Proxmark3 community

daos

Contributor

Registered: 2013-09-09

Posts: 18

Libfreefare

Hi everyone !

In my research I found the libraries libfreefare that is compatible with the Mifare DESfire Card, would be a good idea that works with proxmark, what do you think about this proyect ?

MIFARE Classic 1k     Supported
MIFARE Classic 4k     Supported
MIFARE DESFire 2k     Supported
MIFARE DESFire 4k     Supported
MIFARE DESFire 8k     Supported
MIFARE DESFire EV1     Supported
MIFARE Mini     Not supported
MIFARE Plus S 2k     Not supported
MIFARE Plus S 4k     Not supported
MIFARE Plus X 2k     Not supported
MIFARE Plus X 4k     Not supported
MIFARE Ultralight     Supported
MIFARE UltralightC     Supported

pentura_prox

Contributor

From: England,UK

Registered: 2014-03-11

Posts: 22

Website

Re: Libfreefare

Sure; Desfire v0.6

proxmark3> hf desfire des-auth k 0
#db# Auth1 Resp: 02afed489b91bb7ec990b1                 
#db# AUTH 1 FINISHED                 
enc(nc)/b0:ed 48 9b 91 bb 7e c9 90           
r0:b1 f0 7d ff 22 8c cd db           
r1:f0 7d ff 22 8c cd db b1           
b2:2b 14 d2 1b 72 6a 3f f4           
#db# Auth2 Resp: 03006edd9db5eeb14721                 
#db# AUTH 2 FINISHED                 
b3:6e dd 9d b5 ee b1 47 21           
proxmark3> hf 14a list
Recorded Activity          
          
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer          
All times are in carrier periods (1/13.56Mhz)          
          
     Start |       End | Src | Data          
-----------|-----------|-----|--------          
         0 |       992 | Rdr | 52              
      2404 |      4772 | Tag | 44  03              
      7040 |      9504 | Rdr | 93  20              
     10852 |     16740 | Tag | 88  04  31  1a  a7              
     18816 |     29280 | Rdr | 93  70  88  04  31  1a  a7  23  1e              
     30692 |     34212 | Tag | 24  d8  36              
     35456 |     37920 | Rdr | 95  20              
     39268 |     45156 | Tag | f2  e2  26  80  b6              
     47232 |     57696 | Rdr | 95  70  f2  e2  26  80  b6  10  0c              
     59108 |     62692 | Tag | 20  fc  70              
     64000 |     68768 | Rdr | e0  80  31  73              
     70116 |     79396 | Tag | 06  75  77  81  02  80  02  f0              
     81024 |     86880 | Rdr | 02  0a  00  dc  ed              
     96484 |    110436 | Tag | 02  af  ed  48  9b  91  bb  7e  c9  90  b1  ef              
   1081344 |   1104480 | Rdr | 03  af  a2  f6  20  2e  86  e6  56  1d  2b  14  d2  1b  72  6a  3f  f4  ef  b7              
   1115108 |   1129060 | Tag | 03  00  6e  dd  9d  b5  ee  b1  47  21  ac  f8

pentura_prox

Contributor

From: England,UK

Registered: 2014-03-11

Posts: 22

Website

Re: Libfreefare

Its just a rather simple poc at the moment, needs more work to generate a session key, and works needs to be done on raw apdus or the iso1718? apdus.  I can share with you what i've done so far.  Whats your email address?

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Libfreefare

Just a quick question Pentura_prox,   what is the inital 0x02, and the 0x03  in your commands to the tag?   I just cant find it in any pdfs.  Wrapped commands starts w 0x90 (and little endian)   but  native cmds should just be 0x0a 0x00  + crc...

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: Libfreefare

02 and 03 are "configuration bytes" used in rfid smartcard ISO14443A. For what I understood 02 is used if a simple answer is waited from the card while 03 if some more series of commands are needed (this is only an opinion, datasheets are a bit vague about them). It is different from real contact smart cards; thsoe one don't need that byte.

midnitesnake

Contributor

Registered: 2012-05-11

Posts: 151

Re: Libfreefare

A quick summary of the authentication handshake (bottom of the trace):

    81024 |     86880 | Rdr | 02  0a  00  dc  ed   
Reader : Request DES Auth
header (auth request)+ body=02 0a 00
crc = dc ed 

    96484 |    110436 | Tag | 02  af  ed  48  9b  91  bb  7e  c9  90  b1  ef   
Tag: Respond DES(Rand A)/ Nonce b0     
header (response)=02 af, 
data = ed  48  9b  91  bb  7e  c9  90,
crc=b1  ef     

1081344 |   1104480 | Rdr | 03  af  a2  f6  20  2e  86  e6  56  1d  2b  14  d2  1b  72  6a  3f  f4  ef  b7   
Reader: Responds  b1.b2 
header (handshake p2 request)=03 af ,
b1=a2  f6  20  2e  86  e6  56  1d,
b2= 2b  14  d2  1b  72  6a  3f  f4,
crc=ef  b7   

1115108 |   1129060 | Tag | 03  00  6e  dd  9d  b5  ee  b1  47  21  ac  f8
Tag: Thank you handshake complete, here is b3 for generating session_key.   
header (handshake p2 response) =03 00,
data= 6e  dd  9d  b5  ee  b1  47  21,
crc= ac  f8

So essentially the 02 & 03 are the phases of authentication if you receive "02 ae" or "03 ae" that means an error occurred during the handshake.

daos

Contributor

Registered: 2013-09-09

Posts: 18

Re: Libfreefare

Thanks @pentura_prox I appreciate that. Can you put the code in https://github.com/Proxmark/proxmark3 or maybe can you upload the .os that everyone can install in your pm3