Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2020-09-09 02:37:23

heatwave
Contributor
Registered: 2020-09-08
Posts: 9

Vingcard crack help

Hey,
My place just upgraded to the new vingcard mifare classic 4k system. I tried all the insructions on thread it took me few weeks to try to clone but no success until now,I really appreciated if anyone can give me some advise:)
Below is what I tried so far and stuck..

My current settings.

[ CLIENT ]
  client: RRG/Iceman/master/v4.9237-938-ge10333e2 2020-09-02 13:00:12
  compiled with MinGW-w64 10.2.0 OS:Windows (64b) ARCH:x86_64

 [ PROXMARK3 ]

 [ ARM ]
  bootrom: RRG/Iceman/master/v4.9237-938-ge10333e2 2020-09-02 12:59:57
       os: RRG/Iceman/master/v4.9237-938-ge10333e2 2020-09-02 13:00:03
  compiled with GCC 9.2.1 20191025 (release) [ARM/arm-9-branch revision 277599]

 [ FPGA ]
  LF image built for 2s30vq100 on 2020-07-08 at 23: 8: 7
  HF image built for 2s30vq100 on 2020-07-08 at 23: 8:19
  HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23: 8:30

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev B
  --= Embedded Processor: ARM7TDMI
  --= Nonvolatile Program Memory Size: 512K bytes, Used: 255752 bytes (49%) Free: 268536 bytes (51%)
  --= Second Nonvolatile Program Memory Size: None
  --= Internal SRAM Size: 64K bytes
  --= Architecture Identifier: AT91SAM7Sxx Series
  --= Nonvolatile Program Memory Type: Embedded Flash Memory

Card type

[usb] pm3 --> hf search
[|] Searching for ISO14443-A tag...
[+]  UID: 36 CB 0F 82
[+] ATQA: 00 02
[+]  SAK: 18 [2]
[+] Possible types:
[+]    MIFARE Classic 1K / Classic 1K CL2
[+]    MIFARE Plus 2K / Plus EV1 2K
[+]    MIFARE Plus CL2 2K / Plus CL2 EV1 2K
[+]    MIFARE Plus 2K / Plus CL2 2K
[+]    MIFARE Classic 4K / Classic 4K CL2
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: hard

[+] Valid ISO14443-A tag found

the result of mf chk.

[usb] pm3 --> hf mf chk *4 ? d
[=] No key specified, trying default keys
[ 0] ffffffffffff
[ 1] 000000000000
[ 2] a0a1a2a3a4a5
[ 3] b0b1b2b3b4b5
[ 4] c0c1c2c3c4c5
[ 5] d0d1d2d3d4d5
[ 6] aabbccddeeff
[ 7] 1a2b3c4d5e6f
[ 8] 123456789abc
[ 9] 010203040506
[10] 123456abcdef
[11] abcdef123456
[12] 4d3a99c351dd
[13] 1a982c7e459a
[14] d3f7d3f7d3f7
[15] 714c5c886e97
[16] 587ee5f9350f
[17] a0478cc39091
[18] 533cb6c723f6
[19] 8fd0a4f256e9
[20] 0000014b5c31
[21] b578f38a5c61
[22] 96a301bce267
................................................................................
[=] time in checkkeys 19 seconds

[=] testing to read key B...
[=] Sector 17, First block of sector 68, Num of block 4
[=] Reading block 71
[=] Sector 18, First block of sector 72, Num of block 4
[=] Reading block 75
[=] Sector 19, First block of sector 76, Num of block 4
[=] Reading block 79
[=] Sector 20, First block of sector 80, Num of block 4
[=] Reading block 83
[=] Sector 21, First block of sector 84, Num of block 4
[=] Reading block 87
[=] Sector 22, First block of sector 88, Num of block 4
[=] Reading block 91
[=] Sector 23, First block of sector 92, Num of block 4
[=] Reading block 95
[=] Sector 24, First block of sector 96, Num of block 4
[=] Reading block 99
[=] Sector 25, First block of sector 100, Num of block 4
[=] Reading block 103
[=] Sector 26, First block of sector 104, Num of block 4
[=] Reading block 107
[=] Sector 27, First block of sector 108, Num of block 4
[=] Reading block 111
[=] Sector 28, First block of sector 112, Num of block 4
[=] Reading block 115
[=] Sector 29, First block of sector 116, Num of block 4
[=] Reading block 119
[=] Sector 30, First block of sector 120, Num of block 4
[=] Reading block 123
[=] Sector 31, First block of sector 124, Num of block 4
[=] Reading block 127
[=] Sector 32, First block of sector 128, Num of block 16
[=] Reading block 143
[=] Sector 31, First block of sector 124, Num of block 4
[=] Reading block 127
[=] Sector 30, First block of sector 120, Num of block 4
[=] Reading block 123
[=] Sector 29, First block of sector 116, Num of block 4
[=] Reading block 119
[=] Sector 28, First block of sector 112, Num of block 4
[=] Reading block 115
[=] Sector 27, First block of sector 108, Num of block 4
[=] Reading block 111
[=] Sector 26, First block of sector 104, Num of block 4
[=] Reading block 107
[=] Sector 25, First block of sector 100, Num of block 4
[=] Reading block 103

