mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-06-07 17:32:01 +00:00
Update hf_mfu_amiibo_sim.lua
Changes the way the `.bin` is loaded into the emulator because Command::newNG didn't work. Signed-off-by: Lee Hambley <lee.hambley@gmail.com>
This commit is contained in:
@@ -6,8 +6,8 @@ local ansicolors = require('ansicolors')
|
||||
local amiibo_tools = require('amiibo_tools')
|
||||
|
||||
copyright = ''
|
||||
author = 'George Talusan'
|
||||
version = 'v0.0.2'
|
||||
author = 'George Talusan, modified by Lee Hambley'
|
||||
version = 'v0.0.3'
|
||||
desc = [[
|
||||
This script will try to load a binary datadump of an Amiibo.
|
||||
It will recalculate PWD and PACK if necessary.
|
||||
@@ -24,26 +24,9 @@ arguments = [[
|
||||
-f : filename for the datadump to read (bin)
|
||||
]]
|
||||
|
||||
local DEBUG = false -- the debug flag
|
||||
|
||||
local bxor = bit32.bxor
|
||||
local sub = string.sub
|
||||
local format = string.format
|
||||
|
||||
---
|
||||
-- A debug printout-function
|
||||
local function dbg(args)
|
||||
if not DEBUG then return end
|
||||
if type(args) == 'table' then
|
||||
local i = 1
|
||||
while result[i] do
|
||||
dbg(result[i])
|
||||
i = i+1
|
||||
end
|
||||
else
|
||||
print('###', args)
|
||||
end
|
||||
end
|
||||
---
|
||||
-- This is only meant to be used when errors occur
|
||||
local function oops(err)
|
||||
@@ -65,38 +48,55 @@ local function help()
|
||||
print(ansicolors.cyan..'Example usage'..ansicolors.reset)
|
||||
print(example)
|
||||
end
|
||||
--
|
||||
-- Exit message
|
||||
local function ExitMsg(msg)
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
print(msg)
|
||||
print()
|
||||
|
||||
local function BlocksToBinary(blocks, last)
|
||||
local out = {}
|
||||
for i = 0, last, 1 do
|
||||
local blk = blocks[i]
|
||||
if not blk or #blk ~= 8 then
|
||||
return nil, ('Invalid block %d (%s)'):format(i, tostring(blk))
|
||||
end
|
||||
for j = 1, 8, 2 do
|
||||
out[#out+1] = string.char(tonumber(blk:sub(j, j + 1), 16))
|
||||
end
|
||||
end
|
||||
return table.concat(out)
|
||||
end
|
||||
|
||||
local function LoadEmulator(uid, blocks)
|
||||
local function LoadViaEload(blocks)
|
||||
io.write('Sending Amiibo to emulator memory')
|
||||
local cmd, blockdata
|
||||
for i=0,148,1 do
|
||||
blockdata = blocks[i]
|
||||
io.write('.')
|
||||
io.flush()
|
||||
core.clearCommandBuffer()
|
||||
cmd = Command:newNG{cmd = cmds.CMD_HF_MIFARE_EML_MEMSET, data = ('%02x%02x%02x%s'):format(i, 1, 4, blockdata)}
|
||||
local err, msg = cmd:sendNG(true)
|
||||
if err == nil then return err, msg end
|
||||
local blob, err = BlocksToBinary(blocks, 148)
|
||||
if not blob then return false, err end
|
||||
|
||||
-- Create temp file for eload command
|
||||
-- Note: No direct MFU memory set command available (CMD_HF_MIFARE_EML_MEMSET only for MIFARE)
|
||||
local tmp = '/tmp/amiibo_emul.bin'
|
||||
local fh, ferr = io.open(tmp, 'wb')
|
||||
if not fh then return false, ferr end
|
||||
fh:write(blob)
|
||||
fh:close()
|
||||
|
||||
core.clearCommandBuffer()
|
||||
local ok, msg = core.console(('hf mfu eload -f %s'):format(tmp))
|
||||
|
||||
-- Clean up temp file
|
||||
os.remove(tmp)
|
||||
|
||||
if ok == false then
|
||||
return false, msg or 'eload command failed'
|
||||
end
|
||||
io.write('\n')
|
||||
return true
|
||||
end
|
||||
|
||||
local function main(args)
|
||||
print( string.rep('--',20) )
|
||||
print( string.rep('--',20) )
|
||||
|
||||
local result, err, hex
|
||||
local err, hex
|
||||
local inputTemplate = 'dumpdata.bin'
|
||||
|
||||
for o, a in getopt.getopt(args, 'hf:u:') do
|
||||
for o, a in getopt.getopt(args, 'hf:') do
|
||||
if o == 'h' then return help() end
|
||||
if o == 'f' then inputTemplate = a end
|
||||
end
|
||||
@@ -105,7 +105,6 @@ local function main(args)
|
||||
hex, err = utils.ReadDumpFile(inputTemplate)
|
||||
if not hex then return oops(err) end
|
||||
|
||||
-- only deal with missing PWD and PACK, or with 56 emu hdr
|
||||
if #hex ~= 1064 and #hex ~= 1080 and #hex ~= 1192 then return oops('Expecting either a plain binary or emulator dump') end
|
||||
|
||||
local amiibo_offset = (#hex == 1064 or #hex == 1080) and 0 or 112
|
||||
@@ -114,7 +113,6 @@ local function main(args)
|
||||
local amiibo_type = amiibo_info:sub(7, 8)
|
||||
local amiibo_series = amiibo_info:sub(13, 14)
|
||||
|
||||
dbg('raw: '..ansicolors.green..amiibo_info..ansicolors.reset)
|
||||
print('game: '..ansicolors.green..amiibo_tools.db.game_series[("0x%s"):format(amiibo_game)]..ansicolors.reset)
|
||||
print('character: '..ansicolors.green..amiibo_tools.db.amiibos[("0x%s"):format(amiibo_info)].name..ansicolors.reset)
|
||||
print('type: '..ansicolors.green..amiibo_tools.db.types[("0x%s"):format(amiibo_type)]..ansicolors.reset)
|
||||
@@ -141,11 +139,12 @@ local function main(args)
|
||||
|
||||
-- add PWD and PACK
|
||||
local uid = blocks[14]:sub(1, 6)..blocks[15]:sub(1, 8)
|
||||
blocks[147] = ("%08x"):format(bxor(bxor(tonumber(sub(uid, 2, 10), 16), tonumber(sub(uid, 6, 14), 16)), 0xaa55aa55))
|
||||
local pwd = ("%08x"):format(bxor(bxor(tonumber(sub(uid, 2, 10), 16), tonumber(sub(uid, 6, 14), 16)), 0xaa55aa55))
|
||||
blocks[147] = pwd
|
||||
blocks[148] = "80800000"
|
||||
|
||||
err = LoadEmulator(uid, blocks)
|
||||
if err then return oops(err) end
|
||||
local ok, loadErr = LoadViaEload(blocks)
|
||||
if not ok then return oops(loadErr) end
|
||||
core.clearCommandBuffer()
|
||||
core.console(("hf mfu sim -t 7 -u %s"):format(uid))
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user