Hi there, newbie here learning how to use the proxmark3 and need some help… Trying to close my residential Salto 4k
Here are the two dumps of what I tried to do, and what errors I got attempting to copy it to a MiFare 4k card…
Would love if someone can point me in the right direction but basically I did an hf autopwn, then tried to copy the .bin and key file with “hf mf restore --4k -f hf-mf-dump-005.bin -k hf-mf-key.bin” and got a bunch of errors. Any suggestions?
pm3 ~ ./pm3 bash: ./pm3: No such file or directory pm3 ~ hf mf autopwn
bash: hf: command not found
pm3 ~ cd proxmark3 pm3 ~/proxmark3 ./pm3
[=] Session log C:\ProxSpace\pm3/.proxmark3/logs/log_20240729230913.txt
[+] loadedC:\ProxSpace\pm3/.proxmark3/preferences.json
[+] Using UART port COM3
[+] Communicating with PM3 over USB-CDC8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 “Y8888P” [ ][ Your donation fuels progress! ]
Patreon - https://www.patreon.com/iceman1001/
Paypal - PayPal.Me[ Proxmark3 RFID instrument ]
MCU....... AT91SAM7S512 Rev A Memory.... 512 KB ( 63% used ) Client.... Iceman/master/v4.18589-102-g66650a564 2024-07-18 01:59:32 Bootrom... Iceman/master/v4.18589-102-g66650a564-suspect 2024-07-18 01:57:34 OS........ Iceman/master/v4.18589-102-g66650a564-suspect 2024-07-18 01:58:14 Target.... PM3 GENERIC[=] No previous history could be loaded
[usb] pm3 → hf auto-------- ----------------------- High Frequency -----------------------
14a { ISO14443A RFIDs… }
14b { ISO14443B RFIDs… }
15 { ISO15693 RFIDs… }
cipurse { Cipurse transport Cards… }
epa { German Identification Card… }
emrtd { Machine Readable Travel Document… }
felica { ISO18092 / FeliCa RFIDs… }
fido { FIDO and FIDO2 authenticators… }
fudan { Fudan RFIDs… }
gallagher { Gallagher DESFire RFIDs… }
iclass { ICLASS RFIDs… }
ict { ICT MFC/DESfire RFIDs… }
jooki { Jooki RFIDs… }
ksx6924 { KS X 6924 (T-Money, Snapper+) RFIDs }
legic { LEGIC RFIDs… }
lto { LTO Cartridge Memory RFIDs… }
mf { MIFARE RFIDs… }
mfp { MIFARE Plus RFIDs… }
mfu { MIFARE Ultralight RFIDs… }
mfdes { MIFARE Desfire RFIDs… }
ntag424 { NXP NTAG 4242 DNA RFIDs… }
seos { SEOS RFIDs… }
st25ta { ST25TA RFIDs… }
tesla { TESLA Cards… }
texkom { Texkom RFIDs… }
thinfilm { Thinfilm RFIDs… }
topaz { TOPAZ (NFC Type 1) RFIDs… }
vas { Apple Value Added Service }
xerox { Fuji/Xerox cartridge RFIDs… }
----------- --------------------- General ---------------------
help This help
list List protocol data in trace buffer
plot Plot signal
tune Continuously measure HF antenna tuning
search Search for known HF tags
sniff Generic HF Sniff[usb] pm3 → hf search
[-] Searching for ISO14443-A tag…
[+] UID: 04 AF 2C 1A EB 73 80
[+] ATQA: 00 42
[+] SAK: 18 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+] MIFARE Classic 4K CL2
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection… hard[?] Hint: try
hf mfcommands[+] Valid ISO 14443-A tag found
[usb] pm3 → hf mf autopwn
[!] no known key was supplied, key recovery might fail
[+] loaded 5 user keys
[+] loaded 61 keys from hardcoded default array
[=] running strategy 1
[+] target sector 0 key type A – found valid key [ FFFFFFFFFFFF ] (used for nested / hardnested attack)
[+] target sector 0 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type B – found valid key [ FFFFFFFFFFFF ][+] found keys:
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 001 | 007 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 002 | 011 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 003 | 015 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 004 | 019 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 005 | 023 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 006 | 027 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 007 | 031 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 008 | 035 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 009 | 039 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 010 | 043 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 011 | 047 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 012 | 051 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 013 | 055 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 014 | 059 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 015 | 063 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] -----±----±-------------±–±-------------±—
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )[+] Generating binary key file
[+] Found keys have been dumped toC:\ProxSpace\pm3/hf-mf-04AF2C1AEB7380-key-002.bin
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[#] Sector 4 - Auth error
[#] Sector 15 - Auth error
[-] fast dump reported back failure w KEY A, swapping to KEY B
[#] Block 0 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 0 block 0
[#] Block 1 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 1 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 2 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 2 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 3 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 3 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 4 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 1 block 0
[#] Block 5 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 5 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 6 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 6 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 7 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 7 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 8 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 2 block 0
[#] Block 9 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 9 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 10 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 10 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 11 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 11 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Sector 3 - Auth error
[#] Block 16 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 4 block 0
