kali linux operating system
Hello masters, I have one more question... I'm trying to write to sector 000 blk 01 and 02, but I can't, I'm missing some tip or command. all the information below about the card, thank you in advance for your patience.
everything else I can write.
key a = read
key b = write
──(nbc㉿nbc)-[~/proxmark3]
└─$ pm3
[=] Session log /home/nbc/.proxmark3/logs/log_20250918232600.txt
[+] loaded `/home/nbc/.proxmark3/preferences.json`
[+] Using UART port /dev/ttyACM0
[+] Communicating with PM3 over USB-CDC
8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 "Y8888P"
[ And so I watch, I wait! ☕ ]
[ Proxmark3 ]
MCU....... AT91SAM7S512 Rev A
Memory.... 512 KB ( 68% used )
Target.... PM3 GENERIC
Client.... Iceman/master/v4.20469-250-g06e3f70dd 2025-09-09 20:20:05
Bootrom... Iceman/master/v4.20469-250-g06e3f70dd-suspect 2025-09-09 20:21:16 2689d7032
OS........ Iceman/master/v4.20469-250-g06e3f70dd-suspect 2025-09-09 20:21:55 2689d7032
[usb] pm3 --> hf mf info --blk 1 -k 7B296F353C6B -n -v
[=] --- ISO14443-a Information -----------------------------
[+] UID: C3 83 32 3D
[+] ATQA: 00 04
[+] SAK: 08 [1]
[#] Auth error
[#] Auth error
[=] --- Keys Information
[+] loaded 2 user keys
[+] loaded 61 hardcoded keys
[=] Chunk 1,1s | found 1/4 keys (63)
[+] Sector 0 key A... 7B296F353C6B
[+] Backdoor key..... A396EFA4E24F
[+] Block 0.......... C383323D4F08040004EA8D8E6A8EBF90 | ....j...
[=] --- Fingerprint
[+] Fudan FM11RF08S 0490
[=] --- Magic Tag Information
[=] <n/a>
[=] --- PRNG Information
[+] Prng....... weak
[+] Static enc nonce... yes
[=] Checking for NACK bug
[+] press pm3 button to abort both Proxmark3 and client
[=] ...........................................
[+] num of auth requests : 262
[+] num of received NACK : 0
[+] NACK test... no bug
[?] Hint: Try `script run fm11rf08s_recovery.py`
[=] # | sector 00 / 0x00 | ascii
[=] ----+-------------------------------------------------+-----------------
[=] 0 | C3 83 32 3D 4F 08 04 00 04 EA 8D 8E 6A 8E BF 90 | ..2=O.......j...
[=] 1 | F6 FF FF 7F 09 00 00 80 F6 FF FF 7F 00 FF 00 FF | ................ 2147483638
[=] 2 | F6 FF FF 7F 09 00 00 80 F6 FF FF 7F 00 FF 00 FF | ................ 2147483638
[=] 3 | 7B 29 6F 35 3C 6B E6 98 71 CB 00 00 00 00 00 00 | {)o5<k..q.......
[=] ------------------------ Sector trailer decoder ------------------------
[=] Key A........ 7B296F353C6B
[=] ACR.......... E69871
[=] User / gpb... cb
[=] Key B........ 000000000000
[=]
[=] # | access rights
[=] ----+-------------------------------------------------------------------
[=] 0 | none
[=] 1 | read AB; decrement transfer restore AB
[=] 2 | read AB; decrement transfer restore AB
[=] 3 | write A by B; read ACCESS by AB; write B by B
[=] ------------------------------------------------------------------------
[usb] pm3 --> hf mf wrbl --blk 1 -b -k 109AA2682BA5 -d F7FFFF7F08000080F7FFFF7F00FF00FF
[=] Writing block no 1, key type:B - 109AA2682BA5
[=] data: F7 FF FF 7F 08 00 00 80 F7 FF FF 7F 00 FF 00 FF
[-] ⛔ Write ( fail )
[?] Hint: Maybe access rights? Try specify keytype `hf mf wrbl -a ...` instead
3 Likes
I think the access bits are locked down:
I also think if this isn’t a magic card you’re out of luck trying to write to it
But I wouldn’t necessarily take my word for it
3 Likes
Hello, thanks for responding...
[usb] pm3 --> hf search
🕓 Searching for ISO14443-A tag...
[=] ---------- ISO14443-A Information ----------
[+] UID: C3 83 32 3D ( ONUID, re-used )
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=]
[=] Proprietary non iso14443-4 card found
[=] RATS not supported
[+] Prng detection..... weak
I haven’t been having much luck…hehehe.
I write all blocks except 1 and 2 using the B key.
what keeps me up most at night hehehe, when the card is inserted into the official reader it writes in blocks 1 and 2.
