hf mfu help

Motoko.Iwakura · 2024-10-13 01:34:47

Hey guys, I'm trying to clone a MIFARE Ultralight protocol on the ISO14443-A tag. For some reason I'm not able to clone it while trying the "eload" command. I also tried to "hf mfu setuid" but that also didn't work. The UID is: "UID: 04 EC 5F 92 E4 62 80." I'm sure I'm doing something wrong but not sure what. Any advice would be appreciated.
Thanks team.

┌──(motoko㉿iwakura)-[~]
└─$ pm3
[=] Session log /home/motoko/.proxmark3/logs/log_20241013001457.txt
[+] loaded `/home/motoko/.proxmark3/preferences.json`
[+] Using UART port /dev/ttyACM1
[+] Communicating with PM3 over USB-CDC


  8888888b.  888b     d888  .d8888b.   
  888   Y88b 8888b   d8888 d88P  Y88b  
  888    888 88888b.d88888      .d88P  
  888   d88P 888Y88888P888     8888"  
  8888888P"  888 Y888P 888      "Y8b.  
  888        888  Y8P  888 888    888  
  888        888   "   888 Y88b  d88P 
  888        888       888  "Y8888P"    [ ☕ ]



  [ Donate, empower, grow, sustain! ]
     Patreon - https://www.patreon.com/iceman1001/
     Paypal  - https://www.paypal.me/iceman1001/


  [ Proxmark3 RFID instrument ]

    MCU....... AT91SAM7S512 Rev A
    Memory.... 512 KB ( 71% used )

    Client.... Iceman/master/v4.18994-154-g14dcc9dab 2024-09-24 09:59:45
    Bootrom... Iceman/master/v4.18994-154-g14dcc9dab-suspect 2024-09-24 10:00:18 
    OS........ Iceman/master/v4.18994-154-g14dcc9dab-suspect 2024-09-24 10:00:36 
    Target.... RDV4


[usb] pm3 --> hf search
 ?  Searching for ISO14443-A tag...          
[=] ---------- ISO14443-A Information ----------
[+]  UID: 04 EC 5F 92 E4 62 80   ( double )
[+] ATQA: 00 44
[+]  SAK: 00 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+]    MIFARE Ultralight
[+]    MIFARE Ultralight C
[+]    MIFARE Ultralight EV1
[+]    MIFARE Ultralight Nano
[+]    MIFARE Ultralight AES
[+]    MIFARE Hospitality
[+]    NTAG 2xx
[=] proprietary non iso14443-4 card found, RATS not supported
[=] 

[?] Hint: try `hf mfu info`


[+] Valid ISO 14443-A tag found

[usb] pm3 --> hf mfu dump                     
[+] TYPE: MIFARE Ultralight EV1 48bytes (MF0UL1101)
[+] Reading tag memory...
[?] Try using a pwd

[=] MFU dump file information
[=] -------------------------------------------------------------
[=] Version..... 00 04 03 01 01 00 0B 03 
[=] TBD 0....... 00 00 
[=] TBD 1....... 00 
[=] Signature... D4 E2 F2 E6 36 D1 C5 50 C9 4E 09 86 CD E1 23 B0 
[=]              04 12 DF 41 8B 4C 1F 1E 06 58 1F 26 F8 B6 6E F4 
[=] Counter 0... 00 00 00 
[=] Tearing 0... BD 
[=] Counter 1... 00 00 00 
[=] Tearing 1... BD 
[=] Counter 2... 00 00 00 
[=] Tearing 2... BD 
[=] Max data page... 15 ( 64 bytes )
[=] Header size..... 56 bytes

