more converting scripts

This commit is contained in:
iceman1001 2019-04-28 19:51:25 +02:00
parent 79bfe892d6
commit f4f8636b86
2 changed files with 75 additions and 55 deletions

View file

@ -2,8 +2,8 @@ local getopt = require('getopt')
local bin = require('bin') local bin = require('bin')
copyright = 'Copyright (c) 2018 Bogito. All rights reserved.' copyright = 'Copyright (c) 2018 Bogito. All rights reserved.'
author = "Bogito" author = 'Bogito'
version = 'v1.0.1' version = 'v1.0.2'
desc = desc =
[[ [[
This script will read the flash memory of RDV4 and print the stored passwords. This script will read the flash memory of RDV4 and print the stored passwords.
@ -11,20 +11,6 @@ It was meant to be used as a help tool after using the BogRun standalone mode.
(Iceman) script adapted to read and print keys in the default dictionary flashmemory sections. (Iceman) script adapted to read and print keys in the default dictionary flashmemory sections.
]] ]]
usage =
[[
Usage:
script run read_pwd_mem -h -o <offset> -l <length> -k <keylength>
Arguments:
-h : this help
-o <offset> : memory offset, default is 0
-l <length> : length in bytes, default is 256
-k <keylen> : key length in bytes <4|6|8> , default is 4
-m : print Mifare dictionary keys
-t : print t55xx dictionary passwords
-i : print iClass dictionary keys
]]
example = example =
[[ [[
-- This will scan the first 256 bytes of flash memory for stored passwords -- This will scan the first 256 bytes of flash memory for stored passwords
@ -39,21 +25,37 @@ example =
-- This will print found -- This will print found
script run read_pwd_mem -o 241664 -k 6 script run read_pwd_mem -o 241664 -k 6
]] ]]
usage =
[[
Usage:
script run read_pwd_mem -h -o <offset> -l <length> -k <keylength>
Arguments:
-h : this help
-o <offset> : memory offset, default is 0
-l <length> : length in bytes, default is 256
-k <keylen> : key length in bytes <4|6|8> , default is 4
-m : print Mifare dictionary keys
-t : print t55xx dictionary passwords
-i : print iClass dictionary keys
]]
--- ---
-- This is only meant to be used when errors occur -- This is only meant to be used when errors occur
local function oops(err) local function oops(err)
print("ERROR: ", err) print('ERROR:', err)
core.clearCommandBuffer()
return nil, err return nil, err
end end
--- ---
-- Usage help -- Usage help
local function help() local function help()
print(copyright) print(copyright)
print(author)
print(version) print(version)
print(desc) print(desc)
print(usage) print('Example usage')
print('Example usage:')
print(example) print(example)
print(usage)
end end
--- ---
-- The main entry point -- The main entry point
@ -73,20 +75,20 @@ local function main(args)
for o, a in getopt.getopt(args, 'ho:l:k:mti') do for o, a in getopt.getopt(args, 'ho:l:k:mti') do
-- help -- help
if o == "h" then return help() end if o == 'h' then return help() end
-- offset -- offset
if o == "o" then offset = tonumber(a) end if o == 'o' then offset = tonumber(a) end
-- num of bytes to read -- num of bytes to read
if o == "l" then length = tonumber(a) end if o == 'l' then length = tonumber(a) end
-- keylength -- keylength
if o == "k" then keylength = tonumber(a); usedkey = true end if o == 'k' then keylength = tonumber(a); usedkey = true end
if o == "m" then keylength =6; usedkey = true; offset = 0x3F000-0x4000; end if o == 'm' then keylength =6; usedkey = true; offset = 0x3F000-0x4000; end
if o == "t" then keylength =4; usedkey = true; offset = 0x3F000-0x3000; end if o == 't' then keylength =4; usedkey = true; offset = 0x3F000-0x3000; end
if o == "i" then keylength =8; usedkey = true; offset = 0x3F000-0x5000; end if o == 'i' then keylength =8; usedkey = true; offset = 0x3F000-0x5000; end
end end
if length < 0 or length > 256 then if length < 0 or length > 256 then
@ -116,7 +118,7 @@ local function main(args)
for i = 1, keys do for i = 1, keys do
key = string.sub(s, (i - 1) * kl + 1, i * kl ) key = string.sub(s, (i - 1) * kl + 1, i * kl )
print(string.format("[%02d] %s",i, key)) print(string.format('[%02d] %s',i, key))
end end
print( string.rep('--',20) ) print( string.rep('--',20) )
print( ('[+] found %d passwords'):format(keys)) print( ('[+] found %d passwords'):format(keys))
@ -128,8 +130,8 @@ local function main(args)
for i = 1, (length/keylength) do for i = 1, (length/keylength) do
key = string.sub(s, (i-1)*8+1, i*8) key = string.sub(s, (i-1)*8+1, i*8)
if key == "FFFFFFFF" then break end if key == 'FFFFFFFF' then break end
print(string.format("[%02d] %s",i, key)) print(string.format('[%02d] %s',i, key))
cnt = cnt + 1 cnt = cnt + 1
end end
print( string.rep('--',20) ) print( string.rep('--',20) )

