MAgic Cards can´t read sector 0

drakospart · 2016-02-26 19:42:44

I have got few magic cards from china. I changed UID with proxmark, but when I try read sector 0, it says not valid key.
I can read all sectors with FFFFFFFFFFFF key, but not luck with sector 0.
Any one has any idea about it?

iceman · 2016-02-26 19:44:49

// are you running the latest code from GitHub?
// Your magic tag, is it a generation 1 or 2 ?
// can you post tracelist, commands you ran, output here ?

drakospart · 2016-02-27 20:52:10

proxmark3> hw ver
[[[ Cached information ]]]

Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-11-19 10:08:02
os: /-suspect 2015-11-19 10:08:09
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8

uC: AT91SAM7S256 Rev B
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 169916 bytes (65%). Free: 922
28 bytes (35%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory

proxmark3> hw tune

Measuring antenna characteristics, please wait

....#db# DownloadFPGA(len: 42096)

# LF antenna: 0.00 V @ 125.00 kHz
# LF antenna: 0.00 V @ 134.00 kHz
# LF optimal: 0.00 V @ 12000.00 kHz
# HF antenna: 16.52 V @ 13.56 MHz
# Your LF antenna is unusable.

proxmark3> hf mf cgetblk 0
--block number: 0
#db# wupC1 error
Can't read block. error=2

proxmark3> hf list 14a
Recorded Activity (TraceLen = 20 bytes)

Start = Start of Start Bit, End = End of last modulation. Src = Source of Transf
er
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate

Start | End | Src | Data (! denotes parity error)
| CRC | Annotation |
------------|------------|-----|------------------------------------------------
-----------------|-----|--------------------|
0 | 992 | Rdr | 40
| | MAGIC WUPC1
2116 | 2820 | Tag | 15
| |

drakospart · 2016-02-27 21:22:57

| |
proxmark3> hf mf csetblk 0 d0a5e8e77a980200648f45915d101311
--block number: 0 data:d0 a5 e8 e7 7a 98 02 00 64 8f 45 91 5d 10 13 11

#db# wupC1 error
Can't write block. error=2
proxmark3> hf list 14a
Recorded Activity (TraceLen = 20 bytes)

Start = Start of Start Bit, End = End of last modulation. Src = Source of Transf
er
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate

Start | End | Src | Data (! denotes parity error)
| CRC | Annotation |
------------|------------|-----|------------------------------------------------
-----------------|-----|--------------------|
0 | 992 | Rdr | 40
| | MAGIC WUPC1
58628 | 58820 | Tag | 01

iceman · 2016-02-27 21:43:46

If you do a "hf 14a read" and print here

drakospart · 2016-02-27 21:50:09

proxmark3> hf 14a read
UID : 00 01 81 02
ATQA : 00 04
SAK : 00 [2]
iso14443a card select failed
TYPE : MIFARE Ultralight (MF0ICU1) <magic>
#db# Multiple tags detected. Collision after Bit 4
proxmark3> hf 14a read
iso14443a card select failed
proxmark3> hf 14a read
#db# Multiple tags detected. Collision after Bit 2
iso14443a card select failed

proxmark3> hf 14a read
#db# Multiple tags detected. Collision after Bit 6
UID : 40 00 00 00
ATQA : 10 09
SAK : 00 [2]
#db# Multiple tags detected. Collision after Bit 17
Tag is not Ultralight | NTAG | MY-D [ATQA: 20 10 SAK: 00]

TYPE : MIFARE Ultralight (MF0ICU1) <magic>
#db# Multiple tags detected. Collision after Bit 13
proprietary non iso14443-4 card found, RATS not supported
#db# halt error. response len: 1
Answers to chinese magic backdoor commands: NO

proxmark3> hf 14a read
#db# Multiple tags detected. Collision after Bit 15
iso14443a card select failed
proxmark3> hf 14a read
Card doesn't support standard iso14443-3 anticollision
ATQA : 00 00

proxmark3> hf 14a read
#db# Multiple tags detected. Collision after Bit 4
UID : 10 00 00 00
ATQA : 00 14
SAK : 00 [2]
iso14443a card select failed
TYPE : MIFARE Ultralight (MF0ICU1) <magic>
#db# Multiple tags detected. Collision after Bit 13

drakospart · 2016-02-27 21:51:14

same position, about 1 cm from antenna. There arent tags near.. only this this one. I tested also put the tag over the antenna, but always i get random results

iceman · 2016-02-27 22:30:15

which pm3 device did you buy? The standard older model (greenish)
or the newer rdv2.0 from elechouse?

The older models seem to have an issue with some changes to the fpga firmware done 1year ago. But if you re-compile the armsource with a older fpga_hf.bit file and flash it, then it works again.

Not say this is your issue, but you have an problem with getting a good read out from your tag. Which would explain why you have problems with running other commands against it.

drakospart · 2016-02-28 06:47:11

YOU ARE RIGHT ICEMAN

proxmark3> hf 14a read
ATQA : 00 04
UID : 01 02 03 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: YES

proxmark3> hw ver
#db# Prox/RFID mark3 RFID instrument
#db# bootrom: /-suspect 2015-03-21 05:16:56
#db# os: /-suspect 2015-03-21 05:17:31
#db# HF FPGA image built on 2015/03/09 at 08:41:42
uC: AT91SAM7S256 Rev B
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory

Proxmark3 community

Announcement

#1 2016-02-26 19:42:44

MAgic Cards can´t read sector 0

#2 2016-02-26 19:44:49

Re: MAgic Cards can´t read sector 0

#3 2016-02-27 20:52:10

Re: MAgic Cards can´t read sector 0

#4 2016-02-27 21:22:57

Re: MAgic Cards can´t read sector 0

#5 2016-02-27 21:43:46

Re: MAgic Cards can´t read sector 0

#6 2016-02-27 21:50:09

Re: MAgic Cards can´t read sector 0

#7 2016-02-27 21:51:14

Re: MAgic Cards can´t read sector 0

#8 2016-02-27 22:30:15

Re: MAgic Cards can´t read sector 0

#9 2016-02-28 06:47:11

Re: MAgic Cards can´t read sector 0

Board footer