[=] -------------------------------------------------------------
[=] block#   | data        |lck| ascii
[=] ---------+-------------+---+------
[=]   0/0x00 | 04 EC 5F 3F |   | .._?
[=]   1/0x01 | 92 E4 62 80 |   | ..b.
[=]   2/0x02 | 94 48 08 00 |   | .H..
[=]   3/0x03 | AF 02 FC 1E | 1 | ....
[=]   4/0x04 | 9F E5 EF BC | 0 | ....
[=]   5/0x05 | 2B C4 BB 3D | 0 | +..=
[=]   6/0x06 | 48 C3 FC BE | 0 | H...
[=]   7/0x07 | BE 25 91 49 | 0 | .%.I
[=]   8/0x08 | DE B5 C3 4C | 0 | ...L
[=]   9/0x09 | 44 96 34 4F | 0 | D.4O
[=]  10/0x0A | 01 91 99 82 | 0 | ....
[=]  11/0x0B | 87 6B E9 8C | 0 | .k..
[=]  12/0x0C | 55 87 A7 37 | 0 | U..7
[=]  13/0x0D | B6 83 AA 9E | 0 | ....
[=]  14/0x0E | 9B D2 CC 00 | 0 | ....
[=]  15/0x0F | 5E 01 09 29 | 0 | ^..)
[=] ---------------------------------
[=] Using UID as filename
[+] Saved 120 bytes to binary file `/home/motoko/hf-mfu-04EC5F92E46280-dump.bin`
[+] Saved to json file `/home/motoko/hf-mfu-04EC5F92E46280-dump.json`
[!] ⚠️  Partial dump created. (16 of 20 blocks)

[usb] pm3 --> hf search
 ?  Searching for ISO14443-A tag...          
[=] ---------- ISO14443-A Information ----------
[+]  UID: 04 0F 6D 5A 90 6B 80   ( double )
[+] ATQA: 00 44
[+]  SAK: 00 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+]    MIFARE Ultralight
[+]    MIFARE Ultralight C
[+]    MIFARE Ultralight EV1
[+]    MIFARE Ultralight Nano
[+]    MIFARE Ultralight AES
[+]    MIFARE Hospitality
[+]    NTAG 2xx
[=] proprietary non iso14443-4 card found, RATS not supported
[=] 

[?] Hint: try `hf mfu info`


[+] Valid ISO 14443-A tag found

[usb] pm3 --> hf mfu dump                     
[+] TYPE: NTAG 215 504bytes (NT2H1511G0DU)
[+] Reading tag memory...

[=] MFU dump file information
[=] -------------------------------------------------------------
[=] Version..... 00 04 04 02 01 00 11 03 
[=] TBD 0....... 00 00 
[=] TBD 1....... 00 
[=] Signature... 16 A7 BF 9A 38 B3 95 D7 62 B4 FA C9 9F 02 98 F3 
[=]              3C 77 DB 23 DF 01 91 B2 DC 64 25 FE 19 B0 08 05 
[=] Counter 0... 00 00 00 
[=] Tearing 0... 00 
[=] Counter 1... 00 00 00 
[=] Tearing 1... 00 
[=] Counter 2... 00 00 00 
[=] Tearing 2... BD 
[=] Max data page... 134 ( 540 bytes )
[=] Header size..... 56 bytes

