Could write, verified, still not working

Support
1

Hello guys,

Its pretty hard to find legit writable mifares, I sent back many until I found these round stickers that I could write on them.

The problem that after writing and verification they still wont work, wont open the door. The sensor flashing between red and green but stays red.

What could be the problem?

[+] UID: 3B 20 62 81
[+] ATQA: 00 04

+\] SAK: 08 \[2

[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities : Gen 1a
[+] Prng detection: weak
[#] Auth error

2

Some systems can detect Gen1a magic cards, do you have a gen2 you could try?
I think emulating would also work to check

You might also post a dump of the original and the clone, if you want some more sets of eyes to double check for discrepancies or oddities

1 Like
3

Dont have gen2 sorry.

Here are the dumps:

The original:

{
  "Created": "proxmark3",
  "FileType": "mfcard",
  "Card": {
    "UID": "3B206E84",
    "ATQA": "0400",
    "SAK": "08"
  },
  "blocks": {
    "0": "3B206E84F18804004645859165100709",
    "1": "00000000000000000000000000000000",
    "2": "00000000000000000000000009000000",
    "3": "48455841435471E78800FFFFFFFFFFFF",
    "4": "00000000000000000000000000000000",
    "5": "00000000000000000000000000000000",
    "6": "00000000000000000000000000000000",
    "7": "48455841435470F78800FFFFFFFFFFFF",
    "8": "00000000000000000000000000000000",
    "9": "00000000000000000000000000000000",
    "10": "00000000000000000000000000000000",
    "11": "48455841435470F78800FFFFFFFFFFFF",
    "12": "00000000000000000000000000000000",
    "13": "00000000000000000000000000000000",
    "14": "00000000000000000000000000000000",
    "15": "48455841435470F78800FFFFFFFFFFFF",
    "16": "00000000000000000000000000000000",
    "17": "00000000000000000000000000000000",
    "18": "00000000000000000000000000000000",
    "19": "48455841435470F78800FFFFFFFFFFFF",
    "20": "00000000000000000000000000000000",
    "21": "00000000000000000000000000000000",
    "22": "00000000000000000000000000000000",
    "23": "48455841435478778800FFFFFFFFFFFF",
    "24": "00000000000000000000000000000000",
    "25": "00000000000000000000000000000000",
    "26": "00000000000000000000000000000000",
    "27": "48455841435478778800FFFFFFFFFFFF",
    "28": "00000000000000000000000000000000",
    "29": "00000000000000000000000000000000",
    "30": "00000000000000000000000000000000",
    "31": "48455841435478778800FFFFFFFFFFFF",
    "32": "00000000000000000000000000000000",
    "33": "00000000000000000000000000000000",
    "34": "00000000000000000000000000000000",
    "35": "48455841435478778800FFFFFFFFFFFF",
    "36": "E996D5536B9157442244704A9DF40147",
    "37": "16BC2DB4B5D1D70B8B40785AE26B8845",
    "38": "58B03584D5110913264C606A82AB8408",
    "39": "48455841435478778800FFFFFFFFFFFF",
    "40": "00000000000000000000000000000000",
    "41": "00000000000000000000000000000000",
    "42": "00000000000000000000000000000000",
    "43": "48455841435478778800FFFFFFFFFFFF",
    "44": "945F9BFA5C78FF96CC8AEA37A89BF11A",
    "45": "7F6213FA1E1879FD43A7C6049FFE2097",
    "46": "B67EAFF90BDDF0A74F925E249D1E2AFE",
    "47": "48455841435478778800FFFFFFFFFFFF",
    "48": "00000000000000000000000000000000",
    "49": "00000000000000000000000000000000",
    "50": "00000000000000000000000000000000",
    "51": "48455841435478778800FFFFFFFFFFFF",
    "52": "00000000000000000000000000000000",
    "53": "00000000000000000000000000000000",
    "54": "00000000000000000000000000000000",
    "55": "48455841435478778800FFFFFFFFFFFF",
    "56": "00000000000000000000000000000000",
    "57": "00000000000000000000000000000000",
    "58": "00000000000000000000000000000000",
    "59": "48455841435478778800FFFFFFFFFFFF",
    "60": "684578616374202D20434F47454C4543",
    "61": "6465706F74206C6567616C20494E5049",
    "62": "4AD10F08494E545241544F4E45202020",
    "63": "48455841435407878F00484558414354"
  },
  "SectorKeys": {
