doc/magic_cards_notes.md
<a id="top"></a>
This document is based mostly on information posted on http://www.proxmark.org/forum/viewtopic.php?pid=35372#p35372
Useful docs:
^Top
The temic T55xx/Atmel ATA5577 is the most commonly used chip for cloning LF RFIDs.
A useful document can be found here.
[usb] pm3 --> lf search
...
[+] Chipset detection: T55xx
This will not work if you have a downlink mode other than fixed bit length!
See ATMEL ATA5577C datasheet for sending commands to chip
^Top
The EM4305 and EM4205 (and 4469/4569) chips are the 2nd most common used chips for cloning LF RFIDs. It is also used by HID Global (but with a custom chip) for HIDProx credentials.
[usb] pm3 --> lf search
...
[+] Chipset detection: EM4x05 / EM4x69
See EM microelectronic EM4305 datasheet for sending commands to chip
^Top
These are custom Chinese chips mainly used to clone EM IDs. Often times, these are redesigned clones of Hitag chips.
^Top
This is the cheapest and most common ID82xx chip available. It is usually sold as T55xx on AliExpress, with excuses to use cloners.
00 00 00 00 00 00[usb] pm3 --> lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W00011 -s 3000
[usb] pm3 --> data plot
Check the green line of the plot. It must be a straight line at the end with no big waves.
Try NXP Hitag µ datasheet for sending commands to chip
# login with pass 00000000
lf cmdread -d 48 -z 112 -o 176 -e W3000 -e S240 -e E336 -s 1024 -c W0S0010100010100000000000000000000000000000000000000000000000000000000000000000000000000000000 -k
# write EM4100 Data (EMID 0000000000) to block0 and block1
lf cmdread -d 48 -z 112 -o 176 -e W3000 -e S240 -e E336 -s 1024 -c W0S001000010100000000011111111100000000000000000000000 -k
lf cmdread -d 48 -z 112 -o 176 -e W3000 -e S240 -e E336 -s 1024 -c W0S001000010101000000000000000000000000000000000000000 -k
# write config block 05800000(A0010000 in LSB first)
lf cmdread -d 48 -z 112 -o 176 -e W3000 -e S240 -e E336 -s 1024 -c W0S001000010101111111100000101100000000000000000000000
^Top
This is an "improved" variant of ID82xx chips, bypassing some magic detection in China.
CA 24 00 00
00 00 20 00D4 04 22 CAE3 23 22 CAC7 91 22 CA68 06 39 E000 00 00 00[usb] pm3 --> lf hitag hts rdbl --count 0
Try NXP Hitag S datasheet for sending commands to chip
^Top
This is an "improved" variant of ID82xx chips, bypassing some magic detection in China.
DA A4 00 00
00 00 20 009A EF 9A CB45 04 9B CB0E 31 37 CCDF 02 99 CA0E CE D8 CB90 3C CB CB68 04 39 E000 00 00 00[usb] pm3 --> lf hitag hts rdbl --82xx --count 0
Try NXP Hitag S datasheet for sending commands to chip
^Top
These are chips sold in Russia, manufactured by iKey LLC. Often times these are custom.
^Top
Simplest EM ID cloning chip available. Officially discontinued.
^Top
First "advanced" custom chip with H naming.
[ Chip is discontinued, no info ]
^Top
When a magic card configuration is really messed up and the card is not labeled, it may be hard to find out which type of card it is.
Here are some tips if the card doesn't react or gives error on a simple hf 14a reader:
Let's force a 4b UID anticollision and see what happens:
hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip
hf 14a reader
It it responds, we know it's a TypeA card. But maybe it's a 7b UID, so let's force a 7b UID anticollision:
hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip --rats skip
hf 14a reader
At this stage, you know if it's a TypeA 4b or 7b card and you can check further on this page how to reconfigure different types of cards.
To restore anticollision config of the Proxmark3:
hf 14a config --std
^Top
Referred as M1, S50 (1k), S70 (4k)
^Top
UID 4b: (actually NUID as there are no more "unique" IDs on 4b)
11223344440804006263646566676869
^^^^^^^^ UID
^^ BCC
^^ SAK(*)
^^^^ ATQA
^^^^^^^^^^^^^^^^ Manufacturer data
(*) some cards have a different SAK in their anticollision and in block0: +0x80 in the block0 (e.g. 08->88, 18->98)
Computing BCC on UID 11223344: analyse lrc -d 11223344 = 44
UID 7b:
04112233445566884400c82000000000
^^ Manufacturer byte
^^^^^^^^^^^^^^ UID
^^ SAK(*)
^^^^ ATQA
^^^^^^^^^^^^ Manufacturer data
(*) all? cards have a different SAK in their anticollision and in block0: +0x80 in the block0 (e.g. 08->88, 18->98)
^Top
^Top
hf mf info
...
[+] Magic capabilities... Gen 1a
^Top
40(7), 41 (use 2000ms timeout)40(7), 43, 30xx+crc40(7), 43, A0xx+crc, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx+crc^Top
^Top
^Top
^Top
^Top
^Top
^Top
^Top
^Top
hf mf csetuid
hf mf cwipe
hf mf csetblk
hf mf cgetblk
hf mf cgetsc
hf mf cload
hf mf csave
hf mf cview
When "soft-bricked" (by writing invalid data in block0), these ones may help:
# MFC Gen1A 1k:
hf mf cwipe -u 11223344 -a 0004 -s 08
# MFC Gen1A 4k:
hf mf cwipe -u 11223344 -a 0044 -s 18
or just fixing block0:
# MFC Gen1A 1k:
hf mf csetuid -u 11223344 -a 0004 -s 08
# MFC Gen1A 4k:
hf mf csetuid -u 11223344 -a 0044 -s 18
script run hf_mf_magicrevive
To execute commands manually:
hf 14a raw -a -k -b 7 40
hf 14a raw -k 43
hf 14a raw -k -c A000
hf 14a raw -c -t 1000 11223344440804006263646566676869
wipe:
hf 14a raw -a -k -b 7 40
hf 14a raw -t 1000 41
^Top
nfc-mfsetuid
nfc-mfclassic R a u mydump
nfc-mfclassic W a u mydump
^Top
Similar to Gen1A, but supports directly read/write after command 40
^Top
hf mf info
...
[+] Magic capabilities... Gen 1b
^Top
40(7), 30xx40(7), A0xx+crc, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx+crc^Top
Chip manufactured by iKey LLC as a bypass for Gen1 filters. Support Direct Write as CUID, but block0 can be written only once.
The chip had an issue in the protocol implementation.
The reader could interrupt radiofield for 2-3 microseconds (standard pause in the bit period of ISO14443-2).
After the response to first 26 (7) command, but before the following 93 70 command. In that case original M1 card will stop the flow, but OTP will continue it.
That issue led to the development of the filters against that card and discontinuation of the production.
As a successor, OTP 2.0 was created.
^Top
^Top
Only possible before personalization.
hf mf info
...
[+] Magic capabilities... Write Once / FUID
^Top
Similar to Gen1A, but after first block 0 edit, tag no longer replies to 0x40 command. Were manufactured by iKey LLC as a replacement for OTP
^Top
Only possible before personalization.
hf mf info
...
[=] --- Magic Tag Information
[+] Magic capabilities... Gen 1a
[=] --- PRNG Information
[+] Prng................. hard
^Top
40(7), 43, A0xx+crc, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx+crc^Top
Similar to OTP 2.0, but now additional configuration is possible. Were manufactured by iKey LLC as a replacement for MF3.
^Top
Only possible before personalization.
hf mf info
...
[=] --- Magic Tag Information
[+] Magic capabilities... Gen 1a
[=] --- PRNG Information
[+] Prng................. hard
hf mf cgetblk --blk 3
hf mf rdbl --blk 3
[ If the ACLs do not match, this is an MF4 ]
^Top
Warning: changing the UID from 00000000 will disable all of these commands permanently.
