Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Request Xerox HFD1-T tonerchip file pattern #306

Open
JeroenSteen opened this issue Sep 28, 2024 · 1 comment
Open

Request Xerox HFD1-T tonerchip file pattern #306

JeroenSteen opened this issue Sep 28, 2024 · 1 comment

Comments

@JeroenSteen
Copy link

I would like some help to make a file pattern for Xerox HFD1-T tonerchips. By setting up a pattern file it would be easier to analyse the tonerchip data further. Unfortunately I'm not familiair yet with the pattern code syntax and how it works. I would like some suggestions of good tutorials or example code. I need to select multiple different bits in a certain order, and use encryption/decryption (so files can be encrypted and need decryption, or files can be already decrypted and can maybe have some extra information), and bit shifting function for the data. I think hexpat works with setting up a struct, but I'm confused on how to select the data and twist it to make it work. Here is just a start:

struct TonerChipData {
 decryptionKey;
 partNumber;
 date;
 serialNumber;
};
@JeroenSteen
Copy link
Author

JeroenSteen commented Sep 28, 2024

//Pattern made by Jeroen van der Steen (@JeroenSteen), with help from @AxCut, @somemadeupname in Discord.
//Pattern build with knowledge of the Proxmark source (@iceman1001, @horror)

import std.io;

//Used for infoblocks, 5 blocks (5*4=20): Partnumber, Date, Serial, Type
//block 0x15 (21), 0x15 * 4
u8 infoPart1 @ 0x54; //Partnumber
u8 infoPart2 @ 0x55; //Partnumber
u8 infoPart3 @ 0x56; //Partnumber
u8 infoPart4 @ 0x57; //Partnumber
//block 0x16 (22), 0x16 * 4
u8 infoPart5 @ 0x58; //Partnumber
u8 infoPart6 @ 0x59; //Partnumber
u8 infoPart7 @ 0x5A; //-
u8 infoPart8 @ 0x5B; //-
//block 0x17 (23), 0x17 * 4
u8 infoPart9 @ 0x5C; //Date
u8 infoPart10 @ 0x5D; //Date
u8 infoPart11 @ 0x5E; //Date
u8 infoPart12 @ 0x5F; //-
//block 0x18 (24), 0x18 * 4
u8 infoPart13 @ 0x60; //Serial
u8 infoPart14 @ 0x61; //Serial
u8 infoPart15 @ 0x62; //Serial
u8 infoPart16 @ 0x63; //-
//block 0x22 (34), 0x22 * 4
u8 infoPart17 @ 0x88; //-
u8 infoPart18 @ 0x89; //-
u8 infoPart19 @ 0x8A; //Type
u8 infoPart20 @ 0x8B; //-


//Used for decrypting (RC2_cbc)
u8 decryptKeyPart1 @ 0x08; //8
u8 decryptKeyPart2 @ 0x05; //5
u8 decryptKeyPart3 @ 0x06; //6
u8 decryptKeyPart4 @ 0x07; //7
u8 decryptKeyPart5 @ 0x60; //0x18 * 4 + 0
u8 decryptKeyPart6 @ 0x61; //0x18 * 4 + 1
u8 decryptKeyPart7 @ 0x88; //0x22 * 4 + 0


//Used for secret blocks, 16 blocks (16*4=64)
//Todo research these items of Meaning
//block 0x1c (28), 0x1c * 4
u8 varPart1  @ 0x70; // Block 28
u8 varPart2  @ 0x71;
u8 varPart3  @ 0x72;
u8 varPart4  @ 0x73;

//block 0x1e (29), 0x1e * 4
u8 varPart5  @ 0x78; // Block 29
u8 varPart6  @ 0x79;
u8 varPart7  @ 0x7A;
u8 varPart8  @ 0x7B;

//block 0x20 (30), 0x20 * 4
u8 varPart9  @ 0x80; // Block 30
u8 varPart10 @ 0x81;
u8 varPart11 @ 0x82;
u8 varPart12 @ 0x83;

//block 0x26 (31), 0x26 * 4
u8 varPart13 @ 0x98; // Block 31
u8 varPart14 @ 0x99;
u8 varPart15 @ 0x9A;
u8 varPart16 @ 0x9B;

//block 0x28 (32), 0x28 * 4
u8 varPart17 @ 0xA0; // Block 32
u8 varPart18 @ 0xA1;
u8 varPart19 @ 0xA2;
u8 varPart20 @ 0xA3;

//block 0x2a (33), 0x2a * 4
u8 varPart21 @ 0xA8; // Block 33
u8 varPart22 @ 0xA9;
u8 varPart23 @ 0xAA;
u8 varPart24 @ 0xAB;

//block 0x2c (38), 0x2c * 4
u8 varPart25 @ 0xB0; // Block 38
u8 varPart26 @ 0xB1;
u8 varPart27 @ 0xB2;
u8 varPart28 @ 0xB3;