[+] found keys:
[+] |-----|----------------|---|----------------|---|
[+] | Sec | key A          |res| key B          |res|
[+] |-----|----------------|---|----------------|---|
[+] | 000 | a0a1a2a3a4a5   | 1 | b578f38a5c61   | 1 |
[+] | 001 | ------------   | 0 | ------------   | 0 |
[+] | 002 | a0a1a2a3a4a5   | 1 | 0000014b5c31   | 1 |
[+] | 003 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 004 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 005 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 006 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 007 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 008 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 009 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 010 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 011 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 012 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 013 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 014 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 015 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 016 | a0a1a2a3a4a5   | 1 | b578f38a5c61   | 1 |
[+] | 017 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 018 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 019 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 020 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 021 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 022 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 023 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 024 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 025 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 026 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 027 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 028 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 029 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 030 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 031 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 032 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 033 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 034 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 035 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 036 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 037 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 038 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 039 | ffffffffffff   | 1 | ------------   | 0 |
[+] |-----|----------------|---|----------------|---|
[+] ( 0:Failed / 1:Success)
[+] Generating binary key file
[+] Found keys have been dumped to hf-mf-36CB0F82-key.bin--> 0xffffffffffff has been inserted for unknown keys.

result from hf mf fchk 4

[usb] pm3 --> hf mf fchk 4 mfc_default_keys d
[+] Loaded 933 keys from mfc_default_keys
[=] Running strategy 1
.......[=] Chunk: 14.3s | found 52/80 keys (85)
[=] Chunk: 0.7s | found 52/80 keys (85)
[=] Chunk: 0.7s | found 52/80 keys (85)
[=] Chunk: 0.6s | found 52/80 keys (85)
[=] Chunk: 0.6s | found 52/80 keys (85)
.....[=] Chunk: 12.0s | found 55/80 keys (85)
[=] Chunk: 1.1s | found 55/80 keys (85)
[=] Chunk: 1.1s | found 55/80 keys (85)
[=] Chunk: 1.1s | found 55/80 keys (85)
[=] Chunk: 1.1s | found 55/80 keys (85)
[=] Chunk: 1.1s | found 55/80 keys (83)
[=] Running strategy 2
.......[=] Chunk: 14.2s | found 52/80 keys (85)
......[=] Chunk: 12.8s | found 52/80 keys (85)
......[=] Chunk: 12.8s | found 52/80 keys (85)
......[=] Chunk: 12.8s | found 52/80 keys (85)
......[=] Chunk: 12.8s | found 52/80 keys (85)
......[=] Chunk: 12.1s | found 55/80 keys (85)
.....[=] Chunk: 11.4s | found 55/80 keys (85)
.....[=] Chunk: 11.4s | found 55/80 keys (85)
.....[=] Chunk: 11.4s | found 55/80 keys (85)
.....[=] Chunk: 11.4s | found 55/80 keys (85)
.....[=] Chunk: 11.2s | found 55/80 keys (83)
[=] time in checkkeys (fast) 168.9s


[+] found keys:
[+] |-----|----------------|---|----------------|---|
[+] | Sec | key A          |res| key B          |res|
[+] |-----|----------------|---|----------------|---|
[+] | 000 | a0a1a2a3a4a5   | 1 | b578f38a5c61   | 1 |
[+] | 001 | ------------   | 0 | ------------   | 0 |
[+] | 002 | a0a1a2a3a4a5   | 1 | 0000014b5c31   | 1 |
[+] | 003 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 004 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 005 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 006 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 007 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 008 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 009 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 010 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 011 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 012 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 013 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 014 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 015 | ffffffffffff   | 1 | ffffffffffff   | 1 |
[+] | 016 | a0a1a2a3a4a5   | 1 | b578f38a5c61   | 1 |
[+] | 017 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 018 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 019 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 020 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 021 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 022 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 023 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 024 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 025 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 026 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 027 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 028 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 029 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 030 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 031 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 032 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 033 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 034 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 035 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 036 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 037 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 038 | ffffffffffff   | 1 | ------------   | 0 |
[+] | 039 | ffffffffffff   | 1 | ------------   | 0 |
[+] |-----|----------------|---|----------------|---|
[+] ( 0:Failed / 1:Success)
[+] Generating binary key file
[+] Found keys have been dumped to hf-mf-36CB0F82-key-1.bin--> 0xffffffffffff has been inserted for unknown keys.

