Proxmark3 community

iceman

Administrator

Registered: 2013-04-25

Posts: 9,538

Website

Mifare Classic 4k - magic generation 1b

Thanks to @kwx ,  he seems to gotten hold of new kind magic tags. 

MIfare Classic 4k  - magic generation 1b
4byte UID
UID/ATQA is changeable,   SAK seems to be locked somehow.

These tags doesn't use the full chinese magic backdoor commands, but gets triggered with only 7bit 0x40.
Like gen1,  which needs 0x43 aswell.  No need to authenticate when in backdoor mode.   So I call this Generation 1b.

Havn't test to write a bad sector trailer,  but like all generation 1 tags,  it doesn't need to run anticollision to be selected.

The tag is not compatible with Generation1 start (0x40, 0x43) sequence.  Hence hf mf c* commands will fail.
hf 14a raw works great.

In short-
send 7bit 40  to enter backdoor mode.
send 30nn + crc for reading block.
send A0mm + crc  for writing block. wait for response  0x0a, then send 16bytes + crc

steps:

hf 14a raw -a -p -b 7 40
hf 14a raw -p -c 3000       
hf 14a raw -p -c A000
hf 14a raw -p -c E94094211c18040041424344454647
hf 14a raw -p -c 3000
hf 14a raw -r 00
hf 14a read
hf 14a list 

--[ 3000 -> read block 00 ]
--[ A000 -> write block 00 ]