Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
#1 2018-04-08 13:26:33
- rayway99
- Contributor
- Registered: 2018-04-08
- Posts: 20
[solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
Hi,
I am new with PM3 but I have read the FAQ, WIKI and some manuals on the steps I should be performing
yet no luck on the progress, as the snoop records TAG but no READER lines, while SNIFF records nothing 
Hardware Version: (factory firmware comes with the PM3)
proxmark3> hw version
#db# Prox/RFID mark3 RFID instrument
#db# bootrom: master/v2.0.0-new-YEMA-PM3 Customization -suspect 2017-05-11 13:50:37
#db# os: master/v2.0.0-new-YEMA-PM3 Customization -suspect 2017-05-11 13:50:38
#db# HF FPGA image built on 2015/03/09 at 08:41:42
uC: AT91SAM7S512 Rev B
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 512K bytes
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
Card Info : ( seems to be a Mifare Classic 1 EV1 according to the taginfo app on my Android)
proxmark3> hf 14a reader
ATQA : 00 04
UID : a3 ef cc ba
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
Questions
1) I tried 'hf mf mifare' but no response , guess PRNG not works with SL1 (EV1?)
2) the card is not using default password testing with ' hf mf chk *1 ? d ' , i got another password file but got error 'cannot allocate memory' , do I need to manually split the password dictionary into several files?
3) 'hf 14a' snoop only captures TAG info , no Reader info at all , is it my PM3 and TAG position or due to EV1 and/or modern Reader?
## Snoop info will be included in the next reply for tidiness.
4) 'hf mf sniff' records nothing when I tried the same capturing of reader communication
## is it not working due to my version/client , or modern reader/EV1 tag?
Last edited by rayway99 (2018-04-10 09:44:31)
Offline
#2 2018-04-08 13:30:19
- rayway99
- Contributor
- Registered: 2018-04-08
- Posts: 20
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
Snoop communication (NO Reader Info, only TAG) --
thanks in advanced (first time trying to use 'CODE' syntax, not sure its correct)
proxmark3> hf list 14a
Recorded Activity (TraceLen = 5161 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
iClass - Timings are not as accurate
Start | End | Src | Data (! denotes parity error) | CRC | Annotation |
-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|
0 | 2368 | Tag | 04 00 | |
22512 | 28336 | Tag | a3 ef cc ba 3a | |
64752 | 68272 | Tag | 08 b6 dd | |
143712 | 146080 | Tag | 04 00 | |
175056 | 178576 | Tag | 08 b6 dd | |
203600 | 208336 | Tag | 74 b7 e7 58 | |
220256 | 224928 | Tag | f2 98 17 8f! | |
241632 | 262432 | Tag | b4 f9! 49! f2 83! 7e 34 e3 2f ad b9 e5 89 9b! fe 1b! | |
| | | f0! 50 | !crc|
1502144 | 1504512 | Tag | 04 00 | |
1534528 | 1538048 | Tag | 08 b6 dd | |
2999936 | 3002304 | Tag | 04 00 | |
3031536 | 3035056 | Tag | 08 b6 dd | |
4669968 | 4672336 | Tag | 04 00 | |
4701584 | 4705104 | Tag | 08 b6 dd | |
5943472 | 5945840 | Tag | 04 00 | |
5975072 | 5978592 | Tag | 08 b6 dd | |
7217488 | 7219856 | Tag | 04 00 | |
7249088 | 7252608 | Tag | 08 b6 dd | |
93561488 | 93563856 | Tag | 04 00 | |
93583120 | 93588944 | Tag | a3 ef cc ba 3a | |
93625472 | 93628992 | Tag | 08 b6 dd | |
