Proxmark3 community

iNeedHelpX

Contributor

From: Toronto Canada

Registered: 2019-12-28

Posts: 13

Mifare Desfire ev1 MF3ICD41

I know the communication on this card is in plain text.

Here is a sniff of the hex code given off the app for the agency (its a tap card balance app):

0F 0A 03 5F 70 69 18 AF
CD F0 D3 9F CA FD 91 72
12 03 5F 76 73 18 9B E7
DF A1 BB 2F 20 DA BB DC
A1 BB 2F 12 CE 01 0A 09
0A 02 5F 6F 12 03 61 70
70 0A 21 0A 09 45 76 65
6E 74 4E 61 6D 65 12 14
43 61 72 64 44 65 74 61
69 6C 73 5F 48 6F 6D 65
5F 42 74 6E 0A 18 0A 0A
53 63 72 65 65 6E 4E 61
6D 65 12 0A 48 4F 4D 45
53 43 52 45 45 4E 0A 14
0A 0A 44 65 76 69 63 65
4E 61 6D 65 12 06 69 50
68 6F 6E 65 0A 25 0A 03
5F 73 63 12 1E 51 75 65
72 79 43 61 72 64 44 65
74 61 69 6C 73 56 69 65
77 43 6F 6E 74 72 6F 6C
6C 65 72 0A 12 0A 08 44
65 76 69 63 65 4F 53 12
06 31 34 2E 37 2E 31 0A
0F 0A 03 5F 73 69 18 B0
CD F0 D3 9F CA FD 91 72
12 14 43 61 72 64 44 65
74 61 69 6C 73 5F 48 6F
6D 65 5F 42 74 6E 18 95
AC E0 A1 BB 2F 20 BB DD
DB A1 BB 2F 12 60 0A 0F
0A 03 5F 73 69 18 B0 CD
F0 D3 9F CA FD 91 72 0A
08 0A 03 5F 65 74 18 8A
60 0A 25 0A 03 5F 73 63
12 1E 51 75 65 72 79 43
61 72 64 44 65 74 61 69
6C 73 56 69 65 77 43 6F
6E 74 72 6F 6C 6C 65 72
0A 0A 0A 02 5F 6F 12 04
61 75 74 6F 12 02 5F 65
18 A5 C7 E0 A1 BB 2F 20
A0 98 DE A1 BB 2F 12 57
0A 0F 0A 03 5F 73 69 18
B0 CD F0 D3 9F CA FD 91
72 0A 25 0A 03 5F 73 63
12 1E 51 75 65 72 79 43
61 72 64 44 65 74 61 69
6C 73 56 69 65 77 43 6F
6E 74 72 6F 6C 6C 65 72
0A 0A 0A 02 5F 6F 12 04
61 75 74 6F 12 03 5F 61
62 18 A6 C7 E0 A1 BB 2F
20 A1 98 DE A1 BB 2F 1A
0E 08 96 FC 81 F0 A8 2E
12 03 5F 66 69 20 01 1A
14 08 96 FC 81 F0 A8 2E
12 04 5F 66 6F 74 20 80
A5 88 F0 A8 2E 1A 13 08
A2 E8 BB A1 BB 2F 12 04
5F 73 69 64 20 DD 8A D1
89 06 1A 0F 08 E1 EB BB
A1 BB 2F 12 04 5F 73 6E
6F 20 0D 1A 11 08 CA C7
E0 A1 BB 2F 12 04 5F 6C
74 65 20 B4 9E 71 1A 10
08 CA C7 E0 A1 BB 2F 12
03 5F 73 65 20 F8 96 15
20 D4 C7 E0 A1 BB 2F 28
AB CB DF A1 BB 2F 30 A6
C7 E0 A1 BB 2F 38 A1 98
DE A1 BB 2F 42 03 69 6F
73 4A 06 31 34 2E 37 2E
31 52 0A 69 50 68 6F 6E
65 31 31 2C 36 5A 05 65
6E 2D 63 61 60 90 FE FF
FF FF FF FF FF FF 01 72
24 63 6F 6D 2E 6D 65 74
72 6F 6C 69 6E 78 2E 70
72 65 73 74 6F 2E 69 6F
73 2E 63 6F 6E 73 75 6D
65 72 61 70 70 82 01 05
32 2E 30 2E 37 88 01 E4
DB 03 90 01 E4 DB 03 A0
01 01 AA 01 20 34 32 41
42 43 45 32 46 31 36 32
36 34 35 44 43 39 37 31
42 31 42 43 42 38 39 45
44 36 33 34 32 B8 01 65
CA 01 23 31 3A 39 35 37
38 30 39 30 33 32 31 34
34 3A 69 6F 73 3A 33 35
31 65 61 36 32 38 37 31
35 62 39 64 64 37 D0 01
88 ED DD A1 BB 2F DA 01
24 30 35 32 35 30 37 36
33 2D 30 37 33 37 2D 34
35 39 34 2D 42 41 44 43
2D 36 30 34 44 46 31 44
42 30 31 45 30 F2 01 16
66 50 32 4F 71 39 33 31
77 30 79 6B 67 5A 54 6A
31 54 5A 75 2D 4D F8 01
01 98 02 8A D9 99 F8 DC
C9 F2 02 A2 03 04 47 31
2D 2D A8 03 05

