Python version of the Molto2 USB Config app - molto2.py

Prerequisites

#!/bin/sh
filelocation="/usr/lib/pcsc/drivers/ifd-ccid.bundle/Contents/Info.plist";
arrayclose="<\/array>";
sed -i "/${arrayclose}/d" $filelocation;	
searchstring1="ifdProductID<\/key>";	
addstring1="\               <string>0x349E<\/string>";
searchstring2="ifdFriendlyName<\/key>";	
addstring2="\               <string>0x0300<\/string>";
searchstring3="Copyright<\/key>";
addstring3="\               <string>Token2 Molto2<\/string>";	
sed -i "/${searchstring1}/i ${addstring1}" $filelocation;
sed -i "/${searchstring1}/i ${arrayclose}" $filelocation;
sed -i "/${searchstring2}/i ${addstring2}" $filelocation;
sed -i "/${searchstring2}/i ${arrayclose}" $filelocation;
sed -i "/${searchstring3}/i ${addstring3}" $filelocation;
sed -i "/${searchstring3}/i ${arrayclose}" $filelocation;
reboot;

Usage

As a start, make sure your system is correctly configured. Plug Molto2 into a USB port and run the script without any parameters:
python3 molto2.py

This should produce results similar to the below:

    [i] TOKEN2 Molto2 USB Config Tool, Python version, v0.1


    [!] Note: No customer key was provided, default customer key will be used
    [+] device serial number: 826658719844499
    [+] device system time (UTC): 2022-11-16 09:07:19
    [+] Authentication successful

python3 molto2.py --help

usage: molto2.py [-h] [--key KEY] [--keyascii KEYASCII] [--profile PROFILE] [--title TITLE] [--seed SEED] [--seedbase32 SEEDBASE32] [--setkey SETKEY] [--setkeyascii SETKEYASCII] [--config]
                     [--display_timeout DISPLAY_TIMEOUT] [--algorithm ALGORITHM] [--timestep TIMESTEP] [--factoryreset]
    
    optional arguments:
      -h, --help            show this help message and exit
      --key KEY             Customer key in hex format. Default will be used if not supplied.
      --keyascii KEYASCII   Customer key in ascii format. Default will be used if not supplied.
      --profile PROFILE     Profile number, from 0 to 49 (Molto2) or from 0 to 99 (Molto2 v2)
      --title TITLE         Profile title, 12 chars max
      --seed SEED           Seed to write, in hex format
      --seedbase32 SEEDBASE32
                            Seed to write, in base32 format
      --setkey SETKEY       Set the new customer key, providing the key in hex. Please note that setting new key requires confirmation on the device (physical button press)
      --setkeyascii SETKEYASCII
                            Set the new customer key, providing key in ascii. Please note that setting new key requires confirmation on the device (physical button press)
      --config              If config parameter is set, the config parameters become required.
      --display_timeout DISPLAY_TIMEOUT
                            mandatory if --config is set as 1. Possible values 0=15s, 1=30s, 2=60s, 3=120s
      --algorithm ALGORITHM
                            mandatory if --config is set as 1. Possible values 1=SHA1 HMAC or 2=SHA256 HMAC hashing algorithm
      --timestep TIMESTEP   mandatory if --config is set as 1. Possible values 1=30 seconds or 2= 60 seconds
      --factoryreset        Resets the device to factory setting and clear all data. Please note this requires confirmation on the device (physical button press)


  --synctime            Will update time on the given profile. Should be used together with --profile parameter
  --synctimeall         Will update time on all profiles.

  --lock                Lock device screen (only for v2.1 and higher)
  --unlock              Unlock device screen (only for v2.1 and higher)

GUI

A simplified GUI built with QT is also available.

python3 gui.py

The GUI replicates the interface of the Windows app. Please ensure that the PyQT5 module is installed by executing:

pip install PyQt5

Supported Products

Token2 Molto2v2 purchased in Q2 2022 or later.

License

Obtaining the software

FAQ

Q: The seed value is not accepted, an error similar to 'Non-base32 digit found'  is produced. How can this be fixed?

Our script expects the base32 seed to be in upper case and without spaces. Some systems (i.e. Google) generate the seed in a format similar to below:
24kw bi2e zwgi xexy a5m4 qdev ax3b qjst
The easiest way to convert this seed to a compatible format is running the command below
echo "24kw bi2e zwgi xexy a5m4 qdev ax3b qjst" | sed 's/ //g' | tr [:lower:] [:upper:]
This command will output the seed as 24KWBI2EZWGIXEXYA5M4QDEVAX3BQJST, which will be accepted by the script

While this does not matter for the TOTP calculation itself, the string length of a base32 seed is expected to be a power of 2 (i.e. 16, 32 or 64). If the seed value you have is shorter, you can fix the issue by adding empty characters ("A" in base32). So, for example,  if the seed is JBSWY3DPEHPK3PXPJBSWY3DPEHPK (28 chars), you just add 4 "A"s to it and use JBSWY3DPEHPK3PXPJBSWY3DPEHPKAAAA instead. The OTP generated will be exactly the same (empty characters are ignored).

Q: How can I remove a seed?

There is no API for removing a seed, but you can simply overwrite with an empty one (32 x "0" characters in hex): 
i.e. python3 molto2.py --profile 2 --seed 00000000000000000000000000000000 will overwrite the seed of profile #2 with an empty string

However, if you want to synchronize the clocks for all TOTP profiles simultaneously, you can conveniently use the --synctimeall parameter. This parameter ensures that the time synchronization process is applied to all profiles at once, simplifying the management of time settings across your TOTP profiles.