Writing a dump on a non magic mifare classic v1

[usb] pm3 → hf mf dump --ns
[=] Using… hf-mf-F059B2B1-key.bin
[+] Loaded binary key file hf-mf-F059B2B1-key.bin
[=] Reading sector access bits…
[=] …
[+] Finished reading sector access bits
[=] Dumping all blocks from card…
[-]Sector… 15 block… 3 ( ok )
[+] Succeeded in dumping all blocks

[+] time: 10 seconds

[=] -----±----±------------------------------------------------±----------------
[=] sec | blk | data | ascii
[=] -----±----±------------------------------------------------±----------------
[=] 0 | 0 | F0 59 B2 B1 AA 88 04 00 C8 15 00 20 00 00 00 23 | .Y… …#
[=] | 1 | D5 00 26 88 26 88 69 88 00 00 00 00 00 00 00 00 | …&.&.i…
[=] | 2 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 00 1C BA 75 CF BC 6E | …xw…u…n
[=] 1 | 4 | 25 C5 49 56 BC 40 C6 FD A4 00 43 D7 E2 04 D2 E9 | %.IV.@…C…
[=] | 5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 | …
[=] | 6 | E5 6B AB 30 00 00 00 00 00 00 00 00 00 00 00 03 | .k.0…
[=] | 7 | 0D 73 6F 01 51 71 78 77 88 00 1D 08 FB 23 08 55 | .so.Qqxw…#.U
[=] 2 | 8 | 2E 18 2B 58 95 34 60 FC D7 ED CF 2B 20 93 53 4F | …+X.4....+ .SO [=] | 9 | 4F 7C 54 7C 5B DC 97 F1 40 E0 BB 67 6A 1F CD BF | O|T|[...@..gj... [=] | 10 | E5 6B AB 30 00 00 00 00 00 00 00 00 00 00 00 03 | .k.0............ [=] | 11 | 0E F6 0B 9B 14 BF 08 77 8F 00 1E 88 6A DC CF DE | .......w....j... [=] 3 | 12 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ....O........... [=] | 13 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ....O........... [=] | 14 | 31 01 13 70 69 C9 1C 6B 6B CC 18 57 39 F5 18 35 | 1..pi..kk..W9..5 [=] | 15 | FF FF FF FF FF FF 37 8C 3C 00 FF FF FF FF FF FF | ......7.<....... [=] 4 | 16 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 19 | 08 2B 7C 71 7D 54 78 77 88 00 18 B9 7C AE 17 00 | .+|q}Txw....|... [=] 5 | 20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 21 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 22 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 23 | 09 B1 F2 CD D6 16 78 77 88 00 19 01 1F BD CE DC | ......xw........ [=] 6 | 24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 27 | 0A CA E5 0D 10 95 78 77 88 00 1A D1 92 09 DA B1 | ......xw........ [=] 7 | 28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 31 | 0B 67 66 D8 C3 01 78 77 88 00 1B CE 7D C5 9C 13 | .gf...xw....}... [=] 8 | 32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 35 | 04 74 17 91 C2 EE 78 77 88 00 14 EF E6 B1 93 93 | .t....xw........ [=] 9 | 36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 39 | 05 91 86 E8 B7 74 78 77 88 00 15 09 43 65 4C EF | .....txw....CeL. [=] 10 | 40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 42 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 43 | 06 D9 AA FB 7B D9 78 77 88 00 16 8C C7 05 FB 17 | ....{.xw........ [=] 11 | 44 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 45 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 46 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 47 | 07 E7 92 E2 F2 BF 78 77 88 00 17 D6 65 D2 B7 5D | ......xw....e..] [=] 12 | 48 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 49 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 51 | 00 9F EF E2 70 57 78 77 88 00 10 E7 00 DD D5 45 | ....pWxw.......E [=] 13 | 52 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 53 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 54 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 55 | 01 9C E4 CF B7 C6 78 77 88 00 11 18 19 31 EA 0B | ......xw.....1.. [=] 14 | 56 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 57 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 58 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 59 | 02 7E BE 45 7F E8 78 77 88 00 12 D7 65 2D 43 EB | .~.E..xw....e-C. [=] 15 | 60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 61 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 62 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 63 | 03 4C 38 AE 54 3A 78 77 88 00 13 79 0B 17 46 32 | .L8.T:xw...y..F2 [=] -----+-----+-------------------------------------------------+----------------- [?] MAD key detected. Try hf mf mad` for more details

[=] Called with no save option

let’s check that hf mf mad on the original card

unfortunatly i haven’t it here now, if it can help it’s a comestero eurokey, tomorrow i’ll try the command on the original tag

@Aoxhwjfoavdlhsvfpzha what do you think about this block 15?

