mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-14 10:37:23 -07:00
first batch of updated scripts to use sendMIX commands instead.
This commit is contained in:
iceman1001
parent
195887487b
commit
819896acf6
7 changed files with 223 additions and 194 deletions
client
|
|
@ -4,6 +4,7 @@ Handle Proxmark USB Commands
|
|||
|
||||
local _commands = require('usb_cmd')
|
||||
local util = require('utils')
|
||||
local TIMEOUT = 2000
|
||||
|
||||
local _reverse_lookup,k,v = {}
|
||||
for k, v in pairs(_commands) do
|
||||
|
|
@ -131,6 +132,14 @@ function Command:__responsetostring()
|
|||
print('package ::', self.resp_response)
|
||||
end
|
||||
|
||||
|
||||
--- Sends a packet to the device
|
||||
-- @param command - the usb packet to send
|
||||
-- @param ignoreresponse - if set to true, we don't read the device answer packet
|
||||
-- which is usually recipe for fail. If not sent, the host will wait 2s for a
|
||||
-- response of type CMD_ACK
|
||||
-- @return packet,nil if successfull
|
||||
-- nil, errormessage if unsuccessfull
|
||||
function Command:sendMIX( ignore_response, timeout )
|
||||
local data = self.data
|
||||
local cmd = self.cmd
|
||||
|
|
@ -139,7 +148,9 @@ function Command:sendMIX( ignore_response, timeout )
|
|||
local err, msg = core.SendCommandMIX(cmd, arg1, arg2, arg3, data)
|
||||
if err == nil then return err, msg end
|
||||
|
||||
if ignoreresponse then return true, nil end
|
||||
if ignore_response then return true, nil end
|
||||
|
||||
if timeout == nil then timeout = TIMEOUT end
|
||||
|
||||
local response, msg = core.WaitForResponseTimeout(_commands.CMD_ACK, timeout)
|
||||
if response == nil then
|
||||
|
|
@ -174,8 +185,10 @@ function Command:sendNG( ignore_response, timeout )
|
|||
local err, msg = core.SendCommandNG(cmd, data)
|
||||
if err == nil then return err, msg end
|
||||
|
||||
if ignoreresponse then return true, nil end
|
||||
|
||||
if ignore_response then return true, nil end
|
||||
|
||||
if timeout == nil then timeout = TIMEOUT end
|
||||
|
||||
local response, msg = core.WaitForResponseTimeout(cmd, timeout)
|
||||
if response == nil then
|
||||
return nil, 'Error, waiting for response timed out :: '..msg
|
||||
|
|
|
|||
|
|
@ -71,26 +71,6 @@ local function parse14443a(data)
|
|||
return { uid = uid, atqa = atqa, sak = sak, name = tostring_14443a(sak), data = data}
|
||||
end
|
||||
|
||||
--- Sends a USBpacket to the device
|
||||
-- @param command - the usb packet to send
|
||||
-- @param ignoreresponse - if set to true, we don't read the device answer packet
|
||||
-- which is usually recipe for fail. If not sent, the host will wait 2s for a
|
||||
-- response of type CMD_ACK
|
||||
-- @return packet,nil if successfull
|
||||
-- nil, errormessage if unsuccessfull
|
||||
local function sendToDevice(command, ignoreresponse)
|
||||
--core.clearCommandBuffer()
|
||||
local err = core.SendCommand(command:getBytes())
|
||||
if err then
|
||||
print(err)
|
||||
return nil, err
|
||||
end
|
||||
if ignoreresponse then return nil,nil end
|
||||
|
||||
local response = core.WaitForResponseTimeout(cmds.CMD_ACK, TIMEOUT)
|
||||
return response,nil
|
||||
end
|
||||
|
||||
-- This function does a connect and retrieves som einfo
|
||||
-- @param dont_disconnect - if true, does not disable the field
|
||||
-- @return if successfull: an table containing card info
|
||||
|
|
@ -98,7 +78,10 @@ end
|
|||
local function read14443a(dont_disconnect, no_rats)
|
||||
local command, result, info, err, data
|
||||
|
||||
command = Command:new{cmd = cmds.CMD_READER_ISO_14443a, arg1 = ISO14A_COMMAND.ISO14A_CONNECT }
|
||||
command = Command:newMIX{
|
||||
cmd = cmds.CMD_READER_ISO_14443a,
|
||||
arg1 = ISO14A_COMMAND.ISO14A_CONNECT
|
||||
}
|
||||
|
||||
if dont_disconnect then
|
||||
command.arg1 = command.arg1 + ISO14A_COMMAND.ISO14A_NO_DISCONNECT
|
||||
|
|
@ -106,17 +89,17 @@ local function read14443a(dont_disconnect, no_rats)
