Ultralight C card on PM3

Support flexSecure Support
1

I have an ultralight card read this

[usb] pm3 → hf mfu dump
[+] TYPE: MIFARE Ultralight C (MF0ULC)
[+] Reading tag memory…

[=] MFU dump file information
[=] -------------------------------------------------------------
[=] Version… 00 00 00 00 00 00 00 00
[=] TBD 0… 00 00
[=] TBD 1… 00
[=] Signature… 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] Counter 0… 00 00 00
[=] Tearing 0… 00
[=] Counter 1… 00 00 00
[=] Tearing 1… 00
[=] Counter 2… 00 00 00
[=] Tearing 2… 00
[=] Max data page… 14 ( 60 bytes )
[=] Header size… 56 bytes

[=] -------------------------------------------------------------
[=] block# | data |lck| ascii
[=] ---------±------------±–±-----
[=] 0/0x00 | 04 74 92 6A | | .t.j
[=] 1/0x01 | 72 11 66 80 | | r.f.
[=] 2/0x02 | 85 48 F2 00 | | .H…
[=] 3/0x03 | BB 38 37 B4 | 0 | .87. I want to change to 00 00 00 00
[=] 4/0x04 | B0 81 12 04 | 1 | …
[=] 5/0x05 | 65 82 04 1A | 1 | e…
[=] 6/0x06 | 33 34 30 00 | 1 | 340.
[=] 7/0x07 | 00 00 1A BE | 1 | …
[=] 8/0x08 | 00 00 00 00 | 0 | …
[=] 9/0x09 | 00 00 00 00 | 0 | …
[=] 10/0x0A | 00 00 00 00 | 0 | …
[=] 11/0x0B | 00 00 00 00 | 0 | …
[=] 12/0x0C | 00 00 00 00 | 0 | …
[=] 13/0x0D | 00 00 00 00 | 0 | …
[=] 14/0x0E | 00 00 00 00 | 0 | …
[=] 15/0x0F | 00 00 00 00 | 0 | …
[=] ---------------------------------
[=] Using UID as filename
[+] Saved 120 bytes to binary file C:\ProxSpace\ProxSpace\pm3/hf-mfu-04749272116680-dump.bin
[+] Saved to json file C:\ProxSpace\ProxSpace\pm3/hf-mfu-04749272116680-dump.json
[!] Partial dump created. (16 of 48 blocks)

I want to change what is written in the 4th line from BB 38 37 B4 to 00 00 00 00
Can any one help please

2

I’m pretty sure page 03 is OTP (one time programmable) so bits in that page can only be flipped from 0 to 1 but not back again.

image
image695×355 37.5 KB

page 10 of the spec sheet - https://www.nxp.com/docs/en/data-sheet/MF0ICU1.pdf

1 Like
3

Post from @Iceman on the RFID Discord Server

@np0, @strudel, @Torron, @Zach, @eltrick

You are my heros! The efforts of breaking UL_C cards till today where you all have been a valuable member of the server for years. This is one of my ways to show the community appreciation to you.

@NVX,

Since being part long time of the community and being a solid rock for years, with research, talks, new ideas, fresh concepts, and breaking UL_C, it is time to become a legend.

@doegox,

One the best, just living up to his old legend role. It’s hard on the absolute peak of RFID hacking. The community is looking forward to see all your future research!

2 Likes