos] & 0x04) strcat(dr, "8, ");
|
||||
if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
|
||||
if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
|
||||
PrintAndLog(" - TA1 : different divisors are%s supported, "
|
||||
"DR: [%s], DS: [%s]",
|
||||
(card->ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
|
||||
(card.ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
|
||||
pos++;
|
||||
}
|
||||
if (tb1 && card->ats_len > pos) {
|
||||
PrintAndLog(" - TB1 : SFGI = %d, FWI = %d",
|
||||
(card->ats[pos] & 0x08),
|
||||
(card->ats[pos] & 0x80) >> 4);
|
||||
if (tb1) {
|
||||
uint32_t sfgi = card.ats[pos] & 0x0F;
|
||||
uint32_t fwi = card.ats[pos] >> 4;
|
||||
PrintAndLog(" - TB1 : SFGI = %d (SFGT = %s%ld/fc), FWI = %d (FWT = %ld/fc)",
|
||||
(sfgi),
|
||||
sfgi ? "" : "(not needed) ",
|
||||
sfgi ? (1 << 12) << sfgi : 0,
|
||||
fwi,
|
||||
(1 << 12) << fwi
|
||||
);
|
||||
pos++;
|
||||
}
|
||||
if (tc1 && card->ats_len > pos) {
|
||||
if (tc1) {
|
||||
PrintAndLog(" - TC1 : NAD is%s supported, CID is%s supported",
|
||||
(card->ats[pos] & 0x01) ? "" : " NOT",
|
||||
(card->ats[pos] & 0x02) ? "" : " NOT");
|
||||
(card.ats[pos] & 0x01) ? "" : " NOT",
|
||||
(card.ats[pos] & 0x02) ? "" : " NOT");
|
||||
pos++;
|
||||
}
|
||||
if (card->ats_len > pos) {
|
||||
if (card.ats[0] > pos) {
|
||||
char *tip = "";
|
||||
if (card->ats_len - pos > 7) {
|
||||
if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
|
||||
if (card.ats[0] - pos >= 7) {
|
||||
if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
|
||||
tip = "-> MIFARE Plus X 2K or 4K";
|
||||
} else if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
|
||||
} else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
|
||||
tip = "-> MIFARE Plus S 2K or 4K";
|
||||
}
|
||||
}
|
||||
PrintAndLog(" - HB : %s%s", sprint_hex(card->ats + pos, card->ats_len - pos - 2), tip);
|
||||
if (card->ats[pos] == 0xC1) {
|
||||
PrintAndLog(" - HB : %s%s", sprint_hex(card.ats + pos, card.ats[0] - pos), tip);
|
||||
if (card.ats[pos] == 0xC1) {
|
||||
PrintAndLog(" c1 -> Mifare or (multiple) virtual cards of various type");
|
||||
PrintAndLog(" %02x -> Length is %d bytes",
|
||||
card->ats[pos + 1], card->ats[pos + 1]);
|
||||
switch (card->ats[pos + 2] & 0xf0) {
|
||||
card.ats[pos + 1], card.ats[pos + 1]);
|
||||
switch (card.ats[pos + 2] & 0xf0) {
|
||||
case 0x10:
|
||||
PrintAndLog(" 1x -> MIFARE DESFire");
|
||||
break;
|
||||
|
|
@ -285,7 +327,7 @@ int CmdHF14AReader(const char *Cmd)
|
|||
PrintAndLog(" 2x -> MIFARE Plus");
|
||||
break;
|
||||
}
|
||||
switch (card->ats[pos + 2] & 0x0f) {
|
||||
switch (card.ats[pos + 2] & 0x0f) {
|
||||
case 0x00:
|
||||
PrintAndLog(" x0 -> <1 kByte");
|
||||
break;
|
||||
|
|
@ -302,7 +344,7 @@ int CmdHF14AReader(const char *Cmd)
|
|||
PrintAndLog(" x0 -> 8 kByte");
|
||||
break;
|
||||
}
|
||||
switch (card->ats[pos + 3] & 0xf0) {
|
||||
switch (card.ats[pos + 3] & 0xf0) {
|
||||