|
|||
if no_rats then
|
||||
command.arg1 = command.arg1 + ISO14A_COMMAND.ISO14A_NO_RATS
|
||||
end
|
||||
|
||||
local result,err = sendToDevice(command)
|
||||
|
||||
local result,err = command:sendMIX()
|
||||
if result then
|
||||
local count,cmd,arg0,arg1,arg2 = bin.unpack('LLLL',result)
|
||||
if arg0 == 0 then
|
||||
return nil, "iso14443a card select failed"
|
||||
return nil, 'iso14443a card select failed'
|
||||
end
|
||||
data = string.sub(result,count)
|
||||
info, err = parse14443a(data)
|
||||
else
|
||||
err ="No response from card"
|
||||
err = 'No response from card'
|
||||
end
|
||||
|
||||
if err then
|
||||
|
|
@ -143,7 +126,6 @@ local library = {
|
|||
read = read14443a,
|
||||
waitFor14443a = waitFor14443a,
|
||||
parse14443a = parse14443a,
|
||||
sendToDevice = sendToDevice,
|
||||
ISO14A_COMMAND = ISO14A_COMMAND,
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -7,7 +7,14 @@ local md5 = require('md5')
|
|||
local dumplib = require('html_dumplib')
|
||||
local toys = require('default_toys')
|
||||
|
||||
example =[[
|
||||
copyright = ''
|
||||
author = 'Iceman'
|
||||
version = 'v1.0.1'
|
||||
desc =[[
|
||||
This script will try to dump the contents of a Mifare TNP3xxx card.
|
||||
It will need a valid KeyA in order to find the other keys and decode the card.
|
||||
]]
|
||||
example = [[
|
||||
script run tnp3dump
|
||||
script run tnp3dump -n
|
||||
script run tnp3dump -p
|
||||
|
|
@ -18,11 +25,9 @@ example =[[
|
|||
script run tnp3dump -p -o myfile
|
||||
script run tnp3dump -k aabbccddeeff -n -o myfile
|
||||
]]
|
||||
author = "Iceman"
|
||||
usage = "script run tnp3dump -k <key> -n -p -o <filename>"
|
||||
desc =[[
|
||||
This script will try to dump the contents of a Mifare TNP3xxx card.
|
||||
It will need a valid KeyA in order to find the other keys and decode the card.
|
||||
usage = [[
|
||||
script run tnp3dump -k <key> -n -p -o <filename>
|
||||
|
||||
Arguments:
|
||||
-h : this help
|
||||
-k <key> : Sector 0 Key A.
|
||||
|
|
@ -31,41 +36,44 @@ Arguments:
|
|||
-o : filename for the saved dumps
|
||||
]]
|
||||
local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
|
||||
local TIMEOUT = 2500 -- Shouldn't take longer than 2 seconds
|
||||
local DEBUG = false -- the debug flag
|
||||
local numBlocks = 64
|
||||
local numSectors = 16
|
||||
---
|
||||
-- A debug printout-function
|
||||
function dbg(args)
|
||||
local function dbg(args)
|
||||
if not DEBUG then return end
|
||||
|
||||
if type(args) == "table" then
|
||||
if type(args) == 'table' then
|
||||
local i = 1
|
||||
while result[i] do
|
||||
dbg(result[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print("###", args)
|
||||
print('###', args)
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
function oops(err)
|
||||
print("ERROR: ",err)
|
||||
return nil,err
|
||||
local function oops(err)
|
||||
print('ERROR:', err)
|
||||
core.clearCommandBuffer()
|
||||
return nil, err
|
||||
end
|
||||
---
|
||||
-- Usage help
|
||||
function help()
|
||||
local function help()
|
||||
print(copyright)
|
||||
print(author)
|
||||
print(version)
|
||||
print(desc)
|
||||
print("Example usage")
|
||||
print('Example usage')
|
||||
print(example)
|
||||
print(usage)
|
||||
end
|
||||
--
|
||||
-- Exit message
|
||||
function ExitMsg(msg)
|
||||
local function ExitMsg(msg)
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
print(msg)
|
||||
|
|
@ -79,18 +87,18 @@ local function readdumpkeys(infile)
|
|||
return hex
|
||||
end
|
||||
|
||||
local function waitCmd()
|
||||
local response = core.WaitForResponseTimeout(cmds.CMD_ACK, TIMEOUT)
|
||||
if response then
|
||||
local count, cmd, arg0 = bin.unpack('LL',response)
|
||||
if(arg0==1) then
|
||||
local count,arg1,arg2,data = bin.unpack('LLH511',response,count)
|
||||
return data:sub(1,32)
|
||||
else
|
||||
return nil, "Couldn't read block.. ["..arg0.."]"
