Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2020-06-01 12:17:10

Winds
Member
Registered: 2020-01-28
Posts: 53

Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

Hi to all,

I would like to publish my video guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K at the forum, for newest peoples and give an directly instructions for actions.

Regards to IceMan who has helped me to optimize my code, and to Doegox who removed it from the repo.

Enjoy!

Last edited by Winds (2020-06-01 12:28:57)

Offline

#2 2020-06-05 05:35:50

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

Hi, i watched your videos on how to clone Mifare classic and i followed your instruction but no success.

Offline

#3 2020-06-05 05:38:12

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

I followed your instruction but it just doesn't work when i run  mfc_gen3_writer.lua script.
Please check it and please please tell me what i did wrong

ubuntu@ubuntu:~/proxmark3$ pm3
[=] Session log /home/ubuntu/.proxmark3/log_20200605.txt
[=] Loading Preferences...
[+] loaded from JSON file /home/ubuntu/.proxmark3/preferences.json
[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC


  ██████╗ ███╗   ███╗█████╗ 
  ██╔══██╗████╗ ████║╚═══██╗
  ██████╔╝██╔████╔██║ ████╔╝
  ██╔═══╝ ██║╚██╔╝██║ ╚══██╗     ❄️  iceman@icesql.net
  ██║     ██║ ╚═╝ ██║█████╔╝    https://github.com/rfidresearchgroup/proxmark3/
  ╚═╝     ╚═╝     ╚═╝╚════╝   bleeding edge ☕


 [ Proxmark3 RFID instrument ]

 [ CLIENT ]
  client: RRG/Iceman/master/v4.9237-9-g888235cd 2020-05-22 01:42:05
  compiled with GCC 9.3.0 OS:Linux ARCH:x86_64

 [ PROXMARK3 RDV4 ]
  external flash:                  present
  smartcard reader:                present

 [ PROXMARK3 RDV4 Extras ]
  FPC USART for BT add-on support: absent

 [ ARM ]
  bootrom: RRG/Iceman/master/v4.9237-9-g888235cd 2020-05-22 01:43:23
       os: RRG/Iceman/master/v4.9237-9-g888235cd 2020-05-22 01:43:38
  compiled with GCC 9.2.1 20191025 (release) [ARM/arm-9-branch revision 277599]

 [ FPGA ]
  LF image built for 2s30vq100 on 2020-02-22 at 12:51:14
  HF image built for 2s30vq100 on 2020-01-12 at 15:31:16

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev B
  --= Embedded Processor: ARM7TDMI
  --= Nonvolatile Program Memory Size: 512K bytes, Used: 288908 bytes (55%) Free: 235380 bytes (45%)
  --= Second Nonvolatile Program Memory Size: None
  --= Internal SRAM Size: 64K bytes
  --= Architecture Identifier: AT91SAM7Sxx Series
  --= Nonvolatile Program Memory Type: Embedded Flash Memory


[usb] pm3 --> hf mf autopwn * 1 f mfc_default_keys
[!] ⚠️  no known key was supplied, key recovery might fail
[+] loaded 920 keys from dictionary file /usr/local/bin/../share/proxmark3/dictionaries/mfc_default_keys.dic
[=] running strategy 1

[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 32/32 keys (85)

[+] target sector:  0 key type: A -- found valid key [88 29 DA 9D AF 76 ] (used for nested / hardnested attack)
[+] target sector:  0 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  1 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  1 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  2 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  2 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  3 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  3 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  4 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  4 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  5 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  5 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  6 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  6 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  7 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  7 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  8 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  8 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  9 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  9 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 10 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 10 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 11 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 11 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 12 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 12 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 13 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 13 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 14 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 14 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 15 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 15 key type: B -- found valid key [88 29 DA 9D AF 76 ]

[+] found keys:
[+] |-----|----------------|---|----------------|---|
[+] | Sec | key A          |res| key B          |res|
[+] |-----|----------------|---|----------------|---|
[+] | 000 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 001 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 002 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 003 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 004 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 005 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 006 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 007 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 008 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 009 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 010 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 011 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 012 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 013 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 014 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 015 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] |-----|----------------|---|----------------|---|
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / A:keyA )

