Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
#1 2017-07-24 13:35:58
- speedlimits
- Contributor
- Registered: 2017-06-28
- Posts: 31
MIFARE Ultralight C mod
Hi all,
i like to fine out if i can change the info on the sectors (blocs) on this card .
info card :
--- Tag Information ---------
-------------------------------------------------------------
TYPE : MIFARE Ultralight C (MF0ULC)
#db# ISO14443A Timeout set to 1050 (9ms)
UID : 04 34 5a 42 eb 4b 80
UID[0] : 04, NXP Semiconductors Germany
BCC0 : E2, Ok
BCC1 : 62, Ok
Internal : 48, default
Lock : 00 00 - 0000000000000000
OneTimePad : 00 00 00 00 - 00000000000000000000000000000000Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 04 34 5A E2 42 EB 4B 80 62 48 00 00 00 00 00 00 .4ZâBëK€bH......
00000010 02 00 00 10 00 06 01 10 11 FF 00 00 00 00 00 00 .........ÿ......
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000070 FF FF FF FF 32 00 00 00 2C 01 00 00 32 00 00 00 ÿÿÿÿ2...,...2....Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error) | CRC | Annotation |
------------|------------|-----|-----------------------------------------------------------------|-----|--------------------|
0 | 992 | Rdr | 52 | | WUPA
2244 | 4612 | Tag | 44 00 | |
7040 | 9504 | Rdr | 93 20 | | ANTICOLL
10692 | 16516 | Tag | 88 04 34 5a e2 | |
18816 | 29280 | Rdr | 93 70 88 04 34 5a e2 51 74 | ok | SELECT_UID
30532 | 34052 | Tag | 04 da 17 | |
35328 | 37792 | Rdr | 95 20 | | ANTICOLL-2
38980 | 44868 | Tag | 42 eb 4b 80 62 | |
47104 | 57632 | Rdr | 95 70 42 eb 4b 80 62 6c c1 | ok | ANTICOLL-2
58820 | 62404 | Tag | 00 fe 51 | |
66048 | 70816 | Rdr | 30 00 02 a8 | ok | READBLOCK(0)
72004 | 92868 | Tag | 04 34 5a e2 42 eb 4b 80 62 48 00 00 00 00 00 00 | |
| | | e9 d9 | ok |
106240 | 111008 | Rdr | 30 01 8b b9 | ok | READBLOCK(1)
112196 | 133060 | Tag | 42 eb 4b 80 62 48 00 00 00 00 00 00 02 00 00 10 | |
| | | b5 64 | ok |
146432 | 151136 | Rdr | 30 02 10 8b | ok | READBLOCK(2)
152388 | 173252 | Tag | 62 48 00 00 00 00 00 00 02 00 00 10 00 06 01 10 | |
| | | 6a 2a | ok |
186624 | 191328 | Rdr | 30 03 99 9a | ok | READBLOCK(3)
192580 | 213444 | Tag | 00 00 00 00 02 00 00 10 00 06 01 10 11 ff 00 00 | |
| | | 57 45 | ok |
226816 | 231520 | Rdr | 30 04 26 ee | ok | READBLOCK(4)
232772 | 253636 | Tag | 02 00 00 10 00 06 01 10 11 ff 00 00 00 00 00 00 | |
| | | 70 75 | ok |
267008 | 271712 | Rdr | 30 05 af ff | ok | READBLOCK(5)
272964 | 293764 | Tag | 00 06 01 10 11 ff 00 00 00 00 00 00 00 00 00 00 | |
| | | f0 95 | ok |
307200 | 311968 | Rdr | 30 06 34 cd | ok | READBLOCK(6)
313156 | 334020 | Tag | 11 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | e0 8c | ok |
347392 | 352160 | Rdr | 30 07 bd dc | ok | READBLOCK(7)
353348 | 374212 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
387584 | 392288 | Rdr | 30 08 4a 24 | ok | READBLOCK(8)
393540 | 414404 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
427776 | 432480 | Rdr | 30 09 c3 35 | ok | READBLOCK(9)
433732 | 454596 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
467968 | 472736 | Rdr | 30 0a 58 07 | ok | READBLOCK(10)
473924 | 494788 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
508160 | 512928 | Rdr | 30 0b d1 16 | ok | READBLOCK(11)