At the moment?

I’ll take another look at this thread tomorrow, but right now trying to decipher it through the forum is doing my head in

My apologies

If you could DM me the dump.bin file so I could play with it a little on my end, that would be cool, but I don’t promise it would help either, I think the problem is the target card at the moment

1 Like

Well thank you so much, I’m sending you the original dump. I have other 9 new blank tags to try. Today I’ll try in the reader what happens whit this partial clone

1 Like

Excellent plan

1 Like

[=] 12 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key B
[=] 12 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key A
[=] 13 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key B
[=] 13 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key A
[=] 14 | 31 01 13 70 69 C9 1C 6B 6B CC 18 57 39 F5 18 35 | ( fail ) key B
[=] 14 | 31 01 13 70 69 C9 1C 6B 6B CC 18 57 39 F5 18 35 | ( fail ) key A
[!] Strict ReadOnly Access Conditions on block 2 detected
[!] Strict ReadOnly Access Conditions on block 3 detected
[=] 15 | FF FF FF FF FF FF 37 8C 3C 00 FF FF FF FF FF FF | ( fail ) key B
[=] 15 | FF FF FF FF FF FF 37 8C 3C 00 FF FF FF FF FF FF | ( fail ) key A

Everything is written there.
You can’t write that sector with that access conditions: 378C3C

Block 0
Read: A|B
Write: Never
Incr.: Never
Decr/Trans/Rest: A|B

Block 1
Read: A|B
Write: Never
Incr.: Never
Decr/Trans/Rest: A|B

Block 2
Read: A|B
Write: Never
Incr.: Never
Decr/Trans/Rest: Never

Block 3 (trailer)
Read key A: Never
Write Key A: Never
Read ACS: A|B
Write ACS: Never
Read key B: Never
Write Key B: Never

1 Like

how can i write a single block? i made a new test with another tag and it seems cloned but for my interest i’d like to know how to do

hf mf wrbl 5 A 080808080808 32110000cdeeffff3211000005fa05fa

This command writes block 5 with A key 080808080808, with data 32110000cdeeffff3211000005fa05fa (16 bytes)

Check access conditions if you can write with A or B key; if you can only write with key B use ‘B’ instead of ‘A’ in the command

2 Likes

Moreover this needs to be the keyfile of the ‘blank card’ where the clone will be written.
You need keys to write on that card, not the keys of the cloned source card.
Once and if written you will use the keys of the cloned source card.

1 Like

Can anyone explain why it’s talking about blocks 2 and 3 there? I don’t get what it’s actually trying to do there?

you seem to be on a very very depreciated branch of the fw i would recommend updating

1 Like

cd proxmark3
git pull
make clean && make all OR make -j (it will allow for parallel compiling and goes faster. - Thanks @ Iceman)
./pm3-flash-bootrom
./pm3-flash-fullimage
pm3
hw tune

1 Like

discussing it with @Aoxhwjfoavdlhsvfpzha we came to the conclusion that I need a magic card, but these are readers like this

so I can’t use normal cards, do you know any magic tags suitable for this reader? I can tell you that the maximum width of the hole is 29mm. Thank you

Try a magic key fob maybe?

1 Like

We’re also not totally sure what part of the tag is causing a problem

I’m guessing either the UID or perhaps the tag signature

Is there a magic card that can spoof the signature?

1 Like

USCUID can emulate signatures but it’s very unlikely to be that which is causing the problem.

in most all mifare classic installations the UID is important even in cases like MAD where the PACs data itself is held within an application

i’d try on a gen1a first, making sure UIDs match; if that doesn’t work try editing the SAK as earlier output shows it to be 88 in the dump.

2 Likes

Thank you all but now the biggest problem is the form factor….uff. This is a comestero eurokey next, how can I solve it?

1 Like

29mm hole? you can get 20/25mm flat disc magic chips

1 Like