mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-22 00:06:13 +08:00
276 lines
7.9 KiB
Lua
276 lines
7.9 KiB
Lua
--[[
|
|
This is an example of Lua-scripting within proxmark3. This is a lua-side
|
|
implementation of hf mf chk
|
|
|
|
This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
|
at your option, any later version. See the LICENSE.txt file for the text of
|
|
the license.
|
|
|
|
Copyright (C) 2013 m h swende <martin at swende.se>
|
|
--]]
|
|
-- Loads the commands-library
|
|
local cmds = require('commands')
|
|
-- Load the default keys
|
|
local keylist = require('mf_default_keys')
|
|
-- Ability to read what card is there
|
|
local lib14a = require('read14a')
|
|
local getopt = require('getopt')
|
|
-- Asks the user for input
|
|
local utils = require('utils')
|
|
|
|
example =[[
|
|
script run mfkeys
|
|
]]
|
|
author = "Holiman"
|
|
usage = "script run mfkeys"
|
|
desc = ("This script implements Mifare check keys.\
|
|
It utilises a large list of default keys (currently %d keys).\
|
|
If you want to add more, just put them inside /lualibs/mf_default_keys.lua\n"):format(#keylist) ..
|
|
[[
|
|
|
|
Arguments:
|
|
-h : this help
|
|
-p : print keys
|
|
]]
|
|
|
|
local TIMEOUT = 10000 -- 10 seconds
|
|
---
|
|
-- This is only meant to be used when errors occur
|
|
local function oops(err)
|
|
print('ERROR: ',err)
|
|
return nil,err
|
|
end
|
|
---
|
|
-- Usage help
|
|
local function help()
|
|
print(desc)
|
|
print("Example usage")
|
|
print(example)
|
|
end
|
|
--
|
|
-- waits for answer from pm3 device
|
|
local function checkCommand(command)
|
|
core.clearCommandBuffer()
|
|
local usb = command:getBytes()
|
|
core.SendCommand(usb)
|
|
local result = core.WaitForResponseTimeout(cmds.CMD_ACK, TIMEOUT)
|
|
if result then
|
|
local count, cmd, arg0 = bin.unpack('LL',result)
|
|
if(arg0==1) then
|
|
local count, arg1, arg2, data = bin.unpack('LLH511',result,count)
|
|
key = data:sub(1,12)
|
|
return key
|
|
else
|
|
return nil
|
|
end
|
|
else
|
|
print("Timeout while waiting for response. Increase TIMEOUT in mfkeys.lua to wait longer")
|
|
return nil, "Timeout while waiting for device to respond"
|
|
end
|
|
end
|
|
|
|
local function checkBlock(blockno, testkeys, keytype)
|
|
|
|
-- The command data is only 512 bytes, each key is 6 bytes, meaning that we can send max 85 keys in one go.
|
|
-- If there's more, we need to split it up
|
|
local arg1 = bit32.bor(bit32.lshift(keytype, 8), blockno)
|
|
|
|
local start, remaining = 1, #testkeys
|
|
local chunksize = remaining
|
|
if remaining > 85 then chunksize = 85 end
|
|
local n = chunksize
|
|
|
|
while remaining > 0 do
|
|
--print('start', start, 'chunksize', chunksize, 'testkeys kvar', remaining, 'N-index=', n)
|
|
|
|
local d1 = table.concat(testkeys, "", start, n)
|
|
|
|
print(("Testing block %d, keytype %d, with %d keys"):format(blockno, keytype, chunksize))
|
|
local command = Command:new{cmd = cmds.CMD_MIFARE_CHKKEYS,
|
|
arg1 = arg1,
|
|
arg2 = 0,
|
|
arg3 = chunksize,
|
|
data = d1}
|
|
local status = checkCommand(command)
|
|
if status then return status, blockno end
|
|
start = start + chunksize
|
|
remaining = remaining - chunksize
|
|
|
|
if remaining < 85 then chunksize = remaining end
|
|
n = n + chunksize
|
|
end
|
|
return nil
|
|
end
|
|
|
|
-- A function to display the results
|
|
local function display_results(keys)
|
|
local sector, keyA, keyB, succA, succB
|
|
print('')
|
|
print('|---|----------------|---|----------------|---|')
|
|
print('|sec|key A |res|key B |res|')
|
|
print('|---|----------------|---|----------------|---|')
|
|
|
|
for sector = 0, #keys do
|
|
succA, succB, keyA, keyB = unpack(keys[sector])
|
|
print(('|%03d| %s | %s | %s | %s |'):format(sector, keyA, succA, keyB, succB))
|
|
end
|
|
print('|---|----------------|---|----------------|---|')
|
|
end
|
|
-- A little helper to place an item first in the list
|
|
local function placeFirst(akey, list)
|
|
akey = akey:lower()
|
|
if list[1] == akey then
|
|
-- Already at pole position
|
|
return list
|
|
end
|
|
local result = {akey}
|
|
--print(("Putting '%s' first"):format(akey))
|
|
for i,v in ipairs(list) do
|
|
if v ~= akey then
|
|
result[#result+1] = v
|
|
end
|
|
end
|
|
return result
|
|
end
|
|
--[[
|
|
The mifare Classic 1k card has 16 sectors of 4 data blocks each.