93704304 | 93706672 | Tag | 04 00 | |
93735664 | 93739184 | Tag | 08 b6 dd | |
93764336 | 93769008 | Tag | 99 30 84 db | |
93780992 | 93785664 | Tag | 79 a7! 00 d9! | |
93802224 | 93823088 | Tag | 19! 3b b5 97! 84! 47! df 57 65! 71! 31 6d! 5e 43 23! ca! | |
| | | 2e! 02 | !crc|
95061120 | 95063488 | Tag | 04 00 | |
95093504 | 95097024 | Tag | 08 b6 dd | |
96555504 | 96557872 | Tag | 04 00 | |
96587120 | 96590640 | Tag | 08 b6 dd | |
97902880 | 97905248 | Tag | 04 00 | |
97934496 | 97938016 | Tag | 08 b6 dd | |
99178688 | 99181056 | Tag | 04 00 | |
99210304 | 99213824 | Tag | 08 b6 dd | |
100455344 | 100457712 | Tag | 04 00 | |
100486944 | 100490464 | Tag | 08 b6 dd | |
101724240 | 101726608 | Tag | 04 00 | |
101755984 | 101759504 | Tag | 08 b6 dd | |
154827344 | 154829712 | Tag | 04 00 | |
154849856 | 154855680 | Tag | a3 ef cc ba 3a | |
156098016 | 156100384 | Tag | 04 00 | |
156120544 | 156126368 | Tag | a3 ef cc ba 3a | |
156162768 | 156166288 | Tag | 08 b6 dd | |
156241728 | 156244096 | Tag | 04 00 | |
156272944 | 156276464 | Tag | 08 b6 dd | |
156301616 | 156306288 | Tag | 99 1d 88 6f | |
156318272 | 156323008 | Tag | 01! 10 1b! f7 | |
156339504 | 156360368 | Tag | 9c b5 67 83 9f! c3 f4 b3 6d ff! fb 11 38! e8 04! 26! | |
| | | 8f 00! | !crc|
157602288 | 157604656 | Tag | 04 00 | |
157634656 | 157638176 | Tag | 08 b6 dd | |
159086224 | 159088592 | Tag | 04 00 | |
159118592 | 159122112 | Tag | 08 b6 dd | |
160432576 | 160434944 | Tag | 04 00 | |
160464176 | 160467696 | Tag | 08 b6 dd | |
161710704 | 161713072 | Tag | 04 00 | |
161742304 | 161745824 | Tag | 08 b6 dd | |
162983216 | 162985584 | Tag | 04 00 | |
163014944 | 163018464 | Tag | 08 b6 dd | |
164258080 | 164260448 | Tag | 04 00 | |
164289680 | 164293200 | Tag | 08 b6 dd | |
165533856 | 165536224 | Tag | 04 00 | |
165565456 | 165568976 | Tag | 08 b6 dd | |
166806624 | 166808992 | Tag | 04 00 | |
166838240 | 166841760 | Tag | 08 b6 dd | |
204836800 | 204839168 | Tag | 04 00 | |
204859312 | 204865136 | Tag | a3 ef cc ba 3a | |
204901680 | 204905200 | Tag | 08 b6 dd | |
204980384 | 204982752 | Tag | 04 00 | |
205010832 | 205014352 | Tag | 08 b6 dd | |
205039488 | 205044160 | Tag | b1 39 55 3a | |
205056144 | 205060880 | Tag | 0e c3! 49! 5b | |
205077376 | 205098176 | Tag | bc e6! 64 43! 46 f7! 4a 01! de f2 49! ca ba 79 85 c9 | |
| | | d1! 72 | !crc|
206334656 | 206337024 | Tag | 04 00 | |
206367024 | 206370544 | Tag | 08 b6 dd | |
207853952 | 207856320 | Tag | 04 00 | |
207885424 | 207888944 | Tag | 08 b6 dd | |
209197616 | 209199984 | Tag | 04 00 | |
209229344 | 209232864 | Tag | 08 b6 dd | |
210471744 | 210474112 | Tag | 04 00 | |
210503344 | 210506864 | Tag | 08 b6 dd | |
211846816 | 211849184 | Tag | 04 00 | |
211878416 | 211881936 | Tag | 08 b6 dd | |
213122096 | 213124464 | Tag | 04 00 | |
213153824 | 213157344 | Tag | 08 b6 dd | |
214392368 | 214393904 | Tag | 04 00! | |
214424160 | 214424480 | Tag | 03! | |
246237600 | 246239968 | Tag | 04 00 | |
246259344 | 246265168 | Tag | a3 ef cc ba 3a | |
246301696 | 246305216 | Tag | 08 b6 dd | |
246380656 | 246383024 | Tag | 04 00 | |
246411872 | 246415392 | Tag | 08 b6 dd | |
246440544 | 246445216 | Tag | 79 8a 79 9a | |
