[Proxmark 3 Easy]Multiple tags detected. Collision after Bit XX [SOLVED]

[glycerine]

Thanks for this awesome forum.
"I have a Proxmark3 Easy. I’m trying to read a MIFARE 1K card using iceman’s pm3. I successfully uploaded the bootloader and firmware from iceman, configuring makefile.platform to “PM3GENRIC”.

When I attempt a standard command like “hf mf chk”, I get a ton of traces with “Multiple tags detected. Collision after Bit”.

I’ve tried a lot of things: changing the firmware, switching operating systems and devices (Windows PC, Raspberry Pi, Debian). Nothing seems to work, I still get the same message. Do you think the device is broken?

Thank you for your help."

[Pilgrimsmaster]

What is your end goal?

Do you need to check the keys?

Have you tried

hf mf fchk
( I think it is the same except faster)

Do you get the same result?

Have you tried any other hf mf commands? Do they perform as they should?
eg.
hf mf autopwn

For a list of other commands

hf mf help

Also try creating a gap between the PM3 and MF card, see if you get the same error

Either hold it or place a non-conductive seperator between card and reader

[glycerine]

@Pilgrimsmaster

Also try creating a gap between the PM3 and MF card, see if you get the same error

Either hold it or place a non-conductive seperator between card and reader

"Thank you for your response. Originally, I’m trying to retrieve the keys using the command ‘pm3 hf chk’. I’ve tried all the commands, and I still get the same message. I’ve tried placing the tag in various positions, higher and lower. I always get the same trace ‘Multiple tags detected. Collision after Bit’, and incomplete results

[+] -----+-----+--------------+---+--------------+----
[+]  Sec | Blk | key A        |res| key B        |res
[+] -----+-----+--------------+---+--------------+----
[+]  000 | 003 | ------------ | 0 | ------------ | 0
[+]  001 | 007 | ------------ | 0 | ------------ | 0
[+]  002 | 011 | ------------ | 0 | ------------ | 0
[+]  003 | 015 | ------------ | 0 | 536653644C65 | 1
[+]  004 | 019 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  005 | 023 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  006 | 027 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  007 | 031 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  008 | 035 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  009 | 039 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  010 | 043 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  011 | 047 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  012 | 051 | FFFFFFFFFFFF | 1 | ------------ | 0
[+]  013 | 055 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  014 | 059 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+]  015 | 063 | ------------ | 0 | FFFFFFFFFFFF | 1
[+] -----+-----+--------------+---+--------------+----
[+] ( 0:Failed / 1:Success )

[Pilgrimsmaster]

Can you scan your card with TagInfo and share the result?

How to share NFC chip data via TagInfo app

TagInfo is an app made by a chip manufacturing company called NXP. It does a decent job of determining the type of chip it’s talking to and fully scanning any accessible memory into a scan report. It also makes sharing information gathered easy, which makes diagnosing problems or answering questions about specific NFC tags one might have much more efficient. Android iPhone [Sharing microchip implant data with TagInfo] Do note that iOS has some serious limitations still when it …

Do you have any other Cards you can try? Specificall MF 1k…Did your PM3 come with one?

[Pilgrimsmaster]

@Pilgrimsmaster

What is your end goal?

@glycerine

Originally, I’m trying to retrieve the keys using the command ‘pm3 hf chk’.

So your end goal is JUST to read the keys?
You don’t want to do anything with that information!?

Have you tried reading individual blocks and sectors

something like
hf mf rdbl
hf mf rdsc

Do you have access to the reader to sniff traffic?

[glycerine]

Thank you for your response. Sorry for the delay, I haven’t been in front of my equipment for the past 2 days.
Here’s the NFC TAG from the tag I read.

** TagInfo Scan (version 5.0.0) 14-mars-24 15:07:57 **
Report Type: -- IC INFO ------------------------------

# IC Manufacturer:
NXP Semiconductors

# IC Type:
MIFARE Classic (MF1S50)

-- NDEF ------------------------------

# No NDEF Data Storage Present:
Maximum NDEF storage size after format: 716 bytes

-- EXTRA ------------------------------

# Memory Information:
1 kB
* 16 sectors, with 4 blocks per sector
* 64 blocks, with 16 bytes per block

# TagInfo Version:
Version :5.0.0

# Device Info:
Device Model :OPPO ( CPH2145 )
Android OS Version :13

-- FULL SCAN ------------------------------

# Technologies Supported:
MIFARE Classic compatible
ISO/IEC 14443-3 (Type A) compatible
ISO/IEC 14443-2 (Type A) compatible

# Android Technology Information:
Tag description:
* TAG: Tech [android.nfc.tech.NfcA, android.nfc.tech.MifareClassic, android.nfc.tech.NdefFormatable]
* Maximum transceive length: 253 bytes
* Default maximum transceive time-out: 618 ms

# Detailed Protocol Information:
ID: 02:9A:6A:E4
ATQA: 0x0400
SAK: 0x08

# Memory Content:
Sector 0 (0x00)
[00] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[01] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[02] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[03] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
          (unknown key)                 (unknown key)

Sector 1 (0x01)
[04] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[05] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[06] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[07] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
          (unknown key)                 (unknown key)

Sector 2 (0x02)
[08] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[09] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0A] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0B] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
          (unknown key)                 (unknown key)