|
|
The first 32 sectors of a mifare Classic 4k card consists of 4 data blocks and the remaining
|
|
8 sectors consist of 16 data blocks.
|
|
--]]
|
|
local function get_blockno(s)
|
|
|
|
local b, sector
|
|
|
|
if type(s) == 'string' then
|
|
sector = tonumber(s)
|
|
else
|
|
sector = s
|
|
end
|
|
|
|
if sector < 32 then
|
|
b = sector * 4
|
|
else
|
|
b = 32 * 4 + (sector - 32) * 16
|
|
end
|
|
return ('%02x'):format(b)
|
|
end
|
|
--
|
|
-- dumps all keys to file
|
|
local function dumptofile(keys)
|
|
if utils.confirm('Do you wish to save the keys to dumpfile?') then
|
|
local destination = utils.input('Select a filename to store to', 'dumpkeys.bin')
|
|
local file = io.open(destination, 'wb')
|
|
if file == nil then
|
|
print('Could not write to file ', destination)
|
|
return
|
|
end
|
|
|
|
local key_a = ''
|
|
local key_b = ''
|
|
|
|
--for sector,_ in pairs(keys) do
|
|
for sector = 0, #keys do
|
|
local succA, succB, keyA, keyB = unpack(keys[sector])
|
|
key_a = key_a .. bin.pack('H', keyA);
|
|
key_b = key_b .. bin.pack('H', keyB);
|
|
end
|
|
file:write(key_a)
|
|
file:write(key_b)
|
|
file:close()
|
|
end
|
|
end
|
|
local function printkeys()
|
|
for i=1, #keylist do
|
|
print(i, keylist[i])
|
|
end
|
|
print ('Number of keys: '..#keylist)
|
|
end
|
|
local function perform_check(numsectors)
|
|
|
|
local keyType = 0 -- A=0, B=1
|
|
|
|
-- empty list of found keys
|
|
local keys = {}
|
|
for i = 0, numsectors-1 do
|
|
keys[i] = {0,0,'',''}
|
|
end
|
|
|
|
for sector = 0, #keys do
|
|
-- Check if user aborted
|
|
if core.ukbhit() then
|
|
print('Aborted by user')
|
|
break
|
|
end
|
|
|
|
local targetblock = tonumber(get_blockno(sector), 16)
|
|
|
|
local succA, succB, keyA, keyB = unpack(keys[sector])
|
|
|
|
local keyA = checkBlock(targetblock, keylist, 0)
|
|
if keyA then succA = 1; keylist = placeFirst(keyA, keylist) end
|
|
keyA = keyA or '------------'
|
|
|
|
local keyB = checkBlock(targetblock, keylist, 1)
|
|
if keyB then succB = 1; keylist = placeFirst(keyB, keylist) end
|
|
keyB = keyB or '------------'
|
|
|
|
keys[sector] = {succA, succB, keyA, keyB}
|
|
end
|
|
|
|
display_results(keys)
|
|
|
|
-- save to dumpkeys.bin
|
|
dumptofile(keys)
|
|
end
|
|
--
|
|
-- shows tag information
|
|
local function taginfo(tag)
|
|
|
|
local sectors = 16
|
|
-- Show tag info
|
|
print((' Found tag %s'):format(tag.name))
|
|
|
|
if 0x18 == tag.sak then --NXP MIFARE Classic 4k | Plus 4k
|
|
-- MIFARE Classic 4K offers 4096 bytes split into forty sectors,
|
|
-- of which 32 are same size as in the 1K with eight more that are quadruple size sectors.
|
|
sectors = 40
|
|
elseif 0x08 == tag.sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
|
|
-- 1K offers 1024 bytes of data storage, split into 16 sector
|
|
sectors = 16
|
|
elseif 0x09 == tag.sak then -- NXP MIFARE Mini 0.3k
|
|
-- MIFARE Classic mini offers 320 bytes split into five sectors.
|
|
sectors = 5
|
|
elseif 0x10 == tag.sak then-- "NXP MIFARE Plus 2k"
|
|
sectors = 32
|
|
else
|
|
print("I don't know how many sectors there are on this type of card, defaulting to 16")
|
|
end
|
|
return sectors
|
|
end
|
|
---
|
|
-- The main entry point
|
|
local function main(args)
|
|
|
|
local start_time = os.time()
|
|
local numSectors = 16
|
|
|
|
-- Arguments for the script
|
|
for o, a in getopt.getopt(args, 'hp') do
|
|
if o == "h" then return help() end
|
|
if o == "p" then return printkeys() end
|
|
end
|
|
-- identify tag
|
|
tag, err = lib14a.read(false, true)
|
|
if not tag then return oops(err) end
|
|
|
|
-- detect sectors and print taginfo
|
|
numsectors = taginfo(tag)
|
|
|
|
perform_check(numsectors)
|
|
|
|
local end_time = os.time()
|
|
print('mfkeys - Total execution time: '..os.difftime(end_time, start_time)..' sec')
|
|
end
|
|
|
|
main( args)
|