[+] Generating binary key file
[+] Found keys have been dumped to hf-mf-825B8E02-key-1.bin--> 0xffffffffffff has been inserted for unknown keys.
[+] transferring keys to simulator memory (Cmd Error: 04 can occur)
[=] downloading the card content from emulator memory
[+] saved 1024 bytes to binary file hf-mf-825B8E02-dump-1.bin
[+] saved 64 blocks to text file hf-mf-825B8E02-dump-1.eml
[+] saved to json file hf-mf-825B8E02-dump-1.json
[=] autopwn execution time: 8 seconds
[usb] pm3 --> script run mfc_gen3_writer
[+] executing lua mfc_gen3_writer.lua
[+] args ''
Waiting for card... press Enter to quit
----------------------------------------------------------------
 1 | applypat
 2 | ypatch-m
 3 | brute/ob
 4 | brute/ob
 5 | /obj/buc
 6 | /obj/buc
 7 | c06_cons
 8 | cipher_i
 9 | tion_Ins
 10 | ne/lf_pr
 11 | ne/lf_em
 12 | on-ask-m
 13 | HIDemu-F
 14 | on-ask-m
 15 | on-manch
 16 | on-ask-m
 17 | ts/mifar
 18 | ts/dumpt
 19 | ts/test_
 20 | ts/calc_
 21 | ts/param
 22 | ass/elit
 23 | ass/ciph
 24 | ass/elit
 25 | ass/ciph
 26 | and_form
 27 | crypto_p
 28 | crypto_p
 29 | test/cry
 30 | test/cry
 31 | and_form
 32 | sson/obj
 33 | sson/obj
 34 | sson/lib
 35 | itool/li
 36 | lua/obj/
 37 | lua/obj/
 38 | lua/obj/
 39 | lua/obj/
 40 | lua/obj/
 41 | lua/obj/
 42 | lua/obj/
 43 | lua/obj/
 44 | lua/obj/
 45 | lua/obj/
 46 | lua/obj/
 47 | lua/obj/
 48 | lua/obj/
 49 | lua/obj/
 50 | lua/obj/
 51 | lua/obj/
 52 | lua/obj/
 53 | lua/obj/
find: ‘*dump.eml’: No such file or directory
 54 | and_form
 55 | ass/ciph
 56 | ass/elit
 57 | ass/elit
 58 | ass/hash
 59 | ass/hash
 60 | ass/ciph
 61 | crypto_p
 62 | test/cry
 63 | test/cry
 64 | and_form
 65 | s/iclass
----------------------------------------------------------------
 Your card has UID 4A0B2815

 Select which dump to write (1 until 65)
----------------------------------------------------------------
 --> 1
----------------------------------------------------------------
 You have been selected card dump No 1, with UID: applypat. Your card UID: 4A0B2815
mfc_gen3_writer.lua:294: ./hf-mf-applypat-dump.eml: No such file or directory

[+] finished mfc_gen3_writer

[usb] pm3 --> 

Last edited by Mongol (2020-06-05 06:43:05)

Offline

#4 2020-06-05 06:16:40

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

Would you please upload video how to clone mifare PRNG: hard card? i really need to duplicate my fob

Offline

#5 2020-06-06 00:07:30

Winds
Member
Registered: 2020-01-28
Posts: 53

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

The script works only to Windows platform.
Plese find compiled distro at video discription with already included mfc_gen3_writer.lua if you have any problems.
To correct run it, you might have minimum one dump after autopown command.

Offline

#6 2020-06-08 13:30:10

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

Hi I think that the problem is with my blank mifare cards since they are some types of different card on the market Im gonna buy a some card from your link.
Can u pls tell me which one will work on my mifare card from below 3 options. I found one seller from ebay selling 3 different mifare key. My original fob is prng: Hardened 1k mifare



New  UID Changeable MF Classic 1K 13.56Mhz Cards  IC Cards

IMPORTANT: There are three different types of cards that you can choose  from:

