Proxmark developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2019-05-09 12:34:30

PlayGround
Contributor
Registered: 2019-05-08
Posts: 6

Sniffing / Dumping a Desfire Card?

Hello Forum,

i just read through this forum about desfire. to make sure i got it right:

until now, dumping a desfire card is not possible, am i right?
can i fully dump the desfires if i have the keys to that card?
can i obtail the keys with the proxmark if i dont know them?

hf search
          
 UID : 04 5f 56 8a XX XX XX           
ATQA : 03 44          
 SAK : 20 [1]          
TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41          
MANUFACTURER : NXP Semiconductors Germany          
 ATS : 06 75 77 81 02 80 02 f0           
       -  TL : length is 6 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 5 (FSC = 64)          
       - TA1 : different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]          
       - TB1 : SFGI = 1 (SFGT = 8192/fc), FWI = 8 (FWT = 1048576/fc)          
       - TC1 : NAD is NOT supported, CID is supported          
       -  HB : 80           
No chinese magic backdoor command detected          
PRNG data error: Wrong length: 0          
Prng detection error.          

Valid ISO14443A Tag Found - Quiting Search

best regards

Paul

Offline

#2 2019-05-12 10:04:19

iceman
Administrator
Registered: 2013-04-25
Posts: 5,344
Website

Re: Sniffing / Dumping a Desfire Card?

for more details with regards to desfire,  try  the  hf mfdes info command.
For desfire normally we would need to enumerate all AID's and try to see which can be read.


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

Board footer

Powered by FluxBB