vepr
May 2, 2023, 5:55pm
1
I’m having trouble writing an NDEF record that can be read via NFC Tools or Taginfo . I can read the record on the Proxmark 3 RDV4 via the “nfc type4a read” command. I’ve been changing settings and digging at this for hours. I don’t know what I’m missing. Any suggestions?
Here are the following commands I’m using:
hf mfdes formatpicc
hf mfdes createapp --aid 000001 --fid E110 --dfhex D2760000850101 --numkeys 01
hf mfdes createfile --aid 000001 --fid 01 --isofid E103 --amode plain --size 00000F --rrights free --wrights free --rwrights free --chrights free -m plain --no-auth
hf mfdes createfile --aid 000001 --fid 02 --isofid E104 --amode plain --size 0007D0 --rrights free --wrights free --rwrights free --chrights free -m plain --no-auth
hf mfdes write --aid 000001 --fid 01 -d 000F20003B00340406E10400FF00FF -m plain
hf mfdes write --aid 000001 --fid 02 -d 0313C1010000030C5402656E54686520666f6c6c6f77206973206120677569646520746f2061737369737420696e2073657474696e6720757020612073696e676c65204e444546207265636f7264206f6e20616e20446573666972652045563120286f72206c61746572292e20506c656173652072656665726520746f20746865204e44454620646f63756d656e74696f6e20616e64207374616e646172647320666f7220617373697374616e6365206f6e207468652061637475616c204e444546207265636f726420736574757020616e64207374727563747572652e0a0a497420697320617373756d656420796f75206172652066696d756c61722077697468207573696e672061206465736669726520636172647320616e6420636f6d6d616e64732e0a0a54686520666f6c6c6f77206e6f74657320617265206261736564206f6e3a204e5850202d20414e3131303034202d204d494641524520444553466972652061732054797065203420546167205265762e20322e34202d203232204d617920323031330a0a496e206f7264657220746f207365747570204e444546206f6e2061204d69666172652044657366697265206361726420796f75206e65656420746f2063726561746520616e204170706c69636174696f6e20616e642074776f2066696c657320696e736964652074686174206170706c69636174696f6e2e20546865206170706c69636174696f6e20616e642066696c6573206861766520736f6d65207370656369616c206e6565647320696e206f7264657220666f7220746865207374616e64616e647320746f20776f726b20616e6420746865204e44454620726563726f6420746f20626520666f756e642e0a0a53746570203120437265617465204170706c69636174696f6e0a5768696c6520492062656c65697665207468652041707020494420616e642046696c652049447320646f6e74206d61747465722028666f722045563120616e64206c61746572292049206469642066696e642061207265666572656e636520746f207573696e67207468652076616c75657320696e2074686973206578616d706c652e0a0a546865204170706c69636174696f6e204d5553542068617665207468652044464e616d65206f662044323736303030303835303130310a4e6f74653a205468617420697320746865206865782f62696e61727920646174612074686174206e6565647320746f2062652073746f726564210a -m plain
Verify the file and NDEF record:
hf mfdes read --no-auth --aid 000001 --fid 02
Here are the current app settings:
[usb] pm3 → hf mfdes lsapp
[+] ------------------------------------ PICC level -------------------------------------
[+] --------------------------------- Applications list ---------------------------------
Current file settings:
[usb] pm3 → hf mfdes lsfiles --aid 000001
amal
May 3, 2023, 5:23am
2
I’m way too lazy to decode your NDEF data but my hunch is there’s a problem with how the data was constructed. Either the record or the message envelope are probably malfarmed.
vepr
May 3, 2023, 1:29pm
3
I shouldn’t have used that large amount of data as an example. It does it with any data I use.
I can format the Desfire and write the same data to the Desfire using only NFC Tools . Then overwrite the data using the Proxmark.
Example:
hf mfdes write --aid 000001 --fid 02 -d 0313C1010000030C5402656E54686520666f6c6c6f77206973206120677569646520746f2061737369737420696e2073657474696e6720757020612073696e676c65204e444546207265636f7264206f6e20616e20446573666972652045563120286f72206c61746572292e20506c656173652072656665726520746f20746865204e44454620646f63756d656e74696f6e20616e64207374616e646172647320666f7220617373697374616e6365206f6e207468652061637475616c204e444546207265636f726420736574757020616e64207374727563747572652e0a0a497420697320617373756d656420796f75206172652066696d756c61722077697468207573696e672061206465736669726520636172647320616e6420636f6d6d616e64732e0a0a54686520666f6c6c6f77206e6f74657320617265206261736564206f6e3a204e5850202d20414e3131303034202d204d494641524520444553466972652061732054797065203420546167205265762e20322e34202d203232204d617920323031330a0a496e206f7264657220746f207365747570204e444546206f6e2061204d69666172652044657366697265206361726420796f75206e65656420746f2063726561746520616e204170706c69636174696f6e20616e642074776f2066696c657320696e736964652074686174206170706c69636174696f6e2e20546865206170706c69636174696f6e20616e642066696c6573206861766520736f6d65207370656369616c206e6565647320696e206f7264657220666f7220746865207374616e64616e647320746f20776f726b20616e6420746865204e44454620726563726f6420746f20626520666f756e642e0a0a53746570203120437265617465204170706c69636174696f6e0a5768696c6520492062656c65697665207468652041707020494420616e642046696c652049447320646f6e74206d61747465722028666f722045563120616e64206c61746572292049206469642066696e642061207265666572656e636520746f207573696e67207468652076616c75657320696e2074686973206578616d706c652e0a0a546865204170706c69636174696f6e204d5553542068617665207468652044464e616d65206f662044323736303030303835303130310a4e6f74653a205468617420697320746865206865782f62696e61727920646174612074686174206e6565647320746f2062652073746f726564210a -m plain
Once overwritten with the Proxmark, the NDEF data can still be read with with NFC Tools or TagInfo .NFC Tools is setting an option that I’m missing.
