Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
The most commonly NFC chip used is the PN544.
The PN544 supports 'Virtual Card mode'. So you can emulate cards at least.
On rooted phones you can sign your own packages.
The nfc chip firmware is signed, it is not an app and it is not in the android source code.
Offline
Sure you can (software) emulate cards. There are already apps for this, e.g. "SimplyTapp".
Offline
Regarding card emulation:
It does not only depend on the NFC controller it also depends on the secure element (as far as I know).
If it were that easy, there must be a lot of apps and hacks on how to enable card emulation, or am I wrong?!
Ok, maybe this whole topic depends on the kind of emulation you want to do.
I recommend reading "Software Card Emulation in NFC-enabled Mobile Phones" by M. Roland (the guy who wrote the "NFC TagInfo" App).
Regarding software card emulation with no secure element this paper says:
"At the moment, BlackBerry mobile phones are the only
devices known to support software card emulation. How-
ever, recent patches [18, 19] to the CyanogenMod aftermar-
ket firmware for Android devices will enable this type of
card emulation on Android devices with NXP’s PN544 NFC
controller.
Besides mobile phones, other devices, like certain NFC read-
ers, can also be used to perform card emulation without a
secure element. An example is the ACS ACR 122U NFC
reader. There also exist dedicated card emulators (e.g. Prox-
mark, OpenPICC, IAIK HF RFID DemoTag)."
@Neuer_User:
I'm not sure I the creator of "SimplyTapp" are using software card emulation. I think they need access to the
secure element in order to implement a "safe" micro payment system (or use their own SE).
If they got access to the SE they could emulate with other techniques.
Google Wallet is using the SE: SE am Beispielt von Google Wallet
by Secure Information Technology Center, Austria (Sorry, paper language: German).
Another interesting thing I found (regarding NFC-Controller and Secure Elements):
http://www.devifi.com/in2pay_microsd.html
Yep, it's a micro SD card with NFC-Controller + Secure Element + Antenna build in.
Maybe you can play with this a bit more and easier like with the other secure elements of big companies.
But I'm not sure about this. But at least it will bring NFC to devices with no NFC
@juancollado2003:
If you want to crack the keys of the other sectors you need a Proxmark3 or a simple USB RFID-Reader with special software (mfcuk/mfoc).
A brute force attack (or a dictionary with all possible keys) would not work efficiently. It is way to slow due to protocol.
Kind regards
ikarus
Last edited by ikarus (2013-06-11 14:41:57)
Offline
Google Wallet is using the SE, right. SimplyTapp is pure software emulation. It only works on Cyanogenmod devices, which do have some modifications in order to allow software card emulation.
It is next to impossible to get access to one of the secure elements in the phone. One SE is owned by Google (or the hardware producer), the other one by the network operators (the SIM card). You will never get an app into these, if you are not VISA or similar...
Offline
Yes, getting access to the SE is next to impossible. That's what i heard too.
But SimplyTapp does not use a SE? How do they secure the account balance on the phone?
Am I missing something?
... OK, this is getting a little bit offtopic
Offline
SimplyTapp uses an SE in a cloud (see here: http://www.nfcworld.com/2012/09/19/317966/simplytapp-proposes-secure-elements-in-the-cloud/). Some more info: http://www.cyanogenmod.org/blog/cyanogenmod9-1-and-simplytapp
Anyway, it just shows that software card emulation is possible under Cyanogenmod.
Offline
P.S.: The microSD card is interesting. Any idea about the cost?
Offline
P.S.: The microSD card is interesting. Any idea about the cost?
I suppose they're talking about an otg cable with usb-card-reader or pendrive
Offline
The nfc chip firmware is signed, it is not an app and it is not in the android source code.
What source code are you looking for specifically?
Offline
asper wrote:The nfc chip firmware is signed, it is not an app and it is not in the android source code.
What source code are you looking for specifically?
None, I only want to say this: "it is not possible to send raw commands under Android - The only way can be modifying the NFC-chip (hardware) firmware that is not possible as far as we know."
Can someone explain me the "SecureElements" or wrtie me a link to learn more about them ?
Offline
This is one of the best sites describing the SE in android:
http://nelenkov.blogspot.ch/2012/08/accessing-embedded-secure-element-in.html
Offline
And here about the software card emulation:
http://nelenkov.blogspot.ch/2012/10/emulating-pki-smart-card-with-cm91.html
Offline
0xFFFF wrote:asper wrote:The nfc chip firmware is signed, it is not an app and it is not in the android source code.
What source code are you looking for specifically?
None, I only want to say this: "it is not possible to send raw commands under Android - The only way can be modifying the NFC-chip (hardware) firmware that is not possible as far as we know."
