晚上睡不着,想着白天工作上的事,解决一个现场读卡问题就需要出趟差值得吗。想着在公司就能把现场的卡给读写诊断了,能让数据跑路就别让人跑路,说干就干。
本工具是在浏览器中以Lua脚本的形式对CPU卡,M1卡就行读、写等各种操作,配和使用改造过后的E711读卡器。
远端把读卡器接到电脑上,并运行读写卡服务。告知客户端IP地址和端口,并放上卡。客户端调用相关指令,运行脚本,输出结果。
远程读卡器就是一个普通usb口或串口的读卡器,如E711读卡器。配合一个电脑软件作为tcp读写卡服务。这样可以在公司电脑上运行客户端程序连到服务器上,服务器端操控现场的读卡器。之前做保定公交老卡兼容,让现场寄卡过来,结果拖了好久,卡也没寄过来。说是卡片管理严格,老年卡,学生卡需要从系统上从新办卡。于是让现场同事配合抓下包,读取一下卡上数据,但现场同事连串口助手都没听说过,指望不上了。最后没办法,还是出差跑去一趟,做了些很简单的事。回来想想,其实可以做一个远程读卡器,在公司把现场的卡给操作了。再封装一些读卡的客户端接口,可以实现远程仿真调试程序读卡消费逻辑 ,或者实现一完全软件模拟的pos机。之前用java做过一个读写卡工具,但是只能在本地电脑上读写卡。
交通部卡测试消费成功的lua脚本指令:
--192.168.157.135/test3/runcode.php
--读卡服务地址
ip= "192.168.157.135"
--读卡服务端口
port = 5050
--连接到读卡服务
ret = CONNECT(ip,port) --建立连接
------------------------------------------- CPU卡操作
ret,rcv = S_SFI("\x3F\x00",1) --选择PSAM卡应用3F00
ret,rcv = R_BFile(0x15,0,0,1) --读取PSAM卡15文件
ret,rcv = R_BFile(0x16,0,0,1) --读取PSAM卡16文件
if ret == 0x9000 then
PasmTID = string.sub(rcv,1,12)
print("pasmTID:"..PasmTID)
end
ret,rcv = S_AID("\xA0\x00\x00\x06\x32\x01\x01\x05",0x08,0) --选择交通部应用
ret,rcv = R_BFile(0x15,0,0,0) --读取卡片0x15文件
if ret == 0x9000 then
MakeCardId = string.sub(rcv,1,16)
CardASN = string.sub(rcv,25,25+16-1)
print(rcv)
print("MakeCardId:"..MakeCardId)
print("CardASN:"..CardASN)
end
ret,rcv = R_BFile(0x16,0,0,0)
ret,rcv = R_BFile(0x17,0,0,0)
ret,rcv = S_SFI("\x80\x11",1) --选择交通部PSAM卡应用
ret,rcv = APDU("805C030204",0) --读取余额
--消费初始化
cmd = '805001020B'
index = '01'
money = '00000001'
cmdstr = cmd..index..money..PasmTID
print("xiao fei chu shi hua:")
ret,rcv = APDU(cmdstr,0) --消费初始化
if ret == 0x9000 then
PullCTC = string.sub(rcv,9,9+4-1) --脱机交易序号
KeyVer = string.sub(rcv,19,19+2-1)
KeyDrk = string.sub(rcv,21,21+2-1)
Icc = string.sub(rcv,23,23+8-1) --随机数
print("PullCTC:"..PullCTC)
print("KeyVer:"..KeyVer)
print("KeyDrk:"..KeyDrk)
print("Icc:"..Icc)
end
cmd = '8070000024'
time ='20161128170231'
cmdstr = cmd..Icc..PullCTC..money..'06'..time..KeyVer..KeyDrk..CardASN..MakeCardId
ret,rcv = APDU(cmdstr,1) --PSAM卡算MAC
if ret == 0x9000 then
TTC = string.sub(rcv,1,8) --脱机交易序号
MAC1 = string.sub(rcv,9,9+8-1)
print("TTC:"..TTC)
print("MAC1:"..MAC1)
end
cmd = '805401000F'
cmdstr = cmd..TTC..time..MAC1
ret,rcv = APDU(cmdstr,0)
DISCONNECT() --断开连接
要远程读写卡得有个后台服务去操控远程的读卡器。有了后台读写卡服务,客户端不能只是接口,得简单好用,于是有了这个web端。
附截图:
截图1,运行效果
截图2,相关指令介绍:
截图3,后台文件
截图4,后台读写卡服务显示的收发日志:
后台的解析lua脚本的文件lua_test.c
//包含LUA的头文件,用来支持脚本
#include <stdio.h>
#include "lib/lua-5.3.1/lua.h"
#include "lib/lua-5.3.1/lualib.h"
#include "lib/lua-5.3.1/lauxlib.h"
#include "lib/includes.h"
#define PICC_ADD 0xC1 //加
#define PICC_SUB 0xC0 //减
#define PICC_RESTORE 0xC2 //恢复
#define PICC_KEYA 0x60 //KEY A
#define PICC_KEYB 0x61 //KEY B
#define PICC_NULL 0x00 //不校验KEY
lua_State* L;
U08 gCardSN[8]; //物理卡号
U32 ICF_SelectAID( const char *AID, U32 ilen, U32 ich )
{
U32 rcode;
gCmdBuffer[0] = 0x00; //CLA
gCmdBuffer[1] = 0xA4; //INS
gCmdBuffer[2] = 0x04; //P1
gCmdBuffer[3] = 0x00; //P2
gCmdBuffer[4] = ilen; //Lc
CurCalc_DataCpy( gCmdBuffer+5, (U08*)AID, ilen );
rcode = ICC_APDU_Exchange( ich, gCmdBuffer, ilen+5, gpRcvBuffer, &Grcv_Len, 260 );
if( rcode != 0 )
{ return rcode; }
if( Grcv_Len < 2 )
{ return 2;}
rcode = ( ( gpRcvBuffer[ Grcv_Len - 2 ] << 8 ) | gpRcvBuffer[ Grcv_Len - 1 ] );
return rcode;
}
U32 ICF_SelectSFI( const char *SFI, U32 ich )
{
U32 rcode;
gCmdBuffer[0] = 0x00; //CLA
gCmdBuffer[1] = 0xA4; //INS
gCmdBuffer[2] = 0x00; //P1
gCmdBuffer[3] = 0x00; //P2
gCmdBuffer[4] = 0x02; //Lc
CurCalc_DataCpy( gCmdBuffer+5, (U08*)SFI, 2 );
rcode = ICC_APDU_Exchange( ich, gCmdBuffer, 2+5, gpRcvBuffer, &Grcv_Len, 260 );
if( rcode != 0 )
{ return rcode; }
if( Grcv_Len < 2 )
{ return 2;}
rcode = ( ( gpRcvBuffer[ Grcv_Len - 2 ] << 8 ) | gpRcvBuffer[ Grcv_Len - 1 ] );
return rcode;
}
U32 ICF_ReadBinaryFile( U08 SFI, U08 Offset, U08 BytesToRead, U32 ich )
{
unsigned short rcode;
gCmdBuffer[0] = 0x00; //CLA
gCmdBuffer[1] = 0xB0; //INS
gCmdBuffer[2] = 0x80 | ( SFI & 0x1F ); //P1
gCmdBuffer[3] = Offset; //P2
gCmdBuffer[4] = BytesToRead; //Le
rcode = ICC_APDU_Exchange( ich, gCmdBuffer, 5, gpRcvBuffer, &Grcv_Len, 260 );
if( rcode != 0 )
{ return rcode; }
if( Grcv_Len < 2 ) //长度判断
{ return 2;}
rcode = ( ( gpRcvBuffer[ Grcv_Len - 2 ] << 8 ) | gpRcvBuffer[ Grcv_Len - 1 ] );
return rcode;
}
int LConnect(lua_State* L)
{
int ret = 0;
size_t le = 0;
printf("Connecting...\n");
const char * ipaddr = luaL_checklstring(L,1,&le);
//printf("cmd is %s,le is %d\n",aid,le);
//从L栈中取出索引为2的数值,并检查
int port = luaL_checkinteger(L,2);
printf("ServerIP:%s,Port:%d\n", ipaddr,port);
ret = Connect(ipaddr,port);
lua_pushnumber(L,ret);
return 1;
}
int LDisConnect(lua_State* L)
{
printf("Close connect!\n");
Com_Dev_Disconnect( 0 );
return 1;
}
int LTxData(lua_State* L)
{
int ret = 0;
unsigned int len = 0;
size_t le = 0;
unsigned char buf[1024];
unsigned char outbuf[2048];
memset(buf, 0, 1024);
memset(outbuf, 0, 2048);
//从L栈中取出索引为1的数值,并检查
const char * txdata = luaL_checklstring(L,1,&le);
//printf("tx is %s,le is %d\n",txdata,le);
StrToHex( (char*)txdata, le, buf );
ret = Com_Dev_TxData( buf, le/2, 0, 0 );
if( ret != 0 )
{ DEF_SysCard_Debug; return ret; }
ret = Com_Dev_RxData( buf, &len, 1024, 0, 0 );
if( ret != 0 )
{ DEF_SysCard_Debug; return ret; }
HexToStr(buf,len,(char*)outbuf);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)outbuf,strlen((char*)outbuf));
