MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

ikarus · 2014-03-26 22:18:40

Hi

wous wrote:

Can MCT clone, together with changing the keys?

This is the normal behaviour. MCT writes all blocks from a dump (including blocks with keys).
Can you post the dump here? (if you want you can xxx sections for privacy reasons.)

wous · 2014-03-27 11:15:01

This is what MCT gives:

+Sector: 0
0B7365DDC088040046B9949745402709
870002000F380F380F380F380F380000
0000EF48EF48EF48EF48EF48EF48EF48
A0A1A2A3A4A5787788C1------------
+Sector: 1
904005810FFFFFFFFFFF000000000000
00000000000000000000000000000000
00000000000000000000000000000000
A0A1A2A3A4A50F078F00------------

sideout · 2014-03-27 12:30:22

Hi guys.
Where can i find a GUI of MCT for windows x86?
Thanks

ikarus · 2014-03-27 19:54:29

@wous:
Ahh, now is see the issue. The last block of an sector (block = line) was not completely dumped.
As you can see, key B was not found (the "----" part). You have to know all the keys to dump the
full card. The problem is that it is only possible to write Mifare Classic tags block-wise and there
is now way for MCT to know what the --- part was. Therefore MCT skips blocks which contain unknown data.
I'm sorry, but you can't fully recover the old card with an incomplete dump.

@sideout:
MCT is an Android app. You can, hypothetical, emulate it on other platforms using the Android emulator provided by Google.
But the problem is the NFC interface. Just connecting a USB-Reader won't do the trick. I don't know if there is a way
to tell the emulator to use your connected USB-Reader as NFC interface.

wous · 2014-03-28 10:14:45

ikarus wrote:

@wous:
Ahh, now is see the issue. The last block of an sector (block = line) was not completely dumped.
As you can see, key B was not found (the "----" part). You have to know all the keys to dump the
full card. The problem is that it is only possible to write Mifare Classic tags block-wise and there
is now way for MCT to know what the --- part was. Therefore MCT skips blocks which contain unknown data.
I'm sorry, but you can't fully recover the old card with an incomplete dump.

Thanks a lot for your answer!
Do you know if keys are often the same within a company on different cards? I could try to dump another and change it with the other key.

asper · 2014-03-28 10:42:31

It depends on companies. Some uses the same some other generate them with an usually proprietary algo.

ikarus · 2014-03-28 15:35:47

asper knows what he is talking about!
In most of my experiences the keys were the same on all cards of a company.

wous · 2014-03-29 16:20:26

Nice! I will try mfoc on a similar card then! When I finally get it working..

wous · 2014-04-02 19:42:22

Does anyone know a dictionary attack like MCT does, for PC? It's a really nice feature you built here!

By the way, I just came to know all keys in the company are the same, but on different locations, some sector 3 keys are in sector 2 for example.

asper · 2014-04-15 19:22:14

Hi Ikarus, I am further ivestigating ISO14443 protocol and I have found this good diagram for you to recognize a mifare card type:

ikarus · 2014-04-22 12:57:00

Thanks asper, looks good. When I have some spare time I will use this to display
the tag type (in the tag info view) more accurate.

AlgoJerViA · 2014-04-23 08:36:07

I ordered these key fobs; http://www.aliexpress.com/item/5pcs-lot-UID-Changeable-IC-tag-keyfob-for-mifare-1k-13-56MHz-Writable-mifare-0-zero/1569272672.html

However I can't even read Sector 0 at all. It is strange since all apps I tried have no problem reading out a UID and manufacture info.

When I read the fob with MCT I just get:
Sector 0
No keys found (or dead sector)

Does anyone have any suggestion what to try next? (I have no Proxmark, just HTC One)

ikarus · 2014-04-23 09:39:59

Hi,

I'm not sure if the tags or MCT has an issue.

Pleas try this:
* Install "NFC Taginfo"
* Use this app to read a tag
* After reading, press "Data (HEX)" in the "Mifare Classic 1K" section of the menu
* You should see now something like:

Sector 0:
aa342859fda38294281bcadf23481923
00000000000000000000000000000000
00000000000000000000000000000000
ffffffffffffff078069ffffffffffff
[...]

* If you can see this, it is most likely an issue of MCT. If you see something like
"Read failed!" it is most likely an issue of the tags you bought.

AlgoJerViA · 2014-04-23 10:08:42

NFC Taginfo gives Read failed! four times for sector 0.
It's just that all five tags behave in the same manner that make me think maybe something interesting might be going on.
How is it possible that the apps can get the UID but then can't read anything from sector 0?

asper · 2014-04-23 10:51:01

HTC One is a family, you should check if your sub-model has a mifare-compatible NFC chip inside. "Pure" HTC One has a NXP 44701 NFC controller and "should" be compatible with mifare.

