mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-02-14 03:03:14 +08:00
@iceman1001 updated scripts
This commit is contained in:
marshmellow42
parent
d730878d8c
commit
ab7fdfcbed
4 changed files with 59 additions and 39 deletions
|
|
@ -80,14 +80,14 @@ function GetCardInfo()
|
|||
|
||||
core.clearCommandBuffer()
|
||||
|
||||
if 0x18 == result.sak then --NXP MIFARE Classic 4k | Plus 4k
|
||||
if 0x18 == result.sak then -- NXP MIFARE Classic 4k | Plus 4k
|
||||
-- IFARE Classic 4K offers 4096 bytes split into forty sectors,
|
||||
-- of which 32 are same size as in the 1K with eight more that are quadruple size sectors.
|
||||
numSectors = 40
|
||||
elseif 0x08 == result.sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
|
||||
elseif 0x08 == result.sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
|
||||
-- 1K offers 1024 bytes of data storage, split into 16 sector
|
||||
numSectors = 16
|
||||
elseif 0x09 == result.sak then -- NXP MIFARE Mini 0.3k
|
||||
elseif 0x09 == result.sak then -- NXP MIFARE Mini 0.3k
|
||||
-- MIFARE Classic mini offers 320 bytes split into five sectors.
|
||||
numSectors = 5
|
||||
elseif 0x10 == result.sak then -- NXP MIFARE Plus 2k
|
||||
|
|
|
|||
|
|
@ -13,6 +13,7 @@ local band = bit32.band
|
|||
example =[[
|
||||
script run tnp3clone
|
||||
script run tnp3clone -h
|
||||
script run tnp3clone -l
|
||||
script run tnp3clone -t aa00 -s 0030
|
||||
|
||||
]]
|
||||
|
|
@ -23,7 +24,8 @@ This script will try making a barebone clone of a tnp3 tag on to a magic generat
|
|||
|
||||
Arguments:
|
||||
-h : this help
|
||||
-t <data> : toytype id, 4hex symbols.
|
||||
-l : list all known toy tokens
|
||||
-t <data> : toytype id, 4hex symbols
|
||||
-s <data> : subtype id, 4hex symbols
|
||||
|
||||
For fun, try the following subtype id:
|
||||
|
|
@ -32,7 +34,7 @@ Arguments:
|
|||
0138 - Series 2
|
||||
0234 - Special
|
||||
023c - Special
|
||||
|
||||
0020 - Swapforce
|
||||
]]
|
||||
|
||||
|
||||
|
|
@ -74,7 +76,7 @@ local function readmagicblock( blocknum )
|
|||
-- Read block 0
|
||||
local CSETBLOCK_SINGLE_OPERATION = 0x1F
|
||||
cmd = Command:new{cmd = cmds.CMD_MIFARE_CGETBLOCK, arg1 = CSETBLOCK_SINGLE_OPERATION, arg2 = 0, arg3 = blocknum}
|
||||
err = core.SendCommand(cmd:getBytes())
|
||||
err = core.SendCommand(cmd:getBytes())
|
||||
if err then return nil, err end
|
||||
local block0, err = waitCmd()
|
||||
if err then return nil, err end
|
||||
|
|
@ -98,12 +100,13 @@ local function main(args)
|
|||
local DEBUG = true
|
||||
|
||||
-- Arguments for the script
|
||||
for o, a in getopt.getopt(args, 'ht:s:') do
|
||||
for o, a in getopt.getopt(args, 'ht:s:l') do
|
||||
if o == "h" then return help() end
|
||||
if o == "t" then toytype = a end
|
||||
if o == "s" then subtype = a end
|
||||
if o == "l" then return toys.List() end
|
||||
end
|
||||
|
||||
|
||||
if #toytype ~= 4 then return oops('Wrong size - toytype. (4hex symbols)') end
|
||||
if #subtype ~= 4 then return oops('Wrong size - subtype. (4hex symbols)') end
|
||||
|
||||
|
|
@ -139,8 +142,9 @@ local function main(args)
|
|||
-- wipe card.