    "0": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "71E78800",
      "AccessConditionsText": {
        "block0": "read AB; write AB; increment AB; decrement transfer restore AB",
        "block1": "read AB; write B",
        "block2": "read AB; write B",
        "block3": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "1": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block4": "read AB; write B",
        "block5": "read AB; write B",
        "block6": "read AB; write B",
        "block7": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "2": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block8": "read AB; write B",
        "block9": "read AB; write B",
        "block10": "read AB; write B",
        "block11": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "3": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block12": "read AB; write B",
        "block13": "read AB; write B",
        "block14": "read AB; write B",
        "block15": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "4": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block16": "read AB; write B",
        "block17": "read AB; write B",
        "block18": "read AB; write B",
        "block19": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "5": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block20": "read AB; write B",
        "block21": "read AB; write B",
        "block22": "read AB; write B",
        "block23": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "6": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block24": "read AB; write B",
        "block25": "read AB; write B",
        "block26": "read AB; write B",
        "block27": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "7": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block28": "read AB; write B",
        "block29": "read AB; write B",
        "block30": "read AB; write B",
        "block31": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "8": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block32": "read AB; write B",
        "block33": "read AB; write B",
        "block34": "read AB; write B",
        "block35": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "9": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block36": "read AB; write B",
        "block37": "read AB; write B",
        "block38": "read AB; write B",
        "block39": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "10": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block40": "read AB; write B",
        "block41": "read AB; write B",
        "block42": "read AB; write B",
        "block43": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "11": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block44": "read AB; write B",
        "block45": "read AB; write B",
        "block46": "read AB; write B",
        "block47": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "12": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block48": "read AB; write B",
        "block49": "read AB; write B",
        "block50": "read AB; write B",
        "block51": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "13": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block52": "read AB; write B",
        "block53": "read AB; write B",
        "block54": "read AB; write B",
        "block55": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "14": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block56": "read AB; write B",
        "block57": "read AB; write B",
        "block58": "read AB; write B",
        "block59": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "15": {
      "KeyA": "484558414354",
      "KeyB": "484558414354",
      "AccessConditions": "07878F00",
      "AccessConditionsText": {
        "block60": "read AB",
        "block61": "read AB",
        "block62": "read AB",
        "block63": "read ACCESS by AB",
        "UserData": "00"
      }
    }
  }
}
4

