Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
#1 2020-05-05 19:11:59
- Monster1024
- Contributor
- Registered: 2020-05-05
- Posts: 33
Xiaomi Air Purifier
Didn't found topic for Xiaomi Air Purifier filters.
There is a tag at bottom of filter, that counts work hours.
It has an NTAG 213 144bytes (NT2H1311G0DU) format.
You can read password by sniffing Purifier's requests.
Get your tag id by using "hf search", than simulate your empty tag (hf 14a sim t 2 u <UID>), put your proxmark inside purifier, push "closed door sesor" button and power it on (you will see 100% filter remain message).
Use "hf list" to get your password.
Make backup dump ("hf mfu dump k <password>")
Than you can write zero's to 8 sector to get 100% remain.
"hf mfu wrbl b 8 d 00000000 k <PASSWORD>"
Purifier read blocks 4,5,6,7,8 from a tag.
Block 5 is "filter rfid product id" (mine is "00003033" -> 0:0:30:33).
Block 8 is work time/remain time.
Other blocks content is unknown for me.
p.s. calculator didn't calculate right password for this tag (My tag id 04A81D12DE5F80, pwd: dae55796; "hf mfu pwdgen" calcs for ev1(?): E14146FC)
Last edited by Monster1024 (2020-05-05 19:22:01)
Offline
#2 2020-05-06 06:51:59
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
Thats neat little hack of yours.
Its the first time I heard of this, so I am curious and I would need some more info for documentation.
In order to collect some more data from these kinds of tag. Would you mind running these command and share?
hf mfu info k dae55796
hf mfu dump k dae55796
hf 14a sim t 2 u 04A81D12DE5F80
trace save f Xiaomi_04A81D12DE5F80.traceThe keygen algo is unknown, so don't the output from pwdgen to generate a correct one for you.
Offline
#3 2020-05-06 10:10:08
- Monster1024
- Contributor
- Registered: 2020-05-05
- Posts: 33
Re: Xiaomi Air Purifier
For this moment I have following params readed by purifier:
filter hours used: 31
filter life remaining: 99%
filter rfid product id: 00:00:30:33
filter rfid tag: 80:5f:de:12:1d:a8:4
filter type: regular
Here is tag info and traces:
[usb] pm3 --> hf mfu info k dae55796
[=] --- Tag Information --------------------------
[=] -------------------------------------------------------------
[+] TYPE: NTAG 213 144bytes (NT2H1311G0DU)
[+] UID: 04 A8 1D 12 DE 5F 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] BCC0: 39 (ok)
[+] BCC1: 13 (ok)
[+] Internal: 48 (default)
[+] Lock: 00 00 - 00
[+] OneTimePad: E1 10 3E 00 - 2160
[=] --- NDEF Message
[+] Capability Container: E1 10 3E 00
[+] E1: NDEF Magic Number
[+] 10: version 0.1 supported by tag
[+] : Read access granted without any security / Write access granted without any security
[+] 3E: Physical Memory Size: 496 bytes
[+] 3E: NDEF Memory Size: 496 bytes
[+] Additional feature information
[+] 00
[+] 00000000
[+] xxx - 00: RFU (ok)
[+] x - 00: don't support special frame
[+] x - 00: don't support lock block
[+] xx - 00: RFU (ok)
[+] x - 00: IC don't support multiple block reads
[=] --- Tag Signature
[=] IC signature public key name: NXP NTAG21x (2013)
[=] IC signature public key value: 04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61
[=] Elliptic curve parameters: NID_secp128r1
[=] TAG IC Signature: 84A3053C856ADEAC9C0608BCDEB8554A460EB6ED684121E3EA10D58B02F818C8
[+] Signature verified: successful
[=] --- Tag Version
[=] Raw bytes: 00 04 04 02 01 00 0F 03
[=] Vendor ID: 04, NXP Semiconductors Germany
[=] Product type: 04, NTAG
[=] Product subtype: 02, 50pF
[=] Major version: 01
[=] Minor version: 00
[=] Size: 0F, (256 <-> 128 bytes)
[=] Protocol type: 03, ISO14443-3 Compliant
[=] --- Tag Configuration
[=] cfg0 [41/0x29]: 04 00 00 04
[=] - strong modulation mode disabled
[=] - page 4 and above need authentication
[=] cfg1 [42/0x2A]: C0 05 00 00
[=] - Unlimited password attempts
[=] - NFC counter disabled
[=] - NFC counter password protection enabled
[=] - user configuration permanently locked
[=] - read and write access is protected with password
[=] - 05, Virtual Card Type Identifier is default
[=] PWD [43/0x2B]: DA E5 57 96 - (cannot be read)
[=] PACK [44/0x2C]: 00 00 - (cannot be read)
[=] RFU [44/0x2C]: 00 00 - (cannot be read) [usb] pm3 --> hf mfu dump k dae55796
[+] TYPE: NTAG 213 144bytes (NT2H1311G0DU)
[+] Reading tag memory...