|
||||
local cmd = (csetuid..'%s 0004 08 w'):format(result.uid)
|
||||
core.console(cmd)
|
||||
|
||||
local b1 = toytype..string.rep('00',10)..subtype
|
||||
|
||||
local b1 = toytype..'00000000000000000000'..subtype
|
||||
local calc = utils.Crc16(b0..b1)
|
||||
local calcEndian = bor(rsh(calc,8), lsh(band(calc, 0xff), 8))
|
||||
|
||||
|
|
|
|||
|
|
@ -205,18 +205,19 @@ local function main(args)
|
|||
|
||||
if blockNo < 8 then
|
||||
-- Block 0-7 not encrypted
|
||||
blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata)
|
||||
blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata)
|
||||
else
|
||||
-- blocks with zero not encrypted.
|
||||
if string.find(blockdata, '^0+$') then
|
||||
blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata)
|
||||
blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,blockdata)
|
||||
else
|
||||
local baseStr = utils.ConvertHexToAscii(tmpHash:format(blockNo))
|
||||
local key = md5.sumhexa(baseStr)
|
||||
local aestest = core.aes128_decrypt(key, blockdata)
|
||||
local hex = utils.ConvertAsciiToBytes(aestest)
|
||||
local hex = utils.ConvertAsciiToBytes(aestest)
|
||||
hex = utils.ConvertBytesToHex(hex)
|
||||
blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,hex)
|
||||
blocks[blockNo+1] = ('%02d :: %s'):format(blockNo,hex)
|
||||
io.write(blockNo..',')
|
||||
end
|
||||
end
|
||||
else
|
||||
|
|
@ -273,5 +274,7 @@ local function main(args)
|
|||
print( (' UID : 0x%s'):format(uid) )
|
||||
print( (' CARDID : 0x%s'):format(cardid ) )
|
||||
print( string.rep('--',20) )
|
||||
|
||||
core.clearCommandBuffer()
|
||||
end
|
||||
main(args)
|
||||
|
|
@ -23,10 +23,22 @@ Arguments:
|
|||
-h : this help
|
||||
-m : Maxed out items (experimental)
|
||||
-i : filename for the datadump to read (bin)
|
||||
]]
|
||||
|
||||
]]
|
||||
|
||||
local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
|
||||
local DEBUG = true -- the debug flag
|
||||
local DEBUG = false -- the debug flag
|
||||
local RANDOM = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
|
||||
|
||||
local band = bit32.band
|
||||
local bor = bit32.bor
|
||||
local lshift = bit32.lshift
|
||||
local rshift = bit32.rshift
|
||||
local byte = string.byte
|
||||
local char = string.char
|
||||
local sub = string.sub
|
||||
local format = string.format
|
||||
|
||||
|
||||
|
||||
local band = bit32.band
|
||||
|
|
@ -197,8 +209,6 @@ local function ValidateCheckSums(blocks)
|
|||
io.write( ('TYPE 3 area 2: %04x = %04x -- %s\n'):format(crc,calc,isOk))
|
||||
end
|
||||
|
||||
local function LoadEmulator(blocks)
|
||||
local HASHCONSTANT = '20436F707972696768742028432920323031302041637469766973696F6E2E20416C6C205269676874732052657365727665642E20'
|
||||
local cmd
|
||||
local blockdata
|
||||
for _,b in pairs(blocks) do
|
||||
|
|
@ -207,10 +217,10 @@ local function LoadEmulator(blocks)
|
|||
|
||||
if _%4 ~= 3 then
|
||||
if (_ >= 8 and _<=21) or (_ >= 36 and _<=49) then
|
||||
local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , HASHCONSTANT)
|
||||
local base = ('%s%s%02x%s'):format(blocks[0], blocks[1], _ , RANDOM)
|
||||
local baseStr = utils.ConvertHexToAscii(base)
|
||||
local key = md5.sumhexa(baseStr)
|
||||
local enc = core.aes(key, blockdata)
|
||||
local enc = core.aes128_encrypt(key, blockdata)
|
||||
local hex = utils.ConvertAsciiToBytes(enc)
|
||||
hex = utils.ConvertBytesToHex(hex)
|
||||
|
||||
|
|
@ -346,21 +356,6 @@ local function main(args)
|
|||
local cmdSetDbgOff = "hf mf dbg 0"
|
||||
core.console( cmdSetDbgOff)
|
||||
|
||||
-- if not loadFromDump then
|
||||
-- -- Look for tag present on reader,
|
||||
-- result, err = lib14a.read1443a(false)
|
||||
-- if not result then return oops(err) end
|
||||
|
||||
-- core.clearCommandBuffer()
|
||||
|
||||
-- if 0x01 ~= result.sak then -- NXP MIFARE TNP3xxx
|
||||
-- return oops('This is not a TNP3xxx tag. aborting.')