40(7), 43, 30xx+crc40(7), 43, A0xx+crc, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx+crc^Top
By accessing trailers of sectors 11-15 using gen1 mode, it is possible to re-configure the tag.
The layout for a sector is below:
Any data set in one mode will be mirrored to the other, as such be careful when configuring from gen1 mode to avoid unintentionally changing access conditions, keys or configurations.
Here is how the IC can be configured:
(byte num.-11) (is lower half? +1 if yes))AF you should set block 31 to FFFFFFFFFFFF 00 0 A 8000 FFFFFFFFFFFF and block 35 to FFFFFFFFFFFF 00 0 F 8000 FFFFFFFFFFFF28, you should set block 47 to FFFFFFFFFFFF 28 0 0 8000 FFFFFFFFFFFFFFFFFFFFFFFF 00 0 8 8000 FFFFFFFFFFFF0b1, resulting in byte 7 containing at least 05.^Top
(also referred as MCT compatible by some sellers)
01200145, potentially fixed chip which can bypass Iron Logic's filters.
`^Top
hf mf info
...
[+] Magic capabilities... Gen 2 / CUID
^Top
Android compatible
^Top
^Top
^Top
^Top
^Top
^Top
^Top
TODO need more info
^Top
hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 11223344440804006263646566676869 --force
hf mf wipe --gen2
When "soft-bricked" (by writing invalid data in block0), these ones may help:
hf 14a config -h
e.g. for 4b UID:
hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip
# for 1k
hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 11223344440804006263646566676869 --force
# for 4k
hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 11223344441802006263646566676869 --force
hf 14a config --std
hf 14a reader
e.g. for 7b UID:
hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip --rats skip
# for 1k
hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 04112233445566084400626364656667 --force
# for 4k
hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 04112233445566184200626364656667 --force
hf 14a config --std
hf 14a reader
^Top
^Top
hf mf info
...
[+] Magic capabilities... Gen 3 / APDU ( possibly )
^Top
Android compatible
cla ins p1 p2 len
90 F0 CC CC 10 <block0> - write block 0
90 FB CC CC 07 <uid> - change uid (independently of block0 data)
90 FD 11 11 00 - lock permanently
It seems the length byte gets ignored anyway.
Note: it seems some cards only accept the "change UID" command.
It accepts direct read of block0 (and only block0) without prior auth.
Writing to block 0 has some side-effects:
^Top
^Top
# change just UID:
hf mf gen3uid
# write block0:
hf mf gen3blk
# lock (uid/block0?) forever:
hf mf gen3freeze
See also
script run hf_mf_gen3_writer -h
Equivalent:
# change just UID:
hf 14a raw -s -c -t 2000 90FBCCCC07 11223344556677
# read block0:
hf 14a raw -s -c 3000
# write block0:
hf 14a raw -s -c -t 2000 90F0CCCC10 041219c3219316984200e32000000000
# lock (uid/block0?) forever:
hf 14a raw -s -c 90FD111100
^Top
TLDR: These magic cards have a 16 byte long configuration page, which usually starts with 0x85. All of the known tags are using this, except for Ultralight tags, are listed here.
You cannot turn a Classic tag into an Ultralight and vice-versa!
^Top
^Top
hf mf info
...
[+] Magic capabilities... Gen 4 GDM / USCUID ( Magic Auth/Gen1 Magic Wakeup/Alt Magic Wakeup )
Possible tag wakeup mechanisms are:
^Top
Magic authentication: select, 8000+crc, [Crypto1 Auth: 000000000000]
38xx+crcA8xx+crc, [16 bytes data]+crcE000+crcE100+crc; [16 bytes data]+crcMagic wakeup (A: 00): 40(7), 43
Magic wakeup (B: 85): 20(7), 23
30xx+crcA0xx+crc, [16 bytes data]+crc38xx+crcA8xx+crc, [16 bytes data]+crcE000+crcE100+crcDANGER
F000+crcF100+crcF600+crcF800+crcF900+crcFE00+crc^Top
85000000000000000000000000000008
^^^^^^ ^^ ^^ >> ??? Mystery ???
^^^^ >> Gen1a mode (works with bitflip)
^^ >> Magic wakeup command (00 for 40-43; 85 for 20-23)
^^ >> Block use of Key B if readable by ACL
^^ >> CUID mode
^^ >> MFC EV1 CL2 Perso config*
^^ >> Shadow mode**
^^ >> Magic Auth command
^^ >> Static encrypted nonce mode
^^ >> Signature sector
^^ >> SAK***
To enable an option, set it to 5A.
* 5A - unfused F0. C3 - F0: CL2 UID; A5 - F1: CL2 UID with anticollision shortcut; 87 - F2: CL1 Random UID; 69 - F3: CL1 non-UID. Anything else is going to be ignored, and set as 4 bytes.
** Do not change the real ACL! Backdoor commands only acknowledge FF0780. To recover, disable this byte and issue regular write to sector trailer.
*** If perso byte is enabled, this SAK is ignored, and hidden SAK is used instead.
8000 after selection, and call for Crypto1 auth with key 000000000000.
Sector 0
88 04 BD E5 D4 04 6A BB 5B 80 0A 08 44 00 00 00 - Block 0: Perso F0, F1 data
^^ ^^ ^^ ^^ - UID0
^^ - BCC0
^^ - SAK0 (0x04 to call for CL2)
^^ ^^ ^^ ^^ - UID1
^^ - BCC1
^^ - SAK1
^^ ^^ ^^ ^^ - Unused
04 BD E5 6A 36 08 00 00 00 00 00 00 00 00 00 00 - Block 1: Perso F3 data
^^ ^^ ^^ ^^ - UID0
^^ - BCC0
^^ - SAK0
^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ - Unused
Block 2: unused
Block 3: ignored (custom keys, acl; broken acl ignored - anticollision will still work)
Sector 1
[Signature sector (#17) - needs config byte 13 (from 0) enabled to allow auth]
Sectors 2-15
[Unused]
^Top
# Read config block from card
hf mf gdmcfg
# Write config block to card
hf mf gdmsetcfg
# Parse config block to card
hf mf gdmparsecfg
# Write block to card
hf mf gdmsetblk
^Top No implemented commands today
^Top
| Factory configuration | Name |
|---|---|
| 850000000000000000005A5A00000008 | GDM |
| 850000000000005A00FF005A00000008 | GDCUID |
| 850000000000005A0000005A5A5A0008 | UCUID |
| 8500000000005A00005A005A005A0008 | "7 byte hard" |
| 7AFF850102015A00005A005A005A0008 | M1-7B |
| 7AFF85000000000000FF000000000008 | FUID |
| 7AFF000000000000BAFA358500000008 | PFUID |
| 7AFF000000000000BAFA000000000008 | UFUID |
| 7AFF0000000000000000000000000008 | ZUID |
Not all tags are the same! UFUID, ZUID and PFUID* are not full implementations of USCUID - they only acknowledge the first 8 (except wakeup command) and last config byte(s).
*Read and write config commands are flipped
Well-known variations are described below.
^Top
Known as "write only once", which is only partially true, because old revisions had backdoor commands enabled, so you could manipulate the tag, using them. Newer FUIDs are based on new implementation of chip and have backdoor commands disabled by default.
Allows direct write to block 0 only when UID is default AA55C396. If your tag responds to a 20(7), 23 magic wakeup, the UID could always be rewritten multiple times with backdoors commands, but that makes that tag detecteable.
In ex-USSR countries were widely used as a replacement for UID tags. Especially for protected Iron Logic readers.Later filter OTP was created in those readers.
The idea of the filter is that old version's chip had an issue in the protocol implementation.
The reader could interrupt radiofield for 2-3 microseconds (standard pause in the bit period of ISO14443-2).
After the response to first 26 (7) command, but before the following 93 70 command. In that case original M1 card will stop the flow, but OTP will continue it.
