[SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

ImSchatten360 · 2020-10-07 14:22:10

Hello everybody,

I have bunch of tags that are identified by the proxmark3 as following:

proxmark3> hf search
          
 UID : 11 22 33 44           
ATQA : 00 04          
 SAK : 03 [2]          
proprietary non iso14443-4 card found, RATS not supported          
No chinese magic backdoor command detected          
Prng detection: WEAK          

Valid ISO14443A Tag Found - Quiting Search

As far as I am aware, these are Gen2 tags. They used to have some "random" UID and I changed it with the following command:

 hf mf wrbl 0 A FFFFFFFFFFFF 11223344448804000000000000000000

However, if I try to change block 0 or just the UID + BCC with MCT on my Android Sony Xperia XZ1 Compact, it tells me, that the writing was successful but the block content does not change. Nevertheless, I can write information to all other blocks and sectors.

Does anyone know why this is the case?
Shouldn't I be able to use MCT if I can write to the cards via "hf mf wrbl"?
Are there additional requirements to use cards with MCT?

Regards,

ImSchatten360

Last edited by ImSchatten360 (2020-10-11 15:46:58)

iceman · 2020-10-07 14:52:28

Sounds like a question for MCT app. ikarus the main developer hangs out in the discord server.

An invite for you https://discord.gg/cfNvV5

ImSchatten360 · 2020-10-08 08:26:21

Thanks for your feedback iceman!
I was hoping that someone here experienced the same issue in the past and that I maybe just missed something obvious.
For example that there is more to "hf mf wrbl" than to a conventional writing attempt or that the issue is clearly related to the cards.
Until yesterday, I thought the reason for the issue could be either the phone, the card or the software.
Now that I just tested it with a Huawei P10 Lite (which at least is in the MCT's list of compatible devices), I think it is more likely to be a card issue. Because also with this device it failed.

It is a little unfortunate that MCT confirms the writing attempt as successful without reading the content of the tag again. At least this seems to happen.
In addition, I am still not sure why a "hf mf wrbl" is successful and an attempt with MCT is not. I would like to understand how both procedures differ. I am really not yet familiar with how the procedures are implemented.

iceman · 2020-10-08 17:56:05

Have you confirmed with a read block after you wrote it on yr Pm3?

ImSchatten360 · 2020-10-08 18:17:35

Yes I did:

proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# READ BLOCK FINISHED          
isOk:01 data:11 22 33 44 44 88 04 00 00 00 00 00 00 00 00 00

It is also recognized by MCT.

What I observed is that sometimes the proxmark3 has trouble communicating with the tag(s). Then I need to repeat the operation until I do not obtain any errors ("#db# Cmd CRC response error.", "#db# Can't select card", "#db# Auth error ", ...).

Example:

proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# READ BLOCK FINISHED          
isOk:01 data:11 22 33 44 44 88 04 00 00 00 00 00 00 00 00 00           
proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# Authentication failed. Card timeout.          
#db# Auth error          
#db# READ BLOCK FINISHED          
isOk:00          
proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# Can't select card          
#db# READ BLOCK FINISHED          
isOk:00          
proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# Multiple tags detected. Collision after Bit 1          
#db# Can't select card          
#db# READ BLOCK FINISHED          
isOk:00          
proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# Can't select card          
#db# READ BLOCK FINISHED          
isOk:00          
proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# Auth error          
#db# READ BLOCK FINISHED          
isOk:00          
proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# Auth error          
#db# READ BLOCK FINISHED          
isOk:00          
proxmark3> hf mf rdbl 0 a ffffffffffff
--block no:0, key type:A, key:ff ff ff ff ff ff            
#db# READ BLOCK FINISHED          
isOk:01 data:11 22 33 44 44 88 04 00 00 00 00 00 00 00 00 00

Maybe the tags in general are not performing well?
However, MCT always seems to be able to easily handle them, except for the writing to block 0 part.

iceman · 2020-10-08 18:28:07

Not really, you need to find the sweetspot where you get best coupling between tag and pm3. Usually 1-1.5cm distance for 14A.

ImSchatten360 · 2020-10-09 14:08:36

I was suggested to compare the write operations of the Proxmark3 and MCT.
It seems to be a good idea and I can use "hf mf snoop" and "hf list 14a" to obtain the data for the write operation of MCT.
But unfortunately, I think I cannot do the same for the write operation of the Proxmark3 as I cannot write and snoop and the same time.
Is this correct or do I miss something (I just have one Proxmark3)?
Is there another option to obtain the data without diving too deep into the Proxmark3 source?

iceman · 2020-10-09 15:41:25

after issue the write command,
try "hf mf list" in order to look at what commands the pm3 sent to the card and its reposonse.

ImSchatten360 · 2020-10-11 15:46:41

Ok the problem is solved.

I missed something.
If you choose "Write Block" and go for sector 0 and block 0, MCT asks you whether you know what you are doing and if you want to proceed.
In this case the data on the card is updated.

However, I tried to copy a whole card and went for the "Write Dump (Clone)" option. In this case, it does not update sector 0, block 0 unless you explicitly go to options and choose "Advanced: Enable writing to manufacturer block". Without choosing this option, MCT still tells you that it succeeded but just did not mess with sector 0, block 0.

Happy end.

Frustrating at first but it made me update my Proxmark3 to the new firmware and it made me learn more about its options and especially the sniffing function.

Thanks iceman and IKARUS for the tools and the support!

ImSchatten360

Proxmark3 community

Announcement

#1 2020-10-07 14:22:10

[SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#2 2020-10-07 14:52:28

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#3 2020-10-08 08:26:21

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#4 2020-10-08 17:56:05

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#5 2020-10-08 18:17:35

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#6 2020-10-08 18:28:07

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#7 2020-10-09 14:08:36

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#8 2020-10-09 15:41:25

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

#9 2020-10-11 15:46:41

Re: [SOLVED] Changing UID - Proxmark3 succeeds - MCT fails

Board footer