case 0x00:
|
||||
PrintAndLog(" 0x -> Engineering sample");
|
||||
break;
|
||||
|
|
@ -310,7 +352,7 @@ int CmdHF14AReader(const char *Cmd)
|
|||
PrintAndLog(" 2x -> Released");
|
||||
break;
|
||||
}
|
||||
switch (card->ats[pos + 3] & 0x0f) {
|
||||
switch (card.ats[pos + 3] & 0x0f) {
|
||||
case 0x00:
|
||||
PrintAndLog(" x0 -> Generation 1");
|
||||
break;
|
||||
|
|
@ -321,7 +363,7 @@ int CmdHF14AReader(const char *Cmd)
|
|||
PrintAndLog(" x2 -> Generation 3");
|
||||
break;
|
||||
}
|
||||
switch (card->ats[pos + 4] & 0x0f) {
|
||||
switch (card.ats[pos + 4] & 0x0f) {
|
||||
case 0x00:
|
||||
PrintAndLog(" x0 -> Only VCSL supported");
|
||||
break;
|
||||
|
|
@ -335,10 +377,10 @@ int CmdHF14AReader(const char *Cmd)
|
|||
}
|
||||
}
|
||||
} else {
|
||||
PrintAndLog("proprietary non iso14443a-4 card found, RATS not supported");
|
||||
}
|
||||
PrintAndLog("proprietary non iso14443-4 card found, RATS not supported");
|
||||
}
|
||||
|
||||
return resp.arg[0];
|
||||
return select_status;
|
||||
}
|
||||
|
||||
// Collect ISO14443 Type A UIDs
|
||||
|
|
@ -357,23 +399,20 @@ int CmdHF14ACUIDs(const char *Cmd)
|
|||
UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
|
||||
SendCommand(&c);
|
||||
|
||||
UsbCommand resp;
|
||||
WaitForResponse(CMD_ACK,&resp);
|
||||
UsbCommand resp;
|
||||
WaitForResponse(CMD_ACK,&resp);
|
||||
|
||||
uint8_t *uid = resp.d.asBytes;
|
||||
iso14a_card_select_t *card = (iso14a_card_select_t *)(uid + 12);
|
||||
iso14a_card_select_t *card = (iso14a_card_select_t *) resp.d.asBytes;
|
||||
|
||||
// check if command failed
|
||||
if (resp.arg[0] == 0) {
|
||||
PrintAndLog("Card select failed.");
|
||||
} else {
|
||||
// check if UID is 4 bytes
|
||||
if ((card->atqa[1] & 0xC0) == 0) {
|
||||
PrintAndLog("%02X%02X%02X%02X",
|
||||
*uid, *(uid + 1), *(uid + 2), *(uid + 3));
|
||||
} else {
|
||||
PrintAndLog("UID longer than 4 bytes");
|
||||
char uid_string[20];
|
||||
for (uint16_t i = 0; i < card->uidlen; i++) {
|
||||
sprintf(&uid_string[2*i], "%02X", card->uid[i]);
|
||||
}
|
||||
PrintAndLog("%s", uid_string);
|
||||
}
|
||||
}
|
||||
PrintAndLog("End: %u", time(NULL));
|
||||
|
|
|
|||
891
client/cmdhfmf.c
891
client/cmdhfmf.c
File diff suppressed because it is too large
Load diff
79
client/default_keys.dic
Normal file
79
client/default_keys.dic
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
# Default Keys as already in Proxmark.exe:
|
||||
ffffffffffff,//Defaultkey(firstkeyusedbyprogramifnouserdefinedkey)
|
||||
000000000000,//Blankkey
|
||||
a0a1a2a3a4a5,//NFCForumMADkey
|
||||
b0b1b2b3b4b5,
|
||||
aabbccddeeff,
|
||||
4d3a99c351dd,
|
||||
1a982c7e459a,
|
||||
d3f7d3f7d3f7,
|
||||
714c5c886e97,
|
||||
587ee5f9350f,
|
||||
a0478cc39091,
|
||||
533cb6c723f6,
|
||||
8fd0a4f256e9
|
||||
# more Keys from mf_default_keys.lua
|
||||
000000000001,
|
||||
000000000002,
|
||||
00000000000a,
|
||||
00000000000b,
|
||||
00000ffe2488,--VästtrafikenKeyB
|