The result from autopwn

[usb] pm3 --> hf mf autopwn * 4
[!] no known key was supplied, key recovery might fail
[+] loaded 23 keys from hardcoded default array
[=] running strategy 1
..[=] Chunk: 5.3s | found 55/80 keys (23)
[=] running strategy 2
..[=] Chunk: 5.3s | found 55/80 keys (23)
[+] target sector:  0 key type: A -- found valid key [ A0 A1 A2 A3 A4 A5 ] (used for nested / hardnested attack)
[+] target sector:  0 key type: B -- found valid key [ B5 78 F3 8A 5C 61 ]
[+] target sector:  2 key type: A -- found valid key [ A0 A1 A2 A3 A4 A5 ]
[+] target sector:  2 key type: B -- found valid key [ 00 00 01 4B 5C 31 ]
[+] target sector:  3 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  3 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  4 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  4 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  5 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  5 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  6 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  6 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  7 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  7 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  8 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  8 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  9 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector:  9 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 10 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 10 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 11 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 11 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 12 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 12 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 13 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 13 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 14 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 14 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 15 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 15 key type: B -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 16 key type: A -- found valid key [ A0 A1 A2 A3 A4 A5 ]
[+] target sector: 16 key type: B -- found valid key [ B5 78 F3 8A 5C 61 ]
[+] target sector: 17 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 18 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 19 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 20 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 21 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 22 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 23 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 24 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 25 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 26 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 27 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 28 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 29 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 30 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 31 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 32 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 33 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 34 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 35 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 36 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 37 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 38 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] target sector: 39 key type: A -- found valid key [ FF FF FF FF FF FF ]
[+] Using AVX2 SIMD core.



 time    | #nonces | Activity                                                | expected to brute force
         |         |                                                         | #states         | time
------------------------------------------------------------------------------------------------------
       0 |       0 | Start using 12 threads and AVX2 SIMD core               |                 |
       0 |       0 | Brute force benchmark: 2215 million (2^31.0) keys/s     | 140737488355328 |   18h
       5 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |   18h
       8 |     112 | Apply bit flip properties                               |    169431678976 |   76s
       9 |     224 | Apply bit flip properties                               |      9065571328 |    4s
      10 |     336 | Apply bit flip properties                               |      7512697856 |    3s
      10 |     448 | Apply bit flip properties                               |      6888189952 |    3s
      11 |     559 | Apply bit flip properties                               |      6888189952 |    3s
      12 |     671 | Apply bit flip properties                               |      6805086208 |    3s
      13 |     781 | Apply bit flip properties                               |      6805086208 |    3s
      13 |     890 | Apply bit flip properties                               |      6805086208 |    3s
      14 |    1000 | Apply bit flip properties                               |      6805086208 |    3s
      15 |    1108 | Apply bit flip properties                               |      6805086208 |    3s
      16 |    1220 | Apply bit flip properties                               |      6805086208 |    3s
      17 |    1328 | Apply bit flip properties                               |      6805086208 |    3s
      18 |    1438 | Apply bit flip properties                               |      6805086208 |    3s
      19 |    1548 | Apply Sum property. Sum(a0) = 136                       |       199744704 |    0s
      19 |    1654 | Apply bit flip properties                               |        97163360 |    0s
      20 |    1762 | Apply bit flip properties                               |       152657264 |    0s
      21 |    1874 | Apply bit flip properties                               |       154996320 |    0s
      22 |    1874 | (1. guess: Sum(a8) = 128)                               |       154996320 |    0s
      22 |    1874 | Apply Sum(a8) and all bytes bitflip properties          |       125106768 |    0s
      22 |    1874 | Brute force phase completed. Key found: 3607eb193f0c   |               0 |    0s
[+] target sector:  1 key type: A -- found valid key [36 07 EB 19 3F 0C ]
[+] Using AVX2 SIMD core.



 time    | #nonces | Activity                                                | expected to brute force
         |         |                                                         | #states         | time
------------------------------------------------------------------------------------------------------
       0 |       0 | Start using 12 threads and AVX2 SIMD core               |                 |
       0 |       0 | Brute force benchmark: 2227 million (2^31.1) keys/s     | 140737488355328 |   18h
       4 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |   18h
       7 |     112 | Apply bit flip properties                               |    331985354752 |  2min
       8 |     224 | Apply bit flip properties                               |     11152893952 |    5s
       9 |     335 | Apply bit flip properties                               |      6090179584 |    3s
      10 |     447 | Apply bit flip properties                               |      6090179584 |    3s
      10 |     558 | Apply bit flip properties                               |      5475684352 |    2s
      11 |     668 | Apply bit flip properties                               |      5054461440 |    2s
      12 |     780 | Apply bit flip properties                               |      5054461440 |    2s
      13 |     889 | Apply bit flip properties                               |      5054461440 |    2s
      13 |    1000 | Apply bit flip properties                               |      5054461440 |    2s
      14 |    1111 | Apply bit flip properties                               |      5054461440 |    2s
      15 |    1223 | Apply bit flip properties                               |      5054461440 |    2s
      16 |    1334 | Apply bit flip properties                               |      5054461440 |    2s
      17 |    1445 | Apply bit flip properties                               |      5054461440 |    2s
      19 |    1552 | Apply Sum property. Sum(a0) = 120                       |       287984384 |    0s
      19 |    1552 | (1. guess: Sum(a8) = 128)                               |       287984384 |    0s
      19 |    1552 | Apply Sum(a8) and all bytes bitflip properties          |       272073920 |    0s
      19 |    1552 | Brute force phase completed. Key found: d6170d3e3d0e   |               0 |    0s
[+] target sector:  1 key type: B -- found valid key [D6 17 0D 3E 3D 0E ]
[+] Using AVX2 SIMD core.