Type 1: Normal GEN1 UID Changeable Cards:
All blocks (including Block 0) can be re-written multiple times
Use ProxMark3 (Magic Chinese Guy function) or  libnfc to change UID.
Uses "backdoor" technique to change/rewrite UID.
UID can be changed multiple times.
Not suitable for MCT Mi fare Classic Tool
Answers to chinese magic backdoor commands (GEN 1a): YES
Type 2: Special GEN2 CUID Cards:
All blocks (including Block 0) can be re-written multiple times
Not easily detectable by a system with "anti-clone"  feature
IMPORTANT: Card will die if an  invalid Block 0 is written
Use normal commands. eg. hf mf  wrbl 0 B FFFFFFFFFFFF a473f601200804006263646566676869
Suitable for MCT Mi fare Classic Tool
Answers to chinese magic backdoor commands: NO
Type 3: Special GEN2 FUID Write-Once Cards:
Block 0 can only be written once.
Even greater protection from a  system with "anti-clone" feature
Use normal commands. eg. hf mf  wrbl 0 B FFFFFFFFFFFF a473f601200804006263646566676869
Suitable for MCT Mi fare Classic Tool
Answers to chinese magic backdoor commands: NO

Offline

#7 2020-06-09 12:36:53

Winds
Member
Registered: 2020-01-28
Posts: 53

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

I can't talk about other types cards. Please buy cards from link in description for get a same result like me.

Offline

#8 2020-06-09 14:05:36

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

You don't need to buy a gen3 card.

Just buy a gen1a,  use the 'hf mf c*' commands,  and see if it works on your setup.  Gen1a is dirt cheap.

Offline

#9 2020-06-09 20:14:01

Winds
Member
Registered: 2020-01-28
Posts: 53

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

iceman wrote:

You don't need to buy a gen3 card.

Just buy a gen1a,  use the 'hf mf c*' commands,  and see if it works on your setup.  Gen1a is dirt cheap.

Yeah the seller at AliExpress has changed a price, it was more less.

Offline

#10 2020-06-15 10:10:59

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

thank you so much for the reply iceman and winds. I successfully cloned my Mifare card on gen1a fob which i bought from online but reader doesn't accept my cloned fob.
here's what i did:
I used "hf mf autopwn" command and it successfully recovered all the key in A and B. but the recovered keys were all the same one key.
then i used restore command to copy the recovered keys to my new fob. after that, i used csetuid command to change the UID with original one. Now when i compare the original and clone fob, they all exactly shown same results(keys and UID)
Why is it not working on the reader??? i guess Gen1a card doesn't work with the reader.  i've been trying to clone this fob for many months.
Please help me for this issue.
i can upload all the process here.

Offline

#11 2020-06-15 10:14:21

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

Here's the original fob result:

 ? Searching for ISO14443-A tag...           
[+]  UID: 82 5B 8E 02 
[+] ATQA: 00 04
[+]  SAK: 08 [2]
[+] POSSIBLE TYPE:    MIFARE Classic 1K / Classic 1K CL2
[+] POSSIBLE TYPE:    MIFARE Plus 2K / Plus EV1 2K
[+] POSSIBLE TYPE:    MIFARE Plus CL2 2K / Plus CL2 EV1 2K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: hard

[+] Valid ISO14443-A tag found

 pm3 --> hf mf fchk 1 mfc_default_keys.dic
[+] Loaded 920 keys from mfc_default_keys.dic
[=] Running strategy 1

[=] Chunk: 1.4s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.0s | found 32/32 keys (85)

[=] Time in checkkeys (fast):  5.7s


[+] found keys:
[+] |-----|----------------|---|----------------|---|
[+] | Sec | key A          |res| key B          |res|
[+] |-----|----------------|---|----------------|---|
[+] | 000 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 001 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 002 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 003 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 004 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 005 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 006 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 007 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 008 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 009 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 010 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 011 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 012 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 013 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 014 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 015 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] |-----|----------------|---|----------------|---|
[+] ( 0:Failed / 1:Success)
  

Last edited by Mongol (2020-06-15 10:18:48)

Offline

#12 2020-06-15 10:17:23

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

here's the cloned fob used Gen1a. everything looks same on both card but doesn't work!

[usb] pm3 --> hf se
 ? Searching for ISO14443-A tag...           
[+]  UID: 82 5B 8E 02 
[+] ATQA: 00 04
[+]  SAK: 08 [2]
[+] POSSIBLE TYPE:    MIFARE Classic 1K / Classic 1K CL2
[+] POSSIBLE TYPE:    MIFARE Plus 2K / Plus EV1 2K
[+] POSSIBLE TYPE:    MIFARE Plus CL2 2K / Plus CL2 EV1 2K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities : Gen 1a
[+] Prng detection: weak

[+] Valid ISO14443-A tag found

 ?                                
usb] pm3 --> hf mf fchk 1 mfc_default_keys.dic
[+] Loaded 920 keys from mfc_default_keys.dic
[=] Running strategy 1