vepr
May 3, 2023, 1:41pm
4
Okay, maybe it is a data issue. I’m wondering if it’s a size limit. I used all of the above commands to write the word “hi” and NFC Tools can read it no problem.
hf mfdes write --aid 000001 --fid 02 -d 0009D101055402656E6869 -m plain
I’ll keep playing with it.
vepr
May 3, 2023, 2:40pm
5
I think it’s still something to do with settings.
I can read the data written by NFC Tools and use the sed command to parse it into the exact hex string. After writing that string with the Proxmark commands above, NFC Tools still can’t read the NDEF data.
NFC Tools written data dump:
ndef_dump.txt
[=] 0/0x00 | 03 13 C1 01 00 00 03 0C 54 02 65 6E 54 68 65 20 | …T.enThe
sed 's/^[^|]*|//' ndef_dump.txt > format.txt && \
sed -i.bak 's/|.*$//' format.txt && \
sed -i 's/\s+//g' format.txt && \
sed -i ':a; N; s/\n/ /; ta' format.txt && \
sed -i 's/[\t ]//g;/^$/d' format.txt
format.txt gives me:
0313C1010000030C5402656E54686520666F6C6C6F77206973206120677569646520746F2061737369737420696E2073657474696E6720757020612073696E676C65204E444546207265636F7264206F6E20616E20446573666972652045563120286F72206C61746572292E20506C656173652072656665726520746F20746865204E44454620646F63756D656E74696F6E20616E64207374616E646172647320666F7220617373697374616E6365206F6E207468652061637475616C204E444546207265636F726420736574757020616E64207374727563747572652E20497420697320617373756D656420796F75206172652066696D756C61722077697468207573696E672061206465736669726520636172647320616E6420636F6D6D616E64732E2054686520666F6C6C6F77206E6F74657320617265206261736564206F6E3A204E5850202D20414E3131303034202D204D494641524520444553466972652061732054797065203420546167205265762E20322E34202D203232204D6179203230313320496E206F7264657220746F207365747570204E444546206F6E2061204D69666172652044657366697265206361726420796F75206E65656420746F2063726561746520616E204170706C69636174696F6E20616E642074776F2066696C657320696E736964652074686174206170706C69636174696F6E2E20546865206170706C69636174696F6E20616E642066696C6573206861766520736F6D65207370656369616C206E6565647320696E206F7264657220666F7220746865207374616E64616E647320746F20776F726B20616E6420746865204E44454620726563726F6420746F20626520666F756E642E2053746570203120437265617465204170706C69636174696F6E205768696C6520492062656C65697665207468652041707020494420616E642046696C652049447320646F6E74206D61747465722028666F722045563120616E64206C61746572292049206469642066696E642061207265666572656E636520746F207573696E67207468652076616C75657320696E2074686973206578616D706C652E
Which NFC Tools can’t read.
amal
May 3, 2023, 9:57pm
6
Try breaking the data down into NDEF message and NDEF record inside the message, and check lengths…
Also… in the dump I don’t see the termination character FE … all ndef messages should end with FE.
vepr
May 4, 2023, 12:21am
7
I need to read up more on NDEF and Desfire. Would that be the same as writing 2 or more records using NFC tools ?
I tested NFC Tools on both my phones and it adds FE to the end of my non-Desfire NFC tags. NFC Tools doesn’t add FE to my Desfire tags.
With Desfire, I noticed I first have to add File 01 (Edit Compatibility Container File) with the following in order to make an NDEF record.
[=] 0/0x00 | 00 0F 20 00 3B 00 34 04 06 E1 04 1E 00 00 00 | .. .;.4........
I’m not even sure why that is. I just saw it in the Proxmark example and also noticed it on my NFC Tools written tags. (Edit I found step 2 @ proxmark3/ndef_type4a.md at master · RfidResearchGroup/proxmark3 · GitHub )
amal
May 4, 2023, 1:45am
8
Hmm well NDEF is a data format… it’s identical no matter what the tag types are… even active active connections between two phones use the same format. Not sure what’s going on here
When it comes to files on desfire, there are such things, but there is only one file used for NDEF and it uses a well known AID. Inside that file is where all NDEF data lives, and it’s formatted as one or more “messages”, each with one or more “records” inside, with each record containing a single “payload”.
Typically only one message exists within an NDEF container, though messages will have one or more records.
The end of the message is always FE
