proxmark3/client/luascripts/ndef_dump.lua

258 lines
7.7 KiB
Lua
Raw Normal View History

local getopt = require('getopt')
local cmds = require('commands')
2019-04-29 05:58:51 +08:00
local lib14a = require('read14a')
2019-04-29 03:29:47 +08:00
local utils = require('utils')
2020-04-05 18:41:38 +08:00
local ansicolors = require('ansicolors')
--
-- Refactored iceman, 2019
2019-04-29 03:29:47 +08:00
copyright = ''
author = 'Martin Holst Swende & Asper'
2020-04-05 18:41:38 +08:00
version = 'v1.0.2'
2019-04-29 03:29:47 +08:00
desc = [[
This script will automatically recognize and dump full content of a NFC NDEF Initialized tag; non-initialized tags will be ignored.
It also write the dump to an eml-file <uid>.eml.
(The difference between an .eml-file and a .bin-file is that the eml file contains
2019-03-09 17:34:43 +08:00
ASCII representation of the hex-data, with linebreaks between 'rows'. A .bin-file contains the
raw data, but when saving into that for, we lose the infromation about how the memory is structured.
For example: 24 bytes could be 6 blocks of 4 bytes, or vice versa.
Therefore, the .eml is better to use file when saving dumps.)
2019-04-29 03:29:47 +08:00
]]
example = [[
1. script run ndef_dump
]]
usage = [[
2020-04-05 18:41:38 +08:00
script run ndef_dump [-h] [-d] [-v]
]]
arguments = [[
2019-03-09 17:34:43 +08:00
-h this help
-d debug logging on
-v verbose output (from ndef parsing)
]]
2019-04-29 03:29:47 +08:00
local DEBUG = true -- the debug flag
2019-04-29 23:34:47 +08:00
local band = bit32.band
local rshift = bit32.rshift
---
2019-04-29 03:29:47 +08:00
-- A debug printout-function
local function dbg(args)
if not DEBUG then return end
if type(args) == 'table' then
local i = 1
while result[i] do
dbg(result[i])
i = i+1
end
else
print('###', args)
end
end
2019-03-09 17:34:43 +08:00
---
-- This is only meant to be used when errors occur
local function oops(err)
2019-04-29 03:29:47 +08:00
print('ERROR:', err)
core.clearCommandBuffer()
return nil, err
end
2019-03-09 17:34:43 +08:00
---
-- Usage help
local function help()
2019-04-29 03:29:47 +08:00
print(copyright)
print(author)
print(version)
print(desc)
2020-04-05 18:41:38 +08:00
print(ansicolors.cyan..'Usage'..ansicolors.reset)
2019-04-29 03:29:47 +08:00
print(usage)
2020-04-05 18:41:38 +08:00
print(ansicolors.cyan..'Arguments'..ansicolors.reset)
print(arguments)
print(ansicolors.cyan..'Example usage'..ansicolors.reset)
print(example)
end
2019-04-29 05:58:51 +08:00
--
-- Sends an instruction to do nothing, only disconnect
function disconnect()
local command = Command:newMIX{cmd = cmds.CMD_HF_ISO14443A_READER, arg1 = 0,}
2019-04-29 05:58:51 +08:00
-- We can ignore the response here, no ACK is returned for this command
-- Check /armsrc/iso14443a.c, ReaderIso14443a() for details
return command:sendMIX(true)
end
2019-04-29 03:29:47 +08:00
---
--
2019-04-29 05:58:51 +08:00
local function getblockdata(response)
if not response then
return nil, 'No response from device'
2019-04-29 07:51:00 +08:00
end
2019-04-30 04:41:28 +08:00
2019-04-29 07:51:00 +08:00