|
||||
end
|
||||
local function getblockdata(response)
|
||||
if not response then
|
||||
return nil, 'No response from device'
|
||||
end
|
||||
|
||||
local count, cmd, arg0 = bin.unpack('LL', response)
|
||||
if arg0 == 1 then
|
||||
local count, arg1, arg2, data = bin.unpack('LLH511', response, count)
|
||||
return data:sub(1, 32)
|
||||
else
|
||||
return nil, "Couldn't read block.. ["..arg0.."]"
|
||||
end
|
||||
return nil, 'No response from device'
|
||||
end
|
||||
|
||||
local function main(args)
|
||||
|
|
@ -98,9 +106,7 @@ local function main(args)
|
|||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
|
||||
local keyA
|
||||
local cmd
|
||||
local err
|
||||
local keyA, cmd, err
|
||||
local useNested = false
|
||||
local usePreCalc = false
|
||||
local cmdReadBlockString = 'hf mf rdbl %d A %s'
|
||||
|
|
@ -127,9 +133,7 @@ local function main(args)
|
|||
core.console( cmdSetDbgOff)
|
||||
|
||||
result, err = lib14a.read(false, true)
|
||||
if not result then
|
||||
return oops(err)
|
||||
end
|
||||
if not result then return oops(err) end
|
||||
|
||||
core.clearCommandBuffer()
|
||||
|
||||
|
|
@ -159,23 +163,20 @@ local function main(args)
|
|||
akeys = hex:sub(0,12*16)
|
||||
end
|
||||
|
||||
local block0, block1
|
||||
-- Read block 0
|
||||
dbg('Reading block 0')
|
||||
cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 0, arg2 = 0, arg3 = 0, data = keyA}
|
||||
err = core.SendCommand(cmd:getBytes())
|
||||
if err then return oops(err) end
|
||||
local block0, err = waitCmd()
|
||||
if err then return oops(err) end
|
||||
|
||||
cmd = Command:newMIX{cmd = cmds.CMD_MIFARE_READBL, data = keyA}
|
||||
block0, err = getblockdata(cmd:sendMIX(false))
|
||||
if not block0 then return oops(err) end
|
||||
|
||||
core.clearCommandBuffer()
|
||||
|
||||
-- Read block 1
|
||||
dbg('Reading block 1')
|
||||
cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1, arg2 = 0, arg3 = 0, data = keyA}
|
||||
err = core.SendCommand(cmd:getBytes())
|
||||
if err then return oops(err) end
|
||||
local block1, err = waitCmd()
|
||||
if err then return oops(err) end
|
||||
cmd = Command:newMIX{cmd = cmds.CMD_MIFARE_READBL, arg1 = 1, data = keyA}
|
||||
block1, err = getblockdata(cmd:sendMIX(false))
|
||||
if not block1 then return oops(err) end
|
||||
|
||||
core.clearCommandBuffer()
|
||||
|
||||
|
|
@ -201,12 +202,9 @@ local function main(args)
|
|||
|
||||
pos = (math.floor( blockNo / 4 ) * 12)+1
|
||||
key = akeys:sub(pos, pos + 11 )
|
||||
cmd = Command:new{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo ,arg2 = 0,arg3 = 0, data = key}
|
||||
local err = core.SendCommand(cmd:getBytes())
|
||||
if err then return oops(err) end
|
||||
local blockdata, err = waitCmd()
|
||||
if err then return oops(err) end
|
||||
|
||||
cmd = Command:newMIX{cmd = cmds.CMD_MIFARE_READBL, arg1 = blockNo, data = key}
|
||||
local blockdata, err = getblockdata(cmd:sendMIX(false))
|
||||
if not blockdata then return oops(err) end
|
||||
|
||||
if blockNo%4 ~= 3 then
|
||||
|
||||
|
|
|
|||
|
|
@ -7,27 +7,29 @@ local md5 = require('md5')
|
|||
local toys = require('default_toys')
|
||||
local pre = require('precalc')
|
||||
|
||||
example =[[
|
||||
1. script run tnp3sim
|
||||
2. script run tnp3sim -m
|
||||
3. script run tnp3sim -m -i myfile
|
||||
]]
|
||||
author = "Iceman"
|
||||
usage = "script run tnp3sim -h -m -i <filename>"
|
||||
copyright = ''
|
||||
author = 'Iceman'
|
||||
version = 'v1.0.1'
|
||||
desc =[[
|
||||
This script will try to load a binary datadump of a Mifare TNP3xxx card.