If it is not a phone problem maybe you received some "strange" mifare chanegable UID... maybe you can try to read the tag putting it 1cm form the phone.

Your best chance is to test a real mifare card and see if it works.

Last edited by asper (2014-04-23 10:52:26)

ikarus · 2014-04-23 11:09:11

I think your phone is O.K. with Mifare Classic tags. Otherwise MCT or at least NFC Taginfo should complain about it.
I'm very sure that there is something wrong with this tags!
(Maybe they are not initialized with the standard key "FFFFFFFFFFFF" like the description says?!)

AlgoJerViA wrote:

How is it possible that the apps can get the UID but then can't read anything from sector 0?

Reading the UID is different form reading data. No authentication is needed and the
protocol is ISO 14443 compliant. (Reading data from a MF Classic tag is proprietary NXP stuff.)

AlgoJerViA · 2014-04-23 16:00:59

I have The One and I have no problem reading other mifare chips and I can read and write every other sector expect for 0. I have experimented a bit and it seems like the keys are wrong. authenticateSectorWithKeyA returns false for every value I tried.

asper · 2014-04-23 19:03:32

Well if you can write other sectors other than sector0 of your special card (you seem to have written that) you probably bought a 1st generation changeable UID card (that requires special commands to write sector0) so you are out of luck and there is no way in which you can program them with your mobile phone.

Last edited by asper (2014-04-23 19:04:43)

AlgoJerViA · 2014-04-23 21:50:29

Yes I'm aware of the first generation card but I never heard that it is impossible to read the first sector. Also is it not usually only block 0 of sector 0 that is write protected? I can't access anything from sector 0 of the special card.

asper · 2014-04-23 22:32:13

Strange cards... you should try to read it with a proxmark or for example a galaxy s3... or maybe you bought a used set of changeable uid card with different keys... ask the seller...

AlgoJerViA · 2014-04-29 16:21:21

I bought the Adafruit NFC breakout board.
It is possible to change the UID with the magic commands but I can't still read sector 0 at all.
I have been running mfok for a while but no result so far... it only outputs this.

Sector: 0, type A, probe 92, distance 64 .....
Sector: 0, type A, probe 93, distance 64 .....
Sector: 0, type A, probe 94, distance 64 .....

What does distance mean? I stays fixed at 64 so is this just a brute force attack on a possibly broken chip maybe.

AlgoJerViA · 2014-04-29 18:50:06

I succeeded in formatting the card witch restored Sector 0 to a working state.
Cloning the cards now works perfectly.

Gonzakpo · 2014-05-06 03:49:53

Can anybody tell me where to buy the right cards in US? I've only found this one but I think it's too expensive:

I can't post links. But if you search on google "clonemykey" and "uid-changeable-mifare-1k-s50-classic-compatible-card-block-0-direct-write" you'll find the page. They also sell over ebay.

The other UID changeable cards (the ones that use the special command insted of a regular write) are way more cheaper.

app_o1 · 2014-05-07 05:20:04

Gonzakpo wrote:

Can anybody tell me where to buy the right cards in US? I've only found this one but I think it's too expensive:
I can't post links. But if you search on google "clonemykey" and "uid-changeable-mifare-1k-s50-classic-compatible-card-block-0-direct-write" you'll find the page. They also sell over ebay.
The other UID changeable cards (the ones that use the special command insted of a regular write) are way more cheaper.

Change your privacy setting so we can send you private email/message.

Last edited by app_o1 (2014-05-07 07:16:15)

Gonzakpo · 2014-05-07 13:48:58

app_o1 wrote:

Gonzakpo wrote:
Can anybody tell me where to buy the right cards in US? I've only found this one but I think it's too expensive:
I can't post links. But if you search on google "clonemykey" and "uid-changeable-mifare-1k-s50-classic-compatible-card-block-0-direct-write" you'll find the page. They also sell over ebay.
The other UID changeable cards (the ones that use the special command insted of a regular write) are way more cheaper.
Change your privacy setting so we can send you private email/message.

Done!

Gonzakpo · 2014-05-08 02:09:19

Anyone?

I would like to be able to write UID using this app. But I need to find a suitable card for that. The only one I've found is $22 which is pretty expensive for an NFC card. The ones from China do not specify so I don't know which to buy.

Thanks.

app_o1 · 2014-05-12 07:36:54

Gonzakpo wrote:

Done!

I still cannot see your email nor send your private message from your Profile page

ikarus · 2014-05-14 19:01:21

New release! (Version 1.7.4: APK-file, Google Play, F-Droid)
(See: original post, updated)

* Try to prevent the strange crash issue on S5 devices.
(I'm not sure what is causing this and I'm not a 100% sure if
this update will prevent MCT from crashing).
* Some minor bug fixes.