local count, cmd, arg0, arg1, arg2, data = bin.unpack('LLLLH40', response)
2019-04-29 05:58:51 +08:00
if arg0 == 1 then
return data:sub(1, 32)
2019-04-29 07:51:00 +08:00
end
return nil, "Couldn't read block"
end
---_ Gets data from a block
-- @return {block, block+1, block+2, block+3} if successful
-- @return nil, errormessage if unsuccessful
2019-04-29 05:58:51 +08:00
local function getBlock(blockno)
local block, err
local c = Command:newMIX{cmd = cmds.CMD_HF_MIFAREU_READBL, arg1 = blockno, data = 0}
2019-04-29 20:44:08 +08:00
block, err = getblockdata(c:sendMIX(false))
2019-04-29 05:58:51 +08:00
if not block then return oops(err) end
2019-04-30 04:41:28 +08:00
2019-04-29 05:58:51 +08:00
if #block < 32 then
return nil, ('Expected at least 16 bytes, got %d - this tag is not NDEF-compliant'):format(string.len(data))
2019-03-09 17:34:43 +08:00
end
-- Now, parse out the block data
-- 0534 00B9 049C AD7F 4A00 0000 E110 1000 2155
-- b0b0 b0b0 b1b1 b1b1 b2b2 b2b2 b3b3 b3b3 CRCC
2019-04-29 05:58:51 +08:00
b0 = string.sub(block, 1, 8)
b1 = string.sub(block, 9, 16)
b2 = string.sub(block, 17, 24)
b3 = string.sub(block, 25, 32)
2019-04-29 03:29:47 +08:00
return {b0, b1, b2, b3}
end
2019-04-29 05:58:51 +08:00
---
--
local function main( args)
2019-04-29 03:29:47 +08:00
print( string.rep('--',20) )
print( string.rep('--',20) )
2019-04-30 04:41:28 +08:00
2019-04-29 20:55:39 +08:00
local err, data, data2, k, v, i
local verbose = 0
2019-03-09 17:34:43 +08:00
-- Read the parameters
for o, a in getopt.getopt(args, 'hdv') do
2019-04-29 03:29:47 +08:00
if o == 'h' then return help() end
if o == 'd' then DEBUG = true end
if o == 'v' then verbose = 1 end
2019-03-09 17:34:43 +08:00
end
2019-04-29 05:58:51 +08:00
-- First of all, connect
info, err = lib14a.read(true, true)
2019-04-30 04:41:28 +08:00
if err then
2019-04-29 05:58:51 +08:00
disconnect();
return oops(err)
end
core.clearCommandBuffer()
if info.name:match("Ultralight") then
2019-04-29 23:34:47 +08:00
print('[=] Found a tag')
2019-04-29 05:58:51 +08:00
else
disconnect()
2019-04-29 23:34:47 +08:00
return oops('[!] Not a Ultralightbased card. This script reads NDEF formatted UL/NTAGS')
2019-04-29 05:58:51 +08:00
end
2019-04-30 04:41:28 +08:00
2019-03-09 17:34:43 +08:00
-- Info contained within the tag (block 0 example)
-- 0534 00B9 049C AD7F 4A00 0000 E110 1000 2155
-- b0b0 b0b0 b1b1 b1b1 b2b2 b2b2 b3b3 b3b3 CRCC
-- MM?? ???? ???? ???? ???? ???? NNVV SS?? ----
-- M = Manufacturer info
-- N = NDEF-Structure-Compliant (if value is E1)
-- V = NFC Forum Specification version (if 10 = v1.0)
-- First, get blockt 3 byte 2
local blocks, err = getBlock(0)
2019-04-29 03:29:47 +08:00
if err then
2019-04-29 05:58:51 +08:00
disconnect()
2019-04-29 04:54:00 +08:00
return oops(err)
2019-04-29 03:29:47 +08:00
end
2019-03-09 17:34:43 +08:00
-- Block 3 contains number of blocks
2019-04-29 23:34:47 +08:00
local b3 = utils.ConvertHexToBytes(blocks[4]);
local t5tarea = b3[3] * 8
2019-04-29 20:19:41 +08:00
local t5tarea_blocks = t5tarea / 4;
2019-03-09 17:34:43 +08:00
-- NDEF compliant?
