Magic Ring / Mifare help: wupC1 error

Support
1

Hi all,

I got a Proxmark3 and Magic Ring. After a learning curve and learning the basics I managed to get around well with the major commands.

However, the fob I want to clone does not just rely on the UID, but rather has multiple encrypted blocks.
autopwn solves this, but when copying the .eml file that results from the autopwn, it shows:

[usb] pm3 → hf mf cload -f example-key.eml
[+] loaded 1024 bytes from text file example-key.eml
[=] Copying to magic gen1a card
[=] .[#] wupC1 error
[!] Can’t set magic card block: 0

The pointers in this previous thread don’t work.

I’ve tried for 5 hours, and I’m hitting a wall - please help me out.

2

Have you tried the videos

3

Yes, I trawled the videos. Cloning with the MCT app also produced an error.

The card are high-frequency mifare 1ks, 4 bytes and should allow for cloning according to the last video.

4

The Magic ring is a gen 2 magic mifare, not a gen 1 so you don’t need the backdoor. You should be able to just do a restore of the dump to the ring although you might then need to write block 0 yourself.

The cload command is failing because there is no backdoor on the magic ring.

1 Like
5

Thanks, this helped a bit. I should use hf mf restore instead of cload.

However, after the first few blocks I end up with:

[=] block 14: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 15: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block 16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 17: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 18: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 19: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[=] Writing to manufacture block w key B ( fail )
[=] block 21: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[-] Write to block 1 w key B ( fail )
[=] block 22: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[-] Write to block 2 w key B ( fail )
[=] block 23: 6A 19 87 C4 0A 21 F7 8F 00 5A 7F 33 62 5B C1 29
[#] Auth error
[-] Write to block 3 w key B ( fail )
[=] block 24: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[=] Writing to manufacture block w key B ( fail )
(etc)

Any idea?

I might’ve bricked the card; I rewrote block 0 earlier in the process.

6

Try reading the notes in the Proxmark3 GitHub page.

They should be able to help you unbrick your macic ring.

You might have to set key a and key b to perform the restore.

7

Hi @Zwack and @amal ! I’ve been trying to unbrick this v1 magic ring. But now I’m getting BCC0 incorrect error, and can’t make it work. Could you have a quick look?

Log:

[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 11 CN: 369 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 176 CN: 369 parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556956695559A959

[=] raw: 0000000000000020061602e2

[+] Valid HID Prox ID found!

[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands
[usb] pm3 → hf search
:clock8: Searching for ISO14443-A tag…[#] BCC0 incorrect, got 0x43, expected 0xe2
[#] Aborting
[!] :warning: No known/supported 13.56 MHz tags found
[usb] pm3 → hf 14a info
[#] BCC0 incorrect, got 0x43, expected 0xe2
[#] Aborting
[usb] pm3 → hf mf csetuid -u NNNN
[!!] :rotating_light: Parameter error: Invalid HEX value

[usb] pm3 → hf mf csetuid -u BEF256C2
[#] wupC1 error
[=] couldn’t get old data. Will write over the last bytes of block 0
[+] new block 0… BEF256C2D80000000000000000000000
[#] wupC1 error
[!!] :rotating_light: Can’t set UID. error -1
[usb] pm3 →