Help needed to identify access-card

you PM3 looks like it is working correctly, it may be the placement if your card,
Try your searches again, giving it some seperation put a (non conductive) spacer between card and PM3 antenna.

Alternatively, try scanning with TagInfo and see if you get a result.

Do you have any info on the readers?

Make?
model?
Photos?

Any writing on the card?

This is the manufacturer of the access system.

I tried an “auto” search.

[=] Failed both LF / HF SEARCH,
[=] Trying lf read and save a trace for you
[#] LF Sampling config
[#] [q] divisor… 95 ( 125.00 kHz )
[#] [b] bits per sample… 8
[#] [d] decimation… 1
[#] [a] averaging… no
[#] [t] trigger threshold… 0
[#] [s] samples to skip… 0
[#]
[=] FILE PATH: lf_unknown_2023-02-21_10:18.pm3
[+] saved 40000 bytes to PM3 file ‘lf_unknown_2023-02-21_10:18.pm3

Ok…I’m getting some light into the dark…

It was my fault. That one that is not responding…is correct not to respond. There is no
chip in it. I used the light of my iPhone to check.

This is the real one to clone:

[=] hf search
:clock8: Searching for ISO14443-A tag…
[+] UID: 04 1B 68 82 80 0F 90
[+] ATQA: 03 44
[+] SAK: 20 [1]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+] MIFARE DESFire CL2
[+] MIFARE DESFire EV1 256B/2K/4K/8K CL2
[+] MIFARE DESFire EV2 2K/4K/8K/16K/32K
[+] MIFARE DESFire EV3 2K/4K/8K
[+] MIFARE DESFire Light 640B
[+] NTAG 4xx
[=] -------------------------- ATS --------------------------
[+] ATS: 0F 75 77 81 02 53 45 20 44 45 53 46 69 72 65 [ 53 00 ]
[=] 0F… TL length is 15 bytes
[=] 75… T0 TA1 is present, TB1 is present, TC1 is present, FSCI is 5 (FSC = 64)
[=] 77… TA1 different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]
[=] 81… TB1 SFGI = 1 (SFGT = 8192/fc), FWI = 8 (FWT = 1048576/fc)
[=] 02… TC1 NAD is NOT supported, CID is supported

[=] -------------------- Historical bytes --------------------
[+] 53452044455346697265

[?] Hint: try hf mfdes info

[+] Valid ISO 14443-A tag found

Sorry my fault.

[usb|script] pm3 → hf mfdes info

[=] ---------------------------------- Tag Information ----------------------------------
[+] UID: 04 1B 68 82 80 0F 90
[+] Batch number: CF 5B 96 61 90
[+] Production date: week 39 / 2021
[+] Product type: MIFARE DESFire native IC (physical card)

[=] — Hardware Information
[=] raw: 04010112001605
[=] Vendor Id: NXP Semiconductors Germany
[=] Type: 0x01
[=] Subtype: 0x01
[=] Version: 12.0 ( DESFire EV2 )
[=] Storage size: 0x16 ( 2048 bytes )
[=] Protocol: 0x05 ( ISO 14443-2, 14443-3 )

[=] — Software Information
[=] raw: 04010102011605
[=] Vendor Id: NXP Semiconductors Germany
[=] Type: 0x01
[=] Subtype: 0x01
[=] Version: 2.1
[=] Storage size: 0x16 ( 2048 bytes )
[=] Protocol: 0x05 ( ISO 14443-3, 14443-4 )

[=] --------------------------------- Card capabilities ---------------------------------

[=] — Tag Signature
[=] IC signature public key name: DESFire Ev2
[=] IC signature public key value: […existing but deleted…]
[=] Elliptic curve parameters: NID_secp224r1
[=] TAG IC Signature: […existing but deleted …]
[+] Signature verification: successful

[+] — AID list
[+] AIDs: ffffff, e56918, e56919, e5691a, f52318, 1023f5

[+] ------------------------------------ PICC level -------------------------------------
[+] Applications count: 6 free memory 1344 bytes
[+] PICC level auth commands:
[+] Auth… NO
[+] Auth ISO… NO
[+] Auth AES… YES
[+] Auth Ev2… YES
[+] Auth ISO Native… YES
[+] Auth LRP… NO
[+] PICC level rights:
[+] [1…] CMK Configuration changeable : YES
[+] [.1…] CMK required for create/delete : NO
[+] […1.] Directory list access with CMK : NO
[+] […1] CMK is changeable : YES
[+]
[+]
[+] Key: AES
[+] key count: 1
[+] PICC key 0 version: 1 (0x01)

[=] — Free memory
[+] Available free memory on card : 1344 bytes

[=] Standalone DESFire

@Pilgrimsmaster

So the next logical step to test would be to order some of your mentioned cards from LAB401

and clone the original card to it.

But since it is a MIFARE DESFire ev2 with 7byte UID…that might be the
end of my journey?

No ring…no implant :frowning: ???

Desfire unfortunately cannot be cloned.

:rofl: :rofl: :rofl:

It will still be highly unlikey you will be cloning the card, That is a magic card, but that will only let you change the UID, that’s pretty much all)
It may work, but just unlikely if they have implemented the DESFire capabilites

There is not NO chance, just a LOW chance.
DESFire EV2, you really have 3 options:

The magic card (if it works) in a custom conversion by Amal
Have the original card converted by Amal
Enroll a FlexDF2 into the Access system

When you have a device that is not responding to HF search or LF search, then the next step is to use the “tune” commands like lf tune and hf tune and present the device to each. If the voltage doesn’t drop or doesn’t drop hardly at all, then you likely don’t have a device with an RFID chip inside… but if say, for example, the LF tune numbers drop significantly then it just means there is something in there that the proxmark3 currently can’t detect / read. It might then make sense to reach out to iceman on his discord server to see what next steps might be. He’s always looking for new fobs and chip types to work with and integrate support for on the proxmark3.

I had a talk with the guy who is responsible for the access-card. Ok. His response was not a
HURRAY but it also not a NO.

Product type: MIFARE DESFire native IC (physical card)
[=] Version: 12.0 ( DESFire EV2 )
UID: 04 1B 68 82 80 0F 90

Ist the basic information from the card, so the flexDF2 DESFire EV2 would be the right
choice to test.

Is it delivered in a form that the registration and function can be tested before I get it implanted?

Yes Buddy, Its in a sealed pouch that you can easily read and write to

So I consider to buy a flexDF2 around easter from digiwell germany

Your best bet is to get a desfire card from Amazon and try to register that first. If that is successful then the implant just needs to be tested with the readers but it should not be an issue.

@amal

Which type of cards came with the PM3 Easy from you?

Unlikely there will be a DESFire amongst them.

At a minimum there will be a T5577 and a Mifare Classic 1k

Have you set your PM3 up yet?

If so, do an `hf search’

or use TagInfo to scan your cards…

Yeah it’s just magic mifare classic and t5577 with the proxmark3

Hi.

I’ve ordered flexDF2 from digiwell and it already arrived in germany.
It’s waiting for til eastern to be picked up.

Did you do this before ordering your FlexDF2 ?

1 Like

Nope. Just ordered it. Judt another card won‘t persuade the officemanager to register it.