X-Git-Url: http://git.rot13.org/?a=blobdiff_plain;f=mifare-mad.pl;h=bf9994ad6bc99efbb372ec4e005ecb0913fd2e4f;hb=2b4d76fc300c76d80e992efcf12bda92d1ed03b4;hp=44c3af8d953e86393168cf895832cb7b8a35abac;hpb=6c740ab10d7dce09b8dce27ab025c43638faaab0;p=perl-Mifare-MAD.git diff --git a/mifare-mad.pl b/mifare-mad.pl index 44c3af8..bf9994a 100755 --- a/mifare-mad.pl +++ b/mifare-mad.pl @@ -32,6 +32,29 @@ while() { } } +my $access_condition_data = { +0b000 => 'R:AB W:AB I:AB DTR:AB', +0b010 => 'R:AB W:-- I:-- DTR:--', +0b100 => 'R:AB W:-B I:-- DTR:--', +0b110 => 'R:AB W:-B I:-B DTR:AB', +0b001 => 'R:AB W:-- I:-- DTR:AB', +0b011 => 'R:-B W:-B I:-- DTR:--', +0b101 => 'R:-B W:-- I:-- DTR:--', +0b111 => 'R:-- W:-- I:-- DTR:--', +}; + +my $access_condition_trailer = { +0b000 => 'R/W: KEYSECXA:-/A ACCESS COND:A-/- KEYSECXB:A/A', +0b010 => 'R/W: KEYSECXA:-/- ACCESS COND:A-/- KEYSECXB:A/-', +0b100 => 'R/W: KEYSECXA:-/B ACCESS COND:AB/- KEYSECXB:-/B', +0b110 => 'R/W: KEYSECXA:-/- ACCESS COND:AB/- KEYSECXB:-/-', +0b001 => 'R/W: KEYSECXA:-/A ACCESS COND:A-/A KEYSECXB:A/A', +0b011 => 'R/W: KEYSECXA:-/B ACCESS COND:AB/B KEYSECXB:-/B', +0b101 => 'R/W: KEYSECXA:-/- ACCESS COND:AB/B KEYSECXB:-/-', +0b111 => 'R/W: KEYSECXA:-/- ACCESS COND:AB/- KEYSECXB:-/-', +}; + + if ( $debug ) { warn "# function_clusters ",dump($function_clusters); warn "# mad_id ", dump($mad_id); @@ -44,40 +67,85 @@ die "expected 4096 bytes, got ",length($card), " bytes\n" unless length $card == 4096; foreach my $i ( 0 .. 15 ) { - my $v = unpack('v',(substr($card, 0x10 + ( $i * 2 ), 2))); - my $cluster_id = unpack('HH', (( $v & 0xff00 ) >> 8) ); - my $full_id = sprintf "%04x",$v; - printf "MAD sector %-2d %04x [%s]\n%s\n", $i, $v - , $function_clusters->{ $cluster_id } - , $mad_id->{$full_id} || "FIXME: add $full_id from MAD_overview.pdf to __DATA__ at end of $0" - ; + + my $pos = 0x40 * $i; + + if ( $i == 0 ) { + printf "manufacturer block\nSerial number: %s\nCB: %s\nmanufacturer data: %s\n" + , unpack('H*',substr($card,0,4)) + , unpack('H*',substr($card,4,1)) + , unpack('H*',substr($card,5,11)) + ; + # General purpose byte (GPB) + my $gdp = ord(substr($card,0x39,1)); + printf "ADV (MAD version code): %d\n", $gdp & 0b00000011; + printf "MA (multiapplication): %s\n", $gdp & 0b01000000 ? 'yes' : 'monoaplication'; + printf "DA (MAD available): %s\n", $gdp & 0b10000000 ? 'yes' : 'no'; + + printf "Info byte (publisher sector): %x\n", ord(substr($card,0x11,1)); + } else { + my $mad_offset = 0x10 + ( $i * 2 ); + my $v = unpack('v',(substr($card, $mad_offset, 2))); + my $cluster_id = unpack('HH', (( $v & 0xff00 ) >> 8) ); + my $full_id = sprintf "%04x",$v; + printf "MAD sector %-2d@%x %04x [%s]\n%s\n", $i, $mad_offset, $v + , $function_clusters->{ $cluster_id } + , $mad_id->{$full_id} || "FIXME: add $full_id from MAD_overview.pdf to __DATA__ at end of $0" + ; + + if ( $v == 0x0004 ) { + # RLE encoded card holder information + my $data = substr( $card, $pos, 0x30); + my $o = 0; + my $types = { + 0b00 => 'surname', + 0b01 => 'given name', + 0b10 => 'sex', + 0b11 => 'any', + }; + while ( substr($data,$o,1) ne "\x00" ) { + my $len = ord(substr($data,$o,1)); + my $type = ( $len & 0b11000000 ) >> 6; + $len = $len & 0b00111111; + my $dump = substr($data,$o+1,$len-1); + $dump = '0x' . unpack('H*', $dump) if $type == 0b11; # any + printf "%-10s %2d %s\n", $types->{$type}, $len, $dump; + $o += $len + 1; + } + } elsif ( $v == 0x0015 ) { + printf "Card number: %s\n", unpack('h*',substr($card,$pos + 0x04,6)); + } + + } + + my $c1 = ( ord(substr($card,$pos+0x37,1)) & 0xf0 ) >> 4; + my $c2 = ( ord(substr($card,$pos+0x38,1)) & 0x0f ); + my $c3 = ( ord(substr($card,$pos+0x38,1)) & 0xf0 ) >> 4; foreach my $j ( 0 .. 3 ) { - my $offset = 0x40 * $i + $j * 0x10; + my $offset = $pos + $j * 0x10; my $block = substr($card, $offset, 0x10); - printf "%04x %s\n", $offset, unpack('H*',$block); + my $mask = 1 << $j; + my $cond + = ( ( $c1 & $mask ) * 4 ) + + ( ( $c2 & $mask ) * 2 ) + + ( ( $c3 & $mask ) * 1 ) + ; + $cond >>= $j; + + printf "%04x %s %03b %s\n", $offset, unpack('H*',$block) + , $cond + , $j < 3 ? $access_condition_data->{$cond} : $access_condition_trailer->{$cond} + ; } - if ( $v == 0x0004 ) { - # RLE encoded card holder information - my $data = substr( $card, 0x40 * $i, 0x30); - my $o = 0; - my $types = { - 0b00 => 'surname', - 0b01 => 'given name', - 0b10 => 'sex', - 0b11 => 'any', - }; - while ( substr($data,$o,1) ne "\x00" ) { - my $len = ord(substr($data,$o,1)); - my $type = ( $len & 0b11000000 ) >> 6; - $len = $len & 0b00111111; - my $dump = substr($data,$o+1,$len-1); - $dump = '0x' . unpack('H*', $dump) if $type == 0b11; # any - printf "%-10s %2d %s\n", $types->{$type}, $len, $dump; - $o += $len + 1; - } - } + + printf "KEY A:%s | %s GDP: %s | B:%s\n" + ,unpack('H*',substr($card,$pos+0x30 ,6)) + ,unpack('H*',substr($card,$pos+0x30+6 ,3)) + ,unpack('H*',substr($card,$pos+0x30+9 ,1)) + ,unpack('H*',substr($card,$pos+0x30+10,6)) + ; print "\n"; @@ -135,11 +203,12 @@ E8 computer F0 mail F8-FF miscellaneous applications -0000 sector free -0001 sector defective -0002 sector reserved -0003 DIR continuted -0004 card holder +0000 sector is free +0001 sector is defect, e.g. access keys are destroyed or unknown +0002 sector is reserved +0003 sector contains additional directory info (useful only for future cards) +0004 sector contains card holder information in ASCII format. +0005 sector not applicable (above memory size) 0015 - card administration MIKROELEKTRONIKA spol.s.v.MIKROELEKTRONIKA spol.s.v.o. worldwide 1 01.02.2007 Card publisher info 0016 - card administration Mikroelektronika spol.s.r.o., Kpt.Mikroelektronika spol.s.r.o., Kpt. PoEurope 1 10.10.2007 Issuer information