2019-04-29 23:34:47 +08:00
if b3[1] ~= 0xE1 then
2019-04-29 05:58:51 +08:00
disconnect()
2019-04-29 23:34:47 +08:00
return oops('[!] This tag is not NDEF-Compliant')
2019-03-09 17:34:43 +08:00
end
-- Reuse existing info
2019-04-29 03:29:47 +08:00
local blockData = {blocks[1], blocks[2], blocks[3], blocks[4]}
2019-03-09 17:34:43 +08:00
--[[ Due to the infineon my-d move bug
(if I send 30 0F i receive block0f+block00+block01+block02 insted of block0f+block10+block11+block12)
the only way to avoid this is to send the read command as many times as block numbers
removing bytes from 5 to 18 from each answer.
--]]
2019-04-29 23:34:47 +08:00
print('[=] Dumping data...')
2019-04-29 20:19:41 +08:00
for i = 4, t5tarea_blocks - 1, 1 do
2019-03-09 17:34:43 +08:00
blocks, err = getBlock(i)
2019-04-30 04:41:28 +08:00
if err then
disconnect();
2019-04-29 05:58:51 +08:00
return oops(err)
end
2019-04-29 03:29:47 +08:00
table.insert(blockData, blocks[1])
2019-03-09 17:34:43 +08:00
end
-- Deactivate field
2019-04-29 05:58:51 +08:00
disconnect()
2019-03-09 17:34:43 +08:00
-- Print results
2019-04-29 23:34:47 +08:00
print('[=] --- Tag NDEF Message info')
print('[=] '.. string.rep('--', 50) )
print('[=] Type : ', info.name)
print('[=] UID : ', info.uid)
print('[=] Manufacturer : ', info.manufacturer)
print('[=] Capacity Container : '.. blockData[4])
print(('[=] %02X : NDEF Magic Number'):format(b3[1]) )
local vLow = band(b3[2], 0xF)
local vHi = band(rshift(b3[2], 4), 0xF)
print(('[=] %02X : version %d.%d supported by tag'):format(b3[2], vHi, vLow) )
2019-04-30 04:41:28 +08:00
2019-04-29 23:34:47 +08:00
print(('[=] %02X : Physical Memory Size: %d bytes'):format(b3[3], t5tarea) )
if b3[3] == 0x96 then
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 48))
elseif b3[3] == 0x12 then
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 144))
elseif b3[3] == 0x3E then
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 496))
elseif b3[3] == 0x6D then
print((' %02X : NDEF Memory Size: %d bytes'):format(b3[3], 872))
end
local rLow = band(b3[4], 0xF)
local rHi = band(rshift(b3[4], 4), 0xF)
local wstr, rstr
if rLow == 0 then
wstr = 'Write access granted without any security'
elseif rLow == 0x0F then
wstr = 'No write access granted at all'
else
wstr = '(RFU)'
end
if rHi ~= 0x00 then
rstr = '(RFU)'
else
rstr = 'Read access granted without any security'
end
print( ('[=] %02X : %s / %s'):format(b3[4], rstr, wstr))
print('[=] '.. string.rep('--', 50) )
2019-04-29 20:44:08 +08:00
local ndefdata = table.concat(blockData, '', 5)
core.ndefparse(t5tarea, verbose, ndefdata)
2019-04-29 23:34:47 +08:00
print('[=] '.. string.rep('--', 50) )
print('')
print('[=] Tag dump')
print('|---|-------------------|')
2019-03-09 17:34:43 +08:00
for k,v in ipairs(blockData) do
2019-04-29 23:34:47 +08:00
-- print(string.format('Block %02x: %02x %02x %02x %02x', k-1, string.byte(v, 1,4)))
2019-07-24 06:52:24 +08:00
print(string.format(' %02x | %s', k-1, v) )
2019-03-09 17:34:43 +08:00
end
2019-07-24 06:52:24 +08:00
print('|---|-------------------|')
2019-04-30 04:41:28 +08:00
2019-04-29 05:58:51 +08:00
local filename, err = utils.WriteDumpFile(info.uid, blockData)
2019-03-09 17:34:43 +08:00
if err then return oops(err) end
2019-04-29 23:34:47 +08:00
print(string.format('[+] Dumped data into %s', filename))
end
2019-04-30 04:41:28 +08:00
main(args)