|
||||
It vill try to validate all checksums and view some information stored in the dump
|
||||
For an experimental mode, it tries to manipulate some data.
|
||||
At last it sends all data to the PM3 device memory where it can be used in the command "hf mf sim"
|
||||
]]
|
||||
example =[[
|
||||
1. script run tnp3sim
|
||||
2. script run tnp3sim -m
|
||||
3. script run tnp3sim -m -i myfile
|
||||
]]
|
||||
usage = [[
|
||||
script run tnp3sim -h -m -i <filename>
|
||||
|
||||
Arguments:
|
||||
-h : this help
|
||||
-m : Maxed out items (experimental)
|
||||
-i : filename for the datadump to read (bin)
|
||||
]]
|
||||
|
||||
]]
|
||||
|
||||
local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
|
||||
local DEBUG = true -- the debug flag
|
||||
local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
|
||||
|
||||
|
|
@ -42,35 +44,39 @@ local format = string.format
|
|||
|
||||
---
|
||||
-- A debug printout-function
|
||||
function dbg(args)
|
||||
local function dbg(args)
|
||||
if not DEBUG then return end
|
||||
|
||||
if type(args) == "table" then
|
||||
if type(args) == 'table' then
|
||||
local i = 1
|
||||
while result[i] do
|
||||
dbg(result[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print("###", args)
|
||||
print('###', args)
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
function oops(err)
|
||||
print("ERROR: ",err)
|
||||
return nil,err
|
||||
local function oops(err)
|
||||
print('ERROR:', err)
|
||||
core.clearCommandBuffer()
|
||||
return nil, err
|
||||
end
|
||||
---
|
||||
-- Usage help
|
||||
function help()
|
||||
local function help()
|
||||
print(copyright)
|
||||
print(author)
|
||||
print(version)
|
||||
print(desc)
|
||||
print("Example usage")
|
||||
print('Example usage')
|
||||
print(example)
|
||||
print(usage)
|
||||
end
|
||||
--
|
||||
-- Exit message
|
||||
function ExitMsg(msg)
|
||||
local function ExitMsg(msg)
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
print(msg)
|
||||
|
|
@ -78,9 +84,9 @@ function ExitMsg(msg)
|
|||
end
|
||||
|
||||
local function writedumpfile(infile)
|
||||
t = infile:read("*all")
|
||||
t = infile:read('*all')
|
||||
len = string.len(t)
|
||||
local len,hex = bin.unpack(("H%d"):format(len),t)
|
||||
local len,hex = bin.unpack(('H%d'):format(len),t)
|
||||
return hex
|
||||
end
|
||||
-- blocks with data
|
||||
|
|
@ -238,9 +244,9 @@ local function LoadEmulator(uid, blocks)
|
|||
end
|
||||
end
|
||||
core.clearCommandBuffer()
|
||||
cmd = Command:new{cmd = cmds.CMD_MIFARE_EML_MEMSET, arg1 = _ ,arg2 = 1,arg3 = 16, data = blockdata}
|
||||
local err = core.SendCommand(cmd:getBytes())
|
||||
if err then return err end
|
||||
cmd = Command:newMIX{cmd = cmds.CMD_MIFARE_EML_MEMSET, arg1 = _ ,arg2 = 1,arg3 = 16, data = blockdata}
|
||||
local err, msg = cmd:sendMIX(true)
|
||||
if err == nil then return err, msg end
|
||||
end
|
||||
io.write('\n')
|
||||
end
|
||||
|
|
@ -348,30 +354,30 @@ local function main(args)
|
|||
|
||||
local result, err, hex
|
||||
local maxed = false
|
||||
local inputTemplate = "dumpdata.bin"
|
||||
local outputTemplate = os.date("toydump_%Y-%m-%d_%H%M");
|
||||
local inputTemplate = 'dumpdata.bin'
|
||||
local outputTemplate = os.date('toydump_%Y-%m-%d_%H%M');
|
||||
|
||||
-- Arguments for the script
|
||||