246457200 | 246461936 | Tag | 69 69! be! 86 | |
246478560 | 246499360 | Tag | 4e! 54 0b! 6c a0 90! f9! 4d! 83 3d ef 69 6c! f1 ef 41 | |
| | | ab 4c! | !crc|
247739824 | 247742192 | Tag | 04 00 | |
247771424 | 247774944 | Tag | 08 b6 dd | |
249228928 | 249231296 | Tag | 04 00 | |
249260528 | 249264048 | Tag | 08 b6 dd | |
250574080 | 250576448 | Tag | 04 00 | |
250605680 | 250609200 | Tag | 08 b6 dd | |
251846432 | 251848800 | Tag | 04 00 | |
251878032 | 251881552 | Tag | 08 b6 dd | |
253123696 | 253126064 | Tag | 04 00 | |
253155296 | 253158816 | Tag | 08 b6 dd | |
254398832 | 254401200 | Tag | 04 00 | |
254430432 | 254433952 | Tag | 08 b6 dd | |
255671088 | 255673456 | Tag | 04 00 | |
255702816 | 255706336 | Tag | 08 b6 dd | |
256943920 | 256946288 | Tag | 04 00 | |
256975520 | 256979040 | Tag | 08 b6 dd | |
258215840 | 258218208 | Tag | 04 00 | |
258247440 | 258250960 | Tag | 08 b6 dd | |
259484704 | 259487072 | Tag | 04 00 | |
259515424 | 259518944 | Tag | 08 b6 dd | |
260757648 | 260760016 | Tag | 04 00 | |
260789232 | 260792752 | Tag | 08 b6 dd | |
262031760 | 262034128 | Tag | 04 00 | |
262063360 | 262066880 | Tag | 08 b6 dd | |
263306752 | 263309120 | Tag | 04 00 | |
263338352 | 263341872 | Tag | 08 b6 dd | |
264576672 | 264579040 | Tag | 04 00 | |
264608288 | 264611808 | Tag | 08 b6 dd | |
265847920 | 265850288 | Tag | 04 00 | |
265878640 | 265882160 | Tag | 08 b6 dd | |
267120128 | 267122496 | Tag | 04 00 | |
267151728 | 267155248 | Tag | 08 b6 dd | |
268393008 | 268395376 | Tag | 04 00 | |
268424608 | 268428128 | Tag | 08 b6 dd | |
269669968 | 269672336 | Tag | 04 00 | |
269701584 | 269705104 | Tag | 08 b6 dd | |
273491968 | 273494336 | Tag | 04 00 | |
273523568 | 273527088 | Tag | 08 b6 dd | |
274764272 | 274766640 | Tag | 04 00 | |
274795888 | 274799408 | Tag | 08 b6 dd | |
276036992 | 276039360 | Tag | 04 00 | |
276068592 | 276072112 | Tag | 08 b6 dd | |
277307088 | 277309456 | Tag | 04 00 | |
277338688 | 277342208 | Tag | 08 b6 dd | |
278582752 | 278585120 | Tag | 04 00 | |
278614496 | 278618016 | Tag | 08 b6 dd | |
279855424 | 279857792 | Tag | 04 00 | |
279887024 | 279890544 | Tag | 08 b6 dd | |
281126624 | 281128992 | Tag | 04 00 | |
281158224 | 281161744 | Tag | 08 b6 dd | |
282399376 | 282401744 | Tag | 04 00 | |
282430976 | 282434496 | Tag | 08 b6 dd | |
302767792 | 302770160 | Tag | 04 00 | |
302790320 | 302796144 | Tag | a3 ef cc ba 3a | |
302832672 | 302836192 | Tag | 08 b6 dd | |
302911504 | 302913872 | Tag | 04 00 | |
302942848 | 302946368 | Tag | 08 b6 dd | |
302971504 | 302976240 | Tag | a8 c0 e8 d5 | |
302988160 | 302992896 | Tag | db a8 7b cb | |
303009392 | 303030256 | Tag | d8! c4 97! 5a 8c! 3c! 27 9c 18! 4b! e3 41! 49 49! 94 2d! | |
| | | f2 16 | !crc|
304268688 | 304271056 | Tag | 04 00 | |
304301056 | 304304576 | Tag | 08 b6 dd | |
305780640 | 305783008 | Tag | 04 00 | |
305812240 | 305815760 | Tag | 08 b6 dd | |
307306880 | 307309248 | Tag | 04 00 | |
307338608 | 307342128 | Tag | 08 b6 dd | |
308577536 | 308579904 | Tag | 04 00 | |
308609152 | 308612672 | Tag | 08 b6 dd | |
309850320 | 309852688 | Tag | 04 00 | |
309881920 | 309885440 | Tag | 08 b6 dd | |
311123856 | 311126224 | Tag | 04 00 | |
