Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2019-10-29 15:18:35

mnemarchon
Contributor
Registered: 2019-08-30
Posts: 18

Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

I bought the NTAG21x keyfobs from rfxsecure.com. I already have some NTAG21x credit-card-form originally bought from IceSQL shop which work fine.

The Rfxsecure keyfobs are real PITA to work with. First of all you have to position it very precisely and repeat wipe "script run mfu_magic -w" until there is no timeout. After that you have to repeat programming the type and UID until there is no timeout. Took me quite a while to get the first keyfob programmed.

Haven't tested how they will work against real readers in the wild, will update.

Offline

#2 2019-10-29 15:59:24

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

Sad to hear,  I don't think I tested the keyfobs from rfxsecure yet. 
Do you have the output from the following commands?

hf 14a info
hf mfu info
script run mfu_magic -w
hf 14a list

[moved to trade section]

Offline

#3 2019-10-29 20:57:37

mnemarchon
Contributor
Registered: 2019-08-30
Posts: 18

Re: Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

This is result from already programmed keyfob. At least when I tested it against a real reader, it worked fine, but the programming requires right positioning (note the select failures until I found the right position).

pm3 --> hf 14a info
 UID : 04 11 22 33 44 55 66           
ATQA : 00 44          
 SAK : 00 [2]          
[!] iso14443a card select failed          
TYPE: Possible AZTEK (iso14443a compliant)          
pm3 --> hf 14a info
[!] iso14443a card select failed          
pm3 --> hf 14a info
[!] iso14443a card select failed          
pm3 --> hf 14a info
 UID : 04 11 22 33 44 55 66           
ATQA : 00 44          
 SAK : 00 [2]          
TYPE : MIFARE Ultralight EV1 48bytes (MF0UL1101)          
MANUFACTURER : NXP Semiconductors Germany          
SAK incorrectly claims that card doesn't support RATS          
 ATS : 0D 78 00 71 02 89 01 A0 10 20 18 33 AA C4 70           
       -  TL : length is 13 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 8 (FSC = 256)          
       - TA1 : different divisors are supported, DR: [], DS: []          
       - TB1 : SFGI = 1 (SFGT = 8192/fc), FWI = 7 (FWT = 524288/fc)          
       - TC1 : NAD is NOT supported, CID is supported          
[=] Answers to magic commands: NO          
pm3 --> hf mfu info

--- Tag Information ---------          
-------------------------------------------------------------          
      TYPE : MIFARE Ultralight EV1 48bytes (MF0UL1101)          
       UID : 04 11 22 33 44 55 66            
    UID[0] : 04, NXP Semiconductors Germany          
      BCC0 : BF, Ok          
      BCC1 : 44, Ok          
  Internal : 48, default          
      Lock : 00 00  - 00          
OneTimePad : 00 00 00 00  - 0000
          
--- Tag Counters          

--- Tag Signature          
IC signature public key name  : NXP NTAG21x (2013)          
IC signature public key value : 04 49 4E 1A 38 6D 3D 3C FE 3D C1 0E 5D E6 8A 49 9B 1C 20 2D B5 B1 32 39 3E 89 ED 19 FE 5B E8 BC 61           
    Elliptic curve parameters : secp128r1          
            Tag ECC Signature : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00           

--- Tag Version          
       Raw bytes : 00 04 03 01 01 00 0B 03           
       Vendor ID : 04, NXP Semiconductors Germany          
    Product type : 03, Ultralight          
 Product subtype : 01, 17 pF          
   Major version : 01          
   Minor version : 00          
            Size : 0B, (64 <-> 32 bytes)          
   Protocol type : 03 (ISO14443-3 Compliant)          

--- Tag Configuration          
  cfg0 [16/0x10] : 00 00 00 FF           
                    - strong modulation mode disabled          
                    - pages don't need authentication          
  cfg1 [17/0x11] : 00 05 00 00           
                    - Unlimited password attempts          
                    - NFC counter disabled          
                    - NFC counter password protection enabled          
                    - user configuration writeable          
                    - write access is protected with password          
                    - 05, Virtual Card Type Identifier is  default          
  PWD  [18/0x12] : 00 00 00 00 - (cannot be read)          
  PACK [19/0x13] : 00 00       - (cannot be read)          
  RFU  [19/0x13] :       00 00 - (cannot be read)          

--- Known EV1/NTAG passwords.          
password not known          
          
pm3 --> script run mfu_magic -w
[+] Executing: mfu_magic.lua, args '-w'
          
----------------------------------------
----------------------------------------

auth	hf 14a raw -c -s -p 
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes          
0A           
received 1 bytes
[...]          
turning off
received 1 bytes          
00           
setting default values...
Setting: NTAG 213
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
New type :	NTAG 213
Writing
new UID | 04112233445566
Blk#    |
    00  |041122BF
    01  |33445566
    02  |44480000
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
New UID :	04112233445566
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
New PASSWORD :	FFFFFFFF
Card selected. UID[7]:          
04 11 22 33 44 55 66           
received 1 bytes          
0A           
New PACK :	0000
          
[+] Finished
          
pm3 --> hf 14a list
trace pointer not allocated
Recorded Activity (TraceLen = 160 bytes)          
          
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer          
iso14443a - All times are in carrier periods (1/13.56Mhz)          
          