Card sections :

00000000:
00000001:
00000002:
00000003:
00000004:
00000005:
00000006:
00000007:
00000008:
00000009:
0000000A:
0000000B:
0000000C:
0000000D:
0000000E:
0000000F:
00000010:
00000011:
00000012:
00000013:
00000014:
00000015:
00000016:
00000017:
00000018:
00000019:
0000001A:
0000001B:
0000001C:
0000001D:
0000001E:
0000001F:
00000020:
00000021:
00000022:
00000023:
00000024:
00000025:
00000026:
00000027:
00000028:
00000029:
0000002A:
0000002B:
0000002C:
0000002D:
0000002E:
0000002F:
00000030:
00000031:
00000032:
00000033:
00000034:
00000035:
00000036:
00000037:
00000038:
00000039:
0000003A:
0000003B:
0000003C:
0000003D:
0000003E:
0000003F:
00000040:
00000041:
00000042:
00000043:
00000044:
00000045:
00000046:
00000047:
00000048:
00000049:
0000004A:
0000004B:
0000004C:
0000004D:
0000004E:
0000004F:
00000050:
00000051:
00000052:
00000053:
00000054:
00000055:
00000056:
00000057:
00000058:
00000059:
0000005A:
0000005B:
0000005C:
0000005D:
0000005E:
0000005F:
00000060:
00000061:
00000062:
00000063:
00000064:
00000065:
00000066:
00000067:
00000068:
00000069:
0000006A:
0000006B:
0000006C:
0000006D:
0000006E:
0000006F:
00000070:
00000071:
00000072:
00000073:
00000074:
00000075:
00000076:
00000077:
00000078:
00000079:
0000007A:
0000007B:
0000007C:
0000007D:
0000007E:
0000007F:
00000080:
00000081:
00000082:
00000083:
00000084:
00000085:
00000086:
00000087:
00000088:
00000089:
0000008A:
0000008B:
0000008C:
0000008D:
0000008E:
0000008F:
00000090:
00000091:
00000092:
00000093:
00000094:
00000095:
00000096:
00000097:
00000098:
00000099:
0000009A:
0000009B:
0000009C:
0000009D:
0000009E:
0000009F:
000000A0:
000000A1:
000000A2:
000000A3:
000000A4:
000000A5:
000000A6:
000000A7:
000000A8:
000000A9:
000000AA:
000000AB:
000000AC:
000000AD:
000000AE:
000000AF:
000000B0:
000000B1:
000000B2:
000000B3:
000000B4:
000000B5:
000000B6:
000000B7:
000000B8:
000000B9:
000000BA:
000000BB:
000000BC:
000000BD:
000000BE:
000000BF:
000000C0:
000000C1:
000000C2:
000000C3:
000000C4:
000000C5:
000000C6:
000000C7:
000000C8:
000000C9:
000000CA:
000000CB:
000000CC:
000000CD:
000000CE:
000000CF:
000000D0:
000000D1:
000000D2:
000000D3:
000000D4:
000000D5:
000000D6:
000000D7:
000000D8:
000000D9:
000000DA:
000000DB:
000000DC:
000000DD:
000000DE:
000000DF:
000000E0:
000000E1:
000000E2:
000000E3:
000000E4:
000000E5:
000000E6:
000000E7:
000000E8:
000000E9:
000000EA:
000000EB:
000000EC:
000000ED:
000000EE:
000000EF:

iNeedHelpX

Contributor

From: Toronto Canada

Registered: 2019-12-28

Posts: 13

Re: Mifare Desfire ev1 MF3ICD41

and this is what hex says i think:

