HF_AVEFUL — MIFARE Ultralight Read/Simulation

Author: Ave Ozkal Frequency: HF (13.56 MHz) Hardware: Generic Proxmark3

Back to Standalone Modes Index | Source Code | Development Guide

What

Reads MIFARE Ultralight family cards (UL, ULEV1, UL Nano, My-d Move) and then emulates the captured card. Auto-detects the card type and block count.

Why

MIFARE Ultralight is widely used in transit systems, event tickets, and small-value tokens. This mode enables standalone read-and-replay for:

• Transit fare evasion testing: Capture a valid ticket and present it at a gate
• Ticket cloning assessment: Demonstrate that UL tickets can be replayed
• NFC application testing: Verify that applications properly validate UL tags

How

1. SEARCH: Scans for MIFARE Ultralight cards using anticollision
2. READ: Upon finding a card, detects its type via the VERSION command and reads all accessible blocks
3. EMULATE: Loads the captured data into the emulator and broadcasts it as a MIFARE Ultralight tag

Supports auto-detection of: MIFARE Ultralight, Ultralight EV1, Ultralight Nano, and My-d Move.

LED Indicators

Button Controls

State Machine

stateDiagram-v2
    [*] --> SEARCH : Startup

    SEARCH --> READ : UL card found
    SEARCH --> SEARCH : No card / incompatible

    READ --> EMULATE : All blocks read
    READ --> SEARCH : Read failed

    EMULATE --> SEARCH : Button hold\n(cycle back)
    EMULATE --> [*] : Button hold\n(exit)

    SEARCH --> [*] : Button hold (exit)

Supported Cards

Compilation

make clean
make STANDALONE=HF_AVEFUL -j
./pm3-flash-fullimage

Related

• UL-C/UL-AES Unlocker — Unlock password-protected UL cards
• BogitoRun Auth Sniffer — Capture UL authentication passwords
• CraftByte UID Stealer — Generic 14A UID emulator