311155456 | 311158976 | Tag | 08 b6 dd | |
312401408 | 312403776 | Tag | 04 00 | |
312433024 | 312436544 | Tag | 08 b6 dd | |
344135136 | 344137504 | Tag | 04 00 | |
344156880 | 344162704 | Tag | a3 ef cc ba 3a | |
344199232 | 344202752 | Tag | 08 b6 dd | |
344278064 | 344280432 | Tag | 04 00 | |
344309408 | 344312928 | Tag | 08 b6 dd | |
344337952 | 344342688 | Tag | b7 1e f9 73 | |
344354592 | 344359328 | Tag | 92! 0f! f3 7b! | |
344375840 | 344396704 | Tag | 70! 4b 9e! 2e 2e! b1 d0! aa f8 61! e2! 75 85! d2 34 89 | |
| | | b0! 05! | !crc|
345637696 | 345640064 | Tag | 04 00 | |
345669296 | 345672816 | Tag | 08 b6 dd | |
347119648 | 347122016 | Tag | 04 00 | |
347151248 | 347154768 | Tag | 08 b6 dd | |
348464848 | 348467216 | Tag | 04 00 | |
348496448 | 348499968 | Tag | 08 b6 dd | |
349739056 | 349741424 | Tag | 04 00 | |
349770672 | 349774192 | Tag | 08 b6 dd | |
351009728 | 351012096 | Tag | 04 00 | |
351041328 | 351044848 | Tag | 08 b6 dd | |
352193152 | 352195520 | Tag | 04 00 | |
352224768 | 352228288 | Tag | 08 b6 dd | |
353462560 | 353464928 | Tag | 04 00 | |
353494160 | 353497680 | Tag | 08 b6 dd | |
354734992 | 354737360 | Tag | 04 00 | |
354766720 | 354770240 | Tag | 08 b6 dd | |
382661344 | 382663712 | Tag | 04 00 | |
382682208 | 382688032 | Tag | a3 ef cc ba 3a | |
382724560 | 382728080 | Tag | 08 b6 dd | |
382803392 | 382805760 | Tag | 04 00 | |
382834608 | 382838128 | Tag | 08 b6 dd | |
382863456 | 382863968 | Tag | 03! | |
382879920 | 382884656 | Tag | 47! 22 c4 e1! | |
382901168 | 382921968 | Tag | a2 6a e4 c2 97! de 26 1d! 65 14 10! dc 31! ce b3! 1a | |
| | | b4! 60 | !crc|
384170784 | 384173152 | Tag | 04 00 | |
384202384 | 384205904 | Tag | 08 b6 dd | |
385574336 | 385576704 | Tag | 04 00 | |
385605936 | 385609456 | Tag | 08 b6 dd | |
387094608 | 387096976 | Tag | 04 00 | |
387125312 | 387128832 | Tag | 08 b6 dd | |
388365184 | 388367552 | Tag | 04 00 | |
388396784 | 388400304 | Tag | 08 b6 dd | |
389640416 | 389642784 | Tag | 04 00 | |
389672016 | 389675536 | Tag | 08 b6 dd | |
390825920 | 390828288 | Tag | 04 00 | |
390857520 | 390861040 | Tag | 08 b6 dd | |
392097824 | 392100192 | Tag | 04 00 | |
392129440 | 392132960 | Tag | 08 b6 dd | |
393370256 | 393372624 | Tag | 04 00 | |
393400960 | 393404480 | Tag | 08 b6 dd | |
394641632 | 394644000 | Tag | 04 00 | |
394673248 | 394676768 | Tag | 08 b6 dd | |
395915456 | 395917824 | Tag | 04 00 | |
395947056 | 395950576 | Tag | 08 b6 dd | |
397187888 | 397190256 | Tag | 04 00 | |
397219504 | 397223024 | Tag | 08 b6 dd | |
398459136 | 398461504 | Tag | 04 00 | |
398490736 | 398494256 | Tag | 08 b6 dd | |
399733056 | 399735424 | Tag | 04 00 | |
399764784 | 399768304 | Tag | 08 b6 dd | |
401005312 | 401007680 | Tag | 04 00 | |
401036912 | 401040432 | Tag | 08 b6 dd | |
402282112 | 402284480 | Tag | 04 00 | |
402313712 | 402317232 | Tag | 08 b6 dd | |
403553504 | 403555872 | Tag | 04 00 | |
403585104 | 403588624 | Tag | 08 b6 dd | |
404824608 | 404826976 | Tag | 04 00 | |
404856208 | 404859728 | Tag | 08 b6 dd | |
406096192 | 406098560 | Tag | 04 00 | |
406127920 | 406131440 | Tag | 08 b6 dd | |
407371216 | 407373584 | Tag | 04 00 | |
407402832 | 407406352 | Tag | 08 b6 dd | |
