Trying to clone fob mifare "classic" 1k

Support
1

hi there everyone
i’m trying to clone my building fob, i do all the autopwn but when trying the new copy it does not work
here is the info from the reading when i use HFMFP INFO since i was researching that some 2k fobs usually get disguised as classic ones

[+]  UID: E2 XX XX 76
[+] ATQA: 00 04
[+]  SAK: 08 [2]
[+] Possible types:
[+]    MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection....... hard
[=]
[=] --- Tag Signature
[=]  IC signature public key name: NXP MIFARE Classic MFC1C14_x
[=] IC signature public key value: 044F6DXXXXXXXXXXXXXXXXXXX0C27A591E6F6F65962BAF
[=]     Elliptic curve parameters: NID_secp128r1
[=]              TAG IC Signature: 407152AD1XXXXXXXXXXXXXXXXXXXXXX07A79227D4BC1A5046C
[+]        Signature verification: successful

[?] Hint: try `hf mf` commands

[!!] No card response
[=] --- Fingerprint
[=] Size..... 2K (4 UID)
[=] SAK...... 2K 7b UID
[=] --- Security Level (SL)
[+] SL mode... SL1
[=] SL 1: backwards functional compatibility mode (with MIFARE Classic 1K / 4K) with an optional AES authentication

there you can see it show as 2k 7bits uid
but on the other side the copy does not carry the signature

here is the info

[usb] pm3 --> hf mfp info

[=] --- Tag Information ---------------------------
[!!] No card response

[+]  UID: E2 XX XX 76
[+] ATQA: 00 04
[+]  SAK: 88 [2]
[+] Possible types:
[+]    MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities... Gen 1a
[+] Prng detection....... weak

[?] Hint: use `hf mf c*` magic commands
[?] Hint: try `hf mf` commands

[!!] No card response
[=] --- Fingerprint
[=] Size..... 2K (4 UID)
[=] --- Security Level (SL)
[!] SL mode... unknown

should i need to get a 2k card to do the copy??, if so how do i copy 2k with aes, is that possible?

2

Hello, i have problem with clonning proxy-card Mifare Classic 1k . I work trough device Proxmark3 Easy.
UID: A9 0F 9C 98
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[#] 1 static nonce 01200145
[+] Static nonce: yes

By doing a staticnested attack , I can’t remove the block dump normally - the trailer is encrypted

3

Just to rule some things out:
You mentioned you’ve cloned it to another tag but the clone doesn’t work? Your card seems to get recognized as a normal 1K card so try dumping that first, just using a normal hf mf autopwn. Then once you write it to your cloned card try dumping that and make sure all the 16 sectors are identical.

1 Like