Sector 3 (0x03)
[0C] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0D] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0E] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0F] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
          (unknown key)                 (unknown key)

Sector 4 (0x04)
[10] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[11] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[12] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[13] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 5 (0x05)
[14] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[15] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[16] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[17] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 6 (0x06)
[18] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[19] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[1A] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[1B] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 7 (0x07)
[1C] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[1D] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[1E] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[1F] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 8 (0x08)
[20] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[21] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[22] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[23] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 9 (0x09)
[24] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[25] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[26] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[27] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 10 (0x0A)
[28] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[29] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[2A] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[2B] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 11 (0x0B)
[2C] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[2D] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[2E] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[2F] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 12 (0x0C)
[30] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[31] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[32] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[33] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 13 (0x0D)
[34] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[35] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[36] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[37] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 14 (0x0E)
[38] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[39] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3A] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3B] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

Sector 15 (0x0F)
[3C] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3D] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3E] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3F] wxx  FF:FF:FF:FF:FF:FF FF:07:80 BC FF:FF:FF:FF:FF:FF
          Factory default key           Factory default key (readable)

r/R=read, w/W=write, i/I=increment,
d=decr/transfer/restore, x=r+w, X=R+W
data block: r/w/i/d:key A|B, R/W/I:key B only,
  I/i implies d, *=value block
trailer (order: key A, AC, key B): r/w:key A,
  W:key B, R:key A|B, (r)=readable key
AC: W implies R+r, R implies r

--------------------------------------

My goal is to be able to clone the tag. But every command (chk, mf nested) I try results in collisions.
I have conducted further tests with a blank card. I’m getting different results, sometimes the correct one and sometimes an error message. Between each identical command, I don’t move the tag and I leave a delay of 1 second.

[usb] pm3 --> hf mf rdbl --blk 0

[=]   # | sector 00 / 0x00                                | ascii
[=] ----+-------------------------------------------------+-----------------
[=]   0 | CA 6F 1C 21 98 08 04 00 62 63 64 65 66 67 68 69 | .o.!....bcdefghi

[usb] pm3 --> hf mf rdbl --blk 0
[#] Multiple tags detected. Collision after Bit 40
[#] Can't select card

[usb] pm3 --> hf mf rdbl --blk 0

[=]   # | sector 00 / 0x00                                | ascii
[=] ----+-------------------------------------------------+-----------------
[=]   0 | CA 6F 1C 21 98 08 04 00 62 63 64 65 66 67 68 69 | .o.!....bcdefghi

[usb] pm3 --> hf mf rdbl --blk 0
[#] Can't select card

[usb] pm3 --> hf mf rdbl --blk 0
[#] Auth error

[usb] pm3 --> hf mf rdbl --blk 0
[#] Can't select card

[usb] pm3 --> hf mf rdbl --blk 0
[#] Can't select card

[usb] pm3 --> hf mf rdbl --blk 0
[#] Multiple tags detected. Collision after Bit 37
[#] Can't select card

This leads me to suspect either a hardware issue or an issue with the firmware I’m using. However, the versions seem to be correct:

QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
  [ Proxmark3 RFID instrument ]

    MCU....... AT91SAM7S512 Rev A
    Memory.... 512 KB ( 68% used )

    Client.... Iceman/master/v4.18218-98-g2cac75d8b 2024-03-12 12:23:57
    Bootrom... Iceman/master/v4.18218-98-g2cac75d8b-suspect 2024-03-12 12:23:11 
    OS........ Iceman/master/v4.18218-98-g2cac75d8b-suspect 2024-03-12 12:24:49 
    Target.... PM3 GENERIC

I will try to return my device maybe

[amal]

Can you send a photo of the tag on the proxmark3 when you are trying these commands?

[glycerine]

Please find a couple of question during a hf mf chk:

[amal]

Just out of curiosity… what happens if you put the proxmark3 on a wood table or something else, and then put the fob on the table and place the bottom of the proxmark3 HF antenna overtop of the fob all awkward like?

[Pilgrimsmaster]

What is your laptop casing made of?
Aluminium?

Ah, Amal has already “asked” that

@amal

put the proxmark3 on a wood table or something else

or Something else non-conductive

The reason Amal is asking you to do this is, the HF antenna looks like it is where your fob is placed, but it is ACTUALLY on the bottom where the arrow is pointing.
The top is fine for a full sized card
and normally a fob also, but worth a try like Amal said.
But for our xSeries implants, we need to go direct to the bottom PCB, so remember that if/when you need it.

[Yngvarr]

@glycerine I have the same problem as you, how did you solve it? (if you solved)

[glycerine]

Sorry for responding so late. I just redid some tests by placing my device properly on a wooden table and trying different positions, both below and above, but I don’t see any difference. I still get the same message.

I think it might be a hardware issue or a problem with a faulty batch. I bought it on AliExpress. I’ll probably send it bac

[glycerine]

"I’m reaching out to you to close this thread. I ultimately returned my Proxmark (on AliExpress) and purchased a new one. With the new one, everything is working as expected. Of course, it’s not always easy when you’re starting out with this equipment, but I managed to clone a badge. We’ll see how it goes from here

[Pilgrimsmaster]

@glycerine

I’m reaching out to you to close this thread

there are still some good learnings in this thread.

I have added a [SOLVED] to the thread title though.

I’m glad you got it sorted