514116 | 534980 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
548352 | 553120 | Rdr | 30 0c 6e 62 | ok | READBLOCK(12)
554308 | 575172 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
588544 | 593312 | Rdr | 30 0d e7 73 | ok | READBLOCK(13)
594500 | 615364 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
628736 | 633440 | Rdr | 30 0e 7c 41 | ok | READBLOCK(14)
634692 | 655556 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
668928 | 673632 | Rdr | 30 0f f5 50 | ok | READBLOCK(15)
674884 | 695748 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
709120 | 713824 | Rdr | 30 10 83 b8 | ok | READBLOCK(16)
715076 | 735940 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
749312 | 754016 | Rdr | 30 11 0a a9 | ok | READBLOCK(17)
755268 | 776132 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
789504 | 794272 | Rdr | 30 12 91 9b | ok | READBLOCK(18)
795460 | 816324 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
829696 | 834464 | Rdr | 30 13 18 8a | ok | READBLOCK(19)
835652 | 856516 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
869888 | 874656 | Rdr | 30 14 a7 fe | ok | READBLOCK(20)
875844 | 896708 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
910080 | 914848 | Rdr | 30 15 2e ef | ok | READBLOCK(21)
916036 | 936900 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
950272 | 954976 | Rdr | 30 16 b5 dd | ok | READBLOCK(22)
956228 | 977092 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
990464 | 995168 | Rdr | 30 17 3c cc | ok | READBLOCK(23)
996420 | 1017284 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
1030656 | 1035424 | Rdr | 30 18 cb 34 | ok | READBLOCK(24)
1036612 | 1057476 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | |
| | | 37 49 | ok |
1070848 | 1075616 | Rdr | 30 19 42 25 | ok | READBLOCK(25)
1076804 | 1097668 | Tag | 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff | |
| | | ae ba | ok |
1111040 | 1115744 | Rdr | 30 1a d9 17 | ok | READBLOCK(26)
1116996 | 1137796 | Tag | 00 00 00 00 00 00 00 00 ff ff ff ff 32 00 00 00 | |
| | | 4f 48 | ok |
1151232 | 1155936 | Rdr | 30 1b 50 06 | ok | READBLOCK(27)
1157188 | 1177988 | Tag | 00 00 00 00 ff ff ff ff 32 00 00 00 2c 01 00 00 | |
| | | cd ee | ok |
1191424 | 1196128 | Rdr | 30 1c ef 72 | ok | READBLOCK(28)
1197380 | 1218180 | Tag | ff ff ff ff 32 00 00 00 2c 01 00 00 32 00 00 00 | |
| | | e4 14 | ok |
1231616 | 1236320 | Rdr | 30 1d 66 63 | ok | READBLOCK(29)
1237572 | 1258436 | Tag | 32 00 00 00 2c 01 00 00 32 00 00 00 04 34 5a e2 | |
| | | 6b 5d | ok |
1271808 | 1276576 | Rdr | 30 1e fd 51 | ok | READBLOCK(30)
1277764 | 1298628 | Tag | 2c 01 00 00 32 00 00 00 04 34 5a e2 42 eb 4b 80 | |
| | | 8a dc | ok |
1312000 | 1316768 | Rdr | 30 1f 74 40 | ok | READBLOCK(31)
1317956 | 1338820 | Tag | 32 00 00 00 04 34 5a e2 42 eb 4b 80 62 48 00 00 | |
| | | 59 7c | ok |
1352192 | 1356960 | Rdr | 30 20 00 89 | ok | READBLOCK(32)
1358148 | 1358788 | Tag |00! | |
1570432 | 1575200 | Rdr | 50 00 57 cd | ok | HALTLast edited by speedlimits (2017-07-24 13:36:21)
Offline
#2 2017-07-24 14:26:17
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,537
- Website
Re: MIFARE Ultralight C mod
Have you tried writing to it?
