Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2019-10-14 12:22:20

franskav
Contributor
Registered: 2019-09-22
Posts: 7

[solved] Calculating Mifare Classic 1k MAD CRC

Hi,

I have an existing Mifare Classic 1k card used for public transportation.
The last 4 blocks on the card are empty and use 'FF FF FF FF FF FF' for key A and key B.

This is the card's value in sector 0, block 1:
ec 00 15 00 04 00 1e 07 1d 07 7b 88 7b 88 7b 88

Sector 0, block 2:
7b 88 37 18 62 20 62 20 00 00 00 00 00 00 00 00

I would like to use block 12 for NFC data. I have researched this a lot and I have the data for NFC sector ready.

I'm having issues with re-calculating MAD sector CRC. I would like to update sector 0, block 2 to this (appended 03 E1 for NFC sector):
7b 88 37 18 62 20 62 20 03 E1 00 00 00 00 00 00

Now I don't know how to recalculate Mifare MAD CRC value, sector 0, block 1, byte[0]?
It seems there are no online calculators for this?
I know some windows apps auto-calculate this, but I only have a mac and proxmark 3 rdv4.01 and proxmark software..

Does anyone have any tips what's the best way to calculate this by hand, or in a general purpose programming language, like Ruby?
Thanks

Last edited by franskav (2019-10-15 13:27:22)

Offline

#2 2019-10-15 13:27:10

franskav
Contributor
Registered: 2019-09-22
Posts: 7

Re: [solved] Calculating Mifare Classic 1k MAD CRC

I was able to figure this out with a serendipitous finding. Here are the steps:

- I was using proxmark3 iceman fork. Official  repo has the necessary commands, not sure if the output is the same tho.
- Manually write card MAD to an 'eml' file (along with the rest of the card data). Set the MAD CRC to ANY value, eg 00
- Write the card to a magic Mifare card
- Run 'hf mf mad'. This will output an invalid CRC error, but will print the correct, expected CRC. This 'expected CRC' is what I needed.

Offline

Board footer

Powered by FluxBB