Writing a dump on a non magic mifare classic v1

sfsdfsdfds · May 20, 2024, 8:22am

[usb] pm3 → hf mf dump --ns
[=] Using… hf-mf-F059B2B1-key.bin
[+] Loaded binary key file hf-mf-F059B2B1-key.bin
[=] Reading sector access bits…
[=] …
[+] Finished reading sector access bits
[=] Dumping all blocks from card…
[-]Sector… 15 block… 3 ( ok )
[+] Succeeded in dumping all blocks

[+] time: 10 seconds

[=] -----±----±------------------------------------------------±----------------
[=] sec | blk | data | ascii
[=] -----±----±------------------------------------------------±----------------
[=] 0 | 0 | F0 59 B2 B1 AA 88 04 00 C8 15 00 20 00 00 00 23 | .Y… …#
[=] | 1 | D5 00 26 88 26 88 69 88 00 00 00 00 00 00 00 00 | …&.&.i…
[=] | 2 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 00 1C BA 75 CF BC 6E | …xw…u…n
[=] 1 | 4 | 25 C5 49 56 BC 40 C6 FD A4 00 43 D7 E2 04 D2 E9 | %.IV.@…C…
[=] | 5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 | …
[=] | 6 | E5 6B AB 30 00 00 00 00 00 00 00 00 00 00 00 03 | .k.0…
[=] | 7 | 0D 73 6F 01 51 71 78 77 88 00 1D 08 FB 23 08 55 | .so.Qqxw…#.U
[=] 2 | 8 | 2E 18 2B 58 95 34 60 FC D7 ED CF 2B 20 93 53 4F | …+X.4....+ .SO [=] | 9 | 4F 7C 54 7C 5B DC 97 F1 40 E0 BB 67 6A 1F CD BF | O|T|[...@..gj... [=] | 10 | E5 6B AB 30 00 00 00 00 00 00 00 00 00 00 00 03 | .k.0............ [=] | 11 | 0E F6 0B 9B 14 BF 08 77 8F 00 1E 88 6A DC CF DE | .......w....j... [=] 3 | 12 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ....O........... [=] | 13 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ....O........... [=] | 14 | 31 01 13 70 69 C9 1C 6B 6B CC 18 57 39 F5 18 35 | 1..pi..kk..W9..5 [=] | 15 | FF FF FF FF FF FF 37 8C 3C 00 FF FF FF FF FF FF | ......7.<....... [=] 4 | 16 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 19 | 08 2B 7C 71 7D 54 78 77 88 00 18 B9 7C AE 17 00 | .+|q}Txw....|... [=] 5 | 20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 21 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 22 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 23 | 09 B1 F2 CD D6 16 78 77 88 00 19 01 1F BD CE DC | ......xw........ [=] 6 | 24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 27 | 0A CA E5 0D 10 95 78 77 88 00 1A D1 92 09 DA B1 | ......xw........ [=] 7 | 28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 31 | 0B 67 66 D8 C3 01 78 77 88 00 1B CE 7D C5 9C 13 | .gf...xw....}... [=] 8 | 32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 35 | 04 74 17 91 C2 EE 78 77 88 00 14 EF E6 B1 93 93 | .t....xw........ [=] 9 | 36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 39 | 05 91 86 E8 B7 74 78 77 88 00 15 09 43 65 4C EF | .....txw....CeL. [=] 10 | 40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 42 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 43 | 06 D9 AA FB 7B D9 78 77 88 00 16 8C C7 05 FB 17 | ....{.xw........ [=] 11 | 44 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 45 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 46 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 47 | 07 E7 92 E2 F2 BF 78 77 88 00 17 D6 65 D2 B7 5D | ......xw....e..] [=] 12 | 48 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 49 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 51 | 00 9F EF E2 70 57 78 77 88 00 10 E7 00 DD D5 45 | ....pWxw.......E [=] 13 | 52 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 53 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 54 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 55 | 01 9C E4 CF B7 C6 78 77 88 00 11 18 19 31 EA 0B | ......xw.....1.. [=] 14 | 56 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 57 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 58 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 59 | 02 7E BE 45 7F E8 78 77 88 00 12 D7 65 2D 43 EB | .~.E..xw....e-C. [=] 15 | 60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 61 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 62 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 63 | 03 4C 38 AE 54 3A 78 77 88 00 13 79 0B 17 46 32 | .L8.T:xw...y..F2 [=] -----+-----+-------------------------------------------------+----------------- [?] MAD key detected. Try hf mf mad` for more details

[=] Called with no save option

Aoxhwjfoavdlhsvfpzha · May 20, 2024, 8:22am

let’s check that hf mf mad on the original card

sfsdfsdfds · May 20, 2024, 8:25am

unfortunatly i haven’t it here now, if it can help it’s a comestero eurokey, tomorrow i’ll try the command on the original tag

sfsdfsdfds · May 20, 2024, 8:27am

@Aoxhwjfoavdlhsvfpzha what do you think about this block 15?

Aoxhwjfoavdlhsvfpzha · May 20, 2024, 8:36am

At the moment?

