Not really making any progress here! Is there any other commands I should be trying?
[usb] pm3 --> hf mf info
[=] --- ISO14443-a Information ---------------------
[+] UID: 04 AA BB CC DD EE FF
[+] ATQA: 00 44
[+] SAK: 08 [2]
[=] --- Keys Information
[=] [0] key FF FF FF FF FF FF
[+] loaded 1 keys supplied by user
[+] loaded 59 keys from hardcoded default array
[=] <N/A>
[=] --- Magic Tag Information
[=] <N/A>
[=] --- PRNG Information
[+] Prng................. hard
[usb] pm3 --> hf mf autopwn
[!] ⚠️ no known key was supplied, key recovery might fail
[+] loaded 59 keys from hardcoded default array
[=] running strategy 1
[=] running strategy 2
[=] ......
[-] ⛔ No usable key was found!
[usb] pm3 --> hf mf darkside
[=] Expected execution time is about 25seconds on average
[=] Press pm3 button to abort
[=] Running darkside .[-] ⛔ card is not vulnerable to Darkside attack (its random number generator is not predictable)
The first batch Candace did, but Patrick did my last 3. FlexEM a couple weeks ago, and the xG3 and FlexUG4 the other day. They had run out of numbing gel that morning and that 4 gauge pokey stick wasn’t very fun.
Will say, Candace did alright but Patrick is definitely a pro. Significantly less bleeding and swelling for the ones he put in. He put them exactly where I wanted them to end up, and put the xG3 really close to the surface for better pickup.
Update: I tried scanning the FlexUG4 chip on the reader (very carefully/still in the plastic) and it doesn’t even register a beep. Am I never going to get this to work?
We hear this a lot and it’s still mostly positioning and orientation. Visuals help
I’m remembering this thread now… The UG4, as I recall, comes pre-setup as a MIFARE Classic 1k with a 4-byte UID which your system seems to be ignoring. Can you set it to a MFC with 7-byte UID?
None of them are MFC with a 7-byte UID. There are two MFC (gen1a and gen2) but they have 4-byte UIDs. The NTAG216 has a 7-byte UID but it’s not a MIFARE Classic… And then there’s the DESFire which, while MIFARE, isn’t at all the same thing as MIFARE Classic. NXP’s naming is awful and only leads to further confusion in an already convoluted field.
Edited to add:
Using a Proxmark is pretty easy, here’s the script’s help (which is part of the repo linked on the product page and also shown in the product video):
This script enables easy programming of an Ultimate Mifare Magic card
Usage
script run hf_mf_ultimatecard -h -k <passwd> -c -w <type> -u <uid> -t <type> -p <passwd> -a <pack> -s <signature> -o <otp> -v <version> -q <atqa/sak> -g <gtu> -z <ats> -m <ul-mode> -n <ul-protocol>
Arguments
-h this help
-c read magic configuration
-u UID (8-20 hexsymbols), set UID on tag
-t tag type to impersonate
1 = Mifare Mini S20 4-byte
2 = Mifare Mini S20 7-byte 15 = NTAG 210
3 = Mifare Mini S20 10-byte 16 = NTAG 212
4 = Mifare 1k S50 4-byte 17 = NTAG 213
5 = Mifare 1k S50 7-byte 18 = NTAG 215
6 = Mifare 1k S50 10-byte 19 = NTAG 216
7 = Mifare 4k S70 4-byte 20 = NTAG I2C 1K
8 = Mifare 4k S70 7-byte 21 = NTAG I2C 2K
9 = Mifare 4k S70 10-byte 22 = NTAG I2C 1K PLUS
*** 10 = UL - NOT WORKING FULLY 23 = NTAG I2C 2K PLUS
*** 11 = UL-C - NOT WORKING FULLY 24 = NTAG 213F
12 = UL EV1 48b 25 = NTAG 216F
13 = UL EV1 128b
*** 14 = UL Plus - NOT WORKING YET
-p NTAG password (8 hexsymbols), set NTAG password on tag.
-a NTAG pack ( 4 hexsymbols), set NTAG pack on tag.
-s Signature data (64 hexsymbols), set signature data on tag.
-o OTP data (8 hexsymbols), set `One-Time Programmable` data on tag.
-v Version data (16 hexsymbols), set version data on tag.
-q ATQA/SAK (<2b ATQA><1b SAK> hexsymbols), set ATQA/SAK on tag.
-g GTU Mode (1 hexsymbol), set GTU shadow mode.
-z ATS (<1b length><0-16 ATS> hexsymbols), Configure ATS. Length set to 00 will disable ATS.
-w Wipe tag. 0 for Mifare or 1 for UL. Fills tag with zeros and put default values for type selected.
-m Ultralight mode (00 UL EV1, 01 NTAG, 02 UL-C, 03 UL) Set type of UL.
-n Ultralight protocol (00 MFC, 01 UL), switches between UL and MFC mode
-k Ultimate Magic Card Key (IF DIFFERENT THAN DEFAULT 00000000)
Example usage
-- read magic tag configuration
script run hf_mf_ultimatecard -c
-- set uid
script run hf_mf_ultimatecard -u 04112233445566
-- set NTAG pwd / pack
script run hf_mf_ultimatecard -p 11223344 -a 8080
-- set version to NTAG213
script run hf_mf_ultimatecard -v 0004040201000f03
-- set ATQA/SAK to [00 44] [08]
script run hf_mf_ultimatecard -q 004408
-- wipe tag with a NTAG213 or Mifare 1k S50 4 byte
script run hf_mf_ultimatecard -w 1
-- use a non default UMC key. Only use this if the default key for the MAGIC CARD was changed.
script run hf_mf_ultimatecard -k ffffffff -w 1
-- Wipe tag, turn into NTAG215, set sig, version, NTAG pwd/pak, and OTP.
script run hf_mf_ultimatecard -w 1 -t 18 -u 04112233445566 -s 112233445566778899001122334455667788990011223344556677 -p FFFFFFFF -a 8080 -o 11111111
