Writing commands for MF Ultralight [SOLVED]

Support
1

I am an old newbie (75) who just got my PM3 Easy from DangerousThings. I had lightly used the original PM3 (green board) in the past few years for cloning Paradox fobs. I flashed the latest Iceman fork on the PM3E. The client matches the PM3E.

I am new to the PM3 Easy but understand the process for cloning Mifare Classic cards (MF) thanks to the great tutorial videos from DangerousThings. I also know how to get the password of the MFU tag. However, I have 2 questions regarding Mifare Ultralight commands (MFU).

[SOLVED]1/ After obtaining a bin or eml dump file through the ‘hf mfu dump -k ’ command what HF MFU command should I use to write that dump file to a new TAG as “cload” is only available for the MF classic and not for the MFU?[SOLVED] > the mfu ‘restore’ command does write to a new tag. I thought it was only for MAGIC cards but it does work for regular NTAG213. I had to manually overwrite 3 sectors to match the original and change the PWD to the one calculated based on the new UID. It may not be the most straightforward way of doing it but it works! Thanks! :slightly_smiling_face:

[SOLVED] 2/ Is there a way to edit the dump file in memory to change a sector before writing the dump file? I can write the sectors needing editing one by one using ‘hf mfu wrbl -b <#> -d <‘HEX’> -k ’, however I believe there should be a way to change the sector directly in the memory dump file before writing? Is there a way to access the file and edit it? Where is it stored? [SOLVED] > File is stored in the proxmak3 folder of the installation location on Windows (in my case: C:\PROXSPACE\pm3\proxmark3).

I was able to update the sector I needed to on the original tag (writing the single block with password provided) but I need to be able to copy (clone) the whole tag if I want to be able to properly use the PM3E with MF Ultralight!

Thanks a lot for any help!

FYI, here are the results of the search and MFU info:
(This is a Xiaomi filter tag)

[usb] pm3 → hf search
[|] Searching for ISO14443-A tag…
[+] UID: 04 B7 CB 7A 92 57 80
[+] ATQA: 00 44
[+] SAK: 00 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+] MIFARE Ultralight
[+] MIFARE Ultralight C
[+] MIFARE Ultralight EV1
[+] MIFARE Ultralight Nano
[+] MIFARE Hospitality
[+] NTAG 2xx
[=] proprietary non iso14443-4 card found, RATS not supported
[?] Hint: try hf mfu info

[+] Valid ISO 14443-A tag found

[usb] pm3 → hf mfu info

[=] — Tag Information --------------------------
[=] -------------------------------------------------------------
[+] TYPE: NTAG 213 144bytes (NT2H1311G0DU)
[+] UID: 04 B6 CB 6A 92 57 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] BCC0: F0 ( ok )
[+] BCC1: 0F ( ok )
[+] Internal: 48 ( default )
[+] Lock: 00 00 - 0000000000000000
[+] OneTimePad: E1 10 12 00 - 11100001000100000001001000000000

[=] — NDEF Message
[+] Capability Container: E1 10 12 00
[+] E1: NDEF Magic Number
[+] 10: version 0.1 supported by tag
[+] : Read access granted without any security / Write access granted without any security
[+] 12: Physical Memory Size: 144 bytes
[+] 12: NDEF Memory Size: 144 bytes
[+] 00: Additional feature information
[+] 00000000
[+] xxx… - 00: RFU ( ok )
[+] …x… - 00: don’t support special frame
[+] …x… - 00: don’t support lock block
[+] …xx. - 00: RFU ( ok )
[+] …x - 00: IC don’t support multiple block reads

[=] — Tag Counter
[=] [02]: 00 00 00
[+] - BD tearing ( ok )

[=] — Tag Signature
[=] IC signature public key name: NXP NTAG21x (2013)
[=] IC signature public key value: 04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61
[=] Elliptic curve parameters: NID_secp128r1
[=] TAG IC Signature: 57D0C9FA83536999872B6747CC251964070D72A5C4D8F3C1523FA18C35340179
[+] Signature verification ( successful )

[=] — Tag Silicon Information
[=] Wafer Counter: 17625679 ( 0x10CF24F )
[=] Wafer Coordinates: x 183, y 203 (0xB7, 0xCB)
[=] Test Site: 2

[=] — Tag Version
[=] Raw bytes: 00 04 04 02 01 00 0F 03
[=] Vendor ID: 04, NXP Semiconductors Germany
[=] Product type: NTAG
[=] Product subtype: 02, 50pF
[=] Major version: 01
[=] Minor version: 00
[=] Size: 0F, (256 <-> 128 bytes)
[=] Protocol type: 03, ISO14443-3 Compliant
[?] Hint: try hf mfu pwdgen -r to get see known pwd gen algo suggestions
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory…
[#] Cmd Error: 00
[#] Read block 4 error
[=] ------------------------------------------------------------

2

do you have compatible blanks and if you’re going for it, do you have tags that have a changable UID? you can upload and download the dumps from one another but UIDs don’t normally have the ability to change

3

Thanks for the reply. I have NTAG213 blanks (NT2H1311G0DUx). Which ones should I get? Thanks.

4

those are good if you don’t care about the uid which with mifare ultralights it’s not always 100% important.

the file is saved in the proxmark folder inside your files where you installed the client to

1 Like
5

Very helpful, thank you!

6

if you’ve got any more problems or want a hand with anything feel free to drop me a line here or on discord Equip#1515

1 Like
7

You have been a great help and I will be able to edit the file before writing it… Thanks.

8

OK, I got it! For some reason I had overlooked the mfu ‘restore’ command as it is described as ‘Restore a dump onto a MFU MAGIC tag’ and I was not using a magic tag… I tried it and it worked on a non magic tag! I had to manually write 3 protected blocks (41,42 and 43) to change the password from default FFFFFFFF to the one I needed based on the new UID of the blank tag and to match exactly the original (except for the UID as my tags do not allow writing blocks 00 and 01).Now the copy works perfectly well.

Thanks to Equipter for clarifying the file access which allowed me to analyze and edit the dump before writing it.