Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2017-07-24 13:35:58

speedlimits
Contributor
Registered: 2017-06-28
Posts: 31

MIFARE Ultralight C mod

Hi all,

i like to fine out if i can change the info on the sectors (blocs) on this card .

info card :

--- Tag Information ---------
-------------------------------------------------------------
      TYPE : MIFARE Ultralight C (MF0ULC)
#db# ISO14443A Timeout set to 1050 (9ms)
       UID : 04 34 5a 42 eb 4b 80
    UID[0] : 04, NXP Semiconductors Germany
      BCC0 : E2, Ok
      BCC1 : 62, Ok
  Internal : 48, default
      Lock : 00 00  - 0000000000000000
OneTimePad : 00 00 00 00  - 00000000000000000000000000000000
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  04 34 5A E2 42 EB 4B 80 62 48 00 00 00 00 00 00  .4ZâBëK€bH......
00000010  02 00 00 10 00 06 01 10 11 FF 00 00 00 00 00 00  .........ÿ......
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000070  FF FF FF FF 32 00 00 00 2C 01 00 00 32 00 00 00  ÿÿÿÿ2...,...2....
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass    - Timings are not as accurate

      Start |        End | Src | Data (! denotes parity error)                                   | CRC | Annotation         |
------------|------------|-----|-----------------------------------------------------------------|-----|--------------------|
          0 |        992 | Rdr | 52                                                              |     | WUPA
       2244 |       4612 | Tag | 44  00                                                          |     |
       7040 |       9504 | Rdr | 93  20                                                          |     | ANTICOLL
      10692 |      16516 | Tag | 88  04  34  5a  e2                                              |     |
      18816 |      29280 | Rdr | 93  70  88  04  34  5a  e2  51  74                              |  ok | SELECT_UID
      30532 |      34052 | Tag | 04  da  17                                                      |     |
      35328 |      37792 | Rdr | 95  20                                                          |     | ANTICOLL-2
      38980 |      44868 | Tag | 42  eb  4b  80  62                                              |     |
      47104 |      57632 | Rdr | 95  70  42  eb  4b  80  62  6c  c1                              |  ok | ANTICOLL-2
      58820 |      62404 | Tag | 00  fe  51                                                      |     |
      66048 |      70816 | Rdr | 30  00  02  a8                                                  |  ok | READBLOCK(0)
      72004 |      92868 | Tag | 04  34  5a  e2  42  eb  4b  80  62  48  00  00  00  00  00  00  |     |
            |            |     | e9  d9                                                          |  ok |
     106240 |     111008 | Rdr | 30  01  8b  b9                                                  |  ok | READBLOCK(1)
     112196 |     133060 | Tag | 42  eb  4b  80  62  48  00  00  00  00  00  00  02  00  00  10  |     |
            |            |     | b5  64                                                          |  ok |
     146432 |     151136 | Rdr | 30  02  10  8b                                                  |  ok | READBLOCK(2)
     152388 |     173252 | Tag | 62  48  00  00  00  00  00  00  02  00  00  10  00  06  01  10  |     |
            |            |     | 6a  2a                                                          |  ok |
     186624 |     191328 | Rdr | 30  03  99  9a                                                  |  ok | READBLOCK(3)
     192580 |     213444 | Tag | 00  00  00  00  02  00  00  10  00  06  01  10  11  ff  00  00  |     |
            |            |     | 57  45                                                          |  ok |
     226816 |     231520 | Rdr | 30  04  26  ee                                                  |  ok | READBLOCK(4)
     232772 |     253636 | Tag | 02  00  00  10  00  06  01  10  11  ff  00  00  00  00  00  00  |     |
            |            |     | 70  75                                                          |  ok |
     267008 |     271712 | Rdr | 30  05  af  ff                                                  |  ok | READBLOCK(5)
     272964 |     293764 | Tag | 00  06  01  10  11  ff  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | f0  95                                                          |  ok |
     307200 |     311968 | Rdr | 30  06  34  cd                                                  |  ok | READBLOCK(6)
     313156 |     334020 | Tag | 11  ff  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | e0  8c                                                          |  ok |
     347392 |     352160 | Rdr | 30  07  bd  dc                                                  |  ok | READBLOCK(7)
     353348 |     374212 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     387584 |     392288 | Rdr | 30  08  4a  24                                                  |  ok | READBLOCK(8)
     393540 |     414404 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     427776 |     432480 | Rdr | 30  09  c3  35                                                  |  ok | READBLOCK(9)
     433732 |     454596 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     467968 |     472736 | Rdr | 30  0a  58  07                                                  |  ok | READBLOCK(10)
     473924 |     494788 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     508160 |     512928 | Rdr | 30  0b  d1  16                                                  |  ok | READBLOCK(11)