Can someone explain me the "SecureElements" or wrtie me a link to learn more about them ?
When did I say you could use any form of 'raw' communication? I clearly stated that the PN544 (in my phone) supports 'Virtual Card mode'.
Offline
@Neuer_User:
Thanks for all those links. They are very helpful.
P.S.: The microSD card is interesting. Any idea about the cost?
I know a guy who bought the whole dev kit. It costs him close to $1000. But I have no clue how
much a single microSD is.
Neuer_User wrote:P.S.: The microSD card is interesting. Any idea about the cost?
I suppose they're talking about an otg cable with usb-card-reader or pendrive
I'm not really sure what you are talking about but if you sill want to crack your mifare keys with an USB RFID-reader,
there is no need for an OTG-cable. You will connect the USB reader to your PC running e.g kali-linux.
(Kali-linux has all needed tools preinstalled.)
@asper:
If software card emulation is possible (in modified Android versions like Cyanogenmod), there must be
a way to send and receive raw commands. A (software) emulated card is nothing else than a code snippet
processing raw commands from and to a tag (if I don't misunderstand something).
Kind regards
ikarus
Offline
asper wrote:0xFFFF wrote:What source code are you looking for specifically?
None, I only want to say this: "it is not possible to send raw commands under Android - The only way can be modifying the NFC-chip (hardware) firmware that is not possible as far as we know."
Can someone explain me the "SecureElements" or wrtie me a link to learn more about them ?
When did I say you could use any form of 'raw' communication? I clearly stated that the PN544 (in my phone) supports 'Virtual Card mode'.
FFFF, we are misunderstanding (maybe you miss some of the eary posts of this thread): one of the aim of Ikarus app was sending raw commands to tags but it seems not to be possible because the raw commands are directly managed by the mobile internal NFC chip, so I was not answering to you but in general I was talking about the "general" possibility of sending raw commands using an Android phone.
@ikarus: I really don't know if emulation can solve our problem (sending raw commands), if someone can give more details it will be helpful !
Last edited by asper (2013-06-12 15:50:31)
Offline
What I mean is any sdcard reader or pendrive is an external sd if you have an otg usb cable
Offline
What I mean is any sdcard reader or pendrive is an external sd if you have an otg usb cable
Oh, Ok. But for USB OTG you need at least a smartphone with a usb controller capable of host mode.
Another thing: Why use a USB OTG for a microSD if you could plug it in your smartphone right away?
Offline
@ikarus: I really don't know if emulation can solve our problem (sending raw commands), if someone can give more details it will be helpful !
Sending raw 14443-4 commands must be possible. But sending raw Mifare commands could be difficult/impossible:
"Also, BlackBerry’s software card emulation mode, as well as
the software card emulation that has recently been added
to the CyanogenMod aftermarket firmware for Android de-
vices, only support emulation of ISO/IEC 14443-4 smart-
cards. Proprietary systems that operate on lower protocol
layers (like NXP’s MIFARE Classic) cannot be emulated.
Thus, software card emulation is not usable for several legacy
RFID systems."
(taken from the paper mentioned earlier - by M. Roland)
Offline
.
any smartphone with nfc sensor is otg capable, I mention it because they asking about extrrnal sdcard for encryption and otg could be a solution
Offline
I mention it because they asking about extrrnal sdcard for encryption and otg could be a solution
They are not talking about a microSD card for encryption. They are talking about a microSD card
which is a NFC-controller + secure element + antenna + normal SD card storage. This page
contains a marketing video and a PDF about it. The PDF (CredenSE) is saying something about Mifare card emulation... damn I want one of these.
Offline
sorry, it looks I misunderstood this comment
P.S.: The microSD card is interesting. Any idea about the cost?
Offline
asper wrote:@ikarus: I really don't know if emulation can solve our problem (sending raw commands), if someone can give more details it will be helpful !
Sending raw 14443-4 commands must be possible. But sending raw Mifare commands could be difficult/impossible:
"Also, BlackBerry’s software card emulation mode, as well as
the software card emulation that has recently been added
to the CyanogenMod aftermarket firmware for Android de-
vices, only support emulation of ISO/IEC 14443-4 smart-
cards. Proprietary systems that operate on lower protocol
layers (like NXP’s MIFARE Classic) cannot be emulated.
Thus, software card emulation is not usable for several legacy
RFID systems."
(taken from the paper mentioned earlier - by M. Roland)
The PN544 can emulate Mifare 1K and 4K. I can't recall if it can do anything else. NXP call this virtual card mode.
It's in CyanogenMod but I have not tested it.
Offline
hi iKARUS,
First i will thank you for all you effort. I hope that u will help me for my issue. Let me explain :
- I have some new MIFARE PLUS tags from a manufacturer and i'm not able to write on them under android device . How can I enable writing on the mifare plus tag using android functions ??
Notice that i can i read a mifare plus tag.
Best regards.
Offline
sorry, it looks I misunderstood this comment
Nothing to be sorry about.
The PN544 can emulate Mifare 1K and 4K. I can't recall if it can do anything else. NXP call this virtual card mode.
It's in CyanogenMod but I have not tested it.
For real? CyanogenMod can emulate MF Classic 1k/4k? M. Roland was wrong?
I mean I hope so! It would be awesome to emulate these type of tags!
hi iKARUS,
First i will thank you for all you effort. I hope that u will help me for my issue. Let me explain :
- I have some new MIFARE PLUS tags from a manufacturer and i'm not able to write on them under android device . How can I enable writing on the mifare plus tag using android functions ??
Notice that i can i read a mifare plus tag.Best regards.
First of all: you are welcome.
Regarding your problem:
Sorry, I don't own a MF Plus tag and until now I came not across one. But they should be writable with Android, I think.
At least in the API reference the MF Classic class is aware of the tag type "TYPE_PLUS".
If I get the MF Plus technology right, there is a "Security Level Switch" to switch between legacy mode (MF Classic) and
new mode (128Bit AES). Maybe you have to put the tag in to the legacy mode in order to write to it with Android MifareClassic class.
Hmm.. but this would be sill strange because reading is working already...
I'm really not sure about this...
Kind regards
ikarus
Offline
Hi ikarus,
thanks for reply . So i will try to dig on this with the informations that you give me . Also i will see in details both mifare classic and mifare plus datasheet that might help also.
Regards
Offline
The PN544 can emulate Mifare 1K and 4K. I can't recall if it can do anything else. NXP call this virtual card mode.
It's in CyanogenMod but I have not tested it.
I don't think it is possible to emulate Mifare Classic with CyanogenMod. The patches only enable ISO 14443-4 tags.
"ISO 14443-4 (used mostly for APDU-based communication), which means that you cannot
emulate cards that operate on a lower-level protocol such as MIFARE Classic" (source)
And another problem: The patches from CM do not allow the programmer to choose a UID. The UID will be random.
Emulating Mifare Classic (on Android) is done by the Secure Element. It is the SE which is in "Virtual Card Mode"
"We already know that if the embedded secure element is put in virtual mode it is visible to
external readers as a contactless smartcard." (same source as above and also this)
"Card emulation from the host device is not a feature of the PN544 NFC controller, although some claim that they have managed to get it working."
(also from here)
However, the datasheet of the PN544 (2nd generation) says that the controller is capable of emulating Mifare...
Maybe what they are saying is: you can emulate Mifare, if you connect the PN544 to a SE.
Kind regards
ikarus
Offline
However, the datasheet of the PN544 (2nd generation) says that the controller is capable of emulating Mifare...
Maybe what they are saying is: you can emulate Mifare, if you connect the PN544 to a SE.
The PN544 and PN65N are both capable of emulating Mifare. I have a lot more than the datasheet on hand.
The PN65N has a SE built in. I have a development board on my desk emulating Mifare cards.
The results of the little amount of work that I have done so far has been successful. My biggest challenges have been familiarization of the Android phone architecture and ROM development.
Offline
New release! (Version 1.4.2: APK-file, Google Play)
(See: original post, updated)
* Fixed some crash issues (thanks to Stéphane Haziza).
* Some minor bug fixes.
@0xFFFF:
Do you emulate the Mifare Classic tag with the PN544 or with the PN65N?
And how do you emulate? Hardware or software emulation?
Kind regards
ikarus
Offline
The development board hosts the PN544. I have emulation working on that. This is all done in hardware.
Offline
I'm very interested in a board like that. Can you make it public?
Offline
@ziomekdjpl:
Hmmm.. that is very weird. Please double check the key file
(or send it from one mobile to another via bluetooth to get an exact copy).
I will dig into the code to see if there is some issue!
Oh, and is there any error message? does the app crash?
Last edited by ikarus (2013-07-24 14:31:17)
Offline
New release! (Version 1.5.0: APK-file, Google Play)
(See: original post, updated)
* New Feature: Replace all Access Conditions from the
dump you want to write with custom ones.
* Fixed parse issue for to big/small integers (in value block tool).
* Fixed crash issue for incorrect Access Conditions.
* Some minor bug fixes.
Regarding the new feature:
This will become in handy if the dump contains Access Conditions
that will be permanent for a tag. In case the reader does not check
them, you can easily use custom ones to make the tag reusable.
Kind regards
ikarus
Last edited by ikarus (2013-08-22 11:03:26)
Offline
hello,
I would like to admit it is a great app.