for o, a in getopt.getopt(args, 'hmi:o:') do
|
||||
if o == "h" then return help() end
|
||||
if o == "m" then maxed = true end
|
||||
if o == "o" then outputTemplate = a end
|
||||
if o == "i" then inputTemplate = a end
|
||||
if o == 'h' then return help() end
|
||||
if o == 'm' then maxed = true end
|
||||
if o == 'o' then outputTemplate = a end
|
||||
if o == 'i' then inputTemplate = a end
|
||||
end
|
||||
|
||||
-- Turn off Debug
|
||||
local cmdSetDbgOff = "hf mf dbg 0"
|
||||
local cmdSetDbgOff = 'hf mf dbg 0'
|
||||
core.console( cmdSetDbgOff)
|
||||
|
||||
-- Load dump.bin file
|
||||
print( (' Load data from %s'):format(inputTemplate))
|
||||
print( ('Load data from %s'):format(inputTemplate))
|
||||
hex, err = utils.ReadDumpFile(inputTemplate)
|
||||
if not hex then return oops(err) end
|
||||
|
||||
local blocks = {}
|
||||
local blockindex = 0
|
||||
for i = 1, #hex, 32 do
|
||||
blocks[blockindex] = hex:sub(i,i+31)
|
||||
blocks[blockindex] = hex:sub(i, i+31)
|
||||
blockindex = blockindex + 1
|
||||
end
|
||||
|
||||
|
|
@ -397,8 +403,8 @@ local function main(args)
|
|||
print( (' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype) )
|
||||
end
|
||||
|
||||
print( (' UID : 0x%s'):format(uid) )
|
||||
print( (' CARDID : 0x%s %s [%s]'):format(
|
||||
print( (' UID : %s'):format(uid) )
|
||||
print( (' CARDID : %s %s [%s]'):format(
|
||||
cardidMsw,cardidLsw,
|
||||
--Num2Card(cardidMsw, cardidLsw))
|
||||
'')
|
||||
|
|
|
|||
|
|
@ -4,11 +4,9 @@ local bin = require('bin')
|
|||
local utils = require('utils')
|
||||
local dumplib = require('html_dumplib')
|
||||
|
||||
example =[[
|
||||
1. script run tracetest
|
||||
]]
|
||||
author = "Iceman"
|
||||
usage = "script run tracetest"
|
||||
copyright = ''
|
||||
author = 'Iceman'
|
||||
version = 'v1.0.1'
|
||||
desc =[[
|
||||
This script will load several traces files in ../traces/ folder and do
|
||||
"data load"
|
||||
|
|
@ -17,45 +15,52 @@ This script will load several traces files in ../traces/ folder and do
|
|||
The following tracefiles will be loaded:
|
||||
em*.pm3
|
||||
m*.pm3
|
||||
]]
|
||||
example =[[
|
||||
script run tracetest
|
||||
]]
|
||||
usage = [[
|
||||
script run tracetest -h
|
||||
|
||||
Arguments:
|
||||
-h : this help
|
||||
]]
|
||||
|
||||
local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
|
||||
local DEBUG = true -- the debug flag
|
||||
---
|
||||
-- A debug printout-function
|
||||
function dbg(args)
|
||||
if not DEBUG then
|
||||
return
|
||||
end
|
||||
|
||||
if type(args) == "table" then
|
||||
local function dbg(args)
|
||||
if not DEBUG then return end
|
||||
if type(args) == 'table' then
|
||||
local i = 1
|
||||
while result[i] do
|
||||
dbg(result[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print("###", args)
|
||||
print('###', args)
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
function oops(err)
|
||||
print("ERROR: ",err)
|
||||
local function oops(err)
|
||||
print('ERROR:', err)
|
||||
core.clearCommandBuffer()
|
||||
return nil, err
|
||||
end
|
||||
---
|
||||
-- Usage help
|
||||
function help()
|
||||
local function help()
|
||||
print(copyright)
|
||||
print(author)
|
||||
print(version)
|
||||
print(desc)
|
||||
print("Example usage")
|
||||
print('Example usage')
|
||||
print(example)