     514116 |     534980 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     548352 |     553120 | Rdr | 30  0c  6e  62                                                  |  ok | READBLOCK(12)
     554308 |     575172 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     588544 |     593312 | Rdr | 30  0d  e7  73                                                  |  ok | READBLOCK(13)
     594500 |     615364 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     628736 |     633440 | Rdr | 30  0e  7c  41                                                  |  ok | READBLOCK(14)
     634692 |     655556 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     668928 |     673632 | Rdr | 30  0f  f5  50                                                  |  ok | READBLOCK(15)
     674884 |     695748 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     709120 |     713824 | Rdr | 30  10  83  b8                                                  |  ok | READBLOCK(16)
     715076 |     735940 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     749312 |     754016 | Rdr | 30  11  0a  a9                                                  |  ok | READBLOCK(17)
     755268 |     776132 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     789504 |     794272 | Rdr | 30  12  91  9b                                                  |  ok | READBLOCK(18)
     795460 |     816324 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     829696 |     834464 | Rdr | 30  13  18  8a                                                  |  ok | READBLOCK(19)
     835652 |     856516 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     869888 |     874656 | Rdr | 30  14  a7  fe                                                  |  ok | READBLOCK(20)
     875844 |     896708 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     910080 |     914848 | Rdr | 30  15  2e  ef                                                  |  ok | READBLOCK(21)
     916036 |     936900 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     950272 |     954976 | Rdr | 30  16  b5  dd                                                  |  ok | READBLOCK(22)
     956228 |     977092 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
     990464 |     995168 | Rdr | 30  17  3c  cc                                                  |  ok | READBLOCK(23)
     996420 |    1017284 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
    1030656 |    1035424 | Rdr | 30  18  cb  34                                                  |  ok | READBLOCK(24)
    1036612 |    1057476 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  |     |
            |            |     | 37  49                                                          |  ok |
    1070848 |    1075616 | Rdr | 30  19  42  25                                                  |  ok | READBLOCK(25)
    1076804 |    1097668 | Tag | 00  00  00  00  00  00  00  00  00  00  00  00  ff  ff  ff  ff  |     |
            |            |     | ae  ba                                                          |  ok |
    1111040 |    1115744 | Rdr | 30  1a  d9  17                                                  |  ok | READBLOCK(26)
    1116996 |    1137796 | Tag | 00  00  00  00  00  00  00  00  ff  ff  ff  ff  32  00  00  00  |     |
            |            |     | 4f  48                                                          |  ok |
    1151232 |    1155936 | Rdr | 30  1b  50  06                                                  |  ok | READBLOCK(27)
    1157188 |    1177988 | Tag | 00  00  00  00  ff  ff  ff  ff  32  00  00  00  2c  01  00  00  |     |
            |            |     | cd  ee                                                          |  ok |
    1191424 |    1196128 | Rdr | 30  1c  ef  72                                                  |  ok | READBLOCK(28)
    1197380 |    1218180 | Tag | ff  ff  ff  ff  32  00  00  00  2c  01  00  00  32  00  00  00  |     |
            |            |     | e4  14                                                          |  ok |
    1231616 |    1236320 | Rdr | 30  1d  66  63                                                  |  ok | READBLOCK(29)
    1237572 |    1258436 | Tag | 32  00  00  00  2c  01  00  00  32  00  00  00  04  34  5a  e2  |     |
            |            |     | 6b  5d                                                          |  ok |
    1271808 |    1276576 | Rdr | 30  1e  fd  51                                                  |  ok | READBLOCK(30)
    1277764 |    1298628 | Tag | 2c  01  00  00  32  00  00  00  04  34  5a  e2  42  eb  4b  80  |     |
            |            |     | 8a  dc                                                          |  ok |
    1312000 |    1316768 | Rdr | 30  1f  74  40                                                  |  ok | READBLOCK(31)
    1317956 |    1338820 | Tag | 32  00  00  00  04  34  5a  e2  42  eb  4b  80  62  48  00  00  |     |
            |            |     | 59  7c                                                          |  ok |
    1352192 |    1356960 | Rdr | 30  20  00  89                                                  |  ok | READBLOCK(32)
    1358148 |    1358788 | Tag |00!                                                              |     |
    1570432 |    1575200 | Rdr | 50  00  57  cd                                                  |  ok | HALT

Last edited by speedlimits (2017-07-24 13:36:21)

Offline

#2 2017-07-24 14:26:17

iceman
Administrator
Registered: 2013-04-25
Posts: 9,495
Website

Re: MIFARE Ultralight C mod

Have you tried writing to it?