[=] -------------------------------------------------------------
[=] block#   | data        |lck| ascii
[=] ---------+-------------+---+------
[=]   0/0x00 | 04 0F 6D EE |   | ..m.
[=]   1/0x01 | 5A 90 6B 80 |   | Z.k.
[=]   2/0x02 | 21 48 00 00 |   | !H..
[=]   3/0x03 | E1 10 3E 00 | 0 | ..>.
[=]   4/0x04 | 03 00 FE 00 | 0 | ....
[=]   5/0x05 | 00 00 00 00 | 0 | ....
[=]   6/0x06 | 00 00 00 00 | 0 | ....
[=]   7/0x07 | 00 00 00 00 | 0 | ....
[=]   8/0x08 | 00 00 00 00 | 0 | ....
[=]   9/0x09 | 00 00 00 00 | 0 | ....
[=]  10/0x0A | 00 00 00 00 | 0 | ....
[=]  11/0x0B | 00 00 00 00 | 0 | ....
[=]  12/0x0C | 00 00 00 00 | 0 | ....
[=]  13/0x0D | 00 00 00 00 | 0 | ....
[=]  14/0x0E | 00 00 00 00 | 0 | ....
[=]  15/0x0F | 00 00 00 00 | 0 | ....
[=]  16/0x10 | 00 00 00 00 | 0 | ....
[=]  17/0x11 | 00 00 00 00 | 0 | ....
[=]  18/0x12 | 00 00 00 00 | 0 | ....
[=]  19/0x13 | 00 00 00 00 | 0 | ....
[=]  20/0x14 | 00 00 00 00 | 0 | ....
[=]  21/0x15 | 00 00 00 00 | 0 | ....
[=]  22/0x16 | 00 00 00 00 | 0 | ....
[=]  23/0x17 | 00 00 00 00 | 0 | ....
[=]  24/0x18 | 00 00 00 00 | 0 | ....
[=]  25/0x19 | 00 00 00 00 | 0 | ....
[=]  26/0x1A | 00 00 00 00 | 0 | ....
[=]  27/0x1B | 00 00 00 00 | 0 | ....
[=]  28/0x1C | 00 00 00 00 | 0 | ....
[=]  29/0x1D | 00 00 00 00 | 0 | ....
[=]  30/0x1E | 00 00 00 00 | 0 | ....
[=]  31/0x1F | 00 00 00 00 | 0 | ....
[=]  32/0x20 | 00 00 00 00 | 0 | ....
[=]  33/0x21 | 00 00 00 00 | 0 | ....
[=]  34/0x22 | 00 00 00 00 | 0 | ....
[=]  35/0x23 | 00 00 00 00 | 0 | ....
[=]  36/0x24 | 00 00 00 00 | 0 | ....
[=]  37/0x25 | 00 00 00 00 | 0 | ....
[=]  38/0x26 | 00 00 00 00 | 0 | ....
[=]  39/0x27 | 00 00 00 00 | 0 | ....
[=]  40/0x28 | 00 00 00 00 | 0 | ....
[=]  41/0x29 | 00 00 00 00 | 0 | ....
[=]  42/0x2A | 00 00 00 00 | 0 | ....
[=]  43/0x2B | 00 00 00 00 | 0 | ....
[=]  44/0x2C | 00 00 00 00 | 0 | ....
[=]  45/0x2D | 00 00 00 00 | 0 | ....
[=]  46/0x2E | 00 00 00 00 | 0 | ....
[=]  47/0x2F | 00 00 00 00 | 0 | ....
[=]  48/0x30 | 00 00 00 00 | 0 | ....
[=]  49/0x31 | 00 00 00 00 | 0 | ....
[=]  50/0x32 | 00 00 00 00 | 0 | ....
[=]  51/0x33 | 00 00 00 00 | 0 | ....
[=]  52/0x34 | 00 00 00 00 | 0 | ....
[=]  53/0x35 | 00 00 00 00 | 0 | ....
[=]  54/0x36 | 00 00 00 00 | 0 | ....
[=]  55/0x37 | 00 00 00 00 | 0 | ....
[=]  56/0x38 | 00 00 00 00 | 0 | ....
[=]  57/0x39 | 00 00 00 00 | 0 | ....
[=]  58/0x3A | 00 00 00 00 | 0 | ....
[=]  59/0x3B | 00 00 00 00 | 0 | ....
[=]  60/0x3C | 00 00 00 00 | 0 | ....
[=]  61/0x3D | 00 00 00 00 | 0 | ....
[=]  62/0x3E | 00 00 00 00 | 0 | ....
[=]  63/0x3F | 00 00 00 00 | 0 | ....
[=]  64/0x40 | 00 00 00 00 | 0 | ....
[=]  65/0x41 | 00 00 00 00 | 0 | ....
[=]  66/0x42 | 00 00 00 00 | 0 | ....
[=]  67/0x43 | 00 00 00 00 | 0 | ....
[=]  68/0x44 | 00 00 00 00 | 0 | ....
[=]  69/0x45 | 00 00 00 00 | 0 | ....