This is exactly what prevents me from totaling what is written in it, blocks 1 and 2.
Have you considered picking up a magic card and giving that a try?
2 Likes
run script run fm11rf08s_recovery
and post the output file.
2 Likes
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | ------------ | 0 | ------------ | 0
[+] 001 | 007 | 3FA7217EC575 | 1 | 2164572504C4 | 1
[+] 002 | 011 | 3FA7217EC575 | 1 | EF77880B3289 | 1
[+] 003 | 015 | 741F66025303 | 1 | 3AB771530203 | 1
[+] 004 | 019 | 741F66025304 | 1 | 3AB771530204 | 1
[+] 005 | 023 | D9FD4AF6F66C | 1 | 6C0C9F227C4B | 1
[+] 006 | 027 | 741F66025306 | 1 | 3AB771530206 | 1
[+] 007 | 031 | 741F66025307 | 1 | 3AB771530207 | 1
[+] 008 | 035 | 741F66025308 | 1 | 3AB771530208 | 1
[+] 009 | 039 | 741F66025309 | 1 | 3AB771530209 | 1
[+] 010 | 043 | 741F6602530A | 1 | 3AB77153020A | 1
[+] 011 | 047 | 3FA7217EC575 | 1 | EF77880B3289 | 1
[+] 012 | 051 | 741F6602530C | 1 | 3AB77153020C | 1
[+] 013 | 055 | 741F6602530D | 1 | 3AB77153020D | 1
[+] 014 | 059 | 741F6602530E | 1 | 3AB77153020E | 1
[+] 015 | 063 | D9FD4AF6F66C | 1 | 6C0C9F227C4B | 1
[+] 032 | 131 | D7DB1B00BC4B | 1 | 0000B847EC95 | 1
[+] -----±----±-------------±–±-------------±—
[+] ( 0:Failed / 1:Success )
[=]
[+] Generating binary key file
[+] Found keys have been dumped to /home/nbc/hf-mf-C383323D-key.bin
[=] –[ FFFFFFFFFFFF ]– has been inserted for unknown keys
[+] Generating final dump file
[+] Data has been dumped to /home/nbc/hf-mf-C383323D-dump.bin
[+] Removing generated dictionaries…
[=] ----Step 3: 7 minutes 35 seconds -----------
[=] ---- TOTAL: 8 minutes 17 seconds -----------
[+] finished fm11rf08s_recovery
1 Like
This keeps me up at night, as I said... it writes all the blocks with the B key, except 1 and 2 in sector 0, but when it passes through the official reader it modifies 03 bytes of blocks 1 and 2.
1 Like
hf-mf-C383323D-dump.bin
there’s your fully complete dump.
2 Likes
doing readblock will black out any keys deemed “unreadable” by ACLs, they’re still present in the dump tho.
do hf mf view -f hf-mf-C383323D-dump.bin
2 Likes
usb] pm3 --> hf mf view -f hf-mf-C383323D-dump.bin
[+] Loaded 1024 bytes from binary file `hf-mf-C383323D-dump.bin`
[=] -----+-----+-------------------------------------------------+-----------------
[=] sec | blk | data | ascii
[=] -----+-----+-------------------------------------------------+-----------------
[=] 0 | 0 | C3 83 32 3D 4F 08 04 00 04 EA 8D 8E 6A 8E BF 90 | ..2=O.......j...
[=] | 1 | F4 FF FF 7F 0B 00 00 80 F4 FF FF 7F 00 FF 00 FF | ................
[=] | 2 | F4 FF FF 7F 0B 00 00 80 F4 FF FF 7F 00 FF 00 FF | ................
[=] | 3 | 7B 29 6F 35 3C 6B E6 98 71 CB 10 9A A2 68 2B A5 | {)o5<k..q....h+.
[=] 1 | 4 | F1 FF 02 00 00 00 E8 7B 00 00 00 00 00 00 00 00 | .......{........
[=] | 5 | 00 00 00 00 00 00 00 00 00 00 80 16 66 0C 3A 44 | ............f.:D
[=] | 6 | 44 80 E7 09 00 00 00 00 00 00 53 CB 21 10 9B 9D | D.........S.!...
[=] | 7 | 3F A7 21 7E C5 75 F0 FF 00 FE 21 64 57 25 04 C4 | ?.!~.u....!dW%..
[=] 2 | 8 | 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 9 | 00 00 00 00 00 00 00 00 00 00 FD FF FF FF FF FF | ................
[=] | 10 | FF FF FF FF FF FF FF FF FF FF BC DE 1F 14 B5 47 | ...............G
[=] | 11 | 3F A7 21 7E C5 75 F0 FF 00 FE EF 77 88 0B 32 89 | ?.!~.u.....w..2.