The only problem I face was whet attempting to write custom UID to a special card.
MCT gives error message.
Under linux using ACR122U I am able to write the new UID to the same card
Where can be the problem.
Phone S3, the same result with version 1.4.2 and 1.5.0
Offline
I would like to admit it is a great app.
Thanks!
The only problem I face was whet attempting to write custom UID to a special card.
MCT gives error message.
This must be because it is another type of UID writable Mifare Classic tag.
Please see this post and the the following post.
Offline
Hi,
I can not confirm the type of the card, please PMme where to send you one for testing.
Any chance that MCT will work with a S3 cable and ACR122U?
Offline
for the card I am talking about the following do the job
$ nfc-mfsetuid deadbeef
Offline
Hi,
for the card I am talking about the following do the job
$ nfc-mfsetuid deadbeef
As far as I know the "nfc-mfsetuid" command is for the type of cards that need the special
command sequence to put them into the state where writing to the manufacturer block is possible.
So no writing the UID with MCT here.
Any chance that MCT will work with a S3 cable and ACR122U?
I don't know how Android handles external RFID-Readers. But I think it will
not work, sorry. The app just uses the normal NFC functionality that is provided
by the Android API.
Offline
New release! (Version 1.5.1: APK-file, Google Play)
(See: original post, updated)
* Show sectors that could not be read.
(This information will not be saved in a dump.)
* Fixed the "general purpose byte" (GPB) in the
factory format feature.
* Fixed crash issue on some rare "tag lost"-events.
* Updated support list.
The new Nexus 7 (2013) is not able to read/write
Mifare Classic (due to hardware).
* Some bug fixes.
Regarding "Show sectors that could not be read":
This is what it looks like.
These information will be cleaned on "update colors" and on "save dump".
Also, information about unreadable sectors will not be saved into dumps.
Kind regards
ikarus
Offline
New release! (Version 1.5.2: APK-file, Google Play)
(See: original post, updated)
* Hotfix: Fixed crash issue introduced with the release of version 1.5.1
(This issue occurred in combination of unreadable sectors,
the focused text field (in Dump Editor) and the "update colors" or
"save dump" function.)
Sorry for any issue this bug may have caused.
Kind regards
ikarus
Offline
Hi thanks for your app !
Can you please send another link to the good king of tag for uid writing ?
The previous link seem to be dead.
Offline
@mercutio
Hi,
These cards should work: http://www.aliexpress.com/item/free-shi … 16706.html
At least the description says so:
block 0 directly with normal mifare read-write device modification, don't need special equipment.
Edit: Oops, this is only a bundle of 10 cards for $200. But you get the idea.
Just search for cards on which block 0 is writable with a normal mifare read-write command.
Last edited by ikarus (2013-10-13 12:39:35)
Offline
Thank you.
I just ordered one.
Do you think your app will be able to write on the other kind of chinese card one day ?
Offline
No it will not be possible unless you reprogram the nfc chip firmware (that is signed at factory).
Offline
No it will not be possible unless you reprogram the nfc chip firmware (that is signed at factory).
Can those "special" cards be used with the proxmark to change the UID with "hf mf csetblk 0" ?
I found some really cheap ones but they are the "special" kind...
Offline
Yes, with proxmark you can !
You can also find a windows GUI that is able to easily manage it and recover it if you write "worng values" do sector0block0.
Last edited by asper (2013-10-14 09:09:30)
Offline
New release! (Version 1.5.3: APK-file, Google Play)
(See: original post, updated)
* Improved Mifare Classic support check.
(The app tells you now whether it is your device or the tag that does not
support Mifare Classic.)
* Fixed crash issue for too big/many key files.
* Some bug fixes.
Kind regards
ikarus
Offline
New release! (Version 1.6.0: APK-file, Google Play)
(See: original post, updated)
* New Feature: Decode & Encode Mifare Classic Access Conditions.
(Access the new tool via "Tools" form main menu or
form the dump editor menu.)
The new feature is basically the same as aspers Access Condition tool.
The layout/design is not table based and therefore not as clear as the PC version.
But unfortunately there is no native table-view in Android that is equivalent to the table-views in PC frameworks.
I hope you like it: Screenshot
Kind regards
ikarus
Offline
Great work man ! Thank you !!
Offline
Hi! I just received this http://www.aliexpress.com/snapshot/278336896.html
Still unable to write sector 0 block 0 it say it's write protected.
Help please
Offline
That is weird.
The description in the link states:
block 0 directly with normal mifare read-write device modification, don't need special equipment
This is what MCT (or Android) does. A normal Mifare read-write modification.
Is it possible that you changed the Access Conditions to a state where they do not allow writing to block 0 anymore?
Offline