That issue led to the development of the filters against that card and discontinuation of the production. As a successor, OTP 2.0 was created for that market.
Newer FUID tags (with backdoor command disabled) has protocol fixed and works fine on Iron Logic readers with firmware older than 7.28, but are filtered by latest filters on mentioned firmware.
^Top
7AFF85000000000000FF000000000008AA55C39620(7), 23 commands^Top
Unlocked tag type:
hf mf info
...
[+] Magic capabilities... Gen 4 GDM / USCUID ( Alt Magic Wakeup )
[+] Magic capabilities... Write Once / FUID
Or locked down tag type:
hf mf info
...
[+] Magic capabilities... Write Once / FUID
^Top
[usb] pm3 --> hf mf gdmcfg --gdm
[+] Config... 7A FF 85 00 00 00 00 00 00 FF 00 00 00 00 00 08
[+] 7A FF ......................................... Magic wakeup enabled with GDM config block access
[+] 85 ...................................... Magic wakeup style GDM 20(7)/23
[+] 00 00 00 ............................. Unknown
[+] 00 .......................... Key B use allowed when readable by ACL
[+] 00 ....................... Block 0 Direct Write Disabled (CUID)
[+] 00 .................... Unknown
[+] FF ................. MFC EV1 personalization: 4B UID from Block 0
[+] 00 .............. Shadow mode disabled
[+] 00 ........... Magic auth disabled
[+] 00 ........ Static encrypted nonce disabled
[+] 00 ..... MFC EV1 signature disabled
[+] 00 .. Unknown
[+] 08 SAK
**Note: this is only possile on the FUID style that has not been locked down.
^Top
20(7), 23
30xx+crcA0xx+crc, [16 bytes data]+crc38xx+crcA8xx+crc, [16 bytes data]+crcE000+crcE100+crc[usb] pm3 --> hf 14a raw -k -a -b 7 20
[+] 0A
[usb] pm3 --> hf 14a raw -k -a 23
[+] 0A
[usb] pm3 --> hf 14a raw -c -k -a A000
[+] 0A
[usb] pm3 --> hf 14a raw -c -k -a B502454EBC0804000168AA8947CE4D1D <- Writing 0 block with the backdoor command
[+] 0A
[usb] pm3 --> hf 14a raw -c -a 5000
[usb] pm3 --> hf mf rdbl --blk 0
[=] # | sector 00 / 0x00 | ascii
[=] ----+-------------------------------------------------+-----------------
[=] 0 | B5 02 45 4E BC 08 04 00 01 68 AA 89 47 CE 4D 1D | ..EN.....h..G.M.
^Top
hf mf gdmcfg --gdmhf mf gdmsetcfg --gdmhf mf gdmsetblk --gdm^Top
The tag is positioned as "sealable UID", so that means you could use the same commands, as you could use for UID chip in a default state. But after the sealing (changing the configuration) tag will not answer to the backdoor commands and will behave as a normal Mifare Classic tag.
But at the same time there is some unidentified behavior, which doesn't fully corresponds the protocol and original Mifare Classic tags. So the tag could be filtered out with a protocol-based filters (i.e. Iron Logic OTP2 filter).
^Top
7AFF000000000000BAFA00000000000840(7), 43 commands before the sealing^Top
hf mf info
...
[+] Magic capabilities... Gen 1a
[+] Magic capabilities... Gen 4 GDM / USCUID ( Gen1 Magic Wakeup )
Currently Proxmark3 doesn't identify it as a separate tag. Before the sealing could be detected from the config block value.
^Top
[usb] pm3 --> hf mf gdmcfg --gen1a
[+] Config... 7A FF 00 00 00 00 00 00 BA FA 00 00 00 00 00 08
[+] 7A FF ......................................... Magic wakeup enabled with GDM config block access
[+] 00 ...................................... Magic wakeup style Gen1a 40(7)/43
[+] 00 00 00 ............................. Unknown
[+] 00 .......................... Key B use allowed when readable by ACL
[+] 00 ....................... Block 0 Direct Write Disabled (CUID)
[+] BA .................... Unknown
[+] FA ................. MFC EV1 personalization: 4B UID from Block 0
[+] 00 .............. Shadow mode disabled
[+] 00 ........... Magic auth disabled
[+] 00 ........ Static encrypted nonce disabled
[+] 00 ..... MFC EV1 signature disabled
[+] 00 .. Unknown
[+] 08 SAK
^Top
All commands are available before sealing. After the sealing acts as a Mifare Classic 1K tag.
40(7), 43
30xx+crcA0xx+crc, [16 bytes data]+crcE000+crcE100+crchf 14a raw -a -k -b 7 40
hf 14a raw -k 43
hf 14a raw -k -c e100
hf 14a raw -c 85000000000000000000000000000008
^Top
All commands are available before sealing.
hf mf gdmcfg --gen1ahf mf gdmsetcfg --gen1ahf mf gdmsetblk --gen1ahf mf csetuidhf mf cwipehf mf csetblkhf mf cgetblkhf mf cgetschf mf cloadhf mf csavehf mf cview^Top
That tag is a UID tag, built on USCUID chip. It is not sold separately, but could be found on marketplaces under the guise of a UID tag.
^Top
7AFF000000000000000000000000000840(7), 43 commands7AFF0000000000000000000000000008
^^ >> Block use of Key B if readable by ACL
^^ >> CUID mode
^^ >> SAK***
^Top
hf mf info
...
[+] Magic capabilities... Gen 1a
[+] Magic capabilities... Gen 4 GDM / USCUID ( ZUID Gen1 Magic Wakeup )
^Top
[usb] pm3 --> hf mf gdmcfg --gen1a
[+] Config... 7A FF 00 00 00 00 00 00 00 00 00 00 00 00 00 08
[+] 7A FF ......................................... Magic wakeup enabled with GDM config block access
[+] 00 ...................................... Magic wakeup style Gen1a 40(7)/43
[+] 00 00 00 ............................. Unknown
[+] 00 .......................... Key B use allowed when readable by ACL
[+] 00 ....................... Block 0 Direct Write Disabled (CUID)
[+] 00 .................... Unknown
[+] 00 ................. MFC EV1 personalization: 4B UID from Block 0
[+] 00 .............. Shadow mode disabled
[+] 00 ........... Magic auth disabled
[+] 00 ........ Static encrypted nonce disabled
[+] 00 ..... MFC EV1 signature disabled
[+] 00 .. Unknown
[+] 08 SAK
^Top
40(7), 43
30xx+crcA0xx+crc, [16 bytes data]+crcE000+crcE100+crc^Top
hf mf gdmcfg --gen1ahf mf gdmsetcfg --gen1ahf mf gdmsetblk --gen1ahf mf csetuidhf mf cwipehf mf csetblkhf mf cgetblkhf mf cgetschf mf cloadhf mf csavehf mf cview^Top
The tag has a shadow mode, which means that every change to normal MFC memory would be restored back from the persistent memory after being off RFID field.
^Top
850000000000000000005A5A000000088000+crc, [Crypto1 Auth: 000000000000]^Top
hf mf info
...
[+] Magic capabilities... Gen 4 GDM / USCUID ( Magic Auth )
Could be manually validated with the configuration block value.
^Top
[usb] pm3 --> hf mf gdmcfg
[+] Config... 85 00 00 00 00 00 00 00 00 00 5A 5A 00 00 00 08
[+] 85 00 ......................................... Magic wakeup disabled
[+] 00 ...................................... Magic wakeup style Gen1a 40(7)/43
[+] 00 00 00 ............................. Unknown
[+] 00 .......................... Key B use allowed when readable by ACL
[+] 00 ....................... Block 0 Direct Write Disabled (CUID)
[+] 00 .................... Unknown
[+] 00 ................. MFC EV1 personalization: 4B UID from Block 0
[+] 5A .............. Shadow mode enabled
[+] 5A ........... Magic auth enabled
[+] 00 ........ Static encrypted nonce disabled
[+] 00 ..... MFC EV1 signature disabled
[+] 00 .. Unknown
[+] 08 SAK
^Top
8000+crc, [Crypto1 Auth: 000000000000]
38xx+crcA8xx+crc, [16 bytes data]+crcE000+crcE100+crc; [16 bytes data]+crc^Top
gdmsetcfggdmcfggdmsetcfg^Top
That tag is a CUID tag, built on USCUID chip. It doesn't sold separately, but could be found on marketplaces under the guise of a CUID tag.