I’ll take another look at this thread tomorrow, but right now trying to decipher it through the forum is doing my head in

My apologies

If you could DM me the dump.bin file so I could play with it a little on my end, that would be cool, but I don’t promise it would help either, I think the problem is the target card at the moment

sfsdfsdfds · May 20, 2024, 8:39am

Well thank you so much, I’m sending you the original dump. I have other 9 new blank tags to try. Today I’ll try in the reader what happens whit this partial clone

Aoxhwjfoavdlhsvfpzha · May 20, 2024, 8:40am

Excellent plan

ghost82 · May 21, 2024, 7:57am

[=] 12 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key B
[=] 12 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key A
[=] 13 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key B
[=] 13 | B0 FE FF 7F 4F 01 00 80 B0 FE FF 7F 0D F2 0D F2 | ( fail ) key A
[=] 14 | 31 01 13 70 69 C9 1C 6B 6B CC 18 57 39 F5 18 35 | ( fail ) key B
[=] 14 | 31 01 13 70 69 C9 1C 6B 6B CC 18 57 39 F5 18 35 | ( fail ) key A
[!] Strict ReadOnly Access Conditions on block 2 detected
[!] Strict ReadOnly Access Conditions on block 3 detected
[=] 15 | FF FF FF FF FF FF 37 8C 3C 00 FF FF FF FF FF FF | ( fail ) key B
[=] 15 | FF FF FF FF FF FF 37 8C 3C 00 FF FF FF FF FF FF | ( fail ) key A

Everything is written there.
You can’t write that sector with that access conditions: 378C3C

Block 0
Read: A|B
Write: Never
Incr.: Never
Decr/Trans/Rest: A|B

Block 1
Read: A|B
Write: Never
Incr.: Never
Decr/Trans/Rest: A|B

Block 2
Read: A|B
Write: Never
Incr.: Never
Decr/Trans/Rest: Never

Block 3 (trailer)
Read key A: Never
Write Key A: Never
Read ACS: A|B
Write ACS: Never
Read key B: Never
Write Key B: Never

sfsdfsdfds · May 21, 2024, 8:01am

how can i write a single block? i made a new test with another tag and it seems cloned but for my interest i’d like to know how to do

ghost82 · May 21, 2024, 8:03am

hf mf wrbl 5 A 080808080808 32110000cdeeffff3211000005fa05fa

This command writes block 5 with A key 080808080808, with data 32110000cdeeffff3211000005fa05fa (16 bytes)

Check access conditions if you can write with A or B key; if you can only write with key B use ‘B’ instead of ‘A’ in the command

ghost82 · May 21, 2024, 8:11am

Moreover this needs to be the keyfile of the ‘blank card’ where the clone will be written.
You need keys to write on that card, not the keys of the cloned source card.
Once and if written you will use the keys of the cloned source card.

Aoxhwjfoavdlhsvfpzha · May 21, 2024, 8:57am

Can anyone explain why it’s talking about blocks 2 and 3 there? I don’t get what it’s actually trying to do there?

Equipter · May 21, 2024, 8:57am

you seem to be on a very very depreciated branch of the fw i would recommend updating

Pilgrimsmaster · May 21, 2024, 10:00am

cd proxmark3
git pull
make clean && make all OR make -j (it will allow for parallel compiling and goes faster. - Thanks @ Iceman)
./pm3-flash-bootrom
./pm3-flash-fullimage
pm3
hw tune

sfsdfsdfds · May 22, 2024, 3:06pm

discussing it with @Aoxhwjfoavdlhsvfpzha we came to the conclusion that I need a magic card, but these are readers like this

so I can’t use normal cards, do you know any magic tags suitable for this reader? I can tell you that the maximum width of the hole is 29mm. Thank you

amal · May 22, 2024, 11:25pm

Try a magic key fob maybe?

Aoxhwjfoavdlhsvfpzha · May 22, 2024, 11:35pm

We’re also not totally sure what part of the tag is causing a problem

I’m guessing either the UID or perhaps the tag signature

Is there a magic card that can spoof the signature?

Equipter · May 22, 2024, 11:48pm

USCUID can emulate signatures but it’s very unlikely to be that which is causing the problem.

in most all mifare classic installations the UID is important even in cases like MAD where the PACs data itself is held within an application

i’d try on a gen1a first, making sure UIDs match; if that doesn’t work try editing the SAK as earlier output shows it to be 88 in the dump.

gist.github.com

https://gist.github.com/equipter/3022aea4e371e585ff6e46de637e7769

SAK Switching.md


# Mifare Classic - SAK Swapping Explained

## What is SAK Swapping

Behaviour has been observered where some system using Mifare Classic credentials will identify with one SAK (0x08/18) on a basic search (Wake up) but when the block 0 is dumped, the SAK appears to be different (0x88/0x98) 

This is because the SAK reported on a Wake up is not coming from Block 0 but is instead burned into the card, The SAK in Block 0 is merely a Vanity SAK.

If the dump is loaded onto a Magic Mifare Classic that Mirrors the vanity SAK as the actual SAK on Wake up it will tell the system that the credential is a duplicate & to deny access.

This file has been truncated. show original

sfsdfsdfds · May 23, 2024, 9:47am

Thank you all but now the biggest problem is the form factor….uff. This is a comestero eurokey next, how can I solve it?

Equipter · May 23, 2024, 10:00am

29mm hole? you can get 20/25mm flat disc magic chips