Hf mf trying to write wrong

Buka · December 28, 2024, 6:06am

this is before chip was

[usb] pm3 → hf mf info

[=] — ISO14443-a Information ---------------------

[+] UID: 4DA73503

[+] ATQA: 00 04

[+] SAK: 08 [2]

[=] — Keys Information

[+] loaded 2 user keys

[+] loaded 61 hardcoded keys

[+] Sector 0 key A… FFFFFFFFFFFF

[+] Sector 0 key B… FFFFFFFFFFFF

[+] Sector 1 key A… FFFFFFFFFFFF

[+] Block 0… 4DA73503DC0804006263646566676869 | bcdefghi

[=] — Fingerprint

[+] Fudan based card

[=] — Magic Tag Information

[+] Magic capabilities… Gen 1a

[=] — PRNG Information

[#] Static nonce… 009080a2

[+] Static nonce… yes

this is i just did this

[usb] pm3 → hf mf csetuid -u 04348252477780 -a 0044 -s 08

[#] wupC1 error

[=] couldn’t get old data. Will write over the last bytes of block 0

[+] new block 0… 04348252477780500844000000000000

[#] wupC1 error

[!!] Can’t set UID. error -1

[usb] pm3 → hf mf info

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

now this chip is freeze no writing just like non writable chip

when i read with flipper zero it’s show me 04348252 UID 0004 08

can we recover this?

Aoxhwjfoavdlhsvfpzha · December 28, 2024, 6:38am

~~You’re trying to set a 14 byte UID?~~

Try hf 14a config --bcc ignore and then retry hf mf info, see if that lets it read the card again

Then run hf 14a config --bcc std

amal · December 28, 2024, 6:47am

Pretty sure that’s hex which would be 7 bytes… still not something you can write to a gen 1 magic mifare

Aoxhwjfoavdlhsvfpzha · December 28, 2024, 6:48am

Wow, brain-fart, thanks!

Buka · December 28, 2024, 6:50am

yeah i just tested with my small brain

Buka · December 28, 2024, 6:51am

[usb] pm3 → hf 14a config --bcc ignore

[usb] pm3 → hf mf info

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[=] — ISO14443-a Information ---------------------

[+] UID: 04 34 82 52

[+] ATQA: 00 04

[+] SAK: 08 [2]

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[=] — Keys Information

[+] loaded 2 user keys

[+] loaded 61 hardcoded keys

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] chkKey: Failed at fast selecting the card!

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[=] — Fingerprint

[=] <n/a>

[=] — Magic Tag Information

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[=] <n/a>

[=] — PRNG Information

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Using BCC0 =0x47

[#] Static nonce… 009080a2

[+] Static nonce… yes

Buka · December 28, 2024, 6:53am

[usb] pm3 → hf 14a config --bcc std

[usb] pm3 →

[usb] pm3 → hf mf info

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

[usb] pm3 →

amal · December 28, 2024, 6:56am

I guess the obvious stuff needs to be asked first…

First of all do your client version and firmware version match?

Secondly, are you sure you are trying to write to a gen 1 magic mifare chip? Is it possibly a Gen 2 chip? Or are you even sure it’s a magic chip that has a writable sector 0?

Buka · December 28, 2024, 7:02am

PM3 last version i updated today,

yes and yes

Aoxhwjfoavdlhsvfpzha · December 28, 2024, 7:18am

Are you sure it isn’t a coupling issue?

Have you tried moving the card all over/under/around the PM3?

You can use the hf tune and/or hf 14a reader -@ commands to help you search for a spot with a good connection

I find many of my Gen1 cards want to be sort of half-on half-off the HF antenna

Buka · December 28, 2024, 7:42am

[usb] pm3 → hf tune

[=] Measuring HF antenna

[=] Press pm3 button or to exit

[=] 13731 mV / 13 V / 16 Vmax

[=] Done!

this is our best position

[usb] pm3 → hf 14a reader -@

[=] Press to exit

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

[#] BCC0 incorrect, got 0x47, expected 0xe0

[#] Aborting

Aoxhwjfoavdlhsvfpzha · December 28, 2024, 7:51am

When you run hf tune you move the card around and look for the spot where the mV number is smallest, in theory that’s where you have the best connection

But, it seems like you’re pretty consistently reading the card, it’s just erroring out.

Anyways, here’s what I think’s happening:

By trying to write a 7 byte UID to a 4 byte UID card, you overwrote some other parts of block 0, which seems to check out:

04348252 47 7780

04348252 47 7780500844000000000000
^UID ^BCC

So now you’ve got a BCC that doesn’t match, just like the error says.
But what still doesn’t make sense to me is why hf 14a config --bcc ignore didn’t work…

Next steps I’d try would be maybe:
hf mf cwipe
or
hf mf csetblk --blk 0 -d 4DA73503DC0804006263646566676869

Buka · December 28, 2024, 8:55am

[usb] pm3 → hf tune

[=] Measuring HF antenna

[=] Press pm3 button or to exit

[=] 13575 mV / 13 V / 13 Vmax

[=] Done!

[usb] pm3 →

13 is best connection, so i keep it on 13

[usb] pm3 → hf mf cwipe

wipe block 0[!] retry block 0 …

[!!] error setting block 0 (-1)

[!!] Can’t wipe card. error -1

[usb] pm3 →

[usb] pm3 → hf mf csetblk --blk 0 -d 4DA73503DC0804006263646566676869

[=] Writing block number: 0 data:4DA73503DC0804006263646566676869

[!!] Can’t write block. error=-1

[usb] pm3 →

amal · December 28, 2024, 8:57am

This isn’t exactly clear. Are you certain it is a gen1a magic mifare chip?

Buka · December 28, 2024, 9:02am

you can see my first post my friend

[+] Magic capabilities… Gen 1a

amal · December 28, 2024, 9:13am

Sorry haha

tenor_gif6015718605463790604 (1)

fonzogl · February 9, 2025, 12:03am

I have the same issue with all the transport cards in my city, with most commands like hf mf autopwn. I’m attaching the log. Any updates?
log_20250208220355.txt (95.8 KB)

Aoxhwjfoavdlhsvfpzha · February 9, 2025, 4:45am

What does hf 14a info say?

fonzogl · February 9, 2025, 8:39am

[usb] pm3 → hf 14a info

[=] ---------- ISO14443-A Information ----------
[+] UID: 5A 8A AA B1 ( ONUID, re-used )
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[=]
[#] BCC0 incorrect, got 0x32, expected 0x72
[#] Aborting
[#] BCC0 incorrect, got 0x32, expected 0x72
[#] Aborting
[#] BCC0 incorrect, got 0x32, expected 0x72
[#] Aborting

[?] Hint: try hf mf commands

Aoxhwjfoavdlhsvfpzha · February 9, 2025, 8:50am

Hmm…

Try disabling BCC checking with hf 14a config --bcc ignore

and then retry hf 14a info and post the output again

Make sure to re-enable BCC checking when you’re done with:
hf 14a config --bcc std