||||
010203040506,
|
||||
0123456789ab,
|
||||
0297927c0f77,--VästtrafikenKeyA
|
||||
100000000000,
|
||||
111111111111,
|
||||
123456789abc,
|
||||
12f2ee3478c1,
|
||||
14d446e33363,
|
||||
1999a3554a55,
|
||||
200000000000,
|
||||
222222222222,
|
||||
26940b21ff5d,--RKFSLKeyA
|
||||
27dd91f1fcf1,
|
||||
2BA9621E0A36,--DirectoryandeventlogKeyB
|
||||
333333333333,
|
||||
33f974b42769,
|
||||
34d1df9934c5,
|
||||
434f4d4d4f41,--RKFJOJOGROUPKeyA
|
||||
434f4d4d4f42,--RKFJOJOGROUPKeyB
|
||||
43ab19ef5c31,
|
||||
444444444444,
|
||||
47524f555041,--RKFJOJOGROUPKeyA
|
||||
47524f555042,--RKFJOJOGROUPKeyB
|
||||
4AF9D7ADEBE4,--DirectoryandeventlogKeyA
|
||||
505249564141,--RKFJOJOPRIVAKeyA
|
||||
505249564142,--RKFJOJOPRIVAKeyB
|
||||
505249565441,
|
||||
505249565442,
|
||||
54726176656c,--VästtrafikenKeyA
|
||||
555555555555,
|
||||
55f5a5dd38c9,
|
||||
5c598c9c58b5,--RKFSLKeyB
|
||||
666666666666,
|
||||
722bfcc5375f,--RKFRejskortDanmarkKeyA
|
||||
776974687573,--VästtrafikenKeyB
|
||||
777777777777,
|
||||
888888888888,
|
||||
999999999999,
|
||||
99c636334433,
|
||||
a00000000000,
|
||||
a053a292a4af,
|
||||
a64598a77478,--RKFSLKeyA
|
||||
a94133013401,
|
||||
aaaaaaaaaaaa,
|
||||
abcdef123456,--Keyfromladyada.net
|
||||
b00000000000,
|
||||
b127c6f41436,
|
||||
bbbbbbbbbbbb,
|
||||
bd493a3962b6,
|
||||
c934fe34d934,
|
||||
cccccccccccc,
|
||||
dddddddddddd,
|
||||
e4d2770a89be,--RKFSLKeyB
|
||||
ee0042f88840,--VästtrafikenKeyB
|
||||
eeeeeeeeeeee,
|
||||
f1a97341a9fc,
|
||||
f1d83f964314,--RKFRejskortDanmarkKeyB
|
||||
fc00018778f7,--VästtrafikenKeyA
|
||||
fc0001877bf7,--RKFÖstgötaTrafikenKeyA
|
||||
|
|
@ -8,10 +8,17 @@ bin = require('bin')
|
|||
---
|
||||
-- A debug printout-function
|
||||
local function dbg(args)
|
||||
if DEBUG then
|
||||
|
||||
if type(args) == "table" then
|
||||
local i = 1
|
||||
while args[i] do
|
||||
print("###", args[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print("###", args)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
local function oops(err)
|
||||
|
|
@ -40,20 +47,38 @@ local function save_HTML(javascript, filename)
|
|||
|
||||
end
|
||||
|
||||
|
||||
local function save_BIN(data, filename)
|
||||
-- Open the output file
|
||||
|
||||
local outfile = io.open(filename, "wb")
|
||||
if outfile == nil then
|
||||
return oops(string.format("Could not write to file %s",tostring(filename)))
|
||||
end
|
||||
|
||||
-- Write the data into it
|
||||
local i = 1
|
||||
while data[i] do
|
||||
outfile:write(data[i])
|
||||
i = i+1
|
||||
end
|
||||
|
||||
io.close(outfile)
|
||||
return filename
|
||||
end
|
||||
|
||||
local function convert_ascii_dump_to_JS(infile)
|
||||
local t = infile:read("*all")
|
||||
|
||||
local output = "[";
|
||||
for line in string.gmatch(t, "[^\n]+") do
|
||||
output = output .. "'"..line.."',\n"
|
||||
if string.byte(line,1) ~= string.byte("+",1) then
|
||||
output = output .. "'"..line.."',\n"
|
||||
end
|