|
||||
print(usage)
|
||||
end
|
||||
--
|
||||
-- Exit message
|
||||
function ExitMsg(msg)
|
||||
local function ExitMsg(msg)
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
print(msg)
|
||||
|
|
@ -73,11 +78,11 @@ local function main(args)
|
|||
local tracesMOD = "find '../traces/' -iname 'm*.pm3' -type f"
|
||||
|
||||
local write2File = false
|
||||
local outputTemplate = os.date("testtest_%Y-%m-%d_%H%M%S")
|
||||
local outputTemplate = os.date('testtest_%Y-%m-%d_%H%M%S')
|
||||
|
||||
-- Arguments for the script
|
||||
for o, arg in getopt.getopt(args, 'h') do
|
||||
if o == "h" then return help() end
|
||||
if o == 'h' then return help() end
|
||||
end
|
||||
|
||||
core.clearCommandBuffer()
|
||||
|
|
@ -98,13 +103,13 @@ local function main(args)
|
|||
end
|
||||
p.close();
|
||||
|
||||
local cmdLFSEARCH = "lf search 1 u"
|
||||
local cmdLFSEARCH = 'lf search 1 u'
|
||||
|
||||
-- main loop
|
||||
io.write('Starting to test traces > ')
|
||||
for _,file in pairs(files) do
|
||||
|
||||
local x = "data load "..file
|
||||
local x = 'data load '..file
|
||||
dbg(x)
|
||||
core.console(x)
|
||||
|
||||
|
|
@ -114,7 +119,7 @@ local function main(args)
|
|||
core.clearCommandBuffer()
|
||||
|
||||
if core.ukbhit() then
|
||||
print("aborted by user")
|
||||
print('aborted by user')
|
||||
break
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -2,17 +2,25 @@ local cmds = require('commands')
|
|||
local getopt = require('getopt')
|
||||
local lib14a = require('read14a')
|
||||
local utils = require('utils')
|
||||
example = [[
|
||||
script run ufodump
|
||||
script run ufodump -b 10
|
||||
]]
|
||||
author = "Iceman"
|
||||
|
||||
copyright = ''
|
||||
author = 'Iceman'
|
||||
version = 'v1.0.1'
|
||||
desc =
|
||||
[[
|
||||
This is a script that reads AZTEK iso14443a tags.
|
||||
It starts from block 0, and ends at default block 20. Use 'b' to say different endblock.
|
||||
|
||||
xor: the first three block (0,1,2) is not XORED. The rest seems to be xored.
|
||||
]]
|
||||
example = [[
|
||||
-- default
|
||||
script run ufodump
|
||||
|
||||
-- stop at block 10
|
||||
script run ufodump -b 10
|
||||
]]
|
||||
usage = [[
|
||||
script run ufudump -h -b
|
||||
|
||||
Arguments:
|
||||
h this helptext
|
||||
|
|
@ -20,43 +28,54 @@ Arguments:
|
|||
]]
|
||||
|
||||
-- Some globals
|
||||
local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
|
||||
local DEBUG = false -- the debug flag
|
||||
---
|
||||
-- A debug printout-function
|
||||
local function dbg(args)
|
||||
if DEBUG then
|
||||
print("###", args)
|
||||
if not DEBUG then return end
|
||||
if type(args) == 'table' then
|
||||
local i = 1
|
||||
while args[i] do
|
||||
dbg(args[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print('###', args)
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
local function oops(err)
|
||||
print("ERROR: ",err)
|
||||
print('ERROR:', err)
|
||||
core.clearCommandBuffer()
|
||||
return nil, err
|
||||
end
|
||||
---
|
||||
-- Usage help
|
||||
local function help()
|
||||
print(copyright)
|
||||
print(author)
|
||||
print(version)
|
||||
print(desc)
|
||||
print("Example usage")
|
||||
print('Example usage')
|
||||
print(example)
|
||||
print(usage)
|
||||
end
|
||||
--
|
||||
-- writes data to ascii textfile.
