Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Hello Team,
I’m helping my friend with his mf 1k fob but we’re having no luck. autopwn works but couldn’t decode sector 14 which tells me mad keys detected. No matter what I could’t check the keys in sector 14. I’m using ISO14443A replacement to duplicate this. Here’s the log that I’m dealing with. Keep in mind that some keys are hidden as requested by my friend. He worries so much lol .
[usb] pm3 → hf search
[-] Searching for ISO14443-A tag…
[+] UID: (hidden)
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities… Gen 1a
[+] Prng detection… weak
[?] Hint: use hf mf c* magic commands
[?] Hint: try hf mf commands
[+] Valid ISO 14443-A tag found
[usb] pm3 → hf mf chk -*
[+] loaded 61 keys from hardcoded default array
[=] Start check for keys…
[=] …
[=] time in checkkeys 5 seconds
[=] testing to read key B…
[+] found keys:
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | (hidden) | 1 | (hidden) | 1
[+] 001 | 007 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 002 | 011 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 003 | 015 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 004 | 019 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 005 | 023 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 006 | 027 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 007 | 031 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 008 | 035 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 009 | 039 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 010 | 043 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 011 | 047 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 012 | 051 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 013 | 055 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 014 | 059 | ------------ | 0 | ------------ | 0
[+] 015 | 063 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] -----±----±-------------±–±-------------±—
[+] ( 0:Failed / 1:Success )
[?] MAD key detected. Try hf mf mad for more details
[usb] pm3 → hf mf mad
[=] Authentication ( ok )
[#] Auth error
[=] — MIFARE App Directory Information ----------------
[=] -----------------------------------------------------
[=] ------------ MAD v1 details -------------
[+] Card publisher sector 0x0E
[=] ---------------- Listing ----------------
[=] 00 MAD v1
[=] 01 [0000] free
[=] 02 [0000] free
[=] 03 [0000] free
[=] 04 [0000] free
[=] 05 [0000] free
[=] 06 [0000] free
[=] 07 [0000] free
[=] 08 [0000] free
[=] 09 [0000] free
[=] 10 [0000] free
[=] 11 [0000] free
[=] 12 [0000] free
[=] 13 [0000] free
[=] 14 [5231] Security and Access Control [Integrated Control Technology Limited (ICT)]
[=] 15 [0000] free
[usb] pm3 → hf mf chk --1k -k (hidden)
[+] loaded 1 user keys
[+] loaded 61 keys from hardcoded default array
[=] Start check for keys…
[=] …
[=] time in checkkeys 3 seconds
[=] testing to read key B…
[+] found keys:
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | (hidden) | 1 | (hidden) | 1
[+] 001 | 007 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 002 | 011 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 003 | 015 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 004 | 019 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 005 | 023 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 006 | 027 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 007 | 031 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 008 | 035 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 009 | 039 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 010 | 043 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 011 | 047 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 012 | 051 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 013 | 055 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 014 | 059 | ------------ | 0 | ------------ | 0
[+] 015 | 063 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] -----±----±-------------±–±-------------±—
[+] ( 0:Failed / 1:Success )
[?] MAD key detected. Try hf mf mad for more details
[usb] pm3 → hf mf chk --tblk 14
[+] loaded 61 keys from hardcoded default array
[=] Start check for keys…
[=] …
[=] time in checkkeys 0 seconds
[=] testing to read key B…
[+] found keys:
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | ------------ | 0 | ------------ | 0
[+] 001 | 007 | ------------ | 0 | ------------ | 0
[+] 002 | 011 | ------------ | 0 | ------------ | 0
[+] 003 | 015 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 004 | 019 | ------------ | 0 | ------------ | 0
[+] -----±----±-------------±–±-------------±—
[+] ( 0:Failed / 1:Success )
[usb] pm3 → hf mf mad
[=] Authentication ( ok )
[#] Auth error
[=] — MIFARE App Directory Information ----------------
[=] -----------------------------------------------------
[=] ------------ MAD v1 details -------------
[+] Card publisher sector 0x0E
[=] ---------------- Listing ----------------
[=] 00 MAD v1
[=] 01 [0000] free
[=] 02 [0000] free
[=] 03 [0000] free
[=] 04 [0000] free
[=] 05 [0000] free
[=] 06 [0000] free
[=] 07 [0000] free
[=] 08 [0000] free
[=] 09 [0000] free
[=] 10 [0000] free
[=] 11 [0000] free
[=] 12 [0000] free
[=] 13 [0000] free
[=] 14 [5231] Security and Access Control [Integrated Control Technology Limited (ICT)]
[=] 15 [0000] free
[usb] pm3 → hf mf mad -v
[=] Authentication ( ok )
[#] Auth error
[!!] error, read sector 0x10. card doesn’t have MAD 2 or doesn’t have MAD 2 on default keys
[=] — MIFARE App Directory Information ----------------
[=] -----------------------------------------------------
[+] Loaded file (hidden) (ok) 1953 records.