Not sure if I've seen that dump-format output before. Are you running your own client/firmware?

Offline

#3 2017-07-24 14:55:51

speedlimits
Contributor
Registered: 2017-06-28
Posts: 31

Re: MIFARE Ultralight C mod

Hi Ice,

yes i cant write on it

proxmark3> hf mfu wrbl b 10 d 12345678
Block: 10 (0x0A) [ 12 34 56 78 ]
#db# WRITE BLOCK FINISHED
isOk:01

dump

proxmark3> hf mfu dump
TYPE : MIFARE Ultralight C (MF0ULC)
Reading tag memory...
#db# Cmd Error: 00
#db# Read block 32 error

 Block#  | Data        |lck| Ascii
---------+-------------+---+------
  0/0x00 | 04 34 5a e2 |   |
  1/0x01 | 42 eb 4b 80 |   |
  2/0x02 | 62 48 00 00 |   |
  3/0x03 | 00 00 00 00 | 0 | ....
  4/0x04 | 02 00 00 10 | 0 | ....
  5/0x05 | 00 06 01 10 | 0 | ....
  6/0x06 | 11 ff 00 00 | 0 | ....
  7/0x07 | 00 00 00 00 | 0 | ....
  8/0x08 | 00 00 00 00 | 0 | ....
  9/0x09 | 00 00 00 00 | 0 | ....
 10/0x0A | 12 34 56 78 | 0 | .4Vx
 11/0x0B | 00 00 00 00 | 0 | ....
 12/0x0C | 00 00 00 00 | 0 | ....
 13/0x0D | 00 00 00 00 | 0 | ....
 14/0x0E | 00 00 00 00 | 0 | ....
 15/0x0F | 00 00 00 00 | 0 | ....
 16/0x10 | 00 00 00 00 | 0 | ....
 17/0x11 | 00 00 00 00 | 0 | ....
 18/0x12 | 00 00 00 00 | 0 | ....
 19/0x13 | 00 00 00 00 | 0 | ....
 20/0x14 | 00 00 00 00 | 0 | ....
 21/0x15 | 00 00 00 00 | 0 | ....
 22/0x16 | 00 00 00 00 | 0 | ....
 23/0x17 | 00 00 00 00 | 0 | ....
 24/0x18 | 00 00 00 00 | 0 | ....
 25/0x19 | 00 00 00 00 | 0 | ....
 26/0x1A | 00 00 00 00 | 0 | ....
 27/0x1B | 00 00 00 00 | 0 | ....
 28/0x1C | ff ff ff ff | 0 | ....
 29/0x1D | 32 00 00 00 | 0 | 2...
 30/0x1E | 2c 01 00 00 | 0 | ,...
 31/0x1F | 32 00 00 00 | 0 | 2...
---------------------------------

So I think I can .

:-).


I was confused. I thought  that needed a key to write .



Dump format is :
hf mf dbg 4"
"hf mfu dump k xxxxxx"
"hf list 14a"

Offline

#4 2017-07-24 15:36:59

iceman
Administrator
Registered: 2013-04-25
Posts: 9,495
Website

Re: MIFARE Ultralight C mod

read up on your datasheets.  UL-C doesn't use a 4byte pwd. It uses a 16byte key. 

You only need a key if the tag is configured to authenticate.

Offline

#5 2017-07-24 15:39:52

speedlimits
Contributor
Registered: 2017-06-28
Posts: 31

Re: MIFARE Ultralight C mod

Ok thanks,

can you tell by reading (with Proxmark) the tag if it needs authentication ?

Offline

#6 2017-07-24 22:09:12

iceman
Administrator
Registered: 2013-04-25
Posts: 9,495
Website

Re: MIFARE Ultralight C mod

since you can't get a complete dump (look at number of blocks) , and hf mfu info doesn't report back configuration values for authentication,  I would say that your card is locked down and you need the key to get all data from it.

Offline

#7 2017-07-24 22:11:35

iceman
Administrator
Registered: 2013-04-25
Posts: 9,495
Website

Re: MIFARE Ultralight C mod

and change back the debug level to 0 or 1,  you will most likely get crap values because of missed timing with level 4.

Offline

#8 2017-08-03 14:26:47

speedlimits
Contributor
Registered: 2017-06-28
Posts: 31

Re: MIFARE Ultralight C mod

thanks for your help

Offline

Board footer

Powered by FluxBB