408642928 | 408645296 | Tag | 04 00 | |
408674544 | 408678064 | Tag | 08 b6 dd | |
409919024 | 409921392 | Tag | 04 00 | |
409950624 | 409954144 | Tag | 08 b6 dd | |
411114000 | 411116368 | Tag | 04 00 | |
411145728 | 411149248 | Tag | 08 b6 dd | |
412390496 | 412392864 | Tag | 04 00 | |
412422080 | 412425600 | Tag | 08 b6 dd | |
413661344 | 413663712 | Tag | 04 00 | |
413692960 | 413696480 | Tag | 08 b6 dd | |
414934816 | 414937184 | Tag | 04 00 | |
414966432 | 414969952 | Tag | 08 b6 dd | |
416207936 | 416210304 | Tag | 04 00 | |
416239568 | 416243088 | Tag | 08 b6 dd | |
417479888 | 417482256 | Tag | 04 00 | |
417511600 | 417515120 | Tag | 08 b6 dd | |
418749520 | 418751888 | Tag | 04 00 | |
418781136 | 418784656 | Tag | 08 b6 dd | |
503257952 | 503260320 | Tag | 04 00 | |
503280080 | 503285904 | Tag | a3 ef cc ba 3a | |
503321808 | 503325328 | Tag | 08 b6 dd | |
503401024 | 503403392 | Tag | 04 00 | |
503431984 | 503435504 | Tag | 08 b6 dd | |
503460144 | 503464880 | Tag | a1 eb fe fe | |
503476800 | 503481536 | Tag | 69 2f 2a 66! | |
503498176 | 503518976 | Tag | 22 21! d9! 54 4b aa! ed! 01 33! 45 0d b9 73! 3a! 29 03 | |
| | | e5 ca | !crc|
504468896 | 504471264 | Tag | 04 00 | |
504500880 | 504504400 | Tag | 08 b6 dd | |
506383536 | 506385904 | Tag | 04 00 | |
506414752 | 506418272 | Tag | 08 b6 dd | |
509323952 | 509326320 | Tag | 04 00 | |
509355184 | 509358704 | Tag | 08 b6 dd | |
510164272 | 510166640 | Tag | 04 00 | |
510195488 | 510199008 | Tag | 08 b6 dd | |
511148768 | 511151136 | Tag | 04 00 | |
511180000 | 511183520 | Tag | 08 b6 dd | |
542988624 | 542990992 | Tag | 04 00 | |
543926720 | 543929088 | Tag | 04 00 | |
543948080 | 543953904 | Tag | a3 ef cc ba 3a | |
543989808 | 543993328 | Tag | 08 b6 dd | |
544068128 | 544070496 | Tag | 04 00 | |
544099104 | 544102624 | Tag | 08 b6 dd | |
544127120 | 544131856 | Tag | 56 5c 2d ef | |
544143776 | 544148448 | Tag | c8 2e 54! b8 | |
544907744 | 544910112 | Tag | 04 00 | |
544929248 | 544935072 | Tag | a3 ef cc ba 3a | |
544971104 | 544974624 | Tag | 08 b6 dd | |
545049280 | 545051648 | Tag | 04 00 | |
545080256 | 545083776 | Tag | 08 b6 dd | |
545108400 | 545113072 | Tag | 95 82 ae 09 | |
545125056 | 545129792 | Tag | de! 54! e0! f1 | |
545146432 | 545167232 | Tag | 1c! 53! 83 a5! a9 9e! ec ef! c0 42! cb! c8 35! 15! 94! 3e! | |
| | | a9 97! | !crc|
546068576 | 546070944 | Tag | 04 00 | |
546099808 | 546103328 | Tag | 08 b6 dd | |
548040544 | 548042912 | Tag | 04 00 | |
548071760 | 548075280 | Tag | 08 b6 dd | |
548976160 | 548978528 | Tag | 04 00 | |
549007504 | 549011024 | Tag | 08 b6 dd | |
549908448 | 549910816 | Tag | 04 00 | |
549939680 | 549943200 | Tag | 08 b6 dd | |
550843728 | 550846096 | Tag | 04 00 | |
550874960 | 550878480 | Tag | 08 b6 dd | |
551829008 | 551831376 | Tag | 04 00 | |
551860224 | 551863744 | Tag | 08 b6 dd | |
552762112 | 552764480 | Tag | 04 00 | |
552793344 | 552796864 | Tag | 08 b6 dd | |
553697616 | 553699984 | Tag | 04 00 | |
593573600 | 593575968 | Tag | 04 00 | |
594509488 | 594511856 | Tag | 04 00 | |
594531632 | 594537456 | Tag | a3 ef cc ba 3a | |
594573472 | 594576992 | Tag | 08 b6 dd | |
594652560 | 594654928 | Tag | 04 00 | |
594683536 | 594687056 | Tag | 08 b6 dd | |