[=] ------------ MAD v1 details -------------
[+] GPB… 0xC1
[+] Version… 1
[+] CRC8… 0xC5 ( ok )
[+] Multi application card
[+] Card publisher sector 0x0E
[=] ---------------- Listing ----------------
[=] 00 MAD v1
[=] 01 [0000] free
[=] 02 [0000] free
[=] 03 [0000] free
[=] 04 [0000] free
[=] 05 [0000] free
[=] 06 [0000] free
[=] 07 [0000] free
[=] 08 [0000] free
[=] 09 [0000] free
[=] 10 [0000] free
[=] 11 [0000] free
[=] 12 [0000] free
[=] 13 [0000] free
[=] 14 [5231] Security and Access Control [Integrated Control Technology Limited (ICT)]
[+] MAD: 0x5231
[+] Application: Security and Access Control
[+] Company: Integrated Control Technology Limited (ICT)
[+] Service provider: Integrated Control Technology Limited (ICT)
[+] System integrator: Integrated Control Technology Limited (ICT)
[=] 15 [0000] free
[=] ------------ MAD v1 sector raw -------------
[=] [0] A2 EA 1E 07 51 08 04 00 C8 50 00 20 00 00 00 17
[=] [1] C5 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] [2] 00 00 00 00 00 00 00 00 00 00 00 00 31 52 00 00
[=] [3] 00 00 00 00 00 00 78 77 88 C1 00 00 00 00 00 00
[=] ------------ MAD v2 sector raw -------------
[=] [0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] [1] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[usb] pm3 → hf mf mad --dch
[=] Authentication ( ok )
[#] Auth error
[=] — MIFARE App Directory Information ----------------
[=] -----------------------------------------------------
[=] ------------ MAD v1 details -------------
[+] Card publisher sector 0x0E
[=] ---------------- Listing ----------------
[=] 00 MAD v1
[=] 01 [0000] free
[=] 02 [0000] free
[=] 03 [0000] free
[=] 04 [0000] free
[=] 05 [0000] free
[=] 06 [0000] free
[=] 07 [0000] free
[=] 08 [0000] free
[=] 09 [0000] free
[=] 10 [0000] free
[=] 11 [0000] free
[=] 12 [0000] free
[=] 13 [0000] free
[=] 14 [5231] Security and Access Control [Integrated Control Technology Limited (ICT)]
[=] 15 [0000] free
[=] -------- Card Holder Info 0x0004 --------
[!] no Card Holder Info data
[usb] pm3 → hf mf mad --dch -k (hidden)
[=] Authentication ( ok )
[#] Auth error
[=] Trying user specified key…
[#] Auth error
[=] — MIFARE App Directory Information ----------------
[=] -----------------------------------------------------
[=] ------------ MAD v1 details -------------
[+] Card publisher sector 0x0E
[=] ---------------- Listing ----------------
[=] 00 MAD v1
[=] 01 [0000] free
[=] 02 [0000] free
[=] 03 [0000] free
[=] 04 [0000] free
[=] 05 [0000] free
[=] 06 [0000] free
[=] 07 [0000] free
[=] 08 [0000] free
[=] 09 [0000] free
[=] 10 [0000] free
[=] 11 [0000] free
[=] 12 [0000] free
[=] 13 [0000] free
[=] 14 [5231] Security and Access Control [Integrated Control Technology Limited (ICT)]
[=] 15 [0000] free
[=] -------- Card Holder Info 0x0004 --------
[!] no Card Holder Info data
Offline
What is MAD used for ?
Offline
Hi, look Mifare application Directory AN10787.
Offline
Hi, look Mifare application Directory AN10787.
Thanks a lot my friend! That is definitely helpful but long read. I've found the mifare pdf. I'll go through it and try few things here and there and send some updates . Stay tuned.
Offline