The clone:

{
  "Created": "proxmark3",
  "FileType": "mfcard",
  "Card": {
    "UID": "3B206E84",
    "ATQA": "0400",
    "SAK": "08"
  },
  "blocks": {
    "0": "3B206E84F18804004645859165100709",
    "1": "00000000000000000000000000000000",
    "2": "00000000000000000000000009000000",
    "3": "48455841435471E78800FFFFFFFFFFFF",
    "4": "00000000000000000000000000000000",
    "5": "00000000000000000000000000000000",
    "6": "00000000000000000000000000000000",
    "7": "48455841435470F78800FFFFFFFFFFFF",
    "8": "00000000000000000000000000000000",
    "9": "00000000000000000000000000000000",
    "10": "00000000000000000000000000000000",
    "11": "48455841435470F78800FFFFFFFFFFFF",
    "12": "00000000000000000000000000000000",
    "13": "00000000000000000000000000000000",
    "14": "00000000000000000000000000000000",
    "15": "48455841435470F78800FFFFFFFFFFFF",
    "16": "00000000000000000000000000000000",
    "17": "00000000000000000000000000000000",
    "18": "00000000000000000000000000000000",
    "19": "48455841435470F78800FFFFFFFFFFFF",
    "20": "00000000000000000000000000000000",
    "21": "00000000000000000000000000000000",
    "22": "00000000000000000000000000000000",
    "23": "48455841435478778800FFFFFFFFFFFF",
    "24": "00000000000000000000000000000000",
    "25": "00000000000000000000000000000000",
    "26": "00000000000000000000000000000000",
    "27": "48455841435478778800FFFFFFFFFFFF",
    "28": "00000000000000000000000000000000",
    "29": "00000000000000000000000000000000",
    "30": "00000000000000000000000000000000",
    "31": "48455841435478778800FFFFFFFFFFFF",
    "32": "00000000000000000000000000000000",
    "33": "00000000000000000000000000000000",
    "34": "00000000000000000000000000000000",
    "35": "48455841435478778800FFFFFFFFFFFF",
    "36": "E996D5536B9157442244704A9DF40147",
    "37": "16BC2DB4B5D1D70B8B40785AE26B8845",
    "38": "58B03584D5110913264C606A82AB8408",
    "39": "48455841435478778800FFFFFFFFFFFF",
    "40": "00000000000000000000000000000000",
    "41": "00000000000000000000000000000000",
    "42": "00000000000000000000000000000000",
    "43": "48455841435478778800FFFFFFFFFFFF",
    "44": "945F9BFA5C78FF96CC8AEA37A89BF11A",
    "45": "7F6213FA1E1879FD43A7C6049FFE2097",
    "46": "B67EAFF90BDDF0A74F925E249D1E2AFE",
    "47": "48455841435478778800FFFFFFFFFFFF",
    "48": "00000000000000000000000000000000",
    "49": "00000000000000000000000000000000",
    "50": "00000000000000000000000000000000",
    "51": "48455841435478778800FFFFFFFFFFFF",
    "52": "00000000000000000000000000000000",
    "53": "00000000000000000000000000000000",
    "54": "00000000000000000000000000000000",
    "55": "48455841435478778800FFFFFFFFFFFF",
    "56": "00000000000000000000000000000000",
    "57": "00000000000000000000000000000000",
    "58": "00000000000000000000000000000000",
    "59": "48455841435478778800FFFFFFFFFFFF",
    "60": "684578616374202D20434F47454C4543",
    "61": "6465706F74206C6567616C20494E5049",
    "62": "4AD10F08494E545241544F4E45202020",
    "63": "48455841435407878F00484558414354"
  },
  "SectorKeys": {
    "0": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "71E78800",
      "AccessConditionsText": {
        "block0": "read AB; write AB; increment AB; decrement transfer restore AB",
        "block1": "read AB; write B",
        "block2": "read AB; write B",
        "block3": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "1": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block4": "read AB; write B",
        "block5": "read AB; write B",
        "block6": "read AB; write B",
        "block7": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "2": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block8": "read AB; write B",
        "block9": "read AB; write B",
        "block10": "read AB; write B",
        "block11": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "3": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block12": "read AB; write B",
        "block13": "read AB; write B",
        "block14": "read AB; write B",
        "block15": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "4": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "70F78800",
      "AccessConditionsText": {
        "block16": "read AB; write B",
        "block17": "read AB; write B",
        "block18": "read AB; write B",
        "block19": "read ACCESS by AB",
        "UserData": "00"
      }
    },
    "5": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block20": "read AB; write B",
        "block21": "read AB; write B",
        "block22": "read AB; write B",
        "block23": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "6": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block24": "read AB; write B",
        "block25": "read AB; write B",
        "block26": "read AB; write B",
        "block27": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "7": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block28": "read AB; write B",
        "block29": "read AB; write B",
        "block30": "read AB; write B",
        "block31": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "8": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block32": "read AB; write B",
        "block33": "read AB; write B",
        "block34": "read AB; write B",
        "block35": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "9": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block36": "read AB; write B",
        "block37": "read AB; write B",
        "block38": "read AB; write B",
        "block39": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "10": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block40": "read AB; write B",
        "block41": "read AB; write B",
        "block42": "read AB; write B",
        "block43": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "11": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block44": "read AB; write B",
        "block45": "read AB; write B",
        "block46": "read AB; write B",
        "block47": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "12": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block48": "read AB; write B",
        "block49": "read AB; write B",
        "block50": "read AB; write B",
        "block51": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "13": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block52": "read AB; write B",
        "block53": "read AB; write B",
        "block54": "read AB; write B",
        "block55": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "14": {
      "KeyA": "484558414354",
      "KeyB": "FFFFFFFFFFFF",
      "AccessConditions": "78778800",
      "AccessConditionsText": {
        "block56": "read AB; write B",
        "block57": "read AB; write B",
        "block58": "read AB; write B",
        "block59": "write A by B; read ACCESS by AB; write ACCESS by B; write B by B",
        "UserData": "00"
      }
    },
    "15": {
      "KeyA": "484558414354",
      "KeyB": "484558414354",
      "AccessConditions": "07878F00",
      "AccessConditionsText": {
        "block60": "read AB",
        "block61": "read AB",
        "block62": "read AB",
        "block63": "read ACCESS by AB",
        "UserData": "00"
      }
    }
  }
}
5