594711680 | 594716352 | Tag | 9d 2f 63 69 | |
594728336 | 594733072 | Tag | 06 ad c7! 68 | |
594749712 | 594770576 | Tag | b3! 1f! da 91 0f! 29 d5 39 9e d9! 3c 48! 4f! 86 3b! c4 | |
| | | ea 4e! | !crc|
595677968 | 595680336 | Tag | 04 00 | |
595709952 | 595713472 | Tag | 08 b6 dd | |
597743376 | 597745744 | Tag | 04 00 | |
597775360 | 597778880 | Tag | 08 b6 dd | |
600683072 | 600685440 | Tag | 04 00 | |
600714304 | 600717824 | Tag | 08 b6 dd | |
600785712 | 600788080 | Tag | 04 00 | |
658523152 | 658525520 | Tag | 04 00 | |
659460912 | 659463280 | Tag | 04 00 | |
660399296 | 660401664 | Tag | 04 00 | |
660421424 | 660427248 | Tag | a3 ef cc ba 3a | |
661337456 | 661339824 | Tag | 04 00 | |
661359600 | 661365424 | Tag | a3 ef cc ba 3a | |
662319440 | 662321808 | Tag | 04 00 | |
662341584 | 662347408 | Tag | a3 ef cc ba 3a | |
662383296 | 662386816 | Tag | 08 b6 dd | |
662462384 | 662464752 | Tag | 04 00 | |
662493360 | 662496880 | Tag | 08 b6 dd | |
663258240 | 663260608 | Tag | 04 00 | |
663280384 | 663286208 | Tag | a3 ef cc ba 3a | |
663322096 | 663325616 | Tag | 08 b6 dd | |
663400416 | 663402784 | Tag | 04 00 | |
663431392 | 663434912 | Tag | 08 b6 dd | |
663459552 | 663464224 | Tag | c6 28 18 11 | |
663476208 | 663480880 | Tag | 57! 02 62 8d | |
663497568 | 663518368 | Tag | cc 5f 76! 6e d3 4b 72 2e! db 50 14 52 73! 0e! 46 8b | |
| | | 09 f3 | !crc|
664422784 | 664425152 | Tag | 04 00 | |
664454768 | 664458288 | Tag | 08 b6 dd | |
666272224 | 666274592 | Tag | 04 00 | |
666304224 | 666307744 | Tag | 08 b6 dd | |
667210112 | 667212480 | Tag | 04 00 | |
667241328 | 667244848 | Tag | 08 b6 dd | |
668145280 | 668147648 | Tag | 04 00 | |
668176512 | 668180032 | Tag | 08 b6 dd | |
669078336 | 669080704 | Tag | 04 00 | |
669109568 | 669113088 | Tag | 08 b6 dd | |
670011904 | 670014272 | Tag | 04 00 | |
670043136 | 670046656 | Tag | 08 b6 dd | |
670992464 | 670994832 | Tag | 04 00 | |
671023696 | 671027216 | Tag | 08 b6 dd | |
671928624 | 671930992 | Tag | 04 00 | |
671959840 | 671963360 | Tag | 08 b6 dd | |
708941072 | 708943440 | Tag | 04 00 | |
709874880 | 709877248 | Tag | 04 00 | |
710856144 | 710858512 | Tag | 04 00 | |
710878272 | 710884096 | Tag | a3 ef cc ba 3a | |
711792432 | 711794800 | Tag | 04 00 | |
711814560 | 711820384 | Tag | a3 ef cc ba 3a | |
711856416 | 711859936 | Tag | 08 b6 dd | |
711935504 | 711937872 | Tag | 04 00 | |
711966480 | 711970000 | Tag | 08 b6 dd | |
711994624 | 711999296 | Tag | 54 a7 9b 87 | |
712011280 | 712015952 | Tag | 54 f7 23! 4b | |
712032656 | 712053456 | Tag | e3 28! f5 f0! 43 c1! e2 38! 0a! af 9a 66 b4 84 c4 b3 | |
| | | a4 0a | !crc|
712959728 | 712962096 | Tag | 04 00 | |
712991728 | 712995248 | Tag | 08 b6 dd | |
717142640 | 717145008 | Tag | 04 00 | |
717173984 | 717177504 | Tag | 08 b6 dd | |
717755440 | 717757808 | Tag | 04 00 | |
717786672 | 717790192 | Tag | 08 b6 dd | |
718692144 | 718694512 | Tag | 04 00 | |
718723360 | 718726880 | Tag | 08 b6 dd | |
719675136 | 719677504 | Tag | 04 00 | |
719706480 | 719710000 | Tag | 08 b6 dd | |
720610032 | 720612400 | Tag | 04 00 | |
720641376 | 720644896 | Tag | 08 b6 dd | |
721546720 | 721549088 | Tag | 04 00 | |
721578080 | 721581600 | Tag | 08 b6 dd | |