Regarding the crash issue: If you are one of the unlucky people encountering this crash
please say so! Maybe we can find and fix this issue together.

Kind regards,
ikarus

ikarus · 2014-05-14 19:10:12

... And I'm sorry, but I don't know a reliable source to buy the block 0 writable cards.
On aliexpress.com a lot of sellers claim that they sell this kind of cards. But in the feedback section
you can read that this is not true. In most cases the tags are only writable with special commands.

ikarus · 2014-06-18 08:32:24

Hi kuzaxak,

Please note that Mifare Plus is not MIfare Classic!

Mifare Plus tags have three different security levels. The default is level 0 and used for card personalization.
If you want to use Mifare Plus as Mifare Classic (backwards functional compatibility mode)
you have to change the level to 1 (please read the Mifare Plus Datasheet, especially section 8.3+).
Maybe then MCT will work. Unfortunately I don't own a Mifare Plus tag to test this.

Last edited by ikarus (2014-06-18 13:40:52)

marshmellow · 2014-06-18 19:39:33

I have a feature request. I'd like to be able to dump multiple cards and then output all the dumps to one file. (BTW I love the tool as it is. Excellent job.)

ikarus · 2014-06-19 16:32:17

hi marshmellow,

what is the exact procedure or use case?
I can easily change the save functionality of MCT. I'm thinking of something like:
read tag -> save tag (in dump editor) -> enter name -> warning: file already exists -> replace / append? -> append! -> done.

But if you want something like a multi-read feature that read multiple tags and dumps them all into one file,
I have to say "no". Ok, maybe that is a bit harsh. But I don't want to do it, because I'm too short on time (and too lazy?!).
Maybe in the far, faaaar future....

marshmellow · 2014-06-19 16:54:53

An append would be helpful. I won't push too hard for anything more. . Would the file be like a CSV or delimited text file or something else?

EDIT: nevermind, I see, the current format just appended although i'd prefer a csv or delimited format one row per card. but beggars can't be choosers.

Last edited by marshmellow (2014-06-19 17:29:33)

ikarus · 2014-06-21 22:25:58

New release! (Version 1.7.5: APK-file, Google Play, F-Droid)
(See: original post, updated)

* Fixed issues with Galaxy S5 (at least I think so).
Thanks to "mic".
* Motorola Moto X is (and always was) supported.
Thanks to Markus J. for reporting this.
Now it is unlocked on Google Play.
* Some minor bug fixes.

Regarding the Motorola Moto X: This mobile was blocked on Google Play because
this site states that it does not support Mifare Classic.
But thanks to Markus I now know that the Moto X has an NXP NFC-controller with Mifare Classic support.

Kind regards,
ikarus

OzChO · 2014-07-14 10:31:58

Hi there Ikarus,

I'm programming a new feature, I hope you like it.
the new feature is write the content of editor screen, without saving it as a dump.

if you're ok with this I'll push it to github.

Thanks for this awesome app buddy!

OzChO · 2014-07-14 18:06:49

A promise is a promise!

I've modified the code to write data directlly from editor.
It's a new menu entry (Write tag).

If you can grant me access to github repository i'll do a push.

Also, I can translate app to spanish if you want.

Thanks mate!

ikarus · 2014-07-15 09:35:30

Thanks OzChO!
Please check https://github.com/ikarus23/MifareClassicTool/issues/18

If you want to translate MCT into Spanish please have a look at this.
You basically have to create the directory "MifareClassicTool/res/values-es" and copy the
strings.xml from "MifareClassicTool/res/values/" into the new folder. Then you can start translating.
When you are finished you can create a pull request for the translated strings.xml on github.

ikarus · 2014-07-15 21:36:54

New release! (Version 1.7.6: APK-file, Google Play, F-Droid)
(See: original post, updated)

* Check dumps before writing.
* Save multiple dumps in one file.
(Files that contain more than one dump can not be
viewed or written using this app.)
* Show a donate notice at updates.
* Some minor bug fixes.

If you like MCT you can buy me a beer --> MCT Donate Version

@marshmellow: I hope the append feature works for you. You should be easily able to convert the dumps
into the CVS format you like. (A simple script should do the trick.)

Kind regards,
ikarus

marshmellow · 2014-07-15 21:58:03

@marshmellow: I hope the append feature works for you. You should be easily able to convert the dumps
into the CVS format you like. (A simple script should do the trick.)

It works great! Thanks.

app_o1 · 2014-07-16 02:26:26

Can you guys add an option to compare 2 dumps ?
Side by side, or just show the differences, or just say "dumps are identical" when they are.