[#] Block 17 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 17 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 18 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 18 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 19 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 19 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Sector 5 - Auth error
[#] Block 24 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 6 block 0
[#] Block 25 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 25 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 26 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 26 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 27 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 27 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 28 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 7 block 0
[#] Block 29 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 29 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 30 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 30 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 31 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 31 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 32 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 8 block 0
[#] Block 33 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 33 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 34 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 34 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 35 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 35 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 36 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 9 block 0
[#] Block 37 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 37 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 38 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 38 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 39 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 39 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Sector 10 - Auth error
[#] Block 44 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 11 block 0
[#] Block 45 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 45 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 46 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 46 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 47 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 47 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 48 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 12 block 0
[#] Block 49 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 49 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 50 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 50 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 51 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 51 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Sector 13 - Auth error
[#] Block 56 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 14 block 0
[#] Block 57 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 57 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 58 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 58 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 59 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 59 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 60 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 15 block 0
[#] Block 61 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 61 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 62 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 62 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 63 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 63 Cmd 0x30 Wrong response len, expected 18 got 0
[-] fast dump reported back failure w KEY B
[-] Dump file is PARTIAL complete
[=] downloading card content from emulator memory
[+] Saved 1024 bytes to binary fileC:\ProxSpace\pm3/hf-mf-04AF2C1AEB7380-dump-002.bin
[+] Saved to json fileC:\ProxSpace\pm3/hf-mf-04AF2C1AEB7380-dump-002.json
[=] autopwn execution time: 4 seconds
[usb] pm3 → hf mf autopwn
[#] Multiple tags detected. Collision after Bit 1
[-] No tag detected or other tag communication error
[?] Hint: Try some distance or position of the card
[usb] pm3 → hf mf autopwn
[-] No tag detected or other tag communication error
[?] Hint: Try some distance or position of the card
[usb] pm3 → hf mf autopwn
[!] no known key was supplied, key recovery might fail
[+] loaded 5 user keys
[+] loaded 61 keys from hardcoded default array
[=] running strategy 1
[+] target sector 0 key type A – found valid key [ FFFFFFFFFFFF ] (used for nested / hardnested attack)
[+] target sector 0 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type B – found valid key [ FFFFFFFFFFFF ][+] found keys:
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 001 | 007 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 002 | 011 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 003 | 015 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 004 | 019 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 005 | 023 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 006 | 027 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 007 | 031 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 008 | 035 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 009 | 039 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 010 | 043 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 011 | 047 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 012 | 051 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 013 | 055 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 014 | 059 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 015 | 063 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] -----±----±-------------±–±-------------±—
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )[+] Generating binary key file
[+] Found keys have been dumped toC:\ProxSpace\pm3/hf-mf-04AF2C1AEB7380-key-003.bin
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[=] downloading card content from emulator memory
[+] Saved 1024 bytes to binary fileC:\ProxSpace\pm3/hf-mf-04AF2C1AEB7380-dump-003.bin
[+] Saved to json fileC:\ProxSpace\pm3/hf-mf-04AF2C1AEB7380-dump-003.json
[=] autopwn execution time: 3 seconds
[usb] pm3 →