Oh silly me, I just realize i wrote [+] ATQA: 00 04 instead of 0400.

I rewrote it but now it died on me:

[usb] pm3 --> hf mf csetuid -u 3B206E84 -a 0400 -s 08
[+] old block 0... 3B206E84F10804006263646566676869
[+] new block 0... 3B206E84F10800046263646566676869
[+] Old UID... 3B 20 6E 84
[+] New UID... 3B 20 6E 84  ( verified )
[usb] pm3 --> hf search
[\] Searching for ISO14443-A tag...
[=] Card doesn't support standard iso14443-3 anticollision

[+] Valid ISO 14443-A tag found

“Card doesn’t support standard iso14443-3 anticollision“

Does it mean the tag is dead?

6

My guess would be that’s just a coupling issue, I don’t think that was likely to cause an issue

Try a backdoor command too, hf mf cview or the likes, see if it responds to that

Usually Gen1a credentials are recoverable even if the write did go wrong and it’s misconfigured, fortunately

2 Likes
7

It probably means the card was misconfigured by accident. Possibly recoverable using raw commands. I don’t have those commands handy right now though.

2 Likes
8

hf 14a config --atqa skip

And then

hf mf cwipe

And finally

hf 14a config --std

Perhaps?

2 Likes
9

Thanks for the help, hf 14a config --atqa skip and hf mf cwipe worked, didnt try hf 14a config --stdyet but it gave me some ideas.

First I will upgrade my firmware cause im lacking the command “hf 14a search”, from here:

Hardware

–= uC: AT91SAM7S512 Rev B
–= Embedded flash memory 512K bytes ( 59% used )

I have a Proxmark3 Easy (the “Generic” model). so the right file I guess is “Latest RRG Iceman …“ file?

10

This one:

https://www.proxmarkbuilds.org/latest/rrg_other.php

3 Likes
11

Ok, to recover a gen1a:

hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip

hf mf cwipe

hf 14a config --std

That should fix anything you can do to a 1a!

Similar deal for gen2 if you screw the bcc

hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip

for 1k

hf mf wrbl --blk 0 --force -k FFFFFFFFFFFF -d 11223344440804006263646566676869

for 4k

hf mf wrbl --blk 0—force -k FFFFFFFFFFFF -d 11223344441802006263646566676869
hf 14a config --std

Finally, Many systems now detect gen1a chips which may even

result in a rubbish write getting done to block 0.

so I’d suggest trying a gen2 or even a gen4 where you can turn off the accesses once it’s written,

Be sure to leave one backdoor open or you’ll lock the tag, but it should work.

3 Likes