722483680 | 722486048 | Tag | 04 00 | |
722515040 | 722518560 | Tag | 08 b6 dd | |
723464256 | 723466624 | Tag | 04 00 | |
723495488 | 723499008 | Tag | 08 b6 dd | |
724400864 | 724403232 | Tag | 04 00 | |
724432096 | 724435616 | Tag | 08 b6 dd | |
762364416 | 762366784 | Tag | 04 00 | |
762386560 | 762392384 | Tag | a3 ef cc ba 3a | |
763296736 | 763299104 | Tag | 04 00 | |
763318880 | 763324704 | Tag | a3 ef cc ba 3a | |
763360592 | 763364112 | Tag | 08 b6 dd | |
763438912 | 763441280 | Tag | 04 00 | |
763469888 | 763473408 | Tag | 08 b6 dd | |
763497920 | 763502656 | Tag | c3 e1 fd e3 | |
763514576 | 763519248 | Tag | 38! a1! 2b c6 | |
763535936 | 763556800 | Tag | 52! b1 94 c5 24! 0f 70! 36 3c! f1! 2a! 22 4c 6d ab! c8! | |
| | | 41! 9a! | !crc|
764503104 | 764505472 | Tag | 04 00 | |
764534976 | 764538496 | Tag | 08 b6 dd | |
766520320 | 766522688 | Tag | 04 00 | |
766551552 | 766555072 | Tag | 08 b6 dd | |
767360608 | 767362976 | Tag | 04 00 | |
767391840 | 767395360 | Tag | 08 b6 dd | |
768341472 | 768343840 | Tag | 04 00 | |
768372704 | 768376224 | Tag | 08 b6 dd | |
769278432 | 769280800 | Tag | 04 00 | |
769309664 | 769313184 | Tag | 08 b6 dd | |
770214544 | 770216912 | Tag | 04 00 | |
770245760 | 770249280 | Tag | 08 b6 dd | |
771198320 | 771200688 | Tag | 04 00 | |
771229552 | 771233072 | Tag | 08 b6 dd | |
772136592 | 772138960 | Tag | 04 00 | |
772167824 | 772171344 | Tag | 08 b6 dd | |
773073904 | 773076272 | Tag | 04 00 | |
773105120 | 773108640 | Tag | 08 b6 dd | |
774006704 | 774009072 | Tag | 04 00 | |
774037936 | 774041456 | Tag | 08 b6 dd | |
774992096 | 774994464 | Tag | 04 00 | |
775023440 | 775026960 | Tag | 08 b6 dd | |
proxmark3> Offline
#3 2018-04-08 14:17:52
- rayway99
- Contributor
- Registered: 2018-04-08
- Posts: 20
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
also tried with 'hf mf sim x' but no challenge or response is captured / returned
any suggestion to move forward?
Offline
#4 2018-04-08 15:13:38
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,537
- Website
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
I can tell by the name of the firmware you bought a chinese clone. You can only turn to seller to get help.
#db# bootrom: master/v2.0.0-new-YEMA-PM3 Customization -suspect 2017-05-11 13:50:37
#db# os: master/v2.0.0-new-YEMA-PM3 Customization -suspect 2017-05-11 13:50:38 Online
#5 2018-04-09 12:40:37
- rayway99
- Contributor
- Registered: 2018-04-08
- Posts: 20
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
Hi iceman, thanks for the reply.
I got the pm3 off the internet which claimed to be Elechouse product
it comes with few firmware as
1/ custom one like the one shared ( they claimed *improved* v2.0.0)
2/ iceman
3/ v2.0.0 official
4/ v2.0.0 offline snoop supported/bug fixed
can you shed some light on cloning a EV1 (Mifare Classic 1k SL1), what is the minimum / suitable version required so I can compile one accordingly?
thanks again
Offline
#6 2018-04-09 12:49:04
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,537
- Website
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
The recommendation on this forum is to use latest official source from Github.