|
||||
function writeDumpFile(uid, blockData)
|
||||
local destination = string.format("%s.eml", uid)
|
||||
local file = io.open(destination, "w")
|
||||
local destination = string.format('%s.eml', uid)
|
||||
local file = io.open(destination, 'w')
|
||||
if file == nil then
|
||||
return nil, string.format("Could not write to file %s", destination)
|
||||
return nil, string.format('Could not write to file %s', destination)
|
||||
end
|
||||
local rowlen = string.len(blockData[1])
|
||||
|
||||
for i,block in ipairs(blockData) do
|
||||
if rowlen ~= string.len(block) then
|
||||
print(string.format("WARNING: Dumpdata seems corrupted, line %d was not the same length as line 1",i))
|
||||
print(string.format('WARNING: Dumpdata seems corrupted, line %d was not the same length as line 1',i))
|
||||
end
|
||||
file:write(block.."\n")
|
||||
file:write(block..'\n')
|
||||
end
|
||||
file:close()
|
||||
return destination
|
||||
|
|
@ -91,24 +110,28 @@ end
|
|||
--
|
||||
-- Send a "raw" iso14443a package, ie "hf 14a raw" command
|
||||
function sendRaw(rawdata, options)
|
||||
--print(">> ", rawdata)
|
||||
local flags = lib14a.ISO14A_COMMAND.ISO14A_NO_DISCONNECT + lib14a.ISO14A_COMMAND.ISO14A_RAW + lib14a.ISO14A_COMMAND.ISO14A_APPEND_CRC + lib14a.ISO14A_COMMAND.ISO14A_NO_RATS
|
||||
local command = Command:new{cmd = cmds.CMD_READER_ISO_14443a,
|
||||
|
||||
local flags = lib14a.ISO14A_COMMAND.ISO14A_NO_DISCONNECT
|
||||
+ lib14a.ISO14A_COMMAND.ISO14A_RAW
|
||||
+ lib14a.ISO14A_COMMAND.ISO14A_APPEND_CRC
|
||||
+ lib14a.ISO14A_COMMAND.ISO14A_NO_RATS
|
||||
|
||||
local command = Command:newMIX{cmd = cmds.CMD_READER_ISO_14443a,
|
||||
arg1 = flags, -- Send raw
|
||||
-- arg2 contains the length, which is half the length
|
||||
-- of the ASCII-string rawdata
|
||||
arg2 = string.len(rawdata)/2,
|
||||
data = rawdata}
|
||||
return lib14a.sendToDevice(command, options.ignore_response)
|
||||
|
||||
return command:sendMIX(options.ignore_response)
|
||||
end
|
||||
--
|
||||
-- Sends an instruction to do nothing, only disconnect
|
||||
function disconnect()
|
||||
local command = Command:new{cmd = cmds.CMD_READER_ISO_14443a, arg1 = 0,}
|
||||
local command = Command:newMIX{cmd = cmds.CMD_READER_ISO_14443a, arg1 = 0,}
|
||||
-- We can ignore the response here, no ACK is returned for this command
|
||||
-- Check /armsrc/iso14443a.c, ReaderIso14443a() for details
|
||||
return lib14a.sendToDevice(command, true)
|
||||
--core.console("hf 14a raw -r")
|
||||
return command:sendMIX(true)
|
||||
end
|
||||
---
|
||||
-- The main entry point
|
||||
|
|
@ -119,8 +142,8 @@ function main(args)
|
|||
|
||||
-- Read the parameters
|
||||
for o, a in getopt.getopt(args, 'hb:') do
|
||||
if o == "h" then return help() end
|
||||
if o == "b" then endblock = a end
|
||||
if o == 'h' then return help() end
|
||||
if o == 'b' then endblock = a end
|
||||
end
|
||||
endblock = endblock or 20
|
||||
|
||||
|
|
@ -132,12 +155,12 @@ function main(args)
|
|||
local blockData = {}
|
||||
|
||||
-- Show tag info
|
||||
print(("\nFound Card UID [%s]\n"):format(info.uid))
|
||||
print(('\nFound Card UID [%s]\n'):format(info.uid))
|
||||
|
||||
print("blk | data | xored")
|
||||
print("----+------------------+-------------------")
|
||||
print('blk | data | xored')
|
||||
print('----+------------------+-------------------')
|
||||
for block = 00, endblock do
|
||||
local cmd = string.format("10%02x00", block)
|
||||
local cmd = string.format('10%02x00', block)
|
||||
res, err = sendRaw(cmd , {ignore_response = ignore_response})
|
||||
if err then disconnect() return oops(err) end
|
||||
|
||||
|
|
@ -154,7 +177,7 @@ function main(args)
|
|||
local filename, err = writeDumpFile(info.uid, blockData)
|
||||
if err then return oops(err) end
|
||||
|
||||
print(string.format("\nDumped data into %s", filename))
|
||||
print(string.format('\nDumped data into %s', filename))
|
||||
end
|
||||
|
||||
-------------------------
|
||||
|
|
@ -162,13 +185,13 @@ end
|
|||
-------------------------
|
||||
function selftest()
|
||||
DEBUG = true
|
||||
dbg("Performing test")
|
||||
dbg('Performing test')
|
||||
main()
|
||||
dbg("Tests done")
|
||||
dbg('Tests done')
|
||||
end
|
||||
-- Flip the switch here to perform a sanity check.