 time    | #nonces | Activity                                                | expected to brute force
         |         |                                                         | #states         | time
------------------------------------------------------------------------------------------------------
       0 |       0 | Start using 12 threads and AVX2 SIMD core               |                 |
       0 |       0 | Brute force benchmark: 2204 million (2^31.0) keys/s     | 140737488355328 |   18h
       4 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |   18h
       7 |     112 | Apply bit flip properties                               |   1000364179456 |  8min
       8 |     223 | Apply bit flip properties                               |    357692276736 |  3min
       9 |     335 | Apply bit flip properties                               |    301401407488 |  2min
      10 |     446 | Apply bit flip properties                               |    299530649600 |  2min
      10 |     558 | Apply bit flip properties                               |    299530649600 |  2min
      11 |     670 | Apply bit flip properties                               |    299530649600 |  2min
      12 |     782 | Apply bit flip properties                               |    299530649600 |  2min
      13 |     894 | Apply bit flip properties                               |    299530649600 |  2min
      13 |    1003 | Apply bit flip properties                               |    299530649600 |  2min
      15 |    1114 | Apply Sum property. Sum(a0) = 160                       |     38751166464 |   18s
      15 |    1223 | Apply bit flip properties                               |     24221661184 |   11s
      16 |    1332 | Apply bit flip properties                               |     32519315456 |   15s
      17 |    1443 | Apply bit flip properties                               |     25703831552 |   12s
      18 |    1553 | Apply bit flip properties                               |     25703831552 |   12s
      19 |    1553 | (1. guess: Sum(a8) = 256)                               |     25703831552 |   12s
      19 |    1553 | Apply Sum(a8) and all bytes bitflip properties          |     24840062976 |   11s
      19 |    1553 | Brute force phase completed. Key found: ce1409a8746f   |               0 |    0s
[+] target sector: 17 key type: B -- found valid key [CE 14 09 A8 74 6F ]
[+] target sector: 18 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 19 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 20 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 21 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 22 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 23 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 24 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 25 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 26 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 27 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 28 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 29 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 30 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 31 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 32 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 33 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 34 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 35 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 36 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 37 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 38 key type: B -- found valid key [ CE 14 09 A8 74 6F ]
[+] target sector: 39 key type: B -- found valid key [ CE 14 09 A8 74 6F ]

[+] found keys:
[+] |-----|----------------|---|----------------|---|
[+] | Sec | key A          |res| key B          |res|
[+] |-----|----------------|---|----------------|---|
[+] | 000 | a0a1a2a3a4a5   | D | b578f38a5c61   | D |
[+] | 001 | 3607eb193f0c   | H | d6170d3e3d0e   | H |
[+] | 002 | a0a1a2a3a4a5   | D | 0000014b5c31   | D |
[+] | 003 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 004 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 005 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 006 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 007 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 008 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 009 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 010 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 011 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 012 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 013 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 014 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 015 | ffffffffffff   | D | ffffffffffff   | D |
[+] | 016 | a0a1a2a3a4a5   | D | b578f38a5c61   | D |
[+] | 017 | ffffffffffff   | D | ce1409a8746f   | H |
[+] | 018 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 019 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 020 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 021 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 022 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 023 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 024 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 025 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 026 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 027 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 028 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 029 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 030 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 031 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 032 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 033 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 034 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 035 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 036 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 037 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 038 | ffffffffffff   | D | ce1409a8746f   | R |
[+] | 039 | ffffffffffff   | D | ce1409a8746f   | R |
[+] |-----|----------------|---|----------------|---|
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )

[+] Generating binary key file
[+] Found keys have been dumped to hf-mf-36CB0F82-key-2.bin--> 0xffffffffffff has been inserted for unknown keys.
[+] transferring keys to simulator memory (Cmd Error: 04 can occur)
[#] Cmd Error: 04
[#] Cmd Error: 04
[=] downloading the card content from emulator memory
[+] saved 4096 bytes to binary file hf-mf-36CB0F82-dump.bin
[+] saved 256 blocks to text file hf-mf-36CB0F82-dump.eml
[+] saved to json file hf-mf-36CB0F82-dump.json
[=] autopwn execution time: 90 seconds

Looks I got all the keys from autopwn, but when I tried to dump data from vingcard, I got error message.

[usb] pm3 --> hf mf dump 4
[=] Reading sector access bits...
..[#] Auth error
.[#] Auth error
.[#] Auth error

[-] could not get access rights for sector  1. Trying with defaults...