Online
#7 2018-04-09 14:58:40
- rayway99
- Contributor
- Registered: 2018-04-08
- Posts: 20
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
hi iceman, thanks for the swift reply, once the PM3 is upgraded to the latest 3.1.0, the card was cracked with a default dic file
pm3 --> hw version
[[[ Cached information ]]]
Proxmark3 RFID instrument
[ ARM ]
bootrom: iceman/master/ice_v3.1.0-787-g192aa9ab 2018-04-08 11:49:32
os: iceman/master/ice_v3.1.0-787-g192aa9ab 2018-04-08 11:49:37
[ FPGA ]
LF image built for 2s30vq100 on 2017/10/25 at 19:50:50
HF image built for 2s30vq100 on 2017/11/10 at 19:24:16
[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 237727 bytes (45%) Free: 286561 bytes (55%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory
#source TAG
pm3 --> hf 14a info
UID : A3 EF CC BA
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1
proprietary non iso14443-4 card found, RATS not supported
Answers to magic commands: NO
Prng detection: WEAK
#black CUID
pm3 --> hf 14a info
UID : 01 D1 EC 3B
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1
proprietary non iso14443-4 card found, RATS not supported
Answers to magic commands (GEN 1a): YES
Prng detection: WEAK
pm3 --> hf mf chk *1 ? d default_keys.dic
Loaded 475 keys from default_keys.dic
................................................................................................................................................................Time in checkkeys: 211 seconds
testing to read key B...
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|001| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|002| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|003| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|004| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|005| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|006| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|007| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|008| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|009| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|010| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|011| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|012| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|013| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|014| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|015| 8829da9daf76 | 1 | 8829da9daf76 | 1 |
|---|----------------|---|----------------|---|
Printing keys to binary file hf-mf-A3EFCCBA-key.bin...
Found keys have been dumped to file hf-mf-A3EFCCBA-key.bin. 0xffffffffffff has been inserted for unknown keys. now the problem I have is
1) wrote to a UID card , the reader won't accept it
2) wrote to a CUID card and revised the UID same as the source TAG, the reader still won't accept it
3) I have 2 UFUID cards, but not sure what is the exact steps
writing the block from the dump then update the UID ? ( I tried with one but failed with reader again .. )
and somehow the block0 can be written multiple times but all other block can be written once only..
any suggestions?
Offline
#8 2018-04-10 09:44:04
- rayway99
- Contributor
- Registered: 2018-04-08
- Posts: 20
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
problem solved..
it turns out that seller gave me the incorrect FUID card (it is actually a normal CUID gen1A
EDIT: actually seller insists it is a UFUID.. which can be rewrite multiple times until it is set to locked status, then block0 is set forever, I am still in the search of finding a command from PM3 to do it? (they claimed ACR122U can do it..or those CDxx machine) )
and some CUID cards given are gen1A while some CUID are gen2... (magic Command NO)
the tag reader seems to check UID+Secret+not a magic card.. luckily there are some Gen2 CUID in my purchase.
thanks iceman again for the hints provided, much much appreciated, closing the thread now
Last edited by rayway99 (2018-04-10 12:46:31)
Offline
#9 2018-04-18 18:36:41
- Shashadow
- Contributor
- Registered: 2018-03-13
- Posts: 58
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
Hello rayway,
I don't have UFUID but try with this Tools (Windows only) for your tag, you need to have a ACR122U reader (maybe similar ???).
http://lufia.konyxia.com/UidCard_2.3.7.zip
After the dump with PM3 (hf mf dump), take file with data.bin at end of name (ex : hf-mf-25D5A047-data.bin)
! I think this can work with a dump via mfoc, but not tested !
launch app
click "initial"
click "connect"
click "open" and select your file "hf-mf-25D5A047-data.bin" (it wants a .dump extension, so change extension for all files)
you will have something like that :
http://lufia.konyxia.com/Snap1.png
I'm not sure it will working but its worth a try :-)
tell us if it's ok.
Last edited by Shashadow (2018-04-18 19:33:46)
Offline
#10 2018-04-18 19:33:11
- Shashadow
- Contributor
- Registered: 2018-03-13
- Posts: 58
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
arfff ... :-(
after some research, I afraid that app on previous post is for FUID, and not for UFUID... sorry surely it's will be not ok for UFUID
I let this post just in case
Last edited by Shashadow (2018-04-18 19:36:54)
Offline
#11 2018-04-18 21:17:06
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,537
- Website
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
...I just got the commands for locking the UFUID. Maybe I find time to make a lua script..
Online
#12 2018-06-03 14:07:47
- rayway99
- Contributor
- Registered: 2018-04-08
- Posts: 20
Re: [solved] Need some guidance for cloning a Mifare Classic 1k (EV1)
thanks @Shashadow , the seller also mentioned ACR122U would work for the UFUID he sold me, but he does not encourage me to spend $ to get a ACR122U for just two UFUID cards 
( the UFUID card is like 2-3 times of the CUID card he sold me, yet I don't see the advantage of a UFUID card today ..lol )
@iceman, thanks in advance for a lua script,
i saw the raw signal from the other thread today ( http://www.proxmark.org/forum/viewtopic.php?pid=32307#p32307 )
but cannot figure out how to covert that to write for my UID ( still doing the research but got distracted to the historical iClass threads for few hours , heh)
Offline