[=] 3 | 12 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 13 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 14 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 15 | 74 1F 66 02 53 03 F0 FF 00 FE 3A B7 71 53 02 03 | t.f.S.....:.qS..
[=] 4 | 16 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 19 | 74 1F 66 02 53 04 F0 FF 00 FE 3A B7 71 53 02 04 | t.f.S.....:.qS..
[=] 5 | 20 | 13 00 00 00 00 00 00 00 00 D0 7C 02 1B 00 00 E4 | ..........|.....
[=] | 21 | A4 A0 00 02 05 84 82 58 E0 05 00 00 00 00 00 00 | .......X........
[=] | 22 | C0 BD D0 ED 0B 05 00 00 00 00 00 96 67 0F 40 85 | ............g.@.
[=] | 23 | D9 FD 4A F6 F6 6C F0 FF 00 FE 6C 0C 9F 22 7C 4B | ..J..l....l.."|K
[=] 6 | 24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 27 | 74 1F 66 02 53 06 F0 FF 00 FE 3A B7 71 53 02 06 | t.f.S.....:.qS..
[=] 7 | 28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 31 | 74 1F 66 02 53 07 F0 FF 00 FE 3A B7 71 53 02 07 | t.f.S.....:.qS..
[=] 8 | 32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 35 | 74 1F 66 02 53 08 F0 FF 00 FE 3A B7 71 53 02 08 | t.f.S.....:.qS..
[=] 9 | 36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 39 | 74 1F 66 02 53 09 F0 FF 00 FE 3A B7 71 53 02 09 | t.f.S.....:.qS..
[=] 10 | 40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 42 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 43 | 74 1F 66 02 53 0A F0 FF 00 FE 3A B7 71 53 02 0A | t.f.S.....:.qS..
[=] 11 | 44 | 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 45 | 00 00 00 00 00 00 00 00 00 00 FE FF FF FF FF FF | ................
[=] | 46 | FF FF FF FF FF FF FF FF FF FF 6C D0 16 51 96 6B | ..........l..Q.k
[=] | 47 | 3F A7 21 7E C5 75 F0 FF 00 FE EF 77 88 0B 32 89 | ?.!~.u.....w..2.
[=] 12 | 48 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 49 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 51 | 74 1F 66 02 53 0C F0 FF 00 FE 3A B7 71 53 02 0C | t.f.S.....:.qS..
[=] 13 | 52 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 53 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 54 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 55 | 74 1F 66 02 53 0D F0 FF 00 FE 3A B7 71 53 02 0D | t.f.S.....:.qS..
[=] 14 | 56 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 57 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 58 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 59 | 74 1F 66 02 53 0E F0 FF 00 FE 3A B7 71 53 02 0E | t.f.S.....:.qS..
[=] 15 | 60 | 13 00 00 00 00 00 00 00 00 D0 7C 02 1B 00 00 E4 | ..........|.....
[=] | 61 | A4 A0 00 02 05 84 82 58 E0 05 00 00 00 00 00 00 | .......X........
[=] | 62 | C0 BD 80 10 0C 04 00 00 00 00 00 7D 5E 41 AB 12 | ...........}^A..
[=] | 63 | D9 FD 4A F6 F6 6C F0 FF 00 FE 6C 0C 9F 22 7C 4B | ..J..l....l.."|K
[=] -----+-----+-------------------------------------------------+-----------------
1 Like
yah so your keyb is 10 9A A2 68 2B A5
if the reader is writing to your cards sec0 data, it’s changing the acls to allow block writing and then changing them back.
3 Likes
That’s what I slightly thought, we can change this situation?
[usb] pm3 --> hf mf wrbl --blk 1 -b -k 109AA2682BA5 -d 000102030405060708090a0b0c0d0e0f --force
[=] Writing block no 1, key type:B - 109AA2682BA5
[=] data: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
[#] Auth error
[-] ⛔ Write ( fail )
[?] Hint: Maybe access rights? Try specify keytype `hf mf wrbl -a ...` instead
1 Like
why would you want to change it? if you change it, the reader won’t accept it
2 Likes
why I want to repeat the Dump, save it on your own card. I don’t want to clone.
1 Like
if access is fixed you’ll need to use the transfer commands to alter block content.
MFC 1K Datasheet
if you could get a sniff of communications between the reader and card while it reloads the balance, that would be grand.
then we can try changing the sector trailer to allow writing to restore the block content.
2 Likes
It may be a default master password for this industry, the I/O response time is too short to change and then reset.
I’m thinking about an automatic response too, because if I write from sector 4 to 63 it doesn’t recognize the card.
1 Like
the comms time is milliseconds lol, there’s plenty of time.
but it’s likely doing transfer commands. which is why i asked for the sniff.
1 Like