.[#] Auth error
.[#] Auth error
.[#] Auth error
.[#] Auth error
.[#] Auth error
.[#] Auth error
.[#] Auth error
......................................
[+] Finished reading sector access bits
[=] Dumping all blocks from card...
[+] successfully read block  0 of sector  0.
[+] successfully read block  1 of sector  0.
[+] successfully read block  2 of sector  0.
[+] successfully read block  3 of sector  0.
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector  1
[+] successfully read block  0 of sector  2.
[+] successfully read block  1 of sector  2.
[+] successfully read block  2 of sector  2.
[+] successfully read block  3 of sector  2.
[+] successfully read block  0 of sector  3.
[+] successfully read block  1 of sector  3.
[+] successfully read block  2 of sector  3.
[+] successfully read block  3 of sector  3.
[+] successfully read block  0 of sector  4.
[+] successfully read block  1 of sector  4.
[+] successfully read block  2 of sector  4.
[+] successfully read block  3 of sector  4.
[+] successfully read block  0 of sector  5.
[+] successfully read block  1 of sector  5.
[+] successfully read block  2 of sector  5.
[+] successfully read block  3 of sector  5.
[+] successfully read block  0 of sector  6.
[+] successfully read block  1 of sector  6.
[+] successfully read block  2 of sector  6.
[+] successfully read block  3 of sector  6.
[+] successfully read block  0 of sector  7.
[+] successfully read block  1 of sector  7.
[+] successfully read block  2 of sector  7.
[+] successfully read block  3 of sector  7.
[+] successfully read block  0 of sector  8.
[+] successfully read block  1 of sector  8.
[+] successfully read block  2 of sector  8.
[+] successfully read block  3 of sector  8.
[+] successfully read block  0 of sector  9.
[+] successfully read block  1 of sector  9.
[+] successfully read block  2 of sector  9.
[+] successfully read block  3 of sector  9.
[+] successfully read block  0 of sector 10.
[+] successfully read block  1 of sector 10.
[+] successfully read block  2 of sector 10.
[+] successfully read block  3 of sector 10.
[+] successfully read block  0 of sector 11.
[+] successfully read block  1 of sector 11.
[+] successfully read block  2 of sector 11.
[+] successfully read block  3 of sector 11.
[+] successfully read block  0 of sector 12.
[+] successfully read block  1 of sector 12.
[+] successfully read block  2 of sector 12.
[+] successfully read block  3 of sector 12.
[+] successfully read block  0 of sector 13.
[+] successfully read block  1 of sector 13.
[+] successfully read block  2 of sector 13.
[+] successfully read block  3 of sector 13.
[+] successfully read block  0 of sector 14.
[+] successfully read block  1 of sector 14.
[+] successfully read block  2 of sector 14.
[+] successfully read block  3 of sector 14.
[+] successfully read block  0 of sector 15.
[+] successfully read block  1 of sector 15.
[+] successfully read block  2 of sector 15.
[+] successfully read block  3 of sector 15.
[+] successfully read block  0 of sector 16.
[+] successfully read block  1 of sector 16.
[+] successfully read block  2 of sector 16.
[+] successfully read block  3 of sector 16.
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 17
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 18
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 19
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 20
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 21
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 22
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 23
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 24
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 25
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 26
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 27
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 28
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 29
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 30
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 31
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 32
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 33
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 34
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 35
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 36
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 37
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 38
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[#] Auth error
[-] could not read block  0 of sector 39
[+] time: 77 seconds


[+] Succeeded in dumping all blocks

[+] saved 4096 bytes to binary file hf-mf-36CB0F82-dump-1.bin
[+] saved 256 blocks to text file hf-mf-36CB0F82-dump-1.eml
[+] saved to json file hf-mf-36CB0F82-dump-1.json
[usb] pm3 -->     

                                                                                                     
I use the proxmark 3 easy 512k with the iceman fork.
Is there any solution?
Thank you all!

Offline

#2 2020-09-09 07:47:25

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Vingcard crack help

If you read your output,  you would have found that you already got a dump of the tag.

[+] saved 4096 bytes to binary file hf-mf-36CB0F82-dump.bin
[+] saved 256 blocks to text file hf-mf-36CB0F82-dump.eml
[+] saved to json file hf-mf-36CB0F82-dump.json

Offline

#3 2020-09-09 09:40:19

heatwave
Contributor
Registered: 2020-09-08
Posts: 9

Re: Vingcard crack help

Hey iceman,

Thank you so much for your quick reply (just like in a dream, iceman actually answers to me:cool: )

Yes, I did check the dump file, it does look like I got all the data, but when I trying to restore them back to the 4k (UID 4bytes changeable Chinese magic ) card. I still got the error message. And the lift and door card reader flashing the green light, but the door is still locked. Is there anything I can check?

