Magic Ring / Mifare help: wupC1 error

Support
1

Hi all,

I got a Proxmark3 and Magic Ring. After a learning curve and learning the basics I managed to get around well with the major commands.

However, the fob I want to clone does not just rely on the UID, but rather has multiple encrypted blocks.
autopwn solves this, but when copying the .eml file that results from the autopwn, it shows:

[usb] pm3 → hf mf cload -f example-key.eml
[+] loaded 1024 bytes from text file example-key.eml
[=] Copying to magic gen1a card
[=] .[#] wupC1 error
[!] Can’t set magic card block: 0

The pointers in this previous thread don’t work.

I’ve tried for 5 hours, and I’m hitting a wall - please help me out.

2

Have you tried the videos

3

Yes, I trawled the videos. Cloning with the MCT app also produced an error.

The card are high-frequency mifare 1ks, 4 bytes and should allow for cloning according to the last video.

4

The Magic ring is a gen 2 magic mifare, not a gen 1 so you don’t need the backdoor. You should be able to just do a restore of the dump to the ring although you might then need to write block 0 yourself.

The cload command is failing because there is no backdoor on the magic ring.

1 Like
5

Thanks, this helped a bit. I should use hf mf restore instead of cload.

However, after the first few blocks I end up with:

[=] block 14: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 15: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block 16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 17: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 18: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block 19: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block 20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[=] Writing to manufacture block w key B ( fail )
[=] block 21: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[-] Write to block 1 w key B ( fail )
[=] block 22: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[-] Write to block 2 w key B ( fail )
[=] block 23: 6A 19 87 C4 0A 21 F7 8F 00 5A 7F 33 62 5B C1 29
[#] Auth error
[-] Write to block 3 w key B ( fail )
[=] block 24: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Auth error
[=] Writing to manufacture block w key B ( fail )
(etc)

Any idea?

I might’ve bricked the card; I rewrote block 0 earlier in the process.

6

Try reading the notes in the Proxmark3 GitHub page.

They should be able to help you unbrick your macic ring.

You might have to set key a and key b to perform the restore.