[=] Chunk: 1.7s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.0s | found 32/32 keys (85)

[=] Time in checkkeys (fast):  5.9s


[+] found keys:
[+] |-----|----------------|---|----------------|---|
[+] | Sec | key A          |res| key B          |res|
[+] |-----|----------------|---|----------------|---|
[+] | 000 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 001 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 002 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 003 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 004 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 005 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 006 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 007 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 008 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 009 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 010 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 011 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 012 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 013 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 014 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] | 015 | 8829da9daf76   | 1 | 8829da9daf76   | 1 |
[+] |-----|----------------|---|----------------|---|
[+] ( 0:Failed / 1:Success)

Offline

#13 2020-06-15 11:58:05

Monster1024
Contributor
Registered: 2020-05-05
Posts: 33

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

I think that your reader is detecting gen1a cards. Try using proxmark simulation mode - if it will work, you need little bit 'clever' tag smile

Offline

#14 2020-06-16 05:28:53

mwalker
Moderator
Registered: 2019-05-11
Posts: 318

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

@Mongol

Now when i compare the original and clone fob, they all exactly shown same results(keys and UID)

What about the data on the card ?

Offline

#15 2020-06-26 06:14:49

Mongol
Contributor
Registered: 2020-06-04
Posts: 13

Re: Video Guide for Recovering and Cloning UID: MIFARE Classic EV1 S50 1K

Please tell me what type of mifare card should I use to clone this fob and what command i have to use. please tell me what to do to clone it to blank fob.

hello here's the result:

[usb] pm3 --> hf mf autopwn * 1 f mfc_default_keys
[!] no known key was supplied, key recovery might fail
[+] loaded 920 keys from dictionary file C:\Users\DeLL\Documents\swipe\proxmark3-64-20200602-6980429bd4c01a716c9168b05dd2f805b7e35940\win64\dictionaries/mfc_default_keys.dic
[=] running strategy 1

[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.1s | found 0/32 keys (85)


[=] Chunk: 1.0s | found 32/32 keys (85)

[+] target sector:  0 key type: A -- found valid key [88 29 DA 9D AF 76 ] (used for nested / hardnested attack)
[+] target sector:  0 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  1 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  1 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  2 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  2 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  3 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  3 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  4 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  4 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  5 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  5 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  6 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  6 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  7 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  7 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  8 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  8 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  9 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector:  9 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 10 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 10 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 11 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 11 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 12 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 12 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 13 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 13 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 14 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 14 key type: B -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 15 key type: A -- found valid key [88 29 DA 9D AF 76 ]
[+] target sector: 15 key type: B -- found valid key [88 29 DA 9D AF 76 ]

[+] found keys:
[+] |-----|----------------|---|----------------|---|
[+] | Sec | key A          |res| key B          |res|
[+] |-----|----------------|---|----------------|---|
[+] | 000 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 001 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 002 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 003 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 004 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 005 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 006 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 007 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 008 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 009 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 010 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 011 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 012 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 013 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 014 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] | 015 | 8829da9daf76   | D | 8829da9daf76   | D |
[+] |-----|----------------|---|----------------|---|
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / A:keyA )


[usb] pm3 --> hf mf rdbl 0 a 8829da9daf76
--block no:0, key type:A, key:88 29 DA 9D AF 76
data: 82 5B 8E 02 55 88 04 00 C8 49 00 20 00 00 00 17
[usb] pm3 --> hf mf rdbl 1 a 8829da9daf76
--block no:1, key type:A, key:88 29 DA 9D AF 76
data: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[usb] pm3 --> hf mf rdbl 2 a 8829da9daf76
--block no:2, key type:A, key:88 29 DA 9D AF 76
data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[usb] pm3 --> hf mf rdbl 3 a 8829da9daf76
--block no:3, key type:A, key:88 29 DA 9D AF 76
data: 00 00 00 00 00 00 7F 07 88 00 00 00 00 00 00 00
Trailer decoded:
Access block 0: rdAB wrAB incAB dectrAB
Access block 1: rdAB wrAB incAB dectrAB
Access block 2: rdAB wrAB incAB dectrAB
Access block 3: wrAbyB rdCbyAB wrCbyB wrBbyB
UserData: 00

Offline

Board footer

Powered by FluxBB