Proxmark3 community

yellow_light

Contributor

Registered: 2022-06-18

Posts: 2

Help with iClass DL cards from Red Team Tools

EDIT: SOLVED! In typical fashion, not long after finally deciding to make this post did I get this figured out and working. I owe that to this post here: https://forum.dangerousthings.com/t/so- … rd/14180/2

My issue was not updating keys, which the above post explains how to do.

Cheers

Hi All,

I am trying to learn more about working with proxmark and iClass cards. I purchased some Blank iClass cards from Red Team tools (https://www.redteamtools.com/iCLASS-RFID-card), but can't get my readers to recognize them (R90 and various multi-class readers). I am able to use the proxmark to write data to the card and have tried changing the configuration mode from "[+]     mode......... Personalization (programmable)" to "[+]     mode......... Application (locked)" after writing the desired data to block 7, but the readers still show now indication of reading/recognizing the card.

The Red Team Tools product description says:

"This is an non-programmed, iCLASS 2K credential in an UNPERSONALIZED STATE.

Using this credential will require an understanding of personalization procedures or tools for the PicoPass chip."

I have a feeling I am missing a step or just not following the correct personalization procedures for the card. I also attempted to read the card using the software from https://github.com/ColdHeat/iclass, but the result was "Error: Authentication failed". If anyone could help shed some light on what I may be missing (either directly or to documentation I may have missed) I would greatly appreciate it!!

Here is the result of the hf iclass info command on a blank iClass DL card that I have not made any changes to:

[usb] pm3 --> hf iclass info

[=] --------------------- Tag Information ----------------------
[+]     CSN: 80 5F 83 01 F8 FF 12 E0  uid
[+]  Config: FF FF FF FF 7F 1F FF BC  card configuration
[+] E-purse: FE FF FF FF FF FF FF FF  Card challenge, CC
[+]      Kd: 00 00 00 00 00 00 00 00  debit key ( hidden )
[+]      Kc: 00 00 00 00 00 00 00 00  credit key ( hidden )
[+]     AIA: FF FF FF FF FF FF FF FF  application issuer area
[=] -------------------- card configuration --------------------
[=]     Raw: FF FF FF FF 7F 1F FF BC 
[=]          FF.....................  app limit
[=]             FFFF ( 65535 )......  OTP
[=]                   FF............  block write lock
[=]                      7F.........  chip
[=]                         1F......  mem
[=]                            FF...  EAS
[=]                               BC  fuses
[=]   Fuses:
[+]     mode......... Personalization (programmable)
[+]     coding....... ISO 14443-2 B / 15693
[+]     crypt........ Secured page, keys not locked
[=]     RA........... Read access not enabled
[=]     PROD0/1...... Default production fuses
[=] -------------------------- Memory --------------------------
[=]  2 KBits/2 App Areas ( 256 bytes )
[=]     1 books / 1 pages
[=]  First book / first page configuration
[=]     Config | 0 - 5 ( 0x00 - 0x05 ) - 6 blocks 
[=]     AA1    | 6 - 255 ( 0x06 - 0xFF ) - 250 blocks
[=] ------------------------- KeyAccess ------------------------
[=]  * Kd, Debit key, AA1    Kc, Credit key, AA2 *
[=]     Read A....... debit or credit
[=]     Read B....... debit or credit
[=]     Write A...... credit
[=]     Write B...... credit
[=]     Debit........ debit or credit
[=]     Credit....... credit
[=] ------------------------ Fingerprint -----------------------
[+]     CSN.......... HID range
[+]     Credential... iCLASS legacy
[+]     Card type.... PicoPass 2K

Let me know if providing any more info would be helpful. Cheers!

Last edited by yellow_light (2022-06-20 00:08:02)