Mifare classic card timer help

I have 2 temp cards for my unit - One that was available for 2 days and 1 that was available for 7 days, both worked on the same door, but stop when the timer runs out. I want to make a card that indefinitely works, so I compared the data and keys on both cards to find the timer. Nothing has a 2 to 7 ratio or 2 minus 7 number, or a date that I can decipher in Hex or Dec.

Anyone have insight on where the timer is? This is for an Assa Abloy Essence lock
Any help would be appreciated.

The different lines are line 0, 7, 24, 25 & 27 (All other lines are the same)

Line 0 UID (1st line is 2 day card)
A0131B8028880400C802002000000023
A025A78CAE880400C804002000000023
Line 7 Key
2003F3145B0C78778869A019D918C30C
800BA51FB70378778869606DFD48AF78
Line 24 Data
235FE6B5F234ADF2FE9C542C6DDAEB26
5C2D0752DE8598137391EA1FF88E5BA6
Line 25 Data
121565DE4D3CB9990000000000000000
66C2D9C0FBEC28F20000000000000000
Line 27 Key
FFFFFFFFFFFF0F00FF00F3990989DF26
FFFFFFFFFFFF0F00FF00C57DE03C46AB

My next step is to change this data to the default values to see if the timer goes away, but I’m sure someone here has a better suggestion. Thanks

My first thoughts were it is likely managed at the lock end?

are these locks networked or standalone?

Yes, I should have shared, they are not networked and are battery operated.

don’t beat yourself up, it’s not an obvious thing to mention.

does it look like this?

I know that for my lock at home (also battery powered) I can buy an add on WiFi hub, with which I could add additional locks, and control access to all connected locks; this might be how your ones are “networked”

I’m not saying they are, just a possibility, and to me the more logical way to manage access rather than on the card itself :man_shrugging:

You might need to do some sleuthing :mag_right:

Yes, that is my system, but I am 99.9% sure they are not networked.
Mgmt needs to come to the unit to program it when the key fob is lost and needs to be changed (I assume the other line item keys that match between cards). Mgmt told us they are not networked as it required extensive infrastructure and cost, the common wifi does not reach to all units to be networked and they are not wired. Thanks for the interest and help.

Good Sleuthing

image

That is super inefficient…

That confirms it then.

So back to your original question…

Can you try using MCT!?

Scan both of your 2 day and 7 day tags
and use “Diff Tool” (Compare dumps)

and share the results.

I’m hoping it will see something you didn’t

2 Likes

Ohh.
Thats a good idea. I had to hand back in the 2 day card to get the 7 day one. I will try to keep the 7 day one and get another card (Not 7 days) soon and post the results in a few days. Tks again.

1 Like

OK well, I made copies of the cards and compared them. It did not find lines 7, 24, 25 & 27, they were all zeros, so they came up identical. The only differences it found were in the UID.

And this

2 Likes

Hmm, Interesting. I discounted that as its part of the cards manufacturers data, but if the lock is using that and its programmable, then that could be it. I will look at other cards I have copied and see what they are, modify it and get back to you. Thank you

2 Likes

You could be right, but off the top of my head, thats the 80400, but I would need to look at the data sheet to confirm

2 Likes

My hunch is that byte is part of a calculated check. Look through the spec to find out for sure though… I’m mobile so I’m leaving it up to you :slight_smile:

S50.pdf (140.3 KB)

4 Likes