Thank you

[usb] pm3 --> hf mf restore 4 k hf-mf-36CB0F82-key.bin f hf-mf-36CB0F82-dump.bin
[=] Restoring hf-mf-36CB0F82-dump.bin to card
Writing to block   0: 36 CB 0F 82 70 98 02 00 E3 25 00 20 00 00 00 19
[#] Cmd Error: 04
[#] Write block error
[+] isOk:00
Writing to block   1: D6 01 06 70 05 70 07 70 07 70 07 70 00 00 00 00
[+] isOk:01
Writing to block   2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block   3: A0 A1 A2 A3 A4 A5 78 77 88 C2 B5 78 F3 8A 5C 61
[+] isOk:01
Writing to block   4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block   5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0d
[#] Write block error
[+] isOk:00
Writing to block   6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block   7: FF FF FF FF FF FF 00 00 00 00 FF FF FF FF FF FF
[+] isOk:01
Writing to block   8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block   9: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  11: A0 A1 A2 A3 A4 A5 0F 00 FF AA 00 00 01 4B 5C 31
[+] isOk:01
Writing to block  12: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  13: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  14: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  15: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  17: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  18: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  19: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  21: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  22: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  23: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  24: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  25: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  26: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  27: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  28: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd Error: 00
[#] Write block error
[+] isOk:00
Writing to block  29: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 00
[#] Write block error
[+] isOk:00
Writing to block  30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  31: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  33: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  34: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  35: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  36: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  37: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  38: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  39: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  41: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  42: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  43: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  44: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  45: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 02
[#] Write block error
[+] isOk:00
Writing to block  46: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  47: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  49: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd Error: 00
[#] Write block error
[+] isOk:00
Writing to block  51: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  52: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  53: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  54: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  55: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  56: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  57: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  58: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  59: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  61: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  62: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  63: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[+] isOk:01
Writing to block  64: D4 00 09 70 09 70 09 70 09 70 09 70 09 70 09 70
[+] isOk:01
Writing to block  65: 09 70 09 70 09 70 09 70 09 70 09 70 09 70 09 70
[#] Cmd send data2 Error: 04
[#] Write block error
[+] isOk:00
Writing to block  66: 09 70 09 70 09 70 09 70 09 70 09 70 09 70 09 70
[+] isOk:01
Writing to block  67: A0 A1 A2 A3 A4 A5 78 77 88 C2 B5 78 F3 8A 5C 61
[+] isOk:01
Writing to block  68: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  69: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0a
[#] Write block error
[+] isOk:00
Writing to block  70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  71: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  72: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  73: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  74: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  75: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  76: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  77: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  78: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  79: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd Error: 00
[#] Write block error
[+] isOk:00
Writing to block  81: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  82: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 01
[#] Write block error
[+] isOk:00
Writing to block  83: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 05
[#] Write block error
[+] isOk:00
Writing to block  84: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  85: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  86: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  87: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  88: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  89: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  91: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  92: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 00
[#] Write block error
[+] isOk:00
Writing to block  93: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0f
[#] Write block error
[+] isOk:00
Writing to block  94: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  95: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd Error: 00
[#] Write block error
[+] isOk:00
Writing to block  97: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  98: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block  99: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 101: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 102: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 103: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 104: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 105: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 106: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 107: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 108: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 109: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 111: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 07
[#] Write block error
[+] isOk:00
Writing to block 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 113: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 114: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 115: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 116: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 117: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 118: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 00
[#] Write block error
[+] isOk:00
Writing to block 119: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 121: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 122: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 123: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 124: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 125: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 126: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 127: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0e
[#] Write block error
[+] isOk:00
Writing to block 129: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 131: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 132: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 133: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 134: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 135: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 136: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 137: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 138: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 139: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd Error: 00
[#] Write block error
[+] isOk:00
Writing to block 140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0b
[#] Write block error
[+] isOk:00
Writing to block 141: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 142: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 143: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 145: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 146: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 147: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 05
[#] Write block error
[+] isOk:00
Writing to block 148: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 149: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 151: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 152: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 153: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 154: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 155: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 156: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 157: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 158: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 159: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 161: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 162: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 163: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 164: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0d
[#] Write block error
[+] isOk:00
Writing to block 165: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 166: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 167: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 168: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 169: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 171: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 172: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 173: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 174: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 175: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 03
[#] Write block error
[+] isOk:00
Writing to block 177: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 178: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 179: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 181: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 182: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 183: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 184: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 185: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 186: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 187: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 188: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 189: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 191: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 193: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 194: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 195: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 196: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 197: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0b
[#] Write block error
[+] isOk:00
Writing to block 198: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 199: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 201: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 202: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 203: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 204: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 205: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 206: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 207: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 209: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 211: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 212: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0f
[#] Write block error
[+] isOk:00
Writing to block 213: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 214: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 215: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 216: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 217: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 218: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 219: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 221: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 01
[#] Write block error
[+] isOk:00
Writing to block 222: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 223: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 224: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 225: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 04
[#] Write block error
[+] isOk:00
Writing to block 226: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 227: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 228: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 229: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 231: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 232: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 233: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 234: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0d
[#] Write block error
[+] isOk:00
Writing to block 235: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 236: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 237: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 238: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0f
[#] Write block error
[+] isOk:00
Writing to block 239: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 241: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 242: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 243: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 244: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 245: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 246: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 247: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 248: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 249: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 251: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 252: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[+] isOk:01
Writing to block 253: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[#] Cmd send data2 Error: 0b
[#] Write block error
[+] isOk:00
Writing to block 254: 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00
[#] Cmd send data2 Error: 05
[#] Write block error
[+] isOk:00
Writing to block 255: FF FF FF FF FF FF 00 00 DB 6E 00 00 00 00 00 00
[+] isOk:01
[=] Finish restore
[usb] pm3 -->  

Offline

#4 2020-09-09 10:29:57

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Vingcard crack help

depends on your magic card.  Is it a gen1a,  gen2, gen3 etc?