|
||||
-- end
|
||||
|
||||
-- -- Show tag info
|
||||
-- print((' Found tag : %s'):format(result.name))
|
||||
-- end
|
||||
|
||||
-- Load dump.bin file
|
||||
print( (' Load data from %s'):format(inputTemplate))
|
||||
hex, err = utils.ReadDumpFile(inputTemplate)
|
||||
|
|
@ -374,7 +369,7 @@ local function main(args)
|
|||
end
|
||||
|
||||
if DEBUG then
|
||||
print('Validating checksums in the loaded datadump')
|
||||
print(' Validating checksums')
|
||||
ValidateCheckSums(blocks)
|
||||
end
|
||||
|
||||
|
|
@ -393,7 +388,7 @@ local function main(args)
|
|||
local item = toys.Find( toytype, subtype)
|
||||
if item then
|
||||
local itemStr = ('%s - %s (%s)'):format(item[6],item[5], item[4])
|
||||
print(' ITEM TYPE :'..itemStr )
|
||||
print(' ITEM TYPE : '..itemStr )
|
||||
else
|
||||
print( (' ITEM TYPE : 0x%s 0x%s'):format(toytype, subtype) )
|
||||
end
|
||||
|
|
@ -407,12 +402,19 @@ local function main(args)
|
|||
print( string.rep('--',20) )
|
||||
|
||||
|
||||
-- lets do something.
|
||||
--
|
||||
-- Experience should be:
|
||||
local experience = blocks[8]:sub(1,6)
|
||||
print(('Experience : %d'):format(utils.SwapEndianness(experience,24)))
|
||||
print(('Experience : %d'):format(utils.SwapEndianness(experience,16)))
|
||||
|
||||
local money = blocks[8]:sub(7,10)
|
||||
print(('Money : %d'):format(utils.SwapEndianness(money,16)))
|
||||
|
||||
--
|
||||
|
||||
-- Sequence number
|
||||
local seqnum = blocks[8]:sub(18,19)
|
||||
print(('Sequence number : %d'):format( tonumber(seqnum,16)))
|
||||
|
||||
local fairy = blocks[9]:sub(1,8)
|
||||
--FD0F = Left, FF0F = Right
|
||||
local path = 'not choosen'
|
||||
|
|
@ -425,6 +427,12 @@ local function main(args)
|
|||
|
||||
local hat = blocks[9]:sub(8,11)
|
||||
print(('Hat : %d'):format(utils.SwapEndianness(hat,16)))
|
||||
|
||||
local level = blocks[13]:sub(27,28)
|
||||
print(('LEVEL : %d'):format( tonumber(level,16)))
|
||||
--hälsa: 667 029b
|
||||
--local health = blocks[]:sub();
|
||||
--print(('Health : %d'):format( tonumber(health,16))
|
||||
|
||||
--0x0D 0x29 0x0A 0x02 16-bit hero points value. Maximum 100.
|
||||
local heropoints = blocks[13]:sub(20,23)
|
||||
|
|
@ -434,6 +442,11 @@ local function main(args)
|
|||
local challenges = blocks[16]:sub(25,32)
|
||||
print(('Finished hero challenges : %d'):format(utils.SwapEndianness(challenges,32)))
|
||||
|
||||
-- Character Name
|
||||
local name1 = blocks[10]:sub(1,32)
|
||||
local name2 = blocks[12]:sub(1,32)
|
||||
print('Custom name : '..utils.ConvertHexToAscii(name1..name2))
|
||||
|
||||
if maxed then
|
||||
print('Lets try to max out some values')
|
||||
-- max out money, experience
|
||||
|
|
|
|||
Loading…
Reference in a new issue