^Top
850000000000005A00FF005A000000088000+crc, [Crypto1 Auth: 000000000000]^Top
hf mf info
...
[+] Magic capabilities... Gen 2 / CUID
[+] Magic capabilities... Gen 4 GDM / USCUID ( Magic Auth )
Currently Proxmark3 doesn't identify it as a separate tag. Could be manually validated with the configuration block value.
^Top
[usb] pm3 --> hf mf gdmcfg
[+] Config... 85 00 00 00 00 00 00 5A 00 FF 00 5A 00 00 00 08
[+] 85 00 ......................................... Magic wakeup disabled
[+] 00 ...................................... Magic wakeup style Gen1a 40(7)/43
[+] 00 00 00 ............................. Unknown
[+] 00 .......................... Key B use allowed when readable by ACL
[+] 5A ....................... Block 0 Direct Write Enabled (CUID)
[+] 00 .................... Unknown
[+] FF ................. MFC EV1 personalization: 4B UID from Block 0
[+] 00 .............. Shadow mode disabled
[+] 5A ........... Magic auth enabled
[+] 00 ........ Static encrypted nonce disabled
[+] 00 ..... MFC EV1 signature disabled
[+] 00 .. Unknown
[+] 08 SAK
^Top
8000+crc, [Crypto1 Auth: 000000000000]
38xx+crcA8xx+crc, [16 bytes data]+crcE000+crcE100+crc; [16 bytes data]+crc^Top
gdmsetcfggdmcfggdmsetcfg^Top
TODO
^Top
It behaves like regular Mifare Classic but records reader auth attempts.
^Top
Old type of cards, hard to obtain. They are DirectWrite, UID can be changed via 0 block or backdoor commands.
ATQA/SAK matches 1k card, but works as 4k card.
Backdoor commands provided over APDU. Format:
00 A6 A0 00 05 FF FF FF FF 00
^^ ^^ Backdoor command header
^^ Backdoor command (A0 - set UID/B0 - get trace/C0 - reset card)
^^ Type of answer (used in key recovery to select trace number)
^^ Length of user provided data
^^ ^^ ^^ ^^ ^^ User data
👉 You can't change UID with backdoor command if incorrect data is written to the 0 sector trailer!
DirectWrite card, ATS unknown. Probably same as Gen1, except backdoor commands. Implementation: https://github.com/netscylla/super-card/blob/master/libnfc-1.7.1/utils/nfc-super.c
^Top
New generation of cards, based on limited Gen4 chip. Emulates Gen1 backdoor protocol, but can store up to 7 different traces.
Card always answers ff ff ff ff as at, so reading/writing it via Mifare protocol is impossible.
UID is changeable via UMC backdoor write to 0 block.
Gen4 commands available:
CF <passwd> 34 <1b length><0-16b ATS> // Configure ATS
CF <passwd> CC // Version information, returns 00 00 00 02 AA
CF <passwd> CD <1b block number><16b block data> // Backdoor write 16b block
CF <passwd> CE <1b block number> // Backdoor read 16b block
CF <passwd> FE <4b new_password> // Change password
^Top
^Top
!!!WARNING!!! This tag can die for no reason (no reply to WUPA/REQA). We don't know why this happens.
^Top
[usb] pm3 --> hf 14a raw -sct 250 AAA500000000000000000000000000000000
[+] 90 00
^Top
AAA5[16 byte config]+crcAAA4[4b UID][1b BCC][1b SAK][2b ATQA reversed]0000000000000000+crcAAA8[00/01][00-08]+crcCaution: tag does not append CRC to magic responses!
Please use config as 00 bytes.
Parsing traces:
44 33 22 11 03 61 08 68 7A C7 4B 62 43 A6 11 6F 64 F3
^^ ^^ ^^ ^^ -- UID
^^ ^^ -- auth command, reversed
^^ ^^ ^^ ^^ -- Auth (nt)
^^ ^^ ^^ ^^ -- Auth (nr)
^^ ^^ ^^ ^^ -- Auth (ar)
^Top
Only Gen1/Gen2 at this moment (Gen1B is unsupported):
hf mf info
...
[+] Magic capabilities... Super card ( Gen ? )
[usb] pm3 --> hf mf supercard
...
[usb] pm3 --> hf mf supercard --furui
...
^Top
^Top
SN0 SN1 SN2 BCC0
SN3 SN4 SN5 SN6
BCC1 Int LCK0 LCK1
UID is made of SN0..SN6 bytes
Computing BCC0 on UID 04112233445566: analyse lrc -d 88041122 = bf
Computing BCC1 on UID 04112233445566: analyse lrc -d 33445566 = 44
Int is internal, typically 0x48
Anticol shortcut (CL1/3000) is supported for UL, ULC, NTAG except NTAG I2C
Some cards have a password: B6AA558D. Usually "copykey" chips.
^Top
TODO
TODO
Only 7b versions
TODO need more tests
^Top
script run hf_mfu_setuid -h
When "soft-bricked" (by writing invalid data in block0), these ones may help:
hf 14a config -h
script run hf_mf_magicrevive -u
^Top
^Top
hf 14a info
...
[+] Magic capabilities : Gen 2 / CUID
It seems so far that all MFUL DW have an ATS response in factory configuration.
^Top
Issue three regular MFU write commands in a row to write first three blocks.
^Top
^Top
^Top
hf mfu setuid -h
Equivalent: don't use hf mfu wrbl as you need to write three blocks in a row, but do, with proper BCCx:
hf 14a raw -s -c -k a2 00 041122bf
hf 14a raw -c -k a2 01 33445566
hf 14a raw -c a2 02 44480000
When "soft-bricked" (by writing invalid data in block0), these ones may help:
hf 14a config -h
E.g.:
hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip --rats skip
hf mfu setuid --uid 04112233445566
hf 14a config --std
hf 14a reader
^Top
nfc-mfultralight -h
See --uid and --full
^Top
^Top
Similar to MFUL DirectWrite
^Top
hf 14a info
...
[+] Magic capabilities : Gen 2 / CUID
^Top
^Top
^Top
^Top
^Top
Similar to MFUL Gen1A
^Top
Similar to MFUL DirectWrite
^Top
hf 14a info
...
[+] Magic capabilities : Gen 2 / CUID
^Top
^Top
^Top
^Top
Similar to MFUL DirectWrite
^Top
hf 14a info
...
[+] Magic capabilities : Gen 2 / CUID
^Top
^Top
^Top
^Top
hf 14a info
...
[+] Magic capabilities : NTAG21x
^Top
Emulates fully NTAG213, 213F, 215, 216, 216F
Emulates partially UL EV1 48k/128k, NTAG210, NTAG212, NTAGI2C 1K/2K, NTAGI2C 1K/2K PLUS
Anticol shortcut (CL1/3000): fails
^Top
script run hf_mfu_magicwrite -h
^Top
TLDR: These magic cards, like the MFC USCUIDs have a 16 byte long configuration page, comprised of 4 blocks of 4 bytes each. This usually starts with 0x85. All of the known tags use the same format config page.
The cards will respond to a RATS with the config page in the factory configuration.
As with the MFC USCUIDs, one cannot turn a Classic tag into an Ultralight and vice-versa!
^Top
F6F6^Top
In factory config state:
hf 14a info
...