return 2;
}
int LTxData1(lua_State* L)
{
int ret = 0;
unsigned int len = 0;
size_t le = 0;
unsigned char buf[1024];
unsigned char outbuf[2048];
memset(buf, 0, 1024);
memset(outbuf, 0, 2048);
//从L栈中取出索引为1的数值,并检查
const char * txdata = luaL_checklstring(L,1,&le);
// printf("tx is %s,le is %d\n",txdata,le);
//StrToHex( (char*)txdata, le, buf );
ret = Com_Dev_TxData1( (unsigned char*)txdata, le, 0, 0 );
if( ret != 0 )
{ DEF_SysCard_Debug; return ret; }
ret = Com_Dev_RxData1( buf, &len, 1024, 0, 0 );
if( ret != 0 )
{ DEF_SysCard_Debug; return ret; }
//HexToStr(buf,len,(char*)outbuf);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)buf,len);
return 2;
}
int LAPDU_Exchange(lua_State* L)
{
int ret = 0;
size_t le = 0;
unsigned char buf[520];
memset(buf, 0, 520);
//从L栈中取出索引为1的数值,并检查
const char * cmd = luaL_checklstring(L,1,&le);
//printf("cmd is %s,le is %d\n",aid,le);
//从L栈中取出索引为2的数值,并检查
int ich = luaL_checkinteger(L,2);
StrToHex( (char*)cmd, le, gCmdBuffer );
ret = ICC_APDU_Exchange( ich, gCmdBuffer, le/2, gpRcvBuffer, &Grcv_Len, 260 );
if( Grcv_Len < 2)
{ return 1;}
ret = ( ( gpRcvBuffer[ Grcv_Len - 2 ] << 8 ) | gpRcvBuffer[ Grcv_Len - 1 ] );
HexToStr(gpRcvBuffer,Grcv_Len,(char*)buf);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)buf,strlen((char*)buf));
return 2;
}
int LSelectAID(lua_State* L)
{
int ret = 0;
size_t le = 0;
unsigned char buf[520];
memset(buf, 0, 520);
//从L栈中取出索引为1的数值,并检查
const char * aid = luaL_checklstring(L,1,&le);
//printf("aid is %s,le is %d\n",aid,le);
//从L栈中取出索引为2的数值,并检查
int len = luaL_checkinteger(L,2);
int ich = luaL_checkinteger(L,3);
ret = ICF_SelectAID( aid, len, ich );
HexToStr(gpRcvBuffer,Grcv_Len,(char*)buf);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)buf,strlen((char*)buf));
return 2;
}
int LSelectSFI(lua_State* L)
{
int ret = 0;
size_t le = 0;
unsigned char buf[520];
memset(buf, 0, 520);
//从L栈中取出索引为1的数值,并检查
const char * sfi = luaL_checklstring(L,1,&le);
//printf("aid is %s,le is %d\n",aid,le);
//从L栈中取出索引为2的数值,并检查
int ich = luaL_checkinteger(L,2);
ret = ICF_SelectSFI( sfi, ich );
HexToStr(gpRcvBuffer,Grcv_Len,(char*)buf);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)buf,strlen((char*)buf));
return 2;
}
int LReadBinaryFile( lua_State* L )
{
int ret = 0;
unsigned char buf[520];
memset(buf, 0, 520);
//从L栈中取出索引为1的数值,并检查
int sfi = luaL_checkinteger(L,1);
int oft = luaL_checkinteger(L,2);
int rlen = luaL_checkinteger(L,3);
int ich = luaL_checkinteger(L,4);
ret = ICF_ReadBinaryFile(sfi,oft,rlen,ich);