Offline

#5 2020-09-09 11:50:48

mwalker
Moderator
Registered: 2019-05-11
Posts: 318

Re: Vingcard crack help

I note that in restore post it seems to be missing acls and B keys
Writing to block  67: A0 A1 A2 A3 A4 A5 78 77 88 C2 B5 78 F3 8A 5C 61  <- Seems OK

Writing to block  71: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 <- Missing ACL and B key

Can you check some of those sectors and see if they match.

Offline

#6 2020-09-09 11:56:44

heatwave
Contributor
Registered: 2020-09-08
Posts: 9

Re: Vingcard crack help

Hey iceman,

Thank you so much for taking time to look at my problem:) amazing....

This is a gen2 4k s70 4bytes chinese magic card, and this is the hf search result after restore.  And I really don't know why the prng detection value is weak in the clone card?    Any advice for that are greatly appreciatedc  thank you

[=] Finish restore
[usb] pm3 --> hf searc
[/] Searching for ISO14443-A tag...
[+]  UID: 36 CB 0F 83
[+] ATQA: 00 02
[+]  SAK: 18 [2]
[+] Possible types:
[+]    MIFARE Classic 1K / Classic 1K CL2
[+]    MIFARE Plus 2K / Plus EV1 2K
[+]    MIFARE Plus CL2 2K / Plus CL2 EV1 2K
[+]    MIFARE Plus 2K / Plus CL2 2K
[+]    MIFARE Classic 4K / Classic 4K CL2
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: weak

[+] Valid ISO14443-A tag found 

Offline

#7 2020-09-09 12:50:07

heatwave
Contributor
Registered: 2020-09-08
Posts: 9

Re: Vingcard crack help

Hey @mwalker,

Thank you so much for your advice. I tried to get all the keys out using autopwn, fchk, chk keys, but I won't work though sad

How do I find the Missing ACL and B key?  @mwalker, can you please advice me what to do next, I struggling on this for almost 2 weeks... Do I need to buy rdv4? 

thank you:)

[post]I note that in restore post it seems to be missing acls and B keys
Writing to block  67: A0 A1 A2 A3 A4 A5 78 77 88 C2 B5 78 F3 8A 5C 61  <- Seems OK[/post]

[post]Writing to block  71: FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 <- Missing ACL and B key[/post]

[post]Can you check some of those sectors and see if they match.[/post]

Offline

#8 2020-09-10 00:08:15

mwalker
Moderator
Registered: 2019-05-11
Posts: 318

Re: Vingcard crack help

Your result from the autopwn seems to show every key, so that bit seems to have worked.

What I would try is a manual read blocks/sectors using those keys and see if you get a good read.

Offline

#9 2020-09-10 02:43:22

heatwave
Contributor
Registered: 2020-09-08
Posts: 9

Re: Vingcard crack help

Hey mwalker,
thank yo so much for your advise, I'll try to do this tonight. Appreciate all the help! smile

Offline

#10 2020-09-10 15:56:39

heatwave
Contributor
Registered: 2020-09-08
Posts: 9

Re: Vingcard crack help

mwalker wrote:

Your result from the autopwn seems to show every key, so that bit seems to have worked.

What I would try is a manual read blocks/sectors using those keys and see if you get a good read.

Hey mwalker,

Thank you for your tips:) 

Unfortunately, I was thinking I already got all the keys. After I manually checked each group of keys, I found that I am still locked out.  I need some advice from this point to proceed.... or should I try the iceman's build instead rrg one?


[usb] pm3 --> hf mf rdbl 10 A ffffffffffff
--block no:10, key type:A, key:FF FF FF FF FF FF
[#] Auth error
[-] failed reading block
[usb] pm3 --> hf mf rdbl 15 A ffffffffffff
--block no:15, key type:A, key:FF FF FF FF FF FF
data: 00 00 00 00 00 00 FF 07 80 69 FF FF FF FF FF FF
Trailer decoded:
Access block 12: rdAB wrAB incAB dectrAB
Access block 13: rdAB wrAB incAB dectrAB
Access block 14: rdAB wrAB incAB dectrAB
Access block 15: wrAbyA rdCbyA wrCbyA rdBbyA wrBbyA
UserData: 69
[usb] pm3 --> hf mf rdbl 14 A ffffffffffff
--block no:14, key type:A, key:FF FF FF FF FF FF
data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[usb] pm3 --> hf mf rdbl 13 A ffffffffffff
--block no:13, key type:A, key:FF FF FF FF FF FF
data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[usb] pm3 --> hf mf rdbl 12 A ffffffffffff
--block no:12, key type:A, key:FF FF FF FF FF FF
data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[usb] pm3 --> hf mf rdbl 07 A ffffffffffff
--block no:7, key type:A, key:FF FF FF FF FF FF
[#] Auth error
[-] failed reading block
[usb] pm3 --> hf mf rdbl 3 B b578f38a5c61
--block no:3, key type:B, key:B5 78 F3 8A 5C 61
data: 00 00 00 00 00 00 78 77 88 C2 00 00 00 00 00 00
Trailer decoded:
Access block 0: rdAB wrB
Access block 1: rdAB wrB
Access block 2: rdAB wrB
Access block 3: wrAbyB rdCbyAB wrCbyB wrBbyB
UserData: C2
[usb] pm3 --> hf mf rdbl 03 A ffffffffffff
--block no:3, key type:A, key:FF FF FF FF FF FF
[#] Auth error
[-] failed reading block

