mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-18 14:10:36 -07:00
258 lines
7.7 KiB
Lua
258 lines
7.7 KiB
Lua
local getopt = require('getopt')
|
|
local cmds = require('commands')
|
|
local lib14a = require('read14a')
|
|
local utils = require('utils')
|
|
local ansicolors = require('ansicolors')
|
|
--
|
|
-- Refactored iceman, 2019
|
|
copyright = ''
|
|
author = 'Martin Holst Swende & Asper'
|
|
version = 'v1.0.2'
|
|
desc = [[
|
|
This script will automatically recognize and dump full content of a NFC NDEF Initialized tag; non-initialized tags will be ignored.
|
|
|
|
It also write the dump to an eml-file <uid>.eml.
|
|
|
|
(The difference between an .eml-file and a .bin-file is that the eml file contains
|
|
ASCII representation of the hex-data, with linebreaks between 'rows'. A .bin-file contains the
|
|
raw data, but when saving into that for, we lose the information about how the memory is structured.
|
|
For example: 24 bytes could be 6 blocks of 4 bytes, or vice versa.
|
|
Therefore, the .eml is better to use file when saving dumps.)
|
|
|
|
]]
|
|
example = [[
|
|
1. script run hf_ndef_dump
|
|
]]
|
|
usage = [[
|
|
script run hf_ndef_dump [-h] [-d] [-v]
|
|
]]
|
|
arguments = [[
|
|
-h this help
|
|
-d debug logging on
|
|
-v verbose output (from ndef parsing)
|
|
|
|
]]
|
|
|
|
local DEBUG = true -- the debug flag
|
|
local band = bit32.band
|
|
local rshift = bit32.rshift
|
|
---
|
|
-- A debug printout-function
|
|
local function dbg(args)
|
|
if not DEBUG then return end
|
|
if type(args) == 'table' then
|
|
local i = 1
|
|
while result[i] do
|
|
dbg(result[i])
|
|
i = i+1
|
|
end
|
|
else
|
|
print('###', args)
|
|
end
|
|
end
|
|
---
|
|
-- This is only meant to be used when errors occur
|
|
local function oops(err)
|
|
print('ERROR:', err)
|
|
core.clearCommandBuffer()
|
|
return nil, err
|
|
end
|
|
---
|
|
-- Usage help
|
|
local function help()
|
|
print(copyright)
|
|
print(author)
|
|
print(version)
|
|
print(desc)
|
|
print(ansicolors.cyan..'Usage'..ansicolors.reset)
|
|
print(usage)
|
|
print(ansicolors.cyan..'Arguments'..ansicolors.reset)
|
|
print(arguments)
|
|
print(ansicolors.cyan..'Example usage'..ansicolors.reset)
|
|
print(example)
|
|
end
|
|
--
|
|
-- Sends an instruction to do nothing, only disconnect
|
|
function disconnect()
|
|
local command = Command:newMIX{cmd = cmds.CMD_HF_ISO14443A_READER, arg1 = 0,}
|
|
-- We can ignore the response here, no ACK is returned for this command
|
|
-- Check /armsrc/iso14443a.c, ReaderIso14443a() for details
|
|
return command:sendMIX(true)
|
|
end
|
|
---
|
|
--
|
|
local function getblockdata(response)
|
|
if not response then
|
|
return nil, 'No response from device'
|
|
end
|
|
|
|
local count, cmd, arg0, arg1, arg2, data = bin.unpack('LLLLH40', response)
|
|
if arg0 == 1 then
|
|
return data:sub(1, 32)
|
|
end
|
|
|
|
return nil, "Couldn't read block"
|
|
end
|
|
---_ Gets data from a block
|
|
-- @return {block, block+1, block+2, block+3} if successful
|
|
-- @return nil, errormessage if unsuccessful
|
|
local function getBlock(blockno)
|
|
local block, err
|
|
local c = Command:newMIX{cmd = cmds.CMD_HF_MIFAREU_READBL, arg1 = blockno, data = 0}
|
|
block, err = getblockdata(c:sendMIX(false))
|
|
if not block then return oops(err) end
|
|
|
|
if #block < 32 then
|
|
return nil, ('Expected at least 16 bytes, got %d - this tag is not NDEF-compliant'):format(string.len(data))
|
|
end
|
|
-- Now, parse out the block data
|
|
-- 0534 00B9 049C AD7F 4A00 0000 E110 1000 2155
|
|
-- b0b0 b0b0 b1b1 b1b1 b2b2 b2b2 b3b3 b3b3 CRCC
|
|
b0 = string.sub(block, 1, 8)
|
|
b1 = string.sub(block, 9, 16)
|
|
b2 = string.sub(block, 17, 24)
|
|
b3 = string.sub(block, 25, 32)
|
|
return {b0, b1, b2, b3}
|
|
end
|
|
---
|
|
--
|
|
local function main( args)
|
|
|
|
print( string.rep('--',20) )
|
|
print( string.rep('--',20) )
|
|
|
|
local err, data, data2, k, v, i
|
|
local verbose = 0
|
|
-- Read the parameters
|
|
for o, a in getopt.getopt(args, 'hdv') do
|
|
if o == 'h' then return help() end
|
|
if o == 'd' then DEBUG = true end
|
|
if o == 'v' then verbose = 1 end
|
|
end
|
|
|
|
-- First of all, connect
|
|
info, err = lib14a.read(true, true)
|
|
if err then
|
|
disconnect();
|
|
return oops(err)
|
|
end
|
|
core.clearCommandBuffer()
|
|
|
|
if info.name:match("Ultralight") then
|
|
print('[=] Found a tag')
|
|
else
|
|
disconnect()
|
|
return oops('[!] Not a Ultralightbased card. This script reads NDEF formatted UL/NTAGS')
|
|
end
|
|
|
|
-- Info contained within the tag (block 0 example)
|
|
-- 0534 00B9 049C AD7F 4A00 0000 E110 1000 2155
|
|
-- b0b0 b0b0 b1b1 b1b1 b2b2 b2b2 b3b3 b3b3 CRCC
|
|
-- MM?? ???? ???? ???? ???? ???? NNVV SS?? ----
|
|
-- M = Manufacturer info
|
|
-- N = NDEF-Structure-Compliant (if value is E1)
|
|
-- V = NFC Forum Specification version (if 10 = v1.0)
|
|
|
|
-- First, get blockt 3 byte 2
|
|
local blocks, err = getBlock(0)
|
|
if err then
|
|
disconnect()
|
|
return oops(err)
|
|
end
|
|
-- Block 3 contains number of blocks
|
|
local b3 = utils.ConvertHexToBytes(blocks[4]);
|
|
local t5tarea = b3[3] * 8
|
|
local t5tarea_blocks = t5tarea / 4;
|
|
|
|
-- NDEF compliant?