HexToStr(gpRcvBuffer,Grcv_Len,(char*)buf);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)buf,strlen((char*)buf));
//stackDump(L);
return 2;
}
//获取CPU或M1卡的物理卡号
int LGetPhySn( lua_State* L )
{
int ret = 0;
unsigned char buf[20];
unsigned char buf1[20];
memset(buf,0,20);
memset(buf1,0,20);
ret = ICC_MiOne_GetPhySn(buf);
memcpy(gCardSN,buf,8);//保存全局物理卡号
HexToStr(buf,8,(char*)buf1);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)buf1,strlen((char*)buf1));
//stackDump(L);
return 2;
}
//M1卡扇区读
int LBlkRead( lua_State* L )
{
int ret = 0;
size_t le = 0;
unsigned char rbuf[50];
unsigned char sbuf[50];
unsigned char key[16];
unsigned char cmd=0;
int block = luaL_checkinteger(L,1);
const char * keys = luaL_checklstring(L,2,&le);
int keytype = luaL_checkinteger(L,3); //密码类型,0,不校验 1,A码,2,B码
memset(rbuf,0,50);
memset(sbuf,0,50);
StrToHex( (char*)keys, le, key );
cmd = PICC_KEYA;
if(keytype == 1)
{ cmd = PICC_KEYA; }
else if(keytype == 2)
{ cmd = PICC_KEYB; }
ret = ICC_MiOne_BlkRead(block,cmd,key, gCardSN, rbuf );
HexToStr(rbuf,16,(char*)sbuf);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)sbuf,strlen((char*)sbuf));
//stackDump(L);
return 2;
}
//M1卡扇区写
int LBlkWrite( lua_State* L )
{
int ret = 0;
size_t le = 0,le1 =0;
unsigned char wbuf[50];
unsigned char key[16];
unsigned char cmd=0;
int block = luaL_checkinteger(L,1);
const char * wbufs = luaL_checklstring(L,2,&le);
const char * keys = luaL_checklstring(L,3,&le1);
int keytype = luaL_checkinteger(L,4); //密码类型,0,不校验 1,A码,2,B码
memset(wbuf,0,50);
StrToHex( (char*)wbufs, le, wbuf );
StrToHex( (char*)keys, le1, key );
cmd = PICC_KEYA;
if(keytype == 1)
{ cmd = PICC_KEYA; }
else if(keytype == 2)
{ cmd = PICC_KEYB; }
ret = ICC_MiOne_BlkWrite(block,cmd,key, gCardSN, wbuf );
lua_pushinteger(L,ret);
//stackDump(L);
return 1;
}
//DES加密
int LDES_Encrypt( lua_State* L )
{
// int ret = 0;
size_t le = 0,le1 =0;
unsigned char inkey[16];
unsigned char indata[16];
unsigned char outdata[16];
unsigned char str_out[50];
const char * str_inkey = luaL_checklstring(L,1,&le);
const char * str_indata = luaL_checklstring(L,2,&le1);
StrToHex( (char*)str_inkey, le, inkey );
StrToHex( (char*)str_indata, le1, indata );
CurCalc_DES_Encrypt( inkey, indata, outdata );
HexToStr(outdata,8,(char*)str_out);
//lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)str_out,16);
//stackDump(L);
return 1;
}
//DES解密
int LDES_Decrypt( lua_State* L )
{
// int ret = 0;
size_t le = 0,le1 =0;
unsigned char inkey[16];
unsigned char indata[16];
unsigned char outdata[16];
unsigned char str_out[50];
const char * str_inkey = luaL_checklstring(L,1,&le);
const char * str_indata = luaL_checklstring(L,2,&le1);