Offline

#11 2020-09-10 23:45:55

mwalker
Moderator
Registered: 2019-05-11
Posts: 318

Re: Vingcard crack help

Can i suggest reading the mifare data sheets and see what the access bits mean and if that aligns with your findings.

Offline

#12 2020-09-13 14:41:31

heatwave
Contributor
Registered: 2020-09-08
Posts: 9

Re: Vingcard crack help

mwalker wrote:

Can i suggest reading the mifare data sheets and see what the access bits mean and if that aligns with your findings.

Hey mwalker,

little more closer,I did jardmested,I found more keys now,but still miss three keys from12b. can you advise me how to get rest of keys, appreciated any input, thank you:)


[usb] pm3 --> hf mf hard 1 b b578f38a5c61 12 b
[=] Target block no: 12, target key type:B, known target key: 0x000000000000 (not set)
[=] File action: none, Slow: No, Tests: 0
[+] Using AVX2 SIMD core.



 time    | #nonces | Activity                                                | expected to brute force
         |         |                                                         | #states         | time
------------------------------------------------------------------------------------------------------
       0 |       0 | Start using 12 threads and AVX2 SIMD core               |                 |
       0 |       0 | Brute force benchmark: 2238 million (2^31.1) keys/s     | 140737488355328 |   17h
       4 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |   17h
       7 |     112 | Apply bit flip properties                               |  10409143697408 | 78min
       8 |     223 | Apply bit flip properties                               |   8538752024576 | 64min
       9 |     335 | Apply bit flip properties                               |   8392819081216 | 62min
       9 |     446 | Apply bit flip properties                               |   8380193177600 | 62min
      10 |     558 | Apply bit flip properties                               |   8378623459328 | 62min
      11 |     670 | Apply bit flip properties                               |   8378623459328 | 62min
      12 |     781 | Apply bit flip properties                               |   8378623459328 | 62min
      13 |     893 | Apply bit flip properties                               |   8378623459328 | 62min
      13 |    1004 | Apply bit flip properties                               |   8378623459328 | 62min
      14 |    1115 | Apply bit flip properties                               |   8378623459328 | 62min
      15 |    1225 | Apply bit flip properties                               |   8378623459328 | 62min
      16 |    1336 | Apply bit flip properties                               |   8378623459328 | 62min
      17 |    1445 | Apply bit flip properties                               |   8378623459328 | 62min
      18 |    1555 | Apply bit flip properties                               |   8378623459328 | 62min
      20 |    1664 | Apply Sum property. Sum(a0) = 0                         |    564487913472 |  4min
      20 |    1774 | Apply bit flip properties                               |    235115216896 |  2min
      21 |    1884 | Apply bit flip properties                               |    199867416576 |   89s
      22 |    1992 | Apply bit flip properties                               |    199867416576 |   89s
      22 |    2102 | Apply bit flip properties                               |    175228059648 |   78s
      23 |    2208 | Apply bit flip properties                               |    175228059648 |   78s
      24 |    2317 | Apply bit flip properties                               |    159143034880 |   71s
      25 |    2422 | Apply bit flip properties                               |    148270268416 |   66s
      26 |    2532 | Apply bit flip properties                               |    148270268416 |   66s
      27 |    2643 | Apply bit flip properties                               |    148270268416 |   66s
      28 |    2752 | Apply bit flip properties                               |    148270268416 |   66s
      28 |    2752 | (1. guess: Sum(a8) = 0)                                 |    148270268416 |   66s
      30 |    2752 | Apply Sum(a8) and all bytes bitflip properties          |     67648548864 |   30s
      69 |    2752 | Brute force phase:  24.77%                              |     60086935552 |   27s
      69 |    2752 | Brute force phase completed. Key found: ffffffffffff   |               0 |    0s
[usb] pm3 --> hf mf rdbl 12 b ffffffffffff
--block no 12, key B - FF FF FF FF FF FF
[#] Cmd Error 04
[#] Read block error
[-] failed reading block
[usb] pm3 --> hf mf rdbl 12 b ffffffffffff        

Offline

Board footer

Powered by FluxBB