*special* data
DataType | Data | Ascii
----------+-------------------------+---------
Version | 00 04 04 02 01 00 0F 03 | ........
TBD | 00 00 | ..
TBD | 00 | .
Signature1| 84 A3 05 3C 85 6A DE AC 9C 06 08 BC DE B8 55 4A | ...<.j........UJ
Signature2| 46 0E B6 ED 68 41 21 E3 EA 10 D5 8B 02 F8 18 C8 | F...hA!.........
Counter0 | 00 00 00 | ...
Tearing0 | 00 | .
Counter1 | 00 00 00 | ...
Tearing1 | 00 | .
Counter2 | 00 00 00 | ...
Tearing2 | 00 | .
-------------------------------------------------------------
Block# | Data |lck| Ascii
---------+-------------+---+------
0/0x00 | 04 A8 1D 39 | | ...9
1/0x01 | 12 DE 5F 80 | | .._.
2/0x02 | 13 48 00 00 | | .H..
3/0x03 | E1 10 3E 00 | 0 | ..>.
4/0x04 | 00 00 4A 44 | 0 | ..JD
5/0x05 | 00 00 30 33 | 0 | ..03
6/0x06 | 00 18 12 18 | 0 | ....
7/0x07 | 00 00 76 09 | 0 | ..v.
8/0x08 | 94 BB 01 00 | 0 | ....
9/0x09 | 00 00 00 00 | 0 | ....
10/0x0A | 00 00 00 00 | 0 | ....
11/0x0B | 00 00 00 00 | 0 | ....
12/0x0C | 00 00 00 00 | 0 | ....
13/0x0D | 00 00 00 00 | 0 | ....
14/0x0E | 00 00 00 00 | 0 | ....
15/0x0F | 00 00 00 00 | 0 | ....
16/0x10 | 00 00 00 00 | 0 | ....
17/0x11 | 00 00 00 00 | 0 | ....
18/0x12 | 00 00 00 00 | 0 | ....
19/0x13 | 00 00 00 00 | 0 | ....
20/0x14 | 00 00 00 00 | 0 | ....
21/0x15 | 00 00 00 00 | 0 | ....
22/0x16 | 00 00 00 00 | 0 | ....
23/0x17 | 00 00 00 00 | 0 | ....
24/0x18 | 00 00 00 00 | 0 | ....
25/0x19 | 00 00 00 00 | 0 | ....
26/0x1A | 00 00 00 00 | 0 | ....
27/0x1B | 00 00 00 00 | 0 | ....
28/0x1C | 00 00 00 00 | 0 | ....
29/0x1D | 00 00 00 00 | 0 | ....
30/0x1E | 00 00 00 00 | 0 | ....
31/0x1F | 00 00 00 00 | 0 | ....
32/0x20 | 00 00 00 00 | 0 | ....
33/0x21 | 00 00 00 00 | 0 | ....
34/0x22 | 00 00 00 00 | 0 | ....
35/0x23 | 00 00 00 00 | 0 | ....
36/0x24 | 00 00 00 00 | 0 | ....
37/0x25 | 00 00 00 00 | 0 | ....
38/0x26 | 00 00 00 00 | 0 | ....
39/0x27 | 00 00 00 00 | 0 | ....
40/0x28 | 00 00 00 BD | 0 | ....
41/0x29 | 04 00 00 04 | 0 | ....
42/0x2A | C0 05 00 00 | 0 | ....
43/0x2B | DA E5 57 96 | 0 | ..W.
44/0x2C | 00 00 00 00 | 0 | ....
---------------------------------
[=] Using UID as filename
[+] saved 236 bytes to binary file hf-mfu-04A81D12DE5F80-dump.bin
[+] saved to json file hf-mfu-04A81D12DE5F80-dump.json [usb] pm3 --> hf list
[+] Recorded activity (trace len = 372 bytes)
[=] Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
[=] ISO14443A - All times are in carrier periods (1/13.56MHz)
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 1056 | Rdr |26 | | REQA
2228 | 4596 | Tag |44 00 | |
419818 | 422282 | Rdr |93 20 | | ANTICOLL
423454 | 429278 | Tag |88 04 a8 1d 39 | |
839624 | 850152 | Rdr |93 70 88 04 a8 1d 39 bb 3b | ok | SELECT_UID
851324 | 854844 | Tag |04 da 17 | |
1286526 | 1288990 | Rdr |95 20 | | ANTICOLL-2
1290162 | 1296050 | Tag |12 de 5f 80 13 | |
1706296 | 1716760 | Rdr |95 70 12 de 5f 80 13 51 12 | ok | SELECT_UID-2
1717996 | 1721580 | Tag |00 fe 51 | |
2112566 | 2120726 | Rdr |1b da e5 57 96 70 88 | ok | PWD-AUTH KEY: 0xdae55796
2123114 | 2127850 | Tag |ab da 20 2c | |
2518840 | 2523544 | Rdr |30 04 26 ee | ok | READBLOCK(4)
2527084 | 2547948 | Tag |00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 49 | ok |
2938678 | 2943382 | Rdr |30 05 af ff | ok | READBLOCK(5)
2946922 | 2967786 | Tag |00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 49 | ok |
3358548 | 3363316 | Rdr |30 06 34 cd | ok | READBLOCK(6)
3366600 | 3387464 | Tag |00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 49 | ok |
3778338 | 3783106 | Rdr |30 07 bd dc | ok | READBLOCK(7)
3786582 | 3807446 | Tag |00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 49 | ok |
4198106 | 4202810 | Rdr |30 08 4a 24 | ok | READBLOCK(8)
4206350 | 4227214 | Tag |00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 49 | ok |Here is dumps and trace file:
https://github.com/monster1025/fileshar … .trace.bin
https://github.com/monster1025/fileshar … 0-dump.bin
https://github.com/monster1025/fileshar … -dump.json
Last edited by Monster1024 (2020-05-06 10:26:11)
Offline
#4 2020-05-06 10:34:32
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
Cool, it also has a NDEF container. But the data doesn't look like it has. Nevertheless, try the following.
hf mfu ndefAnd do you have more that one tag?
for the keygen algo, we would need you to simulate specific UIDs' and collect their pwds.
UID pattern:
00 00 00 00 00 00 00
00 00 00 00 00 00 01
00 00 00 00 00 00 02
00 00 00 00 00 00 04
00 00 00 00 00 00 08
00 00 00 00 00 00 10
00 00 00 00 00 00 20
00 00 00 00 00 00 30
00 00 00 00 00 00 40
....
FF FF FF FF FF FF FFOffline
#5 2020-05-06 10:41:34
- Monster1024
- Contributor
- Registered: 2020-05-05
- Posts: 33
Re: Xiaomi Air Purifier
Hmm.. It didn't answer or can't read/parse ndef:
[usb] pm3 --> hf mfu ndef -k dae55796
[=] --- NDEF Message
[+] Capability Container: E1 10 3E 00
[+] E1: NDEF Magic Number
[+] 10: version 0.1 supported by tag
[+] : Read access granted without any security / Write access granted without any security
[+] 3E: Physical Memory Size: 496 bytes
[+] 3E: NDEF Memory Size: 496 bytes
[+] Additional feature information
[+] 00
[+] 00000000
[+] xxx - 00: RFU (ok)
[+] x - 00: don't support special frame
[+] x - 00: don't support lock block
[+] xx - 00: RFU (ok)
[+] x - 00: IC don't support multiple block reads
[=] Tag reported size vs NDEF reported size mismatch. Using smallest value
[=]
[=] NDEF parsing
[=] -----------------------------------------------------
[+] -- NDEF NULL block.
[=] -----------------------------------------------------
[!!] ? unknown tag 0x4a
[usb] pm3 --> hf mfu ndef
[=] --- NDEF Message
[+] Capability Container: E1 10 3E 00
[+] E1: NDEF Magic Number
[+] 10: version 0.1 supported by tag
[+] : Read access granted without any security / Write access granted without any security
[+] 3E: Physical Memory Size: 496 bytes
[+] 3E: NDEF Memory Size: 496 bytes
[+] Additional feature information
[+] 00
[+] 00000000
[+] xxx - 00: RFU (ok)
[+] x - 00: don't support special frame
[+] x - 00: don't support lock block
[+] xx - 00: RFU (ok)
[+] x - 00: IC don't support multiple block reads
[=] Tag reported size vs NDEF reported size mismatch. Using smallest value
[!!] ? Error: tag didn't answer to READ >And do you have more that one tag?
No, I have only one - but I can simulate multiple ids with proxmark and get passwords from purifier.
How many do you need?
Special ids or random?
Last edited by Monster1024 (2020-05-06 10:45:04)
Offline
#6 2020-05-06 11:37:50
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
See my previous post for uid patterns
Offline
#7 2020-05-06 12:36:52
- Monster1024
- Contributor
- Registered: 2020-05-05
- Posts: 33
Re: Xiaomi Air Purifier
made some readings.
When 1 byte is not specified - algo get "default" password (0x90de545e).
00000000000000 - 0x90de545e - ab 90 7e c1
00000000000001 - 0x90de545e - ab 90 7e c1
00000000000004 - 0x90de545e - ab 90 7e c1
000000000000F8 - 0x90de545e - ab 90 7e c1
000000000011F8 - 0x90de545e - ab 90 7e c1
000000000111F8 - 0x90de545e - ab 90 7e c1
000000001111F8 - 0x90de545e - ab 90 7e c1
000000011111F8 - 0x90de545e - ab 90 7e c1
000000111111F8 - 0x90de545e - ab 90 7e c1
000001111111F8 - 0x90de545e - ab 90 7e c1
000011111111F8 - 0x90de545e - ab 90 7e c1
011011111111F8 - 0xe0311bd1 - ab e0 f9 b2
000111111111F8 - 0x90de545e - ab 90 7e c1
001111111111F8 - 0x90de545e - ab 90 7e c1
011111111111F8 - 0x1a7a788f - ab 1a 2c ea
021111111111F8 - 0x65496bd6 - ab 65 5c 61
041111111111F8 - 0xd26e63cf - ab d2 68 a0
141111111111F8 - 0xced4b30f - ab ce 85 7a
141111111112F8 - 0x05a05603 - ab 05 5a 02
010000000000F4 - 0xe640b665 - ab e6 cf d7
01000000000114 - 0xcb07a949 - ab cb 28 2d
020000000001F8 - 0xe1927aa3 - ab e1 70 a3
22222222222222 - 0x7041057d - ab 70 70 26
----
10000000000000 - 0x32b7a568 - ab 32 66 47
20000000000000 - 0x1d1155aa - ab 1d 93 9e
40000000000000 - 0x90de545e - ab 90 7e c1
80000000000000 - 0x90de545e - ab 90 7e c1
01000000000000 - 0x042aabc9 - ab 04 d3 13
02000000000000 - 0x9e89bab3 - 30 04 26 ee
04000000000000 - 0xc78ba898 - ab c7 44 e7
08000000000000 - 0x7b0e246e - ab 7b a3 98
00100000000000 - 0x90de545e - ab 90 7e c1
00200000000000 - 0x90de545e - ab 90 7e c1
00400000000000 - 0x90de545e - ab 90 7e c1
00800000000000 - 0x90de545e - ab 90 7e c1
00010000000000 - 0x90de545e - ab 90 7e c1
01010000000000 - 0xc6dc60f7 - ab c6 cd f6
01020000000000 - 0xf17bae8d - ab f1 f1 b3
01040000000000 - 0x4a6f1dc2 - ab 4a a9 b8
01080000000000 - 0x7bfc436d - ab 7b a3 98
01001000000000 - 0x2d09ce89 - ab 2d 10 af
01002000000000 - 0x9693521b - ab 96 48 a4
01004000000000 - 0xd6fe7dda - ab d6 4c e6
01008000000000 - 0x70dded0f - ab 70 70 26
01000100000000 - 0xfdb1bc02 - ab fd 9d 79
01000200000000 - 0x8d40e753 - ab 8d 1a 0a
01000400000000 - 0x9827d18a - ab 98 36 4d
01000800000000 - 0x5781ea66 - ab 57 cd 73
01000010000000 - 0x03bec653 - ab 03 6c 67
01000020000000 - 0x33873f21 - ab 33 ef 56
01000040000000 - 0x4db37b43 - ab 4d 16 cc
01000080000000 - 0x65e5834c - ab 65 5c 61
01000001000000 - 0x9b98576d - ab 9b ad 7f
01000002000000 - 0x8dab78dc - ab 8d 1a 0a
01000004000000 - 0x11d6ed66 - ab 11 ff 54
01000008000000 - 0x5402a296 - ab 54 56 41
01000000100000 - 0x84e3e24b - ab 84 db 97
01000000200000 - 0x8b3556ce - ab 8b 2c 6f
01000000400000 - 0xfb8ea7db - ab fb ab 1c
01000000800000 - 0x3c87fd31 - ab 3c 18 ae
01000000010000 - 0xa1abe04f - ab a1 74 e1
01000000020000 - 0x0b1a0349 - ab 0b 24 eb
01000000040000 - 0x3ae5e3a3 - ab 3a 2e cb
01000000080000 - 0xb4feb020 - ab b4 58 a6
01000000001000 - 0xe029abee - ab e0 f9 b2
01000000002000 - 0xfb3e913e - ab fb ab 1c
01000000004000 - 0x1daf31d7 - ab 1d 93 9e
01000000008000 - 0x9d0e4388 - ab 9d 9b 1a
01000000000100 - 0x972ae659 - ab 97 c1 b5
01000000000200 - 0xa51f93a9 - ab a5 50 a7
01000000000400 - 0x7f124803 - ab 7f 87 de
01000000000800 - 0xef6d2f43 - ab ef 0e 4a
01000000000010 - 0xf6cba95a - ab f6 4e c7
01000000000020 - 0x160e2786 - ab 16 40 20
01000000000040 - 0xc45f47c2 - ab c4 df d5
01000000000080 - 0x25415f9c - ab 25 58 23
01000000000001 - 0x71949360 - ab 71 f9 37
01000000000002 - 0x6663ef3b - ab 66 c7 53
01000000000004 - 0x73dce7af - ab 73 eb 14
01000000000008 - 0x7687b546 - ab 76 46 43Last edited by Monster1024 (2020-05-07 09:53:16)
Offline
#8 2020-05-06 13:58:28
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
lets go through the need basic pattern first.
hf 14a sim t 2 u %s
---------------------------------
0000000000000001
0000000000000002
0000000000000004
0000000000000008
0000000000000010
0000000000000020
0000000000000040
0000000000000080
0000000000000100
0000000000000200
0000000000000400
0000000000000800
0000000000001000
0000000000002000
0000000000004000
0000000000008000
0000000000010000
0000000000020000
0000000000040000
0000000000080000
0000000000100000
0000000000200000
0000000000400000
0000000000800000
0000000001000000
0000000002000000
0000000004000000
0000000008000000
0000000010000000
0000000020000000
0000000040000000
0000000080000000
0000000100000000
0000000200000000
0000000400000000
0000000800000000
0000001000000000
0000002000000000
0000004000000000
0000008000000000
0000010000000000
0000020000000000
0000040000000000
0000080000000000
0000100000000000
0000200000000000
0000400000000000
0000800000000000
0001000000000000
0002000000000000
0004000000000000
0008000000000000
0010000000000000
0020000000000000
0040000000000000
0080000000000000
0100000000000000
0200000000000000
0400000000000000
0800000000000000
1000000000000000
2000000000000000
4000000000000000
8000000000000000Offline
#9 2020-05-06 15:00:18
- Monster1024
- Contributor
- Registered: 2020-05-05
- Posts: 33
Re: Xiaomi Air Purifier
When first 2 "chars" are 00 - password is always 90de545e.
Example:
Variants from
0000000000000001
0000000000000002
...
to
0080000000000000
will always returns password "90de545e"
First "meaningful" id is 0100000000000000, that's why I started to check with "01" in first two chars.
Will post all results little bit later.
Offline
#10 2020-05-06 15:58:25
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
I see.
The drastic changes from 1bit changes is an indicator that some kind of hash/crypto is being used behind.
So lets continue with what you started, collect the uid pattern from above but with 0x01.
01 xx xx xx xx xx xx
Offline
#11 2020-05-06 21:04:05
- Monster1024
- Contributor
- Registered: 2020-05-05
- Posts: 33
Re: Xiaomi Air Purifier
Done. Updated post #7.
Last edited by Monster1024 (2020-05-06 21:47:43)
Offline
#12 2020-05-07 09:22:08
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
Great,
Would you mind collecting the PACK aswell? To see if its static of dynamic aswell.
2112566 | 2120726 | Rdr |1b da e5 57 96 70 88 | ok | PWD-AUTH KEY: 0xdae55796
2123114 | 2127850 | Tag |ab da 20 2c -->> PACK 0xAB DA[edit] ...if you have more than one original filter. I know that when we simulate, we don't use the right PACK.
Does the air purifier continue and read the whole simulated tag? Or does it stop when it gets the wrong PACK?
Offline
#13 2020-05-07 10:00:14
- Monster1024
- Contributor
- Registered: 2020-05-05
- Posts: 33
Re: Xiaomi Air Purifier
Collected PACKS from logfiles aswell (great that we have a logfiles by default in client application 
).
But as you mentioned above - it is proxmark 'calculated/simulated' pack value.
I have only one original filter and I cannot 'sniff' traffic between purifier and filter, because proxmark physically not fit when filter installed;
so I don't know how to get filter's original pack value (maybe interact as a reader for filter's tag?).
>Does the air purifier continue and read the whole simulated tag? Or does it stop when it gets the wrong PACK?
Yes, it continue reading data for simulated tags (and continue read blocks data for 'wrong/calculated' PACK).
Also, it didn't stop reading when got zeroes in all readed blocks (empty/clean tag).
Last edited by Monster1024 (2020-05-07 10:15:41)
Offline
#14 2020-05-07 10:19:49
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
Cool, this is still a good basis for a lua-script. Reading a filter, presenting the data, reset the data etc.
Offline
#15 2020-05-17 17:13:17
- hayabusa
- Contributor
- From: Australia
- Registered: 2019-08-27
- Posts: 12
Re: Xiaomi Air Purifier
Hi
I also tried and can get 100% from 0% of filter
my UID is 04 5D 81 72 62 60 80
and
my pwd is 0xbe26be3f
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 1056 | Rdr |26 | | REQA
2228 | 4596 | Tag |44 00 | |
419202 | 421666 | Rdr |93 20 | | ANTICOLL
422838 | 428662 | Tag |88 04 5d 81 50 | |
838422 | 848886 | Rdr |93 70 88 04 5d 81 50 08 c0 | ok | SELECT_UID
850122 | 853642 | Tag |04 da 17 | |
1284736 | 1287200 | Rdr |95 20 | | ANTICOLL-2
1288372 | 1294196 | Tag |72 62 60 80 f0 | |
1703936 | 1714400 | Rdr |95 70 72 62 60 80 f0 b6 5c | ok | SELECT_UID-2
1715636 | 1719220 | Tag |00 fe 51 | |
2109626 | 2117850 | Rdr |1b be 26 be 3f cc 80 | ok | PWD-AUTH KEY: 0xbe26be3f
2120046 | 2124718 | Tag |ab be 02 09 | |
3488990 | 3490046 | Rdr |26 | | REQA
3491218 | 3493586 | Tag |44 00 | |
3908190 | 3910654 | Rdr |93 20 | | ANTICOLL
3911826 | 3917650 | Tag |88 04 5d 81 50 | |
4327390 | 4337854 | Rdr |93 70 88 04 5d 81 50 08 c0 | ok | SELECT_UID
4339090 | 4342610 | Tag |04 da 17 | |
4773704 | 4776168 | Rdr |95 20 | | ANTICOLL-2
4777340 | 4783164 | Tag |72 62 60 80 f0 | |
5192924 | 5203388 | Rdr |95 70 72 62 60 80 f0 b6 5c | ok | SELECT_UID-2
5204624 | 5208208 | Tag |00 fe 51 | |
5598678 | 5606902 | Rdr |1b be 26 be 3f cc 80 | ok | PWD-AUTH KEY: 0xbe26be3f
5609034 | 5613706 | Tag |ab be 02 09 | |
Offline
#16 2020-05-17 17:22:48
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
Great!
So far it looks like a simple PACK algo.
PACK = 0xAB PWD[0]
UID | PWD | PACK
----------------------+-------------+-----------
04 A8 1D 12 DE 5F 80 | da e5 57 96 | ab da
04 5D 81 72 62 60 80 | be 26 be 3f | ab beOffline
#17 2021-11-04 18:59:15
- mistalowalowa
- Contributor
- Registered: 2021-11-03
- Posts: 2
Re: Xiaomi Air Purifier
Hey guys, my UID is 04:CA:B2:2A:33:70:80
Could anyone generate my tag password? Would be super nice, I don't have my proxmark yet, trying to unlock the tag with my android phone.
Thanks!
Offline
#18 2022-01-23 14:33:02
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
Ok, since the pwdgen algo was identified by Doegox, it has already been implemented into the pm3 client.
hf mfu pwdgen --uid 04CAB22A337080
gives
8345CF3DOffline
#19 2023-09-11 16:05:46
- Vitaliy86
- Contributor
- Registered: 2021-04-11
- Posts: 5
Re: Xiaomi Air Purifier
Del
Last edited by Vitaliy86 (2023-09-11 21:59:28)
Offline
#20 2023-09-11 16:34:31
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
see if you can collect UID/PWD samples.
Offline
#21 2023-09-11 17:02:47
- Vitaliy86
- Contributor
- Registered: 2021-04-11
- Posts: 5
Re: Xiaomi Air Purifier
Xiaomi Mi Air Purifier A1 (MJXFJ-150-A1)
Last edited by Vitaliy86 (2023-09-23 06:09:55)
Offline
#22 2023-09-11 17:04:11
- Vitaliy86
- Contributor
- Registered: 2021-04-11
- Posts: 5
Re: Xiaomi Air Purifier
..
Last edited by Vitaliy86 (2023-09-23 06:10:19)
Offline
#23 2023-09-17 02:10:46
- Vitaliy86
- Contributor
- Registered: 2021-04-11
- Posts: 5
Re: Xiaomi Air Purifier
see if you can collect UID/PWD samples.
Need more samples?
Offline
#24 2023-09-17 10:08:42
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Xiaomi Air Purifier
yes,
need to collect all UID / PWD / PACK.
simulate with a uid of all zeros. then make a one bit change across the uid and collect all pwd/pack.
Offline
#25 2024-02-14 15:46:56
- sarange
- Contributor
- Registered: 2024-02-10
- Posts: 2
Re: Xiaomi Air Purifier
Hey guys,
If you are still interested about the PACK that the real tag gives, I think I got it. I can only read either the reader or the tag at any given time because I can't put the proxmark in between.
TAG:
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 2368 | Tag |44 00 | |
154208 | 160096 | Tag |88 04 84 5a 52 | |
341696 | 345216 | Tag |04 da 17 | |
487776 | 493600 | Tag |52 a1 70 80 03 | |
667136 | 670720 | Tag |00 fe 51 | |
872496 | 877168 | Tag |00 00 a0 1e | |
1007600 | 1028400 | Tag |00 00 41 50 00 00 31 31 00 21 03 27 00 31 73 66 2b fa | |
1270160 | 1291024 | Tag |00 00 31 31 00 21 03 27 00 31 73 66 56 80 4f 01 4e 2f | |
1432512 | 1453312 | Tag |00 21 03 27 00 31 73 66 56 80 4f 01 00 00 00 00 ce db | |
1595216 | 1616016 | Tag |00 31 73 66 56 80 4f 01 00 00 00 00 00 00 00 00 32 f0 | |
1757920 | 1778784 | Tag |56 80 4f 01 00 00 00 00 00 00 00 00 00 00 00 00 bd a4 | | Reader:
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 1056 | Rdr |26 | |
151280 | 153744 | Rdr |93 20 | |
318656 | 329120 | Rdr |93 70 88 04 84 5a 52 98 4b | |
471488 | 473952 | Rdr |95 20 | |
644096 | 654624 | Rdr |95 70 52 a1 70 80 03 b2 62 | |
851712 | 859936 | Rdr |1b 8a 7f 5f 60 1c fb | |
990320 | 995024 | Rdr |30 04 26 ee | |
1252544 | 1257248 | Rdr |30 05 af ff | |
1415248 | 1420016 | Rdr |30 06 34 cd | |
1577936 | 1582704 | Rdr |30 07 bd dc | |
1740640 | 1745344 | Rdr |30 08 4a 24 | | So the PACK is most likely 0000a01e here. The UID of the tag is 04845A52A17080 and the password is 8a7f5f60.
As for simulating the UIDs and getting the trace, I am not sure if it's feasible becasue the reader initiates a connection only once. After that, you need to "simulate" the back cover being opened, then closed and the power button needs to be pressed again.
If anyone wants to collect the above info for their tag:
Tag: put the proxmark inside the filter and fit it inside the purfier.
Reader: put the filter beneath the purifier with the tag pointed up, and the proxmark inside the purifier.
Also, block 6 for me is 00210327, so I speculate that maybe it's the production date in the form "00YYMMDD".
Offline
Pages: 1