|
||||
-- It read a nonce in two different ways, as specified in the usage-section
|
||||
if "--test"==args then
|
||||
if '--test' == args then
|
||||
selftest()
|
||||
else
|
||||
-- Call the main
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ local utils = require('utils')
|
|||
|
||||
copyright = ''
|
||||
author = "Iceman"
|
||||
version = 'v1.0.0'
|
||||
version = 'v1.0.1'
|
||||
desc = [[
|
||||
This script tries to set UID on a mifare Ultralight magic card which either
|
||||
- answers to chinese backdoor commands
|
||||
|
|
@ -31,20 +31,21 @@ local bxor = bit32.bxor
|
|||
-- A debug printout-function
|
||||
local function dbg(args)
|
||||
if not DEBUG then return end
|
||||
if type(args) == "table" then
|
||||
if type(args) == 'table' then
|
||||
local i = 1
|
||||
while args[i] do
|
||||
dbg(args[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print("###", args)
|
||||
print('###', args)
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
local function oops(err)
|
||||
print("ERROR: ",err)
|
||||
print('ERROR:', err)
|
||||
core.clearCommandBuffer()
|
||||
return nil, err
|
||||
end
|
||||
---
|
||||
|
|
@ -56,6 +57,7 @@ local function help()
|
|||
print(desc)
|
||||
print('Example usage')
|
||||
print(example)
|
||||
print(usage)
|
||||
end
|
||||
--
|
||||
--- Set UID on magic command enabled
|
||||
|
|
@ -64,19 +66,19 @@ function magicUID(b0, b1, b2)
|
|||
print('Using backdoor Magic tag function')
|
||||
|
||||
-- write block 0
|
||||
core.console("hf 14a raw -p -a -b 7 40")
|
||||
core.console("hf 14a raw -p -a 43")
|
||||
core.console("hf 14a raw -c -a A200"..b0)
|
||||
core.console('hf 14a raw -p -a -b 7 40')
|
||||
core.console('hf 14a raw -p -a 43')
|
||||
core.console('hf 14a raw -c -a A200'..b0)
|
||||
|
||||
-- write block 1
|
||||
core.console("hf 14a raw -p -a -b 7 40")
|
||||
core.console("hf 14a raw -p -a 43")
|
||||
core.console("hf 14a raw -c -a A201"..b1)
|
||||
core.console('hf 14a raw -p -a -b 7 40')
|
||||
core.console('hf 14a raw -p -a 43')
|
||||
core.console('hf 14a raw -c -a A201'..b1)
|
||||
|
||||
-- write block 2
|
||||
core.console("hf 14a raw -p -a -b 7 40")
|
||||
core.console("hf 14a raw -p -a 43")
|
||||
core.console("hf 14a raw -c -a A202"..b2)
|
||||
core.console('hf 14a raw -p -a -b 7 40')
|
||||
core.console('hf 14a raw -p -a 43')
|
||||
core.console('hf 14a raw -c -a A202'..b2)
|
||||
end
|
||||
--
|
||||
--- Set UID on magic but brickable
|
||||
|
|
@ -84,16 +86,16 @@ function brickableUID(b0, b1, b2)
|
|||
|
||||
print('Using BRICKABLE Magic tag function')
|
||||
|
||||
core.console("hf 14a raw -p -s -3")
|
||||
core.console('hf 14a raw -p -s -3')
|
||||
|
||||
-- write block 0
|
||||
core.console("hf 14a raw -p -c A200"..b0)
|
||||
core.console('hf 14a raw -p -c A200'..b0)
|
||||
|
||||
-- write block 1
|
||||
core.console("hf 14a raw -p -c A201"..b1)
|
||||
core.console('hf 14a raw -p -c A201'..b1)
|
||||
|
||||
-- write block 2
|
||||
core.console("hf 14a raw -p -c A202"..b2)
|
||||
core.console('hf 14a raw -p -c A202'..b2)
|
||||
end
|
||||
---
|
||||
-- The main entry point
|
||||
|
|
@ -108,9 +110,9 @@ function main(args)
|
|||
|
||||
-- Read the parameters
|
||||
for o, a in getopt.getopt(args, 'hu:b') do
|
||||
if o == "h" then return help() end
|
||||
if o == "u" then uid = a end
|
||||
if o == "b" then tagtype = 2 end
|
||||
if o == 'h' then return help() end
|
||||
if o == 'u' then uid = a end
|
||||
if o == 'b' then tagtype = 2 end
|
||||
end
|
||||
|
||||
-- uid string checks
|
||||
|
|
@ -138,7 +140,7 @@ function main(args)
|
|||
end
|
||||
|
||||
--halt
|
||||
core.console("hf 14a raw -c -a 5000")
|
||||
core.console('hf 14a raw -c -a 5000')
|
||||
end
|
||||
|
||||
main(args)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue