proxmark3/client/scripts/ndef_dump.lua

local getopt = require('getopt')
local cmds = require('commands')
local lib14a = require('read14a')
local utils = require('utils')

copyright = ''
author = 'Martin Holst Swende & Asper'
version = 'v1.0.1'
desc = [[
This script will automatically recognize and dump full content of a NFC NDEF Initialized tag; non-initialized tags will be ignored.

It also write the dump to an eml-file <uid>.eml.

(The difference between an .eml-file and a .bin-file is that the eml file contains
ASCII representation of the hex-data, with linebreaks between 'rows'. A .bin-file contains the
raw data, but when saving into that for, we lose the infromation about how the memory is structured.
For example: 24 bytes could be 6 blocks of 4 bytes, or vice versa.
Therefore, the .eml is better to use file when saving dumps.)

]]
example = [[
    1. script run ndef_dump
]]
usage = [[
script run ndef_dump

Arguments:
    -h              this help
    -d              debug logging on
    -v              verbose output (from ndef parsing)

]]

local DEBUG = true -- the debug flag
local band = bit32.band
local rshift = bit32.rshift
---
-- A debug printout-function
local function dbg(args)
    if not DEBUG then return end
    if type(args) == 'table' then
        local i = 1
        while result[i] do
            dbg(result[i])
            i = i+1
        end
    else
        print('###', args)
    end
end
---
-- This is only meant to be used when errors occur
local function oops(err)
    print('ERROR:', err)
    core.clearCommandBuffer()
    return nil, err
end
---
-- Usage help
local function help()
    print(copyright)
    print(author)
    print(version)
    print(desc)
    print('Example usage')
    print(example)
    print(usage)
end
--
-- Sends an instruction to do nothing, only disconnect
function disconnect()
    local command = Command:newMIX{cmd = cmds.CMD_READER_ISO_14443a, arg1 = 0,}
    -- We can ignore the response here, no ACK is returned for this command
    -- Check /armsrc/iso14443a.c, ReaderIso14443a() for details
    return command:sendMIX(true)
end
---
--
local function getblockdata(response)
    if not response then
        return nil, 'No response from device'
    end

    local count, cmd, arg0, arg1, arg2, data = bin.unpack('LLLLH40', response)
    if arg0 == 1 then
        return data:sub(1, 32)
    end

    return nil, "Couldn't read block"
end
---_ Gets data from a block
-- @return {block, block+1, block+2, block+3} if successfull
-- @return nil, errormessage if unsuccessfull
local function getBlock(blockno)
    local block, err
    local c = Command:newMIX{cmd = cmds.CMD_MIFAREU_READBL, arg1 = blockno, data = 0}
    block, err = getblockdata(c:sendMIX(false))
    if not block then return oops(err) end

    if #block < 32 then
        return nil, ('Expected at least 16 bytes, got %d - this tag is not NDEF-compliant'):format(string.len(data))
    end
    -- Now, parse out the block data
    -- 0534 00B9 049C AD7F 4A00 0000 E110 1000 2155
    -- b0b0 b0b0 b1b1 b1b1 b2b2 b2b2 b3b3 b3b3 CRCC
    b0 = string.sub(block, 1, 8)
    b1 = string.sub(block, 9, 16)
    b2 = string.sub(block, 17, 24)
    b3 = string.sub(block, 25, 32)
    return {b0, b1, b2, b3}
end
---
--
local function main( args)

    print( string.rep('--',20) )
    print( string.rep('--',20) )

    local err, data, data2, k, v, i
    local verbose = 0
    -- Read the parameters
    for o, a in getopt.getopt(args, 'hdv') do
        if o == 'h' then return help() end
        if o == 'd' then DEBUG = true end
        if o == 'v' then verbose = 1 end
    end

    -- First of all, connect
    info, err = lib14a.read(true, true)
    if err then
        disconnect();
        return oops(err)
    end
    core.clearCommandBuffer()

    if info.name:match("Ultralight") then
        print('[=] Found a tag')
    else
        disconnect()
        return oops('[!] Not a Ultralightbased card. This script reads NDEF formatted UL/NTAGS')
    end