||||
end
|
||||
output = output .. "]"
|
||||
return output
|
||||
end
|
||||
|
||||
|
||||
local function convert_binary_dump_to_JS(infile, blockLen)
|
||||
local bindata = infile:read("*all")
|
||||
len = string.len(bindata)
|
||||
|
|
@ -78,6 +103,21 @@ local function convert_binary_dump_to_JS(infile, blockLen)
|
|||
return js
|
||||
end
|
||||
|
||||
local function convert_ascii_dump_to_BIN(infile)
|
||||
local t = infile:read("*all")
|
||||
|
||||
local output = {};
|
||||
for line in string.gmatch(t, "[^\n]+") do
|
||||
if string.byte(line) ~= string.byte("+") then
|
||||
for c in (line or ''):gmatch('..') do
|
||||
output[#output+1] = string.char( tonumber(c,16) )
|
||||
end
|
||||
end
|
||||
end
|
||||
return output
|
||||
end
|
||||
|
||||
|
||||
---
|
||||
-- Converts a .eml-file into a HTML/Javascript file.
|
||||
-- @param input the file to convert
|
||||
|
|
@ -118,7 +158,27 @@ local function convert_bin_to_html(input, output, blockLen)
|
|||
return save_HTML(javascript, output )
|
||||
end
|
||||
|
||||
--- Converts a eml dump into a binary file
|
||||
-- @param input the file containing the eml-dump (defaults to dumpdata.eml)
|
||||
-- @param output the file to write to ( defaults to dumpdata.bin)
|
||||
local function convert_eml_to_bin(input, output)
|
||||
input = input or 'dumpdata.eml'
|
||||
output = output or 'dumpdata.bin'
|
||||
|
||||
local infile = io.open(input, "rb")
|
||||
if infile == nil then
|
||||
return oops(string.format("Could not read file %s",tostring(input)))
|
||||
end
|
||||
-- Read file, get BIN
|
||||
local data = convert_ascii_dump_to_BIN(infile)
|
||||
io.close(infile)
|
||||
|
||||
return save_BIN(data, output )
|
||||
end
|
||||
|
||||
|
||||
return {
|
||||
convert_bin_to_html = convert_bin_to_html,
|
||||
convert_eml_to_html = convert_eml_to_html,
|
||||
convert_eml_to_html = convert_eml_to_html,
|
||||
convert_eml_to_bin = convert_eml_to_bin,
|
||||
}
|
||||
|
|
|
|||
|
|
@ -126,6 +126,21 @@ local _keys = {
|
|||
'eeeeeeeeeeee',
|
||||
'0123456789ab',
|
||||
'123456789abc',
|
||||
|
||||
--[[
|
||||
The keys below are taken from from https://github.com/4ZM/mfterm/blob/master/dictionary.txt
|
||||
--]]
|
||||
|
||||
'abcdef123456', -- Key from ladyada.net
|
||||
|
||||
'000000000001',
|
||||
'000000000002',
|
||||
'00000000000a',
|
||||
'00000000000b',
|
||||
'100000000000',
|
||||
'200000000000',
|
||||
'a00000000000',
|
||||
'b00000000000',
|
||||
}
|
||||
|
||||
---
|
||||
|
|
@ -148,4 +163,4 @@ local function uniq(list)
|
|||
return foobar
|
||||
end
|
||||
|
||||
return uniq(_keys)
|
||||
return uniq(_keys)
|
||||
|
|
|
|||
57
client/lualibs/utils.lua
Normal file
57
client/lualibs/utils.lua
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
--[[
|
||||
This may be moved to a separate library at some point (Holiman)
|
||||
--]]
|
||||
local Utils =
|
||||
{
|
||||
-- Asks the user for Yes or No
|
||||
confirm = function(message, ...)