StrToHex( (char*)str_inkey, le, inkey );
StrToHex( (char*)str_indata, le1, indata );
CurCalc_DES_Decrypt( inkey, indata, outdata );
HexToStr(outdata,8,(char*)str_out);
//lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)str_out,16);
//stackDump(L);
return 1;
}
//3DES加密
int LDES_3Encrypt( lua_State* L )
{
// int ret = 0;
size_t le = 0,le1 =0;
unsigned char inkey[16];
unsigned char indata[16];
unsigned char outdata[16];
unsigned char str_out[50];
const char * str_inkey = luaL_checklstring(L,1,&le);
const char * str_indata = luaL_checklstring(L,2,&le1);
StrToHex( (char*)str_inkey, le, inkey );
StrToHex( (char*)str_indata, le1, indata );
CurCalc_3DES_Encrypt( inkey, indata, outdata );
HexToStr(outdata,16,(char*)str_out);
//lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)str_out,32);
//stackDump(L);
return 1;
}
//3DES解密
int LDES_3Decrypt( lua_State* L )
{
// int ret = 0;
size_t le = 0,le1 =0;
unsigned char inkey[16];
unsigned char indata[16];
unsigned char outdata[16];
unsigned char str_out[50];
const char * str_inkey = luaL_checklstring(L,1,&le);
const char * str_indata = luaL_checklstring(L,2,&le1);
StrToHex( (char*)str_inkey, le, inkey );
StrToHex( (char*)str_indata, le1, indata );
CurCalc_3DES_Decrypt( inkey, indata, outdata );
HexToStr(outdata,16,(char*)str_out);
//lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)str_out,32);
//stackDump(L);
return 1;
}
U32 MathDesMac( U08 *pbuf, U32 length, U08 *key,U08 checktype )
{
U32 len ;
U08 mac[8], mac1[8];
len = length ;
if( checktype == 0 )
{
CurCalc_DES_MAC64( (SINGLE_DES_ENCRYPTION|ZERO_CBC_IV), key, 0, pbuf, len , mac );
memcpy( pbuf+len, mac, 8 );
return 0 ;
}
else
{
//暂存源校验码
memcpy( mac1, pbuf+len-8, 8 ) ;
CurCalc_DES_MAC64( (SINGLE_DES_ENCRYPTION|ZERO_CBC_IV), key, 0, pbuf, len-8 , mac) ;
if ( memcmp( mac, mac1, 8 ) == 0x00 )
{
return 0 ; //校验产生的校验码和原校验码相等, 校验成功
}
else
{
return 1 ; //校验产生的校验码和原校验码不等, 校验失败
}
}
}
int LMathDesMac( lua_State* L )
{
int ret = 0;
size_t le = 0,le1 =0;
unsigned char inkey[16];
unsigned char indata[1024];
unsigned char str_out[2048];
const char * str_indata = luaL_checklstring(L,1,&le);
int inlen = luaL_checkinteger(L,2);
const char * str_inkey = luaL_checklstring(L,3,&le1);
int type = luaL_checkinteger(L,4);
StrToHex( (char*)str_indata, le, indata );
StrToHex( (char*)str_inkey, le1, inkey );
ret = MathDesMac( indata, inlen,inkey,type );
memset(str_out,0,2048);
HexToStr(indata,inlen+8,(char*)str_out);
lua_pushinteger(L,ret);
lua_pushlstring(L,(char*)str_out,strlen((char*)str_out));
//stackDump(L);
return 1;
}
int main( void )
{
//初始化全局L
L = luaL_newstate(); //创建lua的栈