      Start |        End | Src | Data (! denotes parity error)                                           | CRC | Annotation          
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------          
          0 |        992 | Rdr |52                                                                       |     | WUPA          
       2228 |       4596 | Tag |44  00                                                                   |     |           
       7040 |       9504 | Rdr |93  20                                                                   |     | ANTICOLL          
      10676 |      16564 | Tag |88  04  11  22  bf                                                       |     |           
      19072 |      29536 | Rdr |93  70  88  04  11  22  bf  b3  f9                                       |  ok | SELECT_UID          
      30772 |      34292 | Tag |04  da  17                                                               |     |           
      35584 |      38048 | Rdr |95  20                                                                   |     | ANTICOLL-2          
      39220 |      45044 | Tag |33  44  55  66  44                                                       |     |           
      47488 |      57952 | Rdr |95  70  33  44  55  66  44  ec  a3                                       |  ok | ANTICOLL-2          
      59188 |      62772 | Tag |00  fe  51                                                               |     |           
      77056 |      86368 | Rdr |a2  f1  00  00  00  00  c5  2b                                           |  ok | WRITEBLOCK(241) (?)          
     158132 |     158708 | Tag |0a!                                                                      |     |           
pm3 --> hf 14a reader
 UID : 04 11 22 33 44 55 66           
ATQA : 00 44          
 SAK : 00 [2]          
[+] field dropped.          

Offline

#4 2019-10-30 08:22:55

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

... sounds a tricky fob to find good coupling with.

Which version of the script are you running?

script run mfu_magic -h

Offline

#5 2019-10-30 19:42:06

mnemarchon
Contributor
Registered: 2019-08-30
Posts: 18

Re: Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

That was 1.0.5, after long search I found 1.1.0, though except for better output it doesn't work better with the tag.

Copyright (c) 2017 IceSQL AB. All rights reserved.
v1.1.0
This script enables easy programming of a MAGIC NTAG 21* card

Also it seems that no matter what I can't change the UID when the type is NTAG216 (-t 7). When type is set to Ultralight (-t 2), wipe and set UID works:

pm3 --> script run mfu_magic -w
[+] Executing: mfu_magic.lua, args '-w'
          
----------------------------------------
----------------------------------------

Wiping tag
.........................................................................................................................................................................................................................................................
setting default values...
Setting: NTAG 213
Writing new version	0004040201000F03
Writing new type	00
Writing new UID 	04112233445566
Writing new PWD 	FFFFFFFF
Writing new PACK	0000
          
[+] Finished
          
pm3 --> script run mfu_magic -t 7 -u 04112233445599
[+] Executing: mfu_magic.lua, args '-t 7 -u 04112233445599'
          
----------------------------------------
----------------------------------------

Setting: NTAG 216
Writing new version	0004040201001303
Writing new type	02
Writing new UID 	04112233445599
          
[+] Finished
          
pm3 --> hf 14a reader
 UID : 04 11 22 33 44 55 66           
ATQA : 00 44          
 SAK : 00 [2]          
[+] field dropped.          
pm3 --> hf 14a reader
 UID : 04 11 22 33 44 55 66           
ATQA : 00 44          
 SAK : 00 [2]          
[+] field dropped.          
pm3 --> script run mfu_magic -t 7 -u 04112233445599
[+] Executing: mfu_magic.lua, args '-t 7 -u 04112233445599'
          
----------------------------------------
----------------------------------------

Setting: NTAG 216
Writing new version	0004040201001303
Writing new type	02
Writing new UID 	04112233445599
          
[+] Finished
          
pm3 --> hf 14a reader
 UID : 04 11 22 33 44 55 66           
ATQA : 00 44          
 SAK : 00 [2]          
[+] field dropped.          
pm3 --> script run mfu_magic -u 04112233445599
[+] Executing: mfu_magic.lua, args '-u 04112233445599'
          
----------------------------------------
----------------------------------------

Writing new UID 	04112233445599
          
[+] Finished
          
pm3 --> hf 14a reader
 UID : 04 11 22 33 44 55 66           
ATQA : 00 44          
 SAK : 00 [2]          
[+] field dropped.          
pm3 --> script run mfu_magic -t 2 -u 04112233445599
[+] Executing: mfu_magic.lua, args '-t 2 -u 04112233445599'
          
----------------------------------------
----------------------------------------

Setting: UL-EV1 128
Writing new OTP 	00000000
Writing new version	0004030101000e03
Writing new type	01
Writing new UID 	04112233445599
          
[+] Finished
          
pm3 --> hf 14a reader
 UID : 04 11 22 33 44 55 99           
ATQA : 00 44          
 SAK : 00 [2]          
[+] field dropped.          

After some experimenting it seems it just doesn't like some types, like '-t 7' or '-t 3' (can't change UID when emulating NTAG216/NTAG210):

pm3 --> script run mfu_magic -t 7 -u 041122334455ee
[+] Executing: mfu_magic.lua, args '-t 7 -u 041122334455ee'
          
----------------------------------------
----------------------------------------

Setting: NTAG 216
Writing new version	0004040201001303
Writing new type	02
Writing new UID 	041122334455ee
          
[+] Finished
          
pm3 --> hf 14a reader
 UID : 04 11 22 33 44 55 CC           
ATQA : 00 44          
 SAK : 00 [2]          
[+] field dropped.          

Offline

#6 2019-10-30 22:50:43

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

Are you on latest RRG/Iceman repo?
Then you would need a later version of the script.

Offline

#7 2019-10-31 01:51:17

mnemarchon
Contributor
Registered: 2019-08-30
Posts: 18

Re: Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

I cloned the latest RRG repo (https://github.com/RfidResearchGroup/proxmark3), but I can't see the mfu_magic script there at all. Unless it was renamed or lost in history.

Offline

#8 2019-10-31 07:13:51

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Rfxsecure.com Magic NTAG21x keyfobs are fairly problematic

it was never there to start with...   Only accessable from vendor.   Send me an email.

Offline

Board footer

Powered by FluxBB