Proxmark3 community

7_nebo_7

Contributor

Registered: 2019-09-19

Posts: 3

iClass Write block [XX] failed

Hi All,
For few days I tried work with iClass fobs. Unfortunatelly when I am trying to write to FOB I have "Write block failed" message. I am using latest official f/w:

Prox/RFID mark3 RFID instrument
bootrom: master/v3.1.0-171-gfef3084-suspect 2020-01-03 14:10:52
os: master/v3.1.0-171-gfef3084-suspect 2020-01-03 14:10:54
fpga_lf.bit built for 2s30vq100 on 2019/11/21 at 09:02:37
fpga_hf.bit built for 2s30vq100 on 2019/11/13 at 14:52:19
SmartCard Slot: not available

uC: AT91SAM7S256 Rev D
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 206803 bytes (79%). Free: 55341 bytes (21%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory

This is my commands:

proxmark3> hf se

   CSN: 43 88 4e 10 fe ff 12 e0
    CC: fe ff ff ff ff ff ff ff
  Mode: Application [Locked]
Coding: ISO 14443-2 B/ISO 15693
 Crypt: Secured page, keys not locked
    RA: Read access not enabled
   Mem: 2 KBits/2 App Areas (32 * 8 bytes) [1F]
   AA1: blocks 06-12
   AA2: blocks 13-1F
 AppIA: ff ff ff ff ff ff ff ff
      : Possible iClass (legacy tag)

Valid iClass Tag (or PicoPass Tag) Found - Quiting Search

proxmark3> hf iclass chk f default_iclass_keys.dic
Loaded  6 keys from default_iclass_keys.dic

   Found AA1 debit key          [ae a6 84 a6 da b2 32 78]

proxmark3> hf iclass dump k aea684a6dab23278
------+--+-------------------------+
CSN   |00| 43 88 4e 10 fe ff 12 e0|
------+--+-------------------------+
Block |01| 12 ff ff ff 7f 1f ff 3c|
Block |02| fe ff ff ff ff ff ff ff|
Block |03| 09 92 0a 45 a7 64 71 78|
Block |04| ff ff ff ff ff ff ff ff|
Block |05| ff ff ff ff ff ff ff ff|
Block |06| 00 00 00 00 00 00 e0 14|
Block |07| ff ff ff ff ff ff ff ff|
Block |08| ff ff ff ff ff ff ff ff|
Block |09| ff ff ff ff ff ff ff ff|
Block |0A| ff ff ff ff ff ff ff ff|
Block |0B| ff ff ff ff ff ff ff ff|
Block |0C| ff ff ff ff ff ff ff ff|
Block |0D| ff ff ff ff ff ff ff ff|
Block |0E| ff ff ff ff ff ff ff ff|
Block |0F| ff ff ff ff ff ff ff ff|
Block |10| ff ff ff ff ff ff ff ff|
Block |11| ff ff ff ff ff ff ff ff|
Block |12| ff ff ff ff ff ff ff ff|
------+--+-------------------------+
Saving dump file - 19 blocks read
Saved data to 'iclass_tagdump-43884e10feff12e0-1.bin'
proxmark3> hf iclass managekeys p

0: ae a6 84 a6 da b2 32 78
1: 00 00 00 00 00 00 00 00
2: 00 00 00 00 00 00 00 00
3: 00 00 00 00 00 00 00 00
4: 00 00 00 00 00 00 00 00
5: 00 00 00 00 00 00 00 00
6: 00 00 00 00 00 00 00 00
7: 00 00 00 00 00 00 00 00

proxmark3> hf iclass readblk b 06 k aea684a6dab23278
CSN: 43 88 4e 10 fe ff 12 e0
Authenticating with legacy diversified key: 09 92 0a 45 a7 64 71 78
Block 06: 00 00 00 00 00 00 e0 14

proxmark3> hf iclass readblk b 02 k aea684a6dab23278
CSN: 43 88 4e 10 fe ff 12 e0
Authenticating with legacy diversified key: 09 92 0a 45 a7 64 71 78
Block 02: fe ff ff ff ff ff ff ff

proxmark3> hf iclass clone f iclass_tagdump-f08a4e10feff12e0.bin b 06 l 09 k 0
CSN: 43 88 4e 10 fe ff 12 e0
Authenticating with legacy diversified key: 09 92 0a 45 a7 64 71 78
Cloning
Block |06| 000000000000e014 | MAC |ed878a7e|
Block |07| ffffffffffffffff | MAC |cc72b996|
Block |08| ffffffffffffffff | MAC |3c15179b|
Block |09| ffffffffffffffff | MAC |50b17045|
#db# Write block [06] failed
#db# Write block [07] failed
#db# Write block [08] failed
#db# Write block [09] failed
#db# Clone incomplete
proxmark3>

And here I am trying write by blocks:

proxmark3> hf iclass writeblk b 07 d 6ce099fe7e614fd0 k AFA785A7DAB33378
CSN: 43 88 4e 10 fe ff 12 e0
Authenticating with legacy diversified key: 09 92 0a 45 a7 64 71 78
#db# Write block [07] failed
Write Block Failed

any one experience similar? and how to overcome this?

NYCity25

Contributor

From: Mars

Registered: 2018-08-19

Posts: 31

Re: iClass Write block [XX] failed

Bump, I have exact same issue, Not able to sort this out

piwi

Contributor

Registered: 2013-06-04

Posts: 704

Re: iClass Write block [XX] failed

What type of card is this? I tried with the following types (static artwork identifier). None of them shows this behaviour:

• HID iCLASS DP

• HID iCLASS DL

• iCLASS 2K BH

• HID iCLASS Px D8L

(all with dynamic markings starting with *, i.e. 2K, Programmed iClass/Seos)

BTW: the HID GLOBAL CREDENTIAL IDENTIFICATION MARKINGS APPLICATION NOTE doesn't mention all of these "static artwork identifiers". Is there another document explaining these types?

Last edited by piwi (2020-02-05 12:45:15)

NYCity25

Contributor

From: Mars

Registered: 2018-08-19

Posts: 31

Re: iClass Write block [XX] failed

What type of card is this? I tried with the following types (static artwork identifier). None of them shows this behaviour:

• HID iCLASS DP

• HID iCLASS DL

• iCLASS 2K BH

• HID iCLASS Px D8L

(all with dynamic markings starting with *, i.e. 2K, Programmed iClass/Seos)

BTW: the HID GLOBAL CREDENTIAL IDENTIFICATION MARKINGS APPLICATION NOTE doesn't mention all of these "static artwork identifiers". Is there another document explaining these types?

hey piwi,

thanks for these docs,

the cards I have, i was actually never able to detect them on proxmark in 2019 with the official firmware, then I was given up.
2 weeks ago I've installed the latest firmware, now I can see proxmark can detect them no problem, even can see the contents with the default keys, but write any block always fails for some reason,

these are 2 different cards directly ordered from H*D last year, ( one clamshell type, another slim type DL)

If you are really curious I can send them to you ,

thanks