Cloning HD iCLASS MIFARE Px DM18Y

Support
21

I might be getting closer … this is what Amal’s post states:

    Cloning an HID iClass credential to your flexClass
    DT Info
    Aug 2021
    Aug 2021

    amal
    Aug '21
    Steps to clone an HID iClass legacy / standard credential
    Put enrolled iClass credential on HF antenna of Proxmark3 100

    hf ic dump --ki 0
    hf ic wrbl --ki 0 -b 6 -d 030303030003E017
    hf ic wrbl --ki 0 -b 7 -d 10A145919ED16F50

Here is what my "hf ic dump --ki 0: shows me:

[usb] pm3 → hf ic dump --ki 0
[+] Using AA1 (debit) key[0] AE A6 84 A6 DA B2 32 78
[=] Card has at least 2 application areas. AA1 limit 18 (0x12) AA2 limit 255 (0xFF)
.

[=] --------------------------- Tag memory ----------------------------

[=] block# | data | ascii |lck| info
[=] ---------±------------------------±---------±–±---------------
[=] 0/0x00 | 4A 4B 16 12 FF FF 12 E0 | JK… | | CSN
[=] 1/0x01 | 12 FF FF FF E9 7F FF 3C | …< | | Config
[=] 2/0x02 | FF FF FF FF 0D F9 FF FF | … | | E-purse
[=] 3/0x03 | E7 98 4A 3C D9 F9 22 C9 | …J<…". | | Debit
[=] 4/0x04 | FF FF FF FF FF FF FF FF | … | | Credit
[=] 5/0x05 | FF FF FF FF FF FF FF FF | … | | AIA
[=] 6/0x06 | 03 03 03 03 00 03 E0 17 | … | | User / Cred
[=] 7/0x07 | C2 68 67 D2 CD 83 78 F7 | .hg…x. | | User / Cred
[=] 8/0x08 | 2A D4 C8 21 1F 99 68 71 | *…!..hq | | User / Cred
[=] 9/0x09 | 2A D4 C8 21 1F 99 68 71 | *…!..hq | | User / Cred
[=] 10/0x0A | FF FF FF FF FF FF FF FF | … | | User
[=] 11/0x0B | FF FF FF FF FF FF FF FF | … | | User
[=] 12/0x0C | FF FF FF FF FF FF FF FF | … | | User
[=] 13/0x0D | FF FF FF FF FF FF FF FF | … | | User
[=] 14/0x0E | FF FF FF FF FF FF FF FF | … | | User
[=] 15/0x0F | FF FF FF FF FF FF FF FF | … | | User
[=] 16/0x10 | FF FF FF FF FF FF FF FF | … | | User
[=] 17/0x11 | FF FF FF FF FF FF FF FF | … | | User
[=] 18/0x12 | FF FF FF FF FF FF FF FF | … | | User
[=] ---------±------------------------±---------±–±---------------
[?] yellow = legacy credential

[+] saving dump file - 19 blocks read
[+] saved 152 bytes to binary file C:\ProxSpace\pm3/hf-iclass-4A4B1612FFFF12E0-dump-001.bin
[+] saved 19 blocks to text file C:\ProxSpace\pm3/hf-iclass-4A4B1612FFFF12E0-dump-001.eml
[+] saved to json file C:\ProxSpace\pm3/hf-iclass-4A4B1612FFFF12E0-dump-001.json
[?] Try hf iclass decrypt -f to decrypt dump file
[?] Try hf iclass view -f to view dump file

Does anyone have any ideas what I do next? Again, what type of blank card/fob do I need and where can I purchase them?

~Blackhawks

22

The messed up LF command makes me think something went haywire with the application image. J would do a pm3-flash-all again just to be sure?

23

in which you must have cut out the LF commands/other portions of the firmware to make it fit.

when you have a 256k board you can’t have the full firmware on it, it’s too small. what i recommend you do is make two Makefile.platform files corresponding to which flags you have skipped and use them interchangeably when you need that side of the proxmark

1 Like
24

Oh good eye on that!

25

Fine Gents amal & Equipter - much appreciated! :slight_smile:

But I still have issues. The only way I could do the ./pm3-flash-fullimage is by uncommenting everything in the section as the Readme file suggested - see below.

#PLATFORM=PM3RDV4
#PLATFORM=PM3GENERIC

If you want more than one PLATFORM_EXTRAS option, separate them by spaces:

#PLATFORM_EXTRAS=BTADDON
#PLATFORM_EXTRAS=FLASH
#PLATFORM_EXTRAS=BTADDON FLASH
#STANDALONE=LF_SAMYRUN

Uncomment the lines below in order to make a 256KB image

and comment out the lines above

PLATFORM=PM3GENERIC
PLATFORM_SIZE=256
STANDALONE=
SKIP_HITAG=1
SKIP_FELICA=1
SKIP_HFPLOT=1
SKIP_NFCBARCODE=1
SKIP_ZX8211=1
SKIP_LF=1

I only now clued in that the SKIP_LF=1 must be taking out my LF functions. :frowning:

So, if I am correct, my Proxmark Easy is pretty well out of memory space. What else can I delete that will allow me to bring back the LF functions? I don’t see anything else I can take out that allows me to #SKIP_LF=1 :frowning:

Also, if did end up creating a new “Makefile.platform.WithLF” file, how do I switch back from the original Makefile.platform file and the new Makefile.platform.WithLF file without doing all the commands again (make clean && make -j8 all + ./pm3-flash-bootrom +./pm3-flash-fullimage) before running pm3?

I may have missed something and/or not understand something so any input would be much appreciated! I appreciate your patience with this newbie! :slight_smile:

~Blackhawks

26

Nevermind … I figured it out! :slight_smile:

Definitions Rough estimation of the saved space
STANDALONE= 3.6KB
SKIP_LF=1 25.8KB
SKIP_HITAG=1 24.2KB
SKIP_EM4x50=1 2.9KB
SKIP_ISO15693=1 3.2KB
SKIP_LEGICRF=1 3.9KB
SKIP_ISO14443b=1 3.7KB
SKIP_ISO14443a=1 63.0KB
SKIP_ICLASS=1 10.5KB
SKIP_FELICA=1 4.0KB
SKIP_NFCBARCODE=1 1.4KB
SKIP_HFSNIFF=1 0.5KB
SKIP_HFPLOT=1 0.3KB
SKIP_ZX8211=1 0.3KB

This is what I used for my setup:
PLATFORM=PM3GENERIC
PLATFORM_SIZE=256
STANDALONE=
SKIP_HITAG=1
SKIP_FELICA=1
SKIP_HFPLOT=1
SKIP_NFCBARCODE=1
SKIP_ZX8211=1
#SKIP_LF=1
SKIP_ISO14443a=1

~Blackhawks

1 Like