//打开库
luaL_openlibs(L);
//把函数压入栈中
//lua_pushcfunction(L, add);
//设置全局ADD
//lua_setglobal(L, "ADD");
//lua_register(L,"ADD",add);
lua_pushcfunction(L, LConnect);
//设置全局ADD
lua_setglobal(L, "CONNECT");
lua_register(L,"DISCONNECT", LDisConnect);
lua_register(L,"TxData",LTxData);
lua_register(L,"TxData1",LTxData1);
lua_register(L,"APDU", LAPDU_Exchange);
lua_register(L,"S_AID",LSelectAID);
lua_register(L,"S_SFI",LSelectSFI);
lua_register(L,"R_BFile",LReadBinaryFile);
lua_register(L,"G_SN",LGetPhySn);
lua_register(L,"R_Block",LBlkRead);
lua_register(L,"W_Block",LBlkWrite);
lua_register(L,"DES_Enc",LDES_Encrypt);
lua_register(L,"DES_Dec",LDES_Decrypt);
lua_register(L,"DES_3Enc",LDES_3Encrypt);
lua_register(L,"DES_3Dec",LDES_3Decrypt);
lua_register(L,"MathDesMac",LMathDesMac);
//加载我们的lua脚本文件
if(luaL_loadfile(L,"test.lua")) //载入lua脚本,是通过fopen打开的,
{
printf("error,failed to analysis script!\nmaybe syntax error!\n");
}
//安全检查
lua_pcall(L,0,0,0); //这个函数会执行lua脚本
//push进lua函数
// lua_getglobal(L, "mylua1");
// lua_pcall(L,0,0,0);
printf("end my lua script,finish!\n");
lua_close(L); //关闭lua的栈
return 0;
}
php后台的处理原理:
compile.php
<?php
header('Content-Type:json; charset=UTF-8');
set_time_limit(0);
//var_dump($_POST);
$str= $_POST['code'];
//echo $str;
file_put_contents("test.lua",$str);
$flv_cmd="lua_test.exe >out.txt";
exec($flv_cmd);
if(file_exists("out.txt"))
{
$txt1 = file_get_contents("out.txt");
$err ="ok";
$txt =iconv("GB2312","UTF-8//IGNORE",$txt1); //将编码从GB2312转成UTF-8
//echo $txt;
}
else
{
$txt ="output err!\n";
$err ="exec err!\n";
}
$json = array("output"=>$txt,"langid"=>"17","code"=>"print(\"Hello World!\")","errors"=>$err,"time"=>"01\n");
//var_dump($json);
$result = json_encode($json);
//var_dump($result);
$output = $result;
echo $output;
?>
后台库文件的makefile:
########################################
#makefile
########################################
#编译主程序
BINARY := lua_test
OBJ_DIR :=
CC= gcc
LD= ld
CFLAGS= -std=c99 -Wall -g
LDSCRIPT= -lmycom -lws2_32 -liconv -lmyfile -lmycard -lmyup -lmycalc -lmyblkfile -llua
LDFLAGS= -Llib
SRC = $(wildcard *.c)
DIR = $(notdir $(SRC))
OBJS = $(patsubst %.c,$(OBJ_DIR)%.o,$(DIR))
#OBJS= main.o myutils.o inirw.o cmdpboc.o cputest.o bustcp.o ansrec.o m1cmd.o m1api.o m1test.o upcash.o myother.o getsys.o
#CFLAGS=-std=c99
#@echo Building lib...
#$(call make_subdir)
.PHONY: clean lib
all: prebuild $(BINARY).exe
prebuild:
@echo Building app...
$(BINARY).exe : $(OBJS)
@echo Generating ...
$(CC) -o $(BINARY).exe $(OBJS) $(LDFLAGS) $(LDSCRIPT)
@echo OK!
$(OBJ_DIR)%.o : %.c
$(CC) -c $(CFLAGS) $< -o $@
clean:
rm -f $(OBJ_DIR)*.o
@echo Removed!