........
...._c..
....scre
enName..
QUERY.!.
.EventNa
me..NFC_
Query_Oc
currence
....Devi
ceOS..14
.7.1....
stageID.
.....act
ionRetry
Counter.
.....act
ionType.
.NFC_QUE
RY_SUCCE
SS....or
derId...
...platf
ormError
Code....
..cardId
......_o
..app...
.platfor
mErrorRe
sult....
..Device
Name..iP
hone..NF
C_Query_
Occurren
ce......
/ ...../
.......D
eviceOS.
.14.7.1.
(..Event
Name..Ch
eckBalan
ce_Succe
ss_Scree
n....Dev
iceName.
.iPhone.
..._o..a
pp....Sc
reenName
..EMPTY_
CARD_VIE
W..Check
Balance_
Success_
Screen..
..../ ..
.../....
...Devic
eOS..14.
7.1.+..E
ventName
..ViewPr
estoAcco
unt_NFCq
uery_Btn
....Devi
ceName..
iPhone..
.._o..ap
p....Scr
eenName.
.CARDDET
AILSSCRE
EN..View
PrestoAc
count_NF
Cquery_B
tn......
/.......
_c......
screenNa
me..QUER
Y.!..Eve
ntName..
NFC_Quer
y_Occurr
ence....
DeviceOS
..14.7.1
....stag
eID.....
.actionR
etryCoun
ter... .
.actionT
ype..SEE
SION_INV
ALIDATE.
...order
Id......
platform
ErrorCod
e.......
cardId..
...._o..
app.&..p
latformE
rrorResu
lt..Sess
ion time
out....D
eviceNam
e..iPhon
e..NFC_Q
uery_Occ
urrence.
...../ .
..../...
...._si.
........
r.!.._pc
..QueryC
ardTapVi
ewContro
ller.%..
_sc..Que
ryCardDe
tailsVie
wControl
ler...._
o..auto.
..._pi..
.......r
.._vs...
.../ ...
../.....
.._o..ap
p.!..Eve
ntName..
CardDeta
ils_Home
_Btn....
ScreenNa
me..HOME
SCREEN..
..Device
Name..iP
hone.%..
_sc..Que
ryCardDe
tailsVie
wControl
ler....D
eviceOS.
.14.7.1.
..._si..
.......r
..CardDe
tails_Ho
me_Btn..
..../ ..
.../.`..
.._si...
......r.
..._et..
`.%.._sc
..QueryC
ardDetai
lsViewCo
ntroller
...._o..
auto.._e
....../
...../.W
...._si.
........
r.%.._sc
..QueryC
ardDetai
lsViewCo
ntroller
...._o..
auto.._a
b....../
...../.
........
.._fi ..
........
.._fot .
........
...../..
_sid ...
........
../.._sn
o ......
.../.._l
te ..q..
....../.
._se ...
...../(
...../0.
..../8..
.../B.io
sJ.14.7.
1R.iPhon
e11,6Z.e
n-ca`...
.......r
$com.met
rolinx.p
resto.io
s.consum
erapp...
2.0.7...
........
.... 42A
BCE2F162
645DC971
B1BCB89E
D6342..e
..#1:957
80903214
4:ios:35
1ea62871
5b9dd7..
...../..
$0525076
3-0737-4
594-BADC
-604DF1D
B01E0...
fP2Oq931
w0ykgZTj
1TZu-M..
........
......G1
--...

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Mifare Desfire ev1 MF3ICD41

in the end of your last post...

42ABCE2F162645DC971B1BCB89ED6342  - 16bytes.   Might be a key for the desfire card?

iNeedHelpX

Contributor

From: Toronto Canada

Registered: 2019-12-28

Posts: 13

Re: Mifare Desfire ev1 MF3ICD41

in the end of your last post...

42ABCE2F162645DC971B1BCB89ED6342  - 16bytes.   Might be a key for the desfire card?

it could very well be. but I've yet to get this proxmark working on my computer. This is the proxmark I bought (hacker warehouse):

Last edited by iNeedHelpX (2021-09-05 20:03:34)