[=] -------------------------- ATS --------------------------
[!] ATS may be corrupted. Length of ATS (18 bytes incl. 2 Bytes CRC) doesn't match TL
[+] ATS: 85 00 85 A0 00 00 0A A5 00 04 04 02 01 00 0F 03 [ 07 00 ]
If config has been modified to not display config block as ATS response:
hf 14a raw -akb 7 40; hf 14a raw -k 43
OR (depending on the magic wakeup method set)
hf 14a raw -akb 7 20; hf 14a raw -k 23
THEN
hf 14a raw -c e100
[+] 85 00 85 A0 00 00 0A A5 00 04 04 02 01 00 0F 03 [ 07 00 ]
Possible tag wakeup mechanisms are:
^Top
Magic wakeup (A: 00): 40(7), 43
Magic wakeup (B: 85): 20(7), 23
30xx+crcA2xx[4 bytes data]+crcE050+crcE2[offset*4, 1b][data, 4b]+crcDANGER
F000+crcF100+crcF600+crc^Top
0 1 2 3
850000A0 00000AC3 00040301 01000B03
^^ >> ??? Mystery ???
^^^^ >> Gen1a mode (works with bitflip)
^^ >> Magic wakeup command (00 for 40-43; 85 for 20-23)
^^ >> Config available using regular mode (ON: A0)
^^ >> Auth type (00 = PWD mode, 0A = 2TDEA mode for UL-C)
^^ >> CUID mode, allows writing to blocks 0-3 (ON: 0A)
^^ >> Maximum memory configuration, please see below *
^^^^^^^^ ^^^^^^^^ >> Version info
* This isn't a customizable value - it's a preset. So far:
C3 = UL11
3C = UL21
00 = UL-C
A5 = NTAG 213
5A = NTAG 215
AA = NTAG 216
55 = Unknown IC w/ 238 pgs.
To write config:
You must send config info in E2 packets of 4 bytes each (format: E2[offset*4, 1b][data, 4b]), eg for a UL-11 tag:
hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000AC3; hf 14a raw -ck E20200040301; hf 14a raw -c E20301000B03
F0: 00000000
^^^^^^^^ >> Unknown, usually always 00
F1: 00000000
^^^^^^^^ >> Unknown, usually always 00
F2: 000000BD
^^^^^^ >> Counter 0
^^ >> Tearing 0
F3: 000000BD
^^^^^^ >> Counter 1
^^ >> Tearing 1
F4: 000000BD
^^^^^^ >> Counter 2
^^ >> Tearing 2
F5: 00000000
^^^^^^^^ >> Unknown, usually always 00
F6: 44000400
^^^^ >> ATQA in byte reverse order. 4400 = ATQA of 0044
^^ >> SAK1, usually set to 04 to call for CL2
^^ >> SAK2, card uses this as SAK
F7: 88AF0000
^^ >> First byte of UID BCC calculation, for Ultralight family is always 88 per the datasheet
^^ >> Unknown, usually always AF.
^^^^ >> Unknown, usually always 00
F8 - FF: xxxxxxxx >> signature
To read / write hidden blocks:
A config block beginning with 7AFF must be set to enable a 40:43 / 20:23 magic wakeup. From limited testing, the 20:23 magic wakeup is not guaranteed to work, however the 40:43 wakeup works 100% of the time.
You must send config info in A2 packets of 4 bytes each (format: A2[offset*4, 1b][data, 4b]), eg for a UL-11 tag:
hf 14a raw -akb 7 40; hf 14a raw -k 43; hf 14a raw -ck A2F2000000BD; hf 14a raw -ck A2F3000000BD; hf 14a raw -ck A2F4000000BD; hf 14a raw -ck A2F644000400; hf 14a raw -c A2F888AF0000
^Top
No implemented commands at time of writing
^Top
No implemented commands at time of writing
^Top
| Factory configuration | Name |
|---|---|
| 850000A0 00000AC3 00040301 01000B03 | UL-11 |
| 850000A0 00000A3C 00040301 01000E03 | UL-21 |
| 850000A0 0A000A00 00000000 00000000 | UL-C |
| 850085A0 00000AA5 00040402 01000F03 | NTAG213 |
| 850000A0 00000A5A 00040402 01001103 | NTAG215 |
| 850000A0 00000AAA 00040402 01001303 | NTAG216 |
Variations of USCUID-UL, that were distributed in ex-USSR countries are known as UL-family. Different variarions were targeted for copying different original tags + for bypassing of different filters.
^Top
Sold on Russian market in variations with 20, 41 and 44 blocks. All variations support direct write to block 0-2.
^Top
850000A000000AC30034210101000B03.0034210101000B03.^Top
[usb] pm3 --> hf 14a info
...
[+] ATS: 85 00 00 A0 00 00 0A C3 00 34 21 01 01 00 0B 03 [ 84 00 ]
Default configuration for USCUID-UL with 41 blocks. Can be found in China by names UL-21 or Ultra (targeting Russian market).
In China exists in versions with opened and locked configuration.
Could be used for intercoms Grazhda (UA) and Vizit (RU) with non-Micron chips (original chips have EV1 Version 0004030101000E03).
^Top
850000A000000A3C0004030101000E03.0004030101000E03.^Top
[usb] pm3 --> hf 14a info
...
[+] ATS: 85 00 00 A0 00 00 0A 3C 00 04 03 01 01 00 0E 03 [ C8 1D ]
^Top
850000A000000A5A0034210101000E03.0034210101000E03.^Top
[usb] pm3 --> hf 14a info
...
[+] ATS: 85 00 00 A0 00 00 0A 5A 00 34 21 01 01 00 0E 03 [ F1 F3 ]
^Top
Variation based on NTAG215 config. Created for copying 16-blocks Vizit tags. Now there are well-known 2 variations, which differs only with EV1 Version. Newer has Micron Russia version.
^Top
850000A0AA000A5A0000000000000000 or 850000A0AA000A5A0034210100000000.0000000000000000 or 0034210100000000.[=] 130/0x82 | 00 00 00 BD | 0 | ...�
[=] 131/0x83 | 04 00 00 10 | 0 | ....
[=] 132/0x84 | C0 05 00 00 | 0 | �...
[=] 133/0x85 | FF FF FF FF | 0 | .... // Password, will not be readable in normal conditions
^Top
[usb] pm3 --> hf 14a info
...
[+] ATS: 85 00 00 A0 AA 00 0A 5A 00 00 00 00 00 00 00 00 [ D5 F9 ]
^Top
Modification of UL-2 (41 blocks) for Vizit (RU) intercoms.
Suitable for tags with EV1 Version 0034210101000E03.
After communication to iKey LLC (importer of those tags to Russian market), new revisions, imported to Russia have closed config.
^Top
850000A000000A3C0034210101000E03.0034210101000E03.^Top
[usb] pm3 --> hf 14a info
...
[+] ATS: 85 00 00 A0 00 00 0A 3C 00 04 03 01 01 00 0E 03 [ C8 1D ]
^Top
Use the script hf_mfu_ultra.lua to restore (write) dump to tag or clear previously written tag.
Usage:
script run hf_mfu_ultra -f <dump filename> -k <passwd> -r
script run hf_mfu_ultra -k <passwd> -w
script run hf_mfu_ultra -h
Examples:
script run hf_mfu_ultra -f hf-mfu-3476FF1514D866-dump.bin -k ffffffff -r
script run hf_mfu_ultra -k 1d237f76 -w
^Top
Variation of Ultra tag, which allows to change UID only once.
After editing page 0 become locked and tag becomes the original Mifare Ultralight EV1 (except the tag version, which remains specific).
Created as a response to Vizit (RU) filters that try to overwrite page 0 (as a detection for Ultra (RU) tags).
WARNING! When using UL-5 to clone, write UID pages in inverse (from 2 to 0) and do NOT make mistakes! This tag does not allow reversing one-way actions (OTP page, lock bits).
It was confirmed from importers to Russian and Ukrainian market (independently) that UL-5 is a variation of USCUID-UL. But so far it's unknown how to achieve that behaviors, because by default UL-5 has it's config locked.