|
||||
local answer
|
||||
message = message .. " [y/n] ?"
|
||||
repeat
|
||||
io.write(message)
|
||||
io.flush()
|
||||
answer=io.read()
|
||||
if answer == 'Y' or answer == "y" then
|
||||
return true
|
||||
elseif answer == 'N' or answer == 'n' then
|
||||
return false
|
||||
end
|
||||
until false
|
||||
end,
|
||||
---
|
||||
-- Asks the user for input
|
||||
input = function (message , default)
|
||||
local answer
|
||||
if default ~= nil then
|
||||
message = message .. " (default: ".. default.. " )"
|
||||
end
|
||||
message = message .." \n > "
|
||||
io.write(message)
|
||||
io.flush()
|
||||
answer=io.read()
|
||||
if answer == '' then answer = default end
|
||||
|
||||
return answer
|
||||
end,
|
||||
--
|
||||
-- Converts DECIMAL to HEX
|
||||
ConvertDec2Hex = function(IN)
|
||||
local B,K,OUT,I,D=16,"0123456789ABCDEF","",0
|
||||
while IN>0 do
|
||||
I=I+1
|
||||
IN,D=math.floor(IN/B),math.mod(IN,B)+1
|
||||
OUT=string.sub(K,D,D)..OUT
|
||||
end
|
||||
return OUT
|
||||
end,
|
||||
---
|
||||
-- Convert Byte array to string of hex
|
||||
ConvertBytes2String = function(bytes)
|
||||
s = {}
|
||||
for i = 1, #(bytes) do
|
||||
s[i] = string.format("%02X",bytes[i])
|
||||
end
|
||||
return table.concat(s)
|
||||
end,
|
||||
}
|
||||
return Utils
|
||||
|
|
@ -13,7 +13,7 @@ by the emulator
|
|||
Arguments:
|
||||
-h This help
|
||||
-i <file> Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used
|
||||
-o <filename> Speciies the output file. If omitted, <uid>.eml is used.
|
||||
-o <filename> Specifies the output file. If omitted, <uid>.eml is used.
|
||||
|
||||
]]
|
||||
|
||||
|
|
|
|||
60
client/scripts/emul2dump.lua
Normal file
60
client/scripts/emul2dump.lua
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
local getopt = require('getopt')
|
||||
local bin = require('bin')
|
||||
local dumplib = require('html_dumplib')
|
||||
|
||||
example =[[
|
||||
1. script run emul2dump
|
||||
2. script run emul2dump -i myfile.eml
|
||||
3. script run emul2dump -i myfile.eml -o myfile.bin
|
||||
]]
|
||||
author = "Iceman"
|
||||
usage = "script run emul2dump [-i <file>] [-o <file>]"
|
||||
desc =[[
|
||||
This script takes an dumpfile on EML (ASCII) format and converts it to the PM3 dumpbin file to be used with "hf mf restore"
|
||||
|
||||
Arguments:
|
||||
-h This help
|
||||
-i <filename> Specifies the dump-file (input). If omitted, 'dumpdata.eml' is used
|
||||
-o <filename> Specifies the output file. If omitted, <currdate>.bin is used.
