How to recovery "dead" sectors?

I have a CUID braclet. After formatting in MCT, the 1, 2 and 13, the sectors are not readable. The program says that there are no keys or the sector is dead. I checked the tag using proxmark3.

[usb] pm3 → hf search
-] Searching for I5014443-A tag.
+] UID: 79 2B 38 2A
ATQA: 00 04
SAK: 08 [2]
Possible types:
MIFARE Classic 1K
proprietary non iso14443-4 card found, RATS not supported
Prng detection: weak
#] Auth error
?] Hint: try hf mfcommands
[+] Valid I50 14443-A tag found

[usb] pm3 → hf 14a info
+1 UID: 79 2B 38 2A
ATQA: 00 04
SAK: 08 [2]
Possible types:
MIFARE Classic 1K
proprietary non is014443-4 card found, RATS not supported
+] Prng detection: weak
「#] Auth error
[?] Hint: try "hf mf’ commands
[usb] pm3 → hf 14a reader
[+] UID: 79 2B 38 2A
[+] ATQA: 00 04
[+] SAK: 08 [2]
[usb] pm3

I am sure that the sectors are not dead, but just MCT formatted something incorrectly. Is it possible to restore the sectors somehow?

We need to use a common terminology to describe the different magic chips… CUID is too generically used by Chinese vendors to be reliable. If you used MCT then you have a gen2 magic mifare chip. Unlike gen1a magic chips, they have no “backdoor command” that enables writing to any sector (including sector 0) regardless of the keys or access bit settings.

Unfortunately, gen2 chips have no backdoor so the sectors behave exactly like legitimate mifare chips. One of the “features” of mifare chip memory sectors is that there is a check done when setting keys and access bits in the sector trailer block of memory sector. In short, you have to write these keys and access bits in a very specific way such that the bits are sent twice, once in the “normal” way and then again “inverted”… if the data sent is not correct in any way, the sector will lock itself and become unrecoverable.

Because you’re using a piece of software and not manually creating the bit pattern for the data you are trying to write, the problem isn’t that the data is invalid, it’s that the write process was corrupted in some way. When dealing with contactless NFC, this typically means a coupling problem between the reader (your phone) and the mifare chip (bracelet) which results in either a torn page while writing (failed write) or data corruption due to a low power state during writing (corrupted write).

Because the magic chip in your bracelet appears to be gen2, like a legitimate mifare chip, there is no known recovery process for this sector.

5 Likes