^Top
hf mfu info
...
TAG IC Signature: 0000000000000000000000000000000000000000000000000000000000000000
[=] --- Tag Version
[=] Raw bytes: 00 34 21 01 01 00 0E 03
[=] Vendor ID: 34, Mikron JSC Russia
After personalization it is not possible to identify UL-5.
The manufacturer confirmed unpersonalized tags could be identified by first 2 bytes of UID:
AA 55...^Top
Use the script hf_mfu_ultra.lua to restore (write) dump to tag.
Usage:
script run hf_mfu_ultra -f <dump filename> -k <passwd> -r
script run hf_mfu_ultra -h
Examples:
script run hf_mfu_ultra -f hf-mfu-3476FF1514D866-dump.bin -k ffffffff -r
** TODO **
^Top
TODO
Android compatible
^Top
Only mimics DESFire anticollision (but wrong ATS), no further DESFire support
^Top
UID 04112233445566
hf 14a raw -s -c 0200ab00000704112233445566
or equivalently
hf 14a apdu -s 00ab00000704112233445566
^Top
pn53x-tamashell
4a0100
420200ab00000704112233445566
^Top
^Top
Android compatible
^Top
Only mimics DESFire anticollision (but wrong ATS), no further DESFire support
^Top
UID 04112233445566
hf 14a raw -s -c 0200ab00000411223344
or equivalently
hf 14a apdu -s 00ab00000411223344
It accepts longer UID but that doesn't affect BCC/ATQA/SAK
^Top
4a0100
420200ab00000411223344
^Top
The same effect (with better ATQA!) can be obtained with a MFC Gen1A that uses SAK defined in block0:
hf mf csetblk --blk 0 -d 1122334444204403A1A2A3A4A5A6A7A8
hf 14a info
[+] UID: 11 22 33 44
[+] ATQA: 03 44
[+] SAK: 20 [1]
[+] Possible types:
[+] MIFARE DESFire MF3ICD40
^Top
^Top
This is a card sold on Taobao for testing readers. ISO14443-4 compliant.
hf 14a apdu -s 90B2900000 // Get Card OS version
>>> 90 B2 90 00 00
<<< 54 43 4F 53 20 56 31 2E 34 2E 30 90 00 | TCOS V1.4.0..
All commands in APDU.
CL IN P1 P2 Lc Data
90 F4 CC CC 01 [..1 ] // Change protocol used (1: ISO14443 [AA - type A, BB - type B])
90 F6 CC CC 01 [TA1 ] // Change TA1 value (transfer speed)
90 F8 CC CC 01 [..1 ] // Use random UID/PUPI value (1: FF: static, AB: random)
90 F8 DD DD 01 [..1 ] // Set UID length (1: bytes in UID (04, 07, 0A for 4, 7, 10 bytes accordingly))
90 F8 EE EE 0B [... ] // Set UID/PUPI value (FF+enter UID value here). To clear, use Lc=01; data=00.
90 FA CC CC 01 [FSCI] // Set FSCI (1: value 0-8)
90 FC CC CC 01 [SFGI] // Set SFGI (DO NOT SET TOO HIGH!) (1: value 0-E)
90 FE CC CC 01 [FWI ] // Set FWI (DO NOT SET BELOW 4!!!) (value 0-E)
More commands to follow. Be careful with some.
^Top
^Top
TODO
^Top
Always set a UID starting with E0.
hf 15 csetuid E011223344556677
or (ignore errors):
script run hf_15_magic -u E004013344556677
<a id="g4top"></a>
^Top
^Top
A.k.a ultimate magic card, most promenent feature is shadow mode (GTU) and optional password protected backdoor commands.
Can emulate MIFARE Classic, Ultralight/NTAG families, 14b UID & App Data
👉 TODO If the password is not default, Tag doesn't get identified correctly by latest Proxmark3 client (it might get mislabeled as MFC Gen2/CUID, Gen3/APDU or NTAG21x Modifiable, depending on configured UID/ATQA/SAK/ATS)
👉 TODO Using C6 command can change config due to a bug in some cards. CC should be used instead.
hf 14a info
[+] Magic capabilities : Gen 4 GTU
The card will be identified only if the password is the default one. One can identify manually such card if the password is still the default one, with the command to get the current configuration:
hf 14a raw -s -c -t 1000 CF00000000C6
If the card is an Ultimate Magic Card, it returns 30 or 32 bytes.
There are two ways to program this card.
hf 14a examples.OR
script run hf_mf_ultimatecard examples. This script is nof fully compartible with new version UMC.script run hf_mf_ultimatecard.lua -h
This script enables easy programming of an Ultimate Mifare Magic card
Usage
script run hf_mf_ultimatecard -h -k <passwd> -c -w <type> -u <uid> -t <type> -p <passwd> -a <pack> -s <signature> -o <otp> -v <version> -q <atqa/sak> -g <gtu> -z <ats> -m <ul-mode> -n <ul-protocol>
Arguments
-h this help
-c read magic configuration
-u UID (8-20 hexsymbols), set UID on tag
-t tag type to impersonate
1 = Mifare Mini S20 4-byte
2 = Mifare Mini S20 7-byte 15 = NTAG 210
3 = Mifare Mini S20 10-byte 16 = NTAG 212
4 = Mifare 1k S50 4-byte 17 = NTAG 213
5 = Mifare 1k S50 7-byte 18 = NTAG 215
6 = Mifare 1k S50 10-byte 19 = NTAG 216
7 = Mifare 4k S70 4-byte 20 = NTAG I2C 1K
8 = Mifare 4k S70 7-byte 21 = NTAG I2C 2K
9 = Mifare 4k S70 10-byte 22 = NTAG I2C 1K PLUS
*** 10 = UL - NOT WORKING FULLY 23 = NTAG I2C 2K PLUS
*** 11 = UL-C - NOT WORKING FULLY 24 = NTAG 213F
12 = UL EV1 48b 25 = NTAG 216F
13 = UL EV1 128b
*** 14 = UL Plus - NOT WORKING YET
-p NTAG password (8 hexsymbols), set NTAG password on tag.
-a NTAG pack ( 4 hexsymbols), set NTAG pack on tag.
-s Signature data (64 hexsymbols), set signature data on tag.
-o OTP data (8 hexsymbols), set `One-Time Programmable` data on tag.
-v Version data (16 hexsymbols), set version data on tag.
-q ATQA/SAK (<2b ATQA><1b SAK> hexsymbols), set ATQA/SAK on tag.
-g GTU Mode (1 hexsymbol), set GTU shadow mode.
-z ATS (<1b length><0-16 ATS> hexsymbols), Configure ATS. Length set to 00 will disable ATS.
-w Wipe tag. 0 for Mifare or 1 for UL. Fills tag with zeros and put default values for type selected.
-m Ultralight mode (00 UL EV1, 01 NTAG, 02 UL-C, 03 UL) Set type of UL.