View file

@ -1,12 +1,21 @@
local getopt = require('getopt') local getopt = require('getopt')
example = "script run remagic" copyright = ''
author = "Iceman" author = 'Iceman'
version = 'v1.0.1'
desc = desc =
[[ [[
This is a script that tries to bring back a chinese magic card (1k generation1) This is a script that tries to bring back a chinese magic card (1k generation1)
from the dead when it's block 0 has been written with bad values. from the dead when it's block 0 has been written with bad values.
or mifare Ultralight magic card which answers to chinese backdoor commands or mifare Ultralight magic card which answers to chinese backdoor commands
]]
example = [[
-- target a Ultralight based card
1. script run remagic -u
]]
usage = [[
script run remagic
Arguments: Arguments:
-h this help -h this help
@ -15,55 +24,64 @@ Arguments:
--- ---
-- A debug printout-function -- A debug printout-function
local function dbg(args) local function dbg(args)
if DEBUG then if not DEBUG then return end
if type(args) == 'table' then
local i = 1
while result[i] do
dbg(result[i])
i = i+1
end
else
print('###', args) print('###', args)
end end
end end
--- ---
-- This is only meant to be used when errors occur -- This is only meant to be used when errors occur
local function oops(err) local function oops(err)
print('ERROR: ',err) print('ERROR:', err)
core.clearCommandBuffer()
return nil, err
end end
--- ---
-- Usage help -- Usage help
local function help() local function help()
print(copyright)
print(author)
print(version)
print(desc) print(desc)
print('Example usage') print('Example usage')
print(example) print(example)
print(usage)
end end
local function cmdUltralight() local function cmdUltralight()
return { return {
--[[ [0] = 'hf 14a raw -p -a -b 7 40',
--]] [1] = 'hf 14a raw -p -a 43',
[0] = "hf 14a raw -p -a -b 7 40", [2] = 'hf 14a raw -c -a A2005380712A',
[1] = "hf 14a raw -p -a 43", [3] = 'hf 14a raw -p -a -b 7 40',
[2] = "hf 14a raw -c -a A2005380712A", [4] = 'hf 14a raw -p -a 43',
[3] = "hf 14a raw -p -a -b 7 40", [5] = 'hf 14a raw -c -a A2010200D980',
[4] = "hf 14a raw -p -a 43", [6] = 'hf 14a raw -p -a -b 7 40',
[5] = "hf 14a raw -c -a A2010200D980", [7] = 'hf 14a raw -p -a 43',
[6] = "hf 14a raw -p -a -b 7 40", [8] = 'hf 14a raw -c -a A2025B480000',
[7] = "hf 14a raw -p -a 43", [9] = 'hf 14a raw -c -a 5000',
[8] = "hf 14a raw -c -a A2025B480000",
[9] = "hf 14a raw -c -a 5000",
} }
end end
local function cmdClassic() local function cmdClassic()
return { return {
--[[ [0] = 'hf 14a raw -p -a -b 7 40',
--]] [1] = 'hf 14a raw -p -a 43',
[0] = "hf 14a raw -p -a -b 7 40", [2] = 'hf 14a raw -c -p -a A000',
[1] = "hf 14a raw -p -a 43", [3] = 'hf 14a raw -c -p -a 01020304049802000000000000001001',
[2] = "hf 14a raw -c -p -a A000", [4] = 'hf 14a raw -c -a 5000',
[3] = "hf 14a raw -c -p -a 01020304049802000000000000001001",
[4] = "hf 14a raw -c -a 5000",
} }
end end
local function cmdRestoreST() local function cmdRestoreST()
local arr = {} local arr = {}
for i = 0, 15 do for i = 0, 15 do
local blk = 3 + (4*i) local blk = 3 + (4*i)
arr[i] = "hf mf csetbl "..blk.." FFFFFFFFFFFFFF078000FFFFFFFFFFFF" arr[i] = 'hf mf csetbl '..blk..' FFFFFFFFFFFFFF078000FFFFFFFFFFFF'
end end
return arr return arr
end end
@ -86,8 +104,8 @@ function main(args)
-- Read the parameters -- Read the parameters
for o, a in getopt.getopt(args, 'hu') do for o, a in getopt.getopt(args, 'hu') do
if o == "h" then return help() end if o == 'h' then return help() end
if o == "u" then isUltralight = true end if o == 'u' then isUltralight = true end
end end
core.clearCommandBuffer() core.clearCommandBuffer()