|
||||
]]
|
||||
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
function oops(err)
|
||||
print("ERROR: ",err)
|
||||
end
|
||||
---
|
||||
-- Usage help
|
||||
function help()
|
||||
print(desc)
|
||||
print("Example usage")
|
||||
print(example)
|
||||
end
|
||||
--
|
||||
-- Exit message
|
||||
function ExitMsg(msg)
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
print(msg)
|
||||
print()
|
||||
end
|
||||
|
||||
local function main(args)
|
||||
|
||||
local input = "dumpdata.eml"
|
||||
local output = os.date("%Y-%m-%d_%H%M%S.bin");
|
||||
|
||||
-- Arguments for the script
|
||||
for o, a in getopt.getopt(args, 'hi:o:') do
|
||||
if o == "h" then return help() end
|
||||
if o == "i" then input = a end
|
||||
if o == "o" then output = a end
|
||||
end
|
||||
|
||||
local filename, err = dumplib.convert_eml_to_bin(input,output)
|
||||
if err then return oops(err) end
|
||||
|
||||
ExitMsg(("Wrote a BIN dump to the file %s"):format(filename))
|
||||
end
|
||||
|
||||
main(args)
|
||||
196
client/scripts/formatMifare.lua
Normal file
196
client/scripts/formatMifare.lua
Normal file
|
|
@ -0,0 +1,196 @@
|
|||
local cmds = require('commands')
|
||||
local getopt = require('getopt')
|
||||
local bin = require('bin')
|
||||
local lib14a = require('read14a')
|
||||
local utils = require('utils')
|
||||
|
||||
example =[[
|
||||
1. script run formatMifare
|
||||
2. script run formatMifare -k aabbccddeeff -n 112233445566 -a FF0780
|
||||
]]
|
||||
author = "Iceman"
|
||||
usage = "script run formatMifare -k <key>"
|
||||
desc =[[
|
||||
This script will generate 'hf mf wrbl' commands for each block to format a Mifare card.
|
||||
|
||||
Alla datablocks gets 0x00
|
||||
As default the script sets the keys A/B to 0xFFFFFFFFFFFF
|
||||
and the access bytes will become 0x78,0x77,0x88
|
||||
The GDB will become 0x00
|
||||
|
||||
The script will skip the manufactoring block 0.
|
||||
|
||||
Arguments:
|
||||
-h - this help
|
||||
-k <key> - the current six byte key with write access
|
||||
-n <key> - the new key that will be written to the card
|
||||
-a <access> - the new access bytes that will be written to the card
|
||||
]]
|
||||
local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
|
||||
local DEBUG = true -- the debug flag
|
||||
local CmdString = 'hf mf wrbl %d B %s %s'
|
||||
local numBlocks = 64
|
||||
local numSectors = 16
|
||||
---
|
||||
-- A debug printout-function
|
||||
function dbg(args)
|
||||
if not DEBUG then
|
||||
return
|
||||
end
|
||||
|
||||
if type(args) == "table" then
|
||||
local i = 1
|
||||
while result[i] do
|
||||
dbg(result[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print("###", args)
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
function oops(err)
|
||||
print("ERROR: ",err)
|
||||
end
|
||||
---
|
||||
-- Usage help
|
||||
function help()
|
||||
print(desc)
|
||||
print("Example usage")
|
||||
print(example)
|
||||
end
|
||||
--
|
||||
-- Exit message
|
||||
function ExitMsg(msg)
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
print(msg)
|
||||
print()
|
||||
end
|
||||
--
|
||||
-- Read information from a card
|
||||
function GetCardInfo()
|
||||
result, err = lib14a.read1443a(false)
|
||||
if not result then
|
||||
print(err)
|
||||
return
|
||||
end
|
||||
print(("Found: %s"):format(result.name))
|
||||
|
||||
core.clearCommandBuffer()
|
||||
|
||||
if 0x18 == result.sak then --NXP MIFARE Classic 4k | Plus 4k
|
||||
-- IFARE Classic 4K offers 4096 bytes split into forty sectors,
|
||||
-- of which 32 are same size as in the 1K with eight more that are quadruple size sectors.
|
||||
numSectors = 40
|
||||
elseif 0x08 == result.sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
|
||||
-- 1K offers 1024 bytes of data storage, split into 16 sector
|
||||
numSectors = 16
|
||||
elseif 0x09 == result.sak then -- NXP MIFARE Mini 0.3k
|
||||
-- MIFARE Classic mini offers 320 bytes split into five sectors.