Thanks for your hard work so far ^^

ikarus · 2014-07-19 22:22:10

New release! (Version 1.7.7: APK-file, Google Play (Donate Version), F-Droid)
(See: original post, updated)

* Write dumps directly from the dump editor.
Thanks to "ozcho".
* Fixed bug which prevented tags from being read/displayed
if there is a "No keys found (or dead sector)" message.
* Fixed crash that occurred if one uses the
"Decode date of manufacture" function.

Kind regards,
ikarus

ikarus · 2014-07-19 22:31:41

app_o1 wrote:

Can you guys add an option to compare 2 dumps ?
Side by side, or just show the differences, [...]

I had that in mind for quite some time too. But unfortunately I'm too short on time.
Maybe in the (far) future. (No promises!)

app_o1 wrote:

[...] or just say "dumps are identical" when they are.

That sounds not too hard. But as I said: I'm short on time. So be patient with me and I'll see what I can do.

app_o1 wrote:

Thanks for your hard work so far ^^

You are welcome!

marcoss · 2014-08-27 15:16:52

Is there any option to convert mct dumps to mfoc format (.mfd)? Perl mifare mad script need this format.

iceman · 2014-08-27 15:24:17

How does the mct dump- and the mfoc dump- format look like? Any samples?

marcoss · 2014-08-27 15:30:27

https://github.com/zhovner/mfdread - in here you have mfoc dump sample

MCT dump looks like this (readable from notepad without any file extension):

+Sector: 14
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
XXXXXXXXXXXXXXXXXXXXXXXXXXXX (Key A, ACs, Key B)

iceman · 2014-08-27 15:39:41

Check out holimans lua script "emul2html"

I asked him about getting this MCT dumps (actually .eml format) into html and he gave me a small change in this script, so now I got (MCT dump, eml) -> html.
He will commit that change I guess when he finds time.

the Html-formatted dumps is what we use in the PM3 world..

iceman · 2014-08-27 15:43:11

this is the code change Holiman gave me:

Inside /lualibs/html_dumplib.lua

find the function convert_ascii_dump_to_JS

change this:

                  output = output .. "'"..line.."',\n"

to:

	    if string.byte(line,1) ~= string.byte("+",1) then
                  output = output .. "'"..line.."',\n"
           end

ikarus · 2014-08-27 17:06:30

Cool! Looking forward to see that merged into the github repo.

I will go on holidays tomorrow. So I'm short on time right now.
Otherwise I would merge it my self.

marcoss · 2014-08-27 17:11:07

Yeah, but you are talking about other format. I don't use proxmark3, I just dumped my card by mct on android device and I wanna play with mifare dump parser (perl script using mfoc or nfc-mfclassic tools dump format .mfd).

marcoss · 2014-08-27 17:14:48

Sorry if this post is not to me

Proxmark3 community

Announcement

#201 2014-03-26 22:18:40

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#202 2014-03-27 11:15:01

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#203 2014-03-27 12:30:22

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#204 2014-03-27 19:54:29

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#205 2014-03-28 10:14:45

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#206 2014-03-28 10:42:31

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#207 2014-03-28 15:35:47

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#208 2014-03-29 16:20:26

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#209 2014-04-02 19:42:22

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#210 2014-04-15 19:22:14

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#211 2014-04-22 12:57:00

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#212 2014-04-23 08:36:07

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#213 2014-04-23 09:39:59

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#214 2014-04-23 10:08:42

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#215 2014-04-23 10:51:01

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#216 2014-04-23 11:09:11

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#217 2014-04-23 16:00:59

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#218 2014-04-23 19:03:32

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#219 2014-04-23 21:50:29

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#220 2014-04-23 22:32:13

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#221 2014-04-29 16:21:21

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#222 2014-04-29 18:50:06

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#223 2014-05-06 03:49:53

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#224 2014-05-07 05:20:04

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#225 2014-05-07 13:48:58

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#226 2014-05-08 02:09:19

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#227 2014-05-12 07:36:54

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#228 2014-05-14 19:01:21

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#229 2014-05-14 19:10:12

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#230 2014-06-18 08:32:24

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#231 2014-06-18 19:39:33

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#232 2014-06-19 16:32:17

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#233 2014-06-19 16:54:53

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#234 2014-06-21 22:25:58

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#235 2014-07-14 10:31:58

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#236 2014-07-14 18:06:49

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#237 2014-07-15 09:35:30

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#238 2014-07-15 21:36:54

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic

#239 2014-07-15 21:58:03

Re: MCT - An Android NFC-App for reading/writing/analysing/etc. MF Classic