-n Ultralight protocol (00 MFC, 01 UL), switches between UL and MFC mode
-k Ultimate Magic Card Key (IF DIFFERENT THAN DEFAULT 00000000)
Example usage
-- read magic tag configuration
script run hf_mf_ultimatecard -c
-- set uid
script run hf_mf_ultimatecard -u 04112233445566
-- set NTAG pwd / pack
script run hf_mf_ultimatecard -p 11223344 -a 8080
-- set version to NTAG213
script run hf_mf_ultimatecard -v 0004040201000f03
-- set ATQA/SAK to [00 44] [08]
script run hf_mf_ultimatecard -q 004408
-- wipe tag with a NTAG213 or Mifare 1k S50 4 byte
script run hf_mf_ultimatecard -w 1
-- use a non default UMC key. Only use this if the default key for the MAGIC CARD was changed.
script run hf_mf_ultimatecard -k ffffffff -w 1
-- Wipe tag, turn into NTAG215, set sig, version, NTAG pwd/pak, and OTP.
script run hf_mf_ultimatecard -w 1 -t 18 -u 04112233445566 -s 112233445566778899001122334455667788990011223344556677 -p FFFFFFFF -a 8080 -o 11111111
Special raw commands summary:
CF <passwd> 32 <00-04> // Configure GTU shadow mode
CF <passwd> 34 <1b length><0-16b ATS> // Configure ATS
CF <passwd> 35 <2b ATQA><1b SAK> // Configure ATQA/SAK (swap ATQA bytes)
CF <passwd> 68 <00-02> // Configure UID length
CF <passwd> 69 <00-01> // (De)Activate Ultralight mode
CF <passwd> 6A <00-03> // Select Ultralight mode
CF <passwd> 6B <1b> // Set Ultralight and M1 maximum read/write sectors
CF <passwd> C6 // Dump configuration
CF <passwd> CC // Version info, returns `00 00 00 [03 A0 (old) / 06 A0 (new) ]`
CF <passwd> CD <1b block number><16b block data> // Backdoor write 16b block
CF <passwd> CE <1b block number> // Backdoor read 16b block
CF <passwd> CF <1b param> // (De)Activate direct write to block 0
CF <passwd> F0 <30b configuration data> // Configure all params in one cmd
CF <passwd> F1 <30b configuration data> // Configure all params in one cmd and fuse the configuration permanently
CF <passwd> FE <4b new_password> // change password
Default <passwd>: 00000000
# view contents of tag memory:
hf mf gview
# Read a specific block via backdoor command:
hf mf ggetblk
# Write a specific block via backdoor command:
hf mf gsetblk
# Load dump to tag:
hf mf gload
# Save dump from tag:
hf mf gsave
👉 TODO hf mf gview is currently missing Ultralight memory maps
Equivalent:
hf 14a raw -s -c -t 1000 CF00000000CE00
hf 14a raw -s -c -t 1000 CF00000000CE01
hf 14a raw -s -c -t 1000 CF00000000CE02
...
👉 TODO In Mifare Ultralight / NTAG mode, the special writes (hf mfu restore option -s, -e, -r) do not apply. Use script run hf_mf_ultimatecard for UID and signature, and hf mfu wrbl for PWD and PACK.
hf 14a raw -s -c -t 1000 CF<passwd>35<2b ATQA><1b SAK>
iso14443a card select failed (I.E. ATQA=0040 in raw form) can be corrected with hf 14a config --atqa forcehf 14a config --cl2 skip or hf 14a config --cl3 skip to recover a misconfigured card)Example: ATQA 0044 SAK 28, default pwd
hf 14a raw -s -c -t 1000 CF0000000035440028
OR (Note the script will correct the ATQA correctly)
script run hf_mf_ultimatecard -q 004428
hf 14a raw -s -c -t 1000 CF<passwd>34<1b length><0-16b ATS>
<length>: ATS length byte, set to 00 to disable ATSExample: ATS to 0606757781028002F0, default pwd
hf 14a raw -s -c -t 1000 CF000000003406067577810280
Or
script run hf_mf_ultimatecard -z 06067577810280`
hf 14a raw -s -c -t 1000 CF<passwd>68<1b param>
<param>
00: 4 bytes01: 7 bytes02: 10 bytesExample: set UID length to 7 bytes, default pwd
hf 14a raw -s -c -t 1000 CF000000006801
UID is configured according to block0 with a backdoor write. (Script commands are below the UID length examples)
Example: preparing first two blocks: (Note the UMC has to be in MFC mode and the correct UID byte length set)
hf 14a raw -s -c -t 1000 CF00000000CD00000102030405060708090A0B0C0D0E0F
hf 14a raw -s -c -t 1000 CF00000000CD01101112131415161718191A1B1C1D1E1F
hf 14a reader
MFC mode 4b UID
=> UID 00010203
script run hf_mf_ultimatecard -t 4 -u 00010203
MFC mode 7b UID
=> UID 00010203040506
script run hf_mf_ultimatecard -t 5 -u 00010203040506
MFC mode, 10b UID
=> UID 00010203040506070809
script run hf_mf_ultimatecard -t 6 -u 00010203040506070809
Ultralight mode, 4b UID
=> UID 00010203
Ultralight mode, 7b UID
=> UID 00010210111213
👉 the UID is composed of first two blocks as in regular Ultralights
script run hf_mf_ultimatecard -t 12 -u 00010203040506script run hf_mf_ultimatecard -t 13 -u 00010203040506script run hf_mf_ultimatecard -t 18 -u 00010203040506Ultralight mode, 10b UID
=> UID 00010203040506070809
👉 the UID is composed only from block0
Example:
hf 14a raw -s -c -t 1000 CF00000000CD00000102030405060708090A0B0C0D0E0F
hf 14b reader
=> UID 00010203 => ATQB 0405060708090A
hf 14a raw -s -c -t 1000 CF<passwd>69<1b param>
<param>
00: MIFARE Classic mode01: MIFARE Ultralight/NTAG modeExample: activate Ultralight protocol, default pwd
hf 14a raw -s -c -t 1000 CF000000006901
Or
script run hf_mf_ultimatecard -n 01
In this mode, if SAK=00 and ATQA=0044, it acts as an Ultralight card
⚠ only the first four bytes of each block will be mapped in the Ultralight memory map (so the Ultralight block numbers follow backdoor R/W block numbers).
hf 14a raw -s -c -t 1000 CF<passwd>6A<1b param>
<param>
00: UL EV101: NTAG02: UL-C03: UL⚠ it supposes Ultralight mode was activated (cf command 69)
Example: set Ultralight mode to Ultralight-C, default pwd
hf 14a raw -s -c -t 1000 CF000000006A02
Or
script run hf_mf_ultimatecard -m 02
Now the card supports the 3DES UL-C authentication.
hf 14a raw -s -c -t 1000 CF<passwd>6B<1b blocks>
Hexadecimal, maximum sector data, default 0xFF, range 0x00-0xFF
Example: set maximum 63 blocks read/write for Mifare Classic 1K
hf 14a raw -s -c -t 1000 CF000000006B3F
This description of shadow modes wroted by seller at marketpalces:
This mode is divided into four states: off (pre-write), on (on restore), don’t care, and high-speed read and write. If you use it, please enter the pre-write mode first. At this time, write the full card data. After writing, set it to on. At this time, after writing the data, the first time you read the data just written, the next time you read It is the pre-written data. All modes support this operation. It should be noted that using any block to read and write in this mode may give wrong results.
And these conclusions were made after a number of tests with UMC (new version, configured as MFC for example):
| Mode | Buffer | Standart command (rdbl, wrbl e.t.c) | Backdoor command (gsetblk, ggetblk, gload e.t.c.) |
|---|---|---|---|
| 2,3 | buf23 | read/write from/to buf23 | read/write from/to buf23 |
| 0 | buf0 | read from buf0, write to buf0 and buf23 | read/write from/to buf23 |
| 4 | - | read from buf0, write to buf23 | read/write from/to buf23 |
Mode 1: For new card this mode looks like a bug. Reading/writing first two block use buf23. Reading other blocks use invalid region of memory and all returned data looks like pseudo-random. All acl looks like invalid. All data is readable by the keys and acl wich was written in buf0. Any writing operations in this mode use copy of buf0 and only it. It`s not affected any other buffers. So if you change keys or/and acl you will must use new keys to read data.
Example (not work with new UMC):
script run hf_mf_ultimatecard -w 1 -g 00 -t 18 -u 04112233445566 -s 112233445566778899001122334455667788990011223344556677 -p FFFFFFFF -a 8080 -o 11111111 -g 01
At this point the card is set to a unwritten NTAG 215. Now any data written to the card will only last for 1 read. Write a popular game toy to it, read it, now it is back to the unwritten NTAG 215.