|
||||
numSectors = 5
|
||||
elseif 0x10 == result.sak then-- "NXP MIFARE Plus 2k"
|
||||
numSectors = 32
|
||||
else
|
||||
print("I don't know how many sectors there are on this type of card, defaulting to 16")
|
||||
end
|
||||
--[[
|
||||
The mifare Classic 1k card has 16 sectors of 4 data blocks each.
|
||||
The first 32 sectors of a mifare Classic 4k card consists of 4 data blocks and the remaining
|
||||
8 sectors consist of 16 data blocks.
|
||||
--]]
|
||||
|
||||
-- Defaults to 16 * 4 = 64 - 1 = 63
|
||||
numBlocks = numSectors * 4 - 1
|
||||
|
||||
if numSectors > 32 then
|
||||
numBlocks = 32*4+ (numSectors-32)*16 -1
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
local function main(args)
|
||||
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
print()
|
||||
|
||||
local OldKey
|
||||
local NewKey
|
||||
local Accessbytes
|
||||
|
||||
-- Arguments for the script
|
||||
for o, a in getopt.getopt(args, 'hk:n:a:') do
|
||||
if o == "h" then return help() end
|
||||
if o == "k" then OldKey = a end
|
||||
if o == "n" then NewKey = a end
|
||||
if o == "a" then Accessbytes = a end
|
||||
end
|
||||
|
||||
-- validate input args.
|
||||
OldKey = OldKey or 'FFFFFFFFFFFF'
|
||||
if #(OldKey) ~= 12 then
|
||||
return oops( string.format('Wrong length of write key (was %d) expected 12', #OldKey))
|
||||
end
|
||||
|
||||
NewKey = NewKey or 'FFFFFFFFFFFF'
|
||||
if #(NewKey) ~= 12 then
|
||||
return oops( string.format('Wrong length of new key (was %d) expected 12', #NewKey))
|
||||
end
|
||||
|
||||
--Accessbytes = Accessbytes or '787788'
|
||||
Accessbytes = Accessbytes or 'FF0780'
|
||||
if #(Accessbytes) ~= 6 then
|
||||
return oops( string.format('Wrong length of accessbytes (was %d) expected 12', #Accessbytes))
|
||||
end
|
||||
|
||||
GetCardInfo()
|
||||
|
||||
-- Show info
|
||||
print( string.format('Estimating number of blocks: %d', numBlocks))
|
||||
print( string.format('Old key: %s', OldKey))
|
||||
print( string.format('New key: %s', NewKey))
|
||||
print( string.format('New Access: %s', Accessbytes))
|
||||
print( string.rep('--',20) )
|
||||
|
||||
-- Set new block data
|
||||
local EMPTY_BL = string.rep('00',16)
|
||||
local EMPTY_SECTORTRAIL = string.format('%s%s%s%s',NewKey,Accessbytes,'00',NewKey)
|
||||
|
||||
dbg( string.format('New sector-trailer : %s',EMPTY_SECTORTRAIL))
|
||||
dbg( string.format('New emptyblock: %s',EMPTY_BL))
|
||||
dbg('')
|
||||
|
||||
-- Ask
|
||||
local dialogResult = utils.confirm("Do you want to erase this card")
|
||||
if dialogResult == false then
|
||||
return ExitMsg('Quiting it is then. Your wish is my command...')
|
||||
end
|
||||
|
||||
print( string.rep('--',20) )
|
||||
|
||||
-- main loop
|
||||
for block=0,numBlocks,1 do
|
||||
|
||||
local reminder = (block+1) % 4
|
||||
local cmd
|
||||
if reminder == 0 then
|
||||
cmd = CmdString:format(block, OldKey , EMPTY_SECTORTRAIL)
|
||||
else
|
||||
cmd = CmdString:format(block, OldKey , EMPTY_BL)
|
||||
end
|
||||
|
||||
if block ~= 0 then
|
||||
print(cmd)
|
||||
--core.console(cmd)
|
||||
end
|
||||
|
||||
if core.ukbhit() then
|
||||
print("aborted by user")
|
||||
break
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
main(args)
|
||||
Loading…
Add table
Add a link
Reference in a new issue