|
|
if b3[1] ~= 0xE1 then
|
|
disconnect()
|
|
return oops('[!] This tag is not NDEF-Compliant')
|
|
end
|
|
|
|
-- Reuse existing info
|
|
local blockData = {blocks[1], blocks[2], blocks[3], blocks[4]}
|
|
|
|
--[[ Due to the infineon my-d move bug
|
|
(if I send 30 0F i receive block0f+block00+block01+block02 insted of block0f+block10+block11+block12)
|
|
the only way to avoid this is to send the read command as many times as block numbers
|
|
removing bytes from 5 to 18 from each answer.
|
|
--]]
|
|
print('[=] Dumping data...')
|
|
for i = 4, t5tarea_blocks - 1, 1 do
|
|
blocks, err = getBlock(i)
|
|
if err then
|
|
disconnect();
|
|
return oops(err)
|
|
end
|
|
table.insert(blockData, blocks[1])
|
|
end
|
|
-- Deactivate field
|
|
disconnect()
|
|
-- Print results
|
|
print('[=] --- Tag NDEF Message info')
|
|
print('[=] '.. string.rep('--', 50) )
|
|
print('[=] Type : ', info.name)
|
|
print('[=] UID : ', info.uid)
|
|
print('[=] Manufacturer : ', info.manufacturer)
|
|
print('[=] Capacity Container : '.. blockData[4])
|
|
print(('[=] %02X : NDEF Magic Number'):format(b3[1]) )
|
|
|
|
local vLow = band(b3[2], 0xF)
|
|
local vHi = band(rshift(b3[2], 4), 0xF)
|
|
print(('[=] %02X : version %d.%d supported by tag'):format(b3[2], vHi, vLow) )
|
|
|
|
print(('[=] %02X : Physical Memory Size: %d bytes'):format(b3[3], t5tarea) )
|
|
if b3[3] == 0x96 then
|
|
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 48))
|
|
elseif b3[3] == 0x12 then
|
|
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 144))
|
|
elseif b3[3] == 0x3E then
|
|
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 496))
|
|
elseif b3[3] == 0x6D then
|
|
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 872))
|
|
end
|
|
|
|
local rLow = band(b3[4], 0xF)
|
|
local rHi = band(rshift(b3[4], 4), 0xF)
|
|
local wstr, rstr
|
|
|
|
if rLow == 0 then
|
|
wstr = 'Write access granted without any security'
|
|
elseif rLow == 0x0F then
|
|
wstr = 'No write access granted at all'
|
|
else
|
|
wstr = '(RFU)'
|
|
end
|
|
|
|
if rHi ~= 0x00 then
|
|
rstr = '(RFU)'
|
|
else
|
|
rstr = 'Read access granted without any security'
|
|
end
|
|
|
|
print( ('[=] %02X : %s / %s'):format(b3[4], rstr, wstr))
|
|
|
|
print('[=] '.. string.rep('--', 50) )
|
|
local ndefdata = table.concat(blockData, '', 5)
|
|
core.ndefparse(t5tarea, verbose, ndefdata)
|
|
print('[=] '.. string.rep('--', 50) )
|
|
|
|
print('')
|
|
print('[=] Tag dump')
|
|
print('|---|-------------------|')
|
|
for k,v in ipairs(blockData) do
|
|
|
|
-- print(string.format('Block %02x: %02x %02x %02x %02x', k-1, string.byte(v, 1,4)))
|
|
print(string.format(' %02x | %s', k-1, v) )
|
|
end
|
|
print('|---|-------------------|')
|
|
|
|
local filename, err = utils.WriteDumpFile(info.uid, blockData)
|
|
if err then return oops(err) end
|
|
|
|
print(string.format('[+] Dumped data into %s', filename))
|
|
|
|
end
|
|
main(args)
|