👉 Remember to disable GTU mode to get the card back to a normal state.
script run hf_mf_ultimatecard -g 03
hf 14a raw -s -c -t 1000 CF<passwd>32<1b param>
<param>
00: pre-write, shadow data can be written01: restore mode
02: disabled03: disabled, high speed R/W mode for Ultralight?04: split mode, work with new UMC. With old UMC is untested.Using the backdoor command, one can read and write any area without MFC password, similarly to MFC Gen1 card. It should be noted that this command must be used to modify UID.
Backdoor read 16b block:
hf 14a raw -s -c -t 1000 CF<passwd>CE<1b block number>
Backdoor write 16b block:
hf 14a raw -s -c -t 1000 CF<passwd>CD<1b block number><16b block data>
Read/Write operations work on 16 bytes, no matter the Ultralight mode.
Note that only the first four bytes of each block will be mapped in the Ultralight memory map.
Example: read block0, default pwd
hf 14a raw -s -c -t 1000 CF00000000CE00
Example: write block0 with factory data, default pwd
hf 14a raw -s -c -t 1000 CF00000000CD00112233441C000011778185BA18000000
This command enables/disables direct writes to block 0.
hf 14a raw -s -c -t 1000 CF<passwd>CF<1b param>
<param>
00: Activate direct write to block 0 (Same behaviour of Gen2 cards. Some readers may identify the card as magic)01: Deactivate direct write to block 0 (Same behaviour of vanilla cards)02: Default value. (Same behaviour as 00 (?))Example: enable direct writes to block 0, default pwd
hf 14a raw -s -c -t 1000 CF00000000CF00
Example: disable direct writes to block 0, default pwd
hf 14a raw -s -c -t 1000 CF00000000CF01
All backdoor operations are protected by a password. If password is forgotten, it can't be recovered. Default password is 00000000.
WARNING: new UMC (06A0) returns 6300 when issuing password change command. Please write the password using F0 and entering the full configuration, but with the new password.
Change password:
hf 14a raw -s -c -t 1000 CF <passwd> FE <4b new_password>
Example: change password from 00000000 to AABBCCDD
hf 14a raw -s -c -t 1000 CF00000000FEAABBCCDD
Example: change password from AABBCCDD back to 00000000
hf 14a raw -s -c -t 1000 CFAABBCCDDFE00000000
hf 14a raw -s -c -t 1000 CF<passwd>C6
Default configuration:
00000000000002000978009102DABC191010111213141516040008006B024F6B
^^^^ CRC, type unknown
^^ cf cmd cf: block0 direct write setting, factory value 0x02
^^ cf cmd 6b: maximum read/write sectors, factory value 0x6b
^^ cf cmd 6a: UL mode
^^^^^^ cf cmd 35: ATQA/SAK
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cf cmd 34: ATS length & content
^^ cf cmd 32: GTU mode
^^^^^^^^ cf cmd fe: password
^^ cf cmd 68: UID length
^^ cf cmd 69: Ultralight protocol
hf 14a raw -s -c -t 1000 CF<passwd>F0<30b configuration data>
cf Dump configuration for configuration data description.
Example: Write factory configuration, using default password
hf 14a raw -s -c -t 1000 CF00000000F000000000000002000978009102DABC191010111213141516040008004F6B
⚠ Variant with command F1 instead of F0 will set and fuse permanently the configuration. Backdoor R/W will still work.
Here are some presets available in the FuseTool (but with all ATS disabled)
MIFARE Mini S20 4-byte UID
hf 14a raw -s -c -t 1000 CF00000000F000000000000002000978009102DABC19101011121314151604000900
MIFARE Mini S20 7-byte UID
hf 14a raw -s -c -t 1000 CF00000000F000010000000002000978009102DABC19101011121314151644000900
MIFARE 1k S50 4-byte UID (this is the factory setting)
hf 14a raw -s -c -t 1000 CF00000000F000000000000002000978009102DABC19101011121314151604000800
MIFARE 1k S50 7-byte UID
hf 14a raw -s -c -t 1000 CF00000000F000010000000002000978009102DABC19101011121314151644000800
MIFARE 4k S70 4-byte UID
hf 14a raw -s -c -t 1000 CF00000000F000000000000002000978009102DABC19101011121314151602001800
MIFARE 4k S70 7 byte UID
hf 14a raw -s -c -t 1000 CF00000000F000010000000002000978009102DABC19101011121314151642001800
Ultralight
hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000003FB
Ultralight-C
hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000002FB
Ultralight EV1
hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000000FB
NTAG21x
hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000001FB
Don't forget configure maximum read/write blocks. It's can be adjusted directly in config (see Dump configuration) or by command 6B:
hf 14a raw -s -c -t 1000 CF000000006BFB
Note: 0xFB = 251
Ultralight EV1 and NTAG Version info and Signature are stored respectively in blocks 250-251 and 242-249.
Example for an Ultralight EV1 128b with the signature sample from tools/recover_pk.py
hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000000FB
hf mfu wrbl -b 0 -d 04C12865
hf mfu wrbl -b 1 -d 5A373080
hf mfu wrbl -b 242 -d CEA2EB0B --force
hf mfu wrbl -b 243 -d 3C95D084 --force
hf mfu wrbl -b 244 -d 4A95B824 --force
hf mfu wrbl -b 245 -d A7553703 --force
hf mfu wrbl -b 246 -d B3702378 --force
hf mfu wrbl -b 247 -d 033BF098 --force
hf mfu wrbl -b 248 -d 7899DB70 --force
hf mfu wrbl -b 249 -d 151A19E7 --force
hf mfu wrbl -b 250 -d 00040301 --force
hf mfu wrbl -b 251 -d 01000E03 --force
hf mfu info
Example for an NTAG216 with the signature sample from tools/recover_pk.py
hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000001FB
hf mfu wrbl -b 0 -d 04E10C61
hf mfu wrbl -b 1 -d DA993C80
hf mfu wrbl -b 242 -d 8B76052E --force
hf mfu wrbl -b 243 -d E42F5567 --force
hf mfu wrbl -b 244 -d BEB53238 --force
hf mfu wrbl -b 245 -d B3E3F995 --force
hf mfu wrbl -b 246 -d 0707C0DC --force
hf mfu wrbl -b 247 -d C956B5C5 --force
hf mfu wrbl -b 248 -d EFCFDB70 --force
hf mfu wrbl -b 249 -d 9B2D82B3 --force
hf mfu wrbl -b 250 -d 00040402 --force
hf mfu wrbl -b 251 -d 01001303 --force
hf mfu info
^Top
These are chips to clone other ICs. Usually the originals are only sold in China.
^Top
^Top
0008-2010 78 80 A0 02 00 9D 46 16 40 00 A3 [UID]^Top
WARNING!!! Risk of bricking tag - cause is unknown
INS | RES
0A | 44454641554C540000002018112840000000000000000000000000000000000000000000000000000000400000000000
3B | 00000000001C0EF90000000000000000000000000000000000000000000000002000000000C09040009002840000000000000000000000000000000000006C0FC08700EB1A9F1BA01801010019000000000000000000000000000090000000000000094B066600000000007D000000000000000000000000000000003B000000107880A002009D46164000A3CA81E15000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
3C* | 0000
3D | 6700
7D | Tag does not reply (if 0<Lc<=15, RES=6700)
CD | 6A82
D5 | 9000
DD | 6700
DE | 6700
DF | 9000
EE | 6700
F0 | 6A82
FB | 6A82
* - DO NOT EXECUTE THIS INSTRUCTION!!! After 2nd execution tag will brick (No reply to REQA/WUPA). Very likely you need to add extra data which we do not know
^Top
^Top
0044-2005 72 F7 60 02When writing with copykey, after RATS, this communication takes place (NSC ID programmed: 5800000000, tag UID: 1D94CE25840000):
>>> 54 03 8A BC DF C1 [CRC]
<<< A2 [CRC]
>>> 54 04 57 AA 84 DD [CRC]
<<< A2 [CRC]
^Top
54 [part 1b] [data 4b enc] [CRC]
A2 [CRC]