Not sure if I've seen that dump-format output before. Are you running your own client/firmware?
Offline
#3 2017-07-24 14:55:51
- speedlimits
- Contributor
- Registered: 2017-06-28
- Posts: 31
Re: MIFARE Ultralight C mod
Hi Ice,
yes i cant write on it
proxmark3> hf mfu wrbl b 10 d 12345678
Block: 10 (0x0A) [ 12 34 56 78 ]
#db# WRITE BLOCK FINISHED
isOk:01dump
proxmark3> hf mfu dump
TYPE : MIFARE Ultralight C (MF0ULC)
Reading tag memory...
#db# Cmd Error: 00
#db# Read block 32 error
Block# | Data |lck| Ascii
---------+-------------+---+------
0/0x00 | 04 34 5a e2 | |
1/0x01 | 42 eb 4b 80 | |
2/0x02 | 62 48 00 00 | |
3/0x03 | 00 00 00 00 | 0 | ....
4/0x04 | 02 00 00 10 | 0 | ....
5/0x05 | 00 06 01 10 | 0 | ....
6/0x06 | 11 ff 00 00 | 0 | ....
7/0x07 | 00 00 00 00 | 0 | ....
8/0x08 | 00 00 00 00 | 0 | ....
9/0x09 | 00 00 00 00 | 0 | ....
10/0x0A | 12 34 56 78 | 0 | .4Vx
11/0x0B | 00 00 00 00 | 0 | ....
12/0x0C | 00 00 00 00 | 0 | ....
13/0x0D | 00 00 00 00 | 0 | ....
14/0x0E | 00 00 00 00 | 0 | ....
15/0x0F | 00 00 00 00 | 0 | ....
16/0x10 | 00 00 00 00 | 0 | ....
17/0x11 | 00 00 00 00 | 0 | ....
18/0x12 | 00 00 00 00 | 0 | ....
19/0x13 | 00 00 00 00 | 0 | ....
20/0x14 | 00 00 00 00 | 0 | ....
21/0x15 | 00 00 00 00 | 0 | ....
22/0x16 | 00 00 00 00 | 0 | ....
23/0x17 | 00 00 00 00 | 0 | ....
24/0x18 | 00 00 00 00 | 0 | ....
25/0x19 | 00 00 00 00 | 0 | ....
26/0x1A | 00 00 00 00 | 0 | ....
27/0x1B | 00 00 00 00 | 0 | ....
28/0x1C | ff ff ff ff | 0 | ....
29/0x1D | 32 00 00 00 | 0 | 2...
30/0x1E | 2c 01 00 00 | 0 | ,...
31/0x1F | 32 00 00 00 | 0 | 2...
---------------------------------So I think I can .
:-).
I was confused. I thought that needed a key to write .
Dump format is :
hf mf dbg 4"
"hf mfu dump k xxxxxx"
"hf list 14a"
Offline
#4 2017-07-24 15:36:59
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,537
- Website
Re: MIFARE Ultralight C mod
read up on your datasheets. UL-C doesn't use a 4byte pwd. It uses a 16byte key.
You only need a key if the tag is configured to authenticate.
Offline
#5 2017-07-24 15:39:52
- speedlimits
- Contributor
- Registered: 2017-06-28
- Posts: 31
Re: MIFARE Ultralight C mod
Ok thanks,
can you tell by reading (with Proxmark) the tag if it needs authentication ?
Offline
#6 2017-07-24 22:09:12
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,537
- Website
Re: MIFARE Ultralight C mod
since you can't get a complete dump (look at number of blocks) , and hf mfu info doesn't report back configuration values for authentication, I would say that your card is locked down and you need the key to get all data from it.
Offline
#7 2017-07-24 22:11:35
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,537
- Website
Re: MIFARE Ultralight C mod
and change back the debug level to 0 or 1, you will most likely get crap values because of missed timing with level 4.
Offline
#8 2017-08-03 14:26:47
- speedlimits
- Contributor
- Registered: 2017-06-28
- Posts: 31
Re: MIFARE Ultralight C mod
thanks for your help
Offline
Pages: 1