    -- Info contained within the tag (block 0 example)
    -- 0534 00B9 049C AD7F 4A00 0000 E110 1000 2155
    -- b0b0 b0b0 b1b1 b1b1 b2b2 b2b2 b3b3 b3b3 CRCC
    -- MM?? ???? ???? ???? ???? ???? NNVV SS?? ----
    -- M = Manufacturer info
    -- N = NDEF-Structure-Compliant (if value is E1)
    -- V = NFC Forum Specification version (if 10 = v1.0)

    -- First, get blockt 3 byte 2
    local blocks, err = getBlock(0)
    if err then
        disconnect()
        return oops(err)
    end
    -- Block 3 contains number of blocks
    local b3 = utils.ConvertHexToBytes(blocks[4]);
    local t5tarea = b3[3] * 8
    local t5tarea_blocks = t5tarea / 4;

    -- NDEF compliant?
    if b3[1] ~= 0xE1 then
        disconnect()
        return oops('[!] This tag is not NDEF-Compliant')
    end

    -- Reuse existing info
    local blockData = {blocks[1], blocks[2], blocks[3], blocks[4]}

    --[[ Due to the infineon my-d move bug
    (if I send 30 0F i receive block0f+block00+block01+block02 insted of block0f+block10+block11+block12)
    the only way to avoid this is to send the read command as many times as block numbers
    removing bytes from 5 to 18 from each answer.
    --]]
    print('[=] Dumping data...')
    for i = 4, t5tarea_blocks - 1, 1 do
        blocks, err = getBlock(i)
        if err then
            disconnect();
            return oops(err)
        end
        table.insert(blockData, blocks[1])
    end
    -- Deactivate field
    disconnect()
    -- Print results
    print('[=] --- Tag NDEF Message info')
    print('[=] '.. string.rep('--', 50) )
    print('[=]          Type : ', info.name)
    print('[=]           UID : ', info.uid)
    print('[=]  Manufacturer : ', info.manufacturer)
    print('[=]  Capacity Container : '.. blockData[4])
    print(('[=]     %02X : NDEF Magic Number'):format(b3[1]) )

    local vLow = band(b3[2], 0xF)
    local vHi = band(rshift(b3[2], 4), 0xF)
    print(('[=]     %02X : version %d.%d supported by tag'):format(b3[2], vHi, vLow) )

    print(('[=]     %02X : Physical Memory Size: %d bytes'):format(b3[3], t5tarea) )
    if b3[3] == 0x96 then
       print(('  %02X : NDEF Memory Size: %d bytes'):format(b3[3], 48))
    elseif b3[3] == 0x12 then
       print(('  %02X : NDEF Memory Size: %d bytes'):format(b3[3], 144))
    elseif b3[3] == 0x3E then
       print(('  %02X : NDEF Memory Size: %d bytes'):format(b3[3], 496))
    elseif b3[3] == 0x6D then
       print(('  %02X : NDEF Memory Size: %d bytes'):format(b3[3], 872))
    end

    local rLow = band(b3[4], 0xF)
    local rHi = band(rshift(b3[4], 4), 0xF)
    local wstr, rstr

    if rLow == 0 then
       wstr = 'Write access granted without any security'
    elseif rLow == 0x0F then
       wstr = 'No write access granted at all'
    else
       wstr = '(RFU)'
    end

    if rHi ~= 0x00 then
       rstr = '(RFU)'
    else
       rstr = 'Read access granted without any security'
    end

    print( ('[=]     %02X : %s / %s'):format(b3[4], rstr, wstr))

    print('[=] '.. string.rep('--', 50) )
    local ndefdata = table.concat(blockData, '', 5)
    core.ndefparse(t5tarea, verbose, ndefdata)
    print('[=] '.. string.rep('--', 50) )

    print('')
    print('[=] Tag dump')
    print('|---|-------------------|')
    for k,v in ipairs(blockData) do

--        print(string.format('Block %02x: %02x %02x %02x %02x', k-1, string.byte(v, 1,4)))
        print(string.format(' %02x | %s', k-1, v) )
    end
    print('|---|-------------------|')

    local filename, err = utils.WriteDumpFile(info.uid, blockData)
    if err then return oops(err) end

    print(string.format('[+] Dumped data into %s', filename))

end
main(args)