Starting the College ID implant process

Support
21

Screen Shot 2022-02-08 at 1.27.27 PM
Screen Shot 2022-02-08 at 1.27.27 PM1178×1176 156 KB

I think it worked, Thank you

22

Try changing what —ki You’re using. It’s possible the redteamtools card uses another default key to write.

23

In fact try scanning the blank card and see what key you get that returns successfully.

24

Took a shot and did --ki 2, came up with this, (sorry photos dont like me today)

[usb] pm3 --> hf ic dump --ki 2
[+] Using AA1 (debit) key[2] F0 E1 D2 C3 B4 A5 96 87 
[!] ⚠️  AA1 config is >= card size, using card size as AA1 limit
[=] Card has 1 application area. AA1 limit 31 (0x1F)
.

[=] -------------------------- Tag memory ---------------------------

[=]  block#  | data                    | ascii    |lck| info
[=] ---------+-------------------------+----------+---+--------------
[=]   0/0x00 | 8B 7F 83 01 F8 FF 12 E0 | ........ |   | CSN 
[=]   1/0x01 | FF FF FF FF 7F 1F FF BC | ........ |   | Config 
[=]   2/0x02 | FE FF FF FF FF FF FF FF | ........ |   | E-purse 
[=]   3/0x03 | BF FE 4B BB 6A 05 EE 18 | ..K.j... |   | Debit 
[=]   4/0x04 | FF FF FF FF FF FF FF FF | ........ |   | Credit 
[=]   5/0x05 | FF FF FF FF FF FF FF FF | ........ |   | AIA 
[=]   6/0x06 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]   7/0x07 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]   8/0x08 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]   9/0x09 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  10/0x0A | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  11/0x0B | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  12/0x0C | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  13/0x0D | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  14/0x0E | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  15/0x0F | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  16/0x10 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  17/0x11 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  18/0x12 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  19/0x13 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  20/0x14 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  21/0x15 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  22/0x16 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  23/0x17 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  24/0x18 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  25/0x19 | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  26/0x1A | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  27/0x1B | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  28/0x1C | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  29/0x1D | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  30/0x1E | FF FF FF FF FF FF FF FF | ........ |   | User 
[=]  31/0x1F | FF FF FF FF FF FF FF FF | ........ |   | User 
[=] ---------+-------------------------+----------+---+--------------

[+] saving dump file - 32 blocks read
[+] saved 256 bytes to binary file hf-iclass-8B7F8301F8FF12E0-dump.bin
[+] saved 32 blocks to text file hf-iclass-8B7F8301F8FF12E0-dump.eml
[+] saved to json file hf-iclass-8B7F8301F8FF12E0-dump.json
[?] Try `hf iclass decrypt -f` to decrypt dump file
[?] Try `hf iclass view -f` to view dump file
25

Okay, you’ll need to use key 2 in the cloning process. The command should look something like this:

hf ic wrbl  --ki 2 -b 6 -d {data}

Also, it looks like you don’t have a card that’s set up as SE. That’s good!

26

alright so i used key 2 to write blocks 6 and 7, went to go try the card and it did not work, but now when i try to create a dump file to verify the block contents it comes up with this,

[usb] pm3 --> hf ic dump --ki 2
[+] Using AA1 (debit) key[2] F0 E1 D2 C3 B4 A5 96 87 
[=] Card has at least 2 application areas. AA1 limit 18 (0x12) AA2 limit 31 (0x1F)
.
[!!] 🚨 failed to communicate with card
27

That’s… not good. Can you confirm that the pm3 will still read another card? Does it work with any other keys?

28

The proxmark still works fine with the tester cards as well as my id