Making the NExT read only (with a password)

[theradioguy]

Hello all,

Just got my NExT implanted last week and have been having a blast setting it all up.

For the HF side of the chip, I am storing some encrypted backup text and would ideally like to make the implant read only, with a password required to overwrite the data. This would basically be a sanity check to avoid me accidentally overwriting the data unintentionally.

I found this thread Can my xNT be easily set to read-only? - #2 by amal referencing the xNT and I believe I have figured out the default password on the NExT, however, when I try and send the second and 3rd lines of hex I just receive an NAK response. Below is what I am sending and receiving:

TX: 1B xx xx xx xx
RX: 0000
TX: A2 E3 04 00 00 04
RX: NAK
TX: A2 E4 00 00 00 00
RX: NAK

When I send an intentionally invalid password, I receive an ‘NAK’ on line 1 as well, so I believe this means the password is correct.

Anyone have any pointers?

[Devilclarke]

How are you sending the commands

[Pilgrimsmaster]

I believe there are 2 commonly known passwords
DNGR and in your case NExT

Have you tried both?

There might be something in here @DonFire posted for the xSIID that could help

XSIID - password protecting the data inside your xSIID chip?

Ok, so here are the NFC Shell commands to prevent writing pages 04 onwards (user memory) without the password, keeping the default password of DNGR converted to hex using ascii codes: 1B444E4752 A2E300000004 If you want to change the password too, here’s the short way: 1B444E4752 A2E300000004 A2E5XXXXXXXX An explanation: First is the PWD_AUTH command (1B), using the DT set default password of DNGR (44 4E 47 52). This allows us to now write to any protected memory, which if I recall correctl…

[theradioguy]

I’m using the NFC Shell app on Android to send the commands

[theradioguy]

Thanks for the suggestion, using the DNGR password results in the first line coming back ‘NAK’ which is what I have observed when using a deliberately invalid password

[Pilgrimsmaster]

You sounds like you know what you are doing; but better safe than sorry, so just a little reminder for you, just be very careful when using shell commands, it is easy to get your implant all kinds of fucked up if you make a mistake with your command

[Pilgrimsmaster]

@theradioguy

using the DNGR password

So have you tried NExT …

[theradioguy]

Yup NExT is what I am using when I get a ‘0000’ response on the first line.

Interestingly, using the article that you linked I was able to successfully change the password, but still unable to set the lock bits using the A2E300000004 string

[theradioguy]

Thanks! Yeah, sightly terrified of potentially bricking this thing

[Zwack]

Might I suggest getting some NTAG 216 stickers, they are relatively cheap on Amazon for example.

Then you can practice your commands on those, ensure that you have the right commands, and that they do what you want, without risking your implant?

[theradioguy]

For sure! Initial experiments I’ve actually done on an unimplemented sacrificial NxT which works without issue with the above commands, just seems odd that the NExT seems to have different behavior

[amal]

You should not need to change page E4 so I would leave that one alone for now. What is your current page E2 and E3 set to?

[theradioguy]

Thanks for the reply, How would I check the current values?

[amal]

How to share NFC chip data via TagInfo app

[theradioguy]

Cheers!
When I look at the ‘full scan’ tab I’m seeing the following:

[00] 04 2E A4 06
[01] 32 0A 54 80
[02] EC 48 0F 00
[03] E1 10 6D 00
…

Does that give you what you need?

[amal]

Yep but the last few pages

[theradioguy]

Gotchya, sorry I see now:

[E2] 00 00 7F BD
[E3] FF 00 00 FF

[amal]

Hmm uh oh. Page E3 has a config byte of FF… I have to review my notes but pretty sure that includes a config lock bit which has been set… therefore you cannot change the configuration at all.

[amal]

Actually what’s page E4 look like?

[amal]

For reference…