//block 0x2e (39), 0x2e * 4
u8 varPart29 @ 0xB8; // Block 39
u8 varPart30 @ 0xB9;
u8 varPart31 @ 0xBA;
u8 varPart32 @ 0xBB;

//block 0x30 (40), 0x30 * 4
u8 varPart33 @ 0xC0; // Block 40
u8 varPart34 @ 0xC1;
u8 varPart35 @ 0xC2;
u8 varPart36 @ 0xC3;

//block 0x32 (41), 0x32 * 4
u8 varPart37 @ 0xC8; // Block 41
u8 varPart38 @ 0xC9;
u8 varPart39 @ 0xCA;
u8 varPart40 @ 0xCB;

//block 0x34 (42), 0x34 * 4
u8 varPart41 @ 0xD0; // Block 42
u8 varPart42 @ 0xD1;
u8 varPart43 @ 0xD2;
u8 varPart44 @ 0xD3;

//block 0x36 (43), 0x36 * 4
u8 varPart45 @ 0xD8; // Block 43
u8 varPart46 @ 0xD9;
u8 varPart47 @ 0xDA;
u8 varPart48 @ 0xDB;

//block 0x38 (44), 0x38 * 4
u8 varPart49 @ 0xE0; // Block 44
u8 varPart50 @ 0xE1;
u8 varPart51 @ 0xE2;
u8 varPart52 @ 0xE3;

//block 0x3A (45), 0x3A * 4
u8 varPart53 @ 0xE8; // Block 45
u8 varPart54 @ 0xE9;
u8 varPart55 @ 0xEA;
u8 varPart56 @ 0xEB;

//block 0x3C (46), 0x3C * 4
u8 varPart57 @ 0xF0; // Block 46
u8 varPart58 @ 0xF1;
u8 varPart59 @ 0xF2;
u8 varPart60 @ 0xF3;

//block 0x3E (47), 0x3E * 4
u8 varPart61 @ 0xF8; // Block 47
u8 varPart62 @ 0xF9;
u8 varPart63 @ 0xFA;
u8 varPart64 @ 0xFB;


fn dec_digit(u8 dig) {
    if(dig <= 9) {
        return char(dig + '0');
    } 
    return char('?');
};

fn format_part_number(ref auto v) {
    //Example of partnumber 006R01734(-01)
    str result;
    
    result += dec_digit(v[0] >> 4); //0
    result += dec_digit(v[0] & 0xF); //0
    result += dec_digit(v[1] >> 4); //6  
    
    char sym = ((v[1] & 0xF) << 4) | (v[2] >> 4);
    result += char((sym >= 'A' && sym <= 'Z') ? sym : '?'); //R
    
    result += dec_digit(v[2] & 0xF); //0
    result += dec_digit(v[3] >> 4); //1
    result += dec_digit(v[3] & 0xF); //6
    result += dec_digit(v[4] >> 4); //
    result += dec_digit(v[4] & 0xF); //

    result += "-"; //-
    result += dec_digit(v[5] >> 4); //0
    result += dec_digit(v[5] & 0xF); //1
    result += "0"; //o
    
    return result;
};

fn construct_decrypt_key(u8 p1, u8 p2, u8 p3, u8 p4, u8 p5, u8 p6) {
    str result;
    
    result += char(p1);
    result += char(p2);
    result += char(p3);
    result += char(p4);
    result += char(p5);
    result += char(p6);
    
    std::print("{}", "Decrypt key: "+result);
    
    return result;
};

//Find the partnumber of the consumable
char partNumber[0x06] @ 0x54[[format("format_part_number")]];
//Construct the decruption key, to decrypt the var/secret blocks
construct_decrypt_key(decryptKeyPart1, decryptKeyPart2, decryptKeyPart3, decryptKeyPart4, decryptKeyPart5, decryptKeyPart6);

struct Date {
    u8 day, month, year; //0x03
} [[format("format_date")]];

fn format_date(ref auto d) {
    return std::format("{:2}/{:2}/{:2}", d.day, d.month, d.year+2000);
};
//Find the date of the consumable
Date date @ 0x5C; //Look at 3 items (day, month, year from the start position)

fn format_serial_number(ref auto d) {
    return (d[2] << 16) | (d[1] << 8) | d[0];
};
//Find the serial number of the tonerchip
char serialNumber[0x03] @ 0x60[[format("format_serial_number")]];

fn format_consumable_type(u8 d) { 
    str consumable_types[5] = {"drum", "yellow", "magenta", "cyan", "black"};
    
    return (d <= 4) ? consumable_types[d] : "Unknown";
};
//find the type of consumable
u8 consumableType @ 0x8A[[format("format_consumable_type")]];

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant