Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
#1 2012-02-15 20:33:04
- axxe
- Member
- Registered: 2012-02-15
- Posts: 7
Mifare UltraLight - command Set request
Hi,
anybody knows where I may find a complete command-set for mifare ultralight tags?
Any link to any docs?
Thanks!
Offline
#2 2012-02-20 10:52:58
- axxe
- Member
- Registered: 2012-02-15
- Posts: 7
Re: Mifare UltraLight - command Set request
Solved,
I've found some NXP datasheet about ultraLight and ultraLight C tags like this: http://www.nxp.com/documents/short_data_sheet/MF0ICU2_SDS.pdf
where i've found all the informations I need.
Another question is:
due the fact that the ATQA and SAK of the ultraLight tag are identical as for the ultraLight C tag, which is the fastest way to recognize them? trying to read on a user memory address out of ultraLight bound (over 0x0F)?
thanks 
Offline
#3 2012-02-20 13:25:38
- rule
- Member
- Registered: 2008-05-21
- Posts: 417
Re: Mifare UltraLight - command Set request
You could try to send
1A 00 crc1 crc2Only the Ultralight C will answer with authentication info
AF ...Cheers,
Roel
Offline
#4 2012-02-20 13:34:54
- axxe
- Member
- Registered: 2012-02-15
- Posts: 7
Re: Mifare UltraLight - command Set request
Thanks for the suggestion roel!
Offline
#5 2012-05-04 16:02:45
- rule
- Member
- Registered: 2008-05-21
- Posts: 417
Re: Mifare UltraLight - command Set request
You can just regular 14443 type A crc.
Offline