[=]  70/0x46 | 00 00 00 00 | 0 | ....
[=]  71/0x47 | 00 00 00 00 | 0 | ....
[=]  72/0x48 | 00 00 00 00 | 0 | ....
[=]  73/0x49 | 00 00 00 00 | 0 | ....
[=]  74/0x4A | 00 00 00 00 | 0 | ....
[=]  75/0x4B | 00 00 00 00 | 0 | ....
[=]  76/0x4C | 00 00 00 00 | 0 | ....
[=]  77/0x4D | 00 00 00 00 | 0 | ....
[=]  78/0x4E | 00 00 00 00 | 0 | ....
[=]  79/0x4F | 00 00 00 00 | 0 | ....
[=]  80/0x50 | 00 00 00 00 | 0 | ....
[=]  81/0x51 | 00 00 00 00 | 0 | ....
[=]  82/0x52 | 00 00 00 00 | 0 | ....
[=]  83/0x53 | 00 00 00 00 | 0 | ....
[=]  84/0x54 | 00 00 00 00 | 0 | ....
[=]  85/0x55 | 00 00 00 00 | 0 | ....
[=]  86/0x56 | 00 00 00 00 | 0 | ....
[=]  87/0x57 | 00 00 00 00 | 0 | ....
[=]  88/0x58 | 00 00 00 00 | 0 | ....
[=]  89/0x59 | 00 00 00 00 | 0 | ....
[=]  90/0x5A | 00 00 00 00 | 0 | ....
[=]  91/0x5B | 00 00 00 00 | 0 | ....
[=]  92/0x5C | 00 00 00 00 | 0 | ....
[=]  93/0x5D | 00 00 00 00 | 0 | ....
[=]  94/0x5E | 00 00 00 00 | 0 | ....
[=]  95/0x5F | 00 00 00 00 | 0 | ....
[=]  96/0x60 | 00 00 00 00 | 0 | ....
[=]  97/0x61 | 00 00 00 00 | 0 | ....
[=]  98/0x62 | 00 00 00 00 | 0 | ....
[=]  99/0x63 | 00 00 00 00 | 0 | ....
[=] 100/0x64 | 00 00 00 00 | 0 | ....
[=] 101/0x65 | 00 00 00 00 | 0 | ....
[=] 102/0x66 | 00 00 00 00 | 0 | ....
[=] 103/0x67 | 00 00 00 00 | 0 | ....
[=] 104/0x68 | 00 00 00 00 | 0 | ....
[=] 105/0x69 | 00 00 00 00 | 0 | ....
[=] 106/0x6A | 00 00 00 00 | 0 | ....
[=] 107/0x6B | 00 00 00 00 | 0 | ....
[=] 108/0x6C | 00 00 00 00 | 0 | ....
[=] 109/0x6D | 00 00 00 00 | 0 | ....
[=] 110/0x6E | 00 00 00 00 | 0 | ....
[=] 111/0x6F | 00 00 00 00 | 0 | ....
[=] 112/0x70 | 00 00 00 00 | 0 | ....
[=] 113/0x71 | 00 00 00 00 | 0 | ....
[=] 114/0x72 | 00 00 00 00 | 0 | ....
[=] 115/0x73 | 00 00 00 00 | 0 | ....
[=] 116/0x74 | 00 00 00 00 | 0 | ....
[=] 117/0x75 | 00 00 00 00 | 0 | ....
[=] 118/0x76 | 00 00 00 00 | 0 | ....
[=] 119/0x77 | 00 00 00 00 | 0 | ....
[=] 120/0x78 | 00 00 00 00 | 0 | ....
[=] 121/0x79 | 00 00 00 00 | 0 | ....
[=] 122/0x7A | 00 00 00 00 | 0 | ....
[=] 123/0x7B | 00 00 00 00 | 0 | ....
[=] 124/0x7C | 00 00 00 00 | 0 | ....
[=] 125/0x7D | 00 00 00 00 | 0 | ....
[=] 126/0x7E | 00 00 00 00 | 0 | ....
[=] 127/0x7F | 00 00 00 00 | 0 | ....
[=] 128/0x80 | 00 00 00 00 | 0 | ....
[=] 129/0x81 | 00 00 00 00 | 0 | ....
[=] 130/0x82 | 00 00 00 BD | 0 | ....
[=] 131/0x83 | 04 00 00 FF | 0 | ....
[=] 132/0x84 | 00 05 00 00 | 0 | ....
[=] 133/0x85 | 00 00 00 00 | 0 | ....
[=] 134/0x86 | 00 00 00 00 | 0 | ....
[=] ---------------------------------
[=] Using UID as filename
[+] Saved 596 bytes to binary file `/home/motoko/hf-mfu-040F6D5A906B80-dump.bin`
[+] Saved to json file `/home/motoko/hf-mfu-040F6D5A906B80-dump.json`
[usb] pm3 --> hf mfu eload -f /home/motoko/hf-mfu-040F6D5A906B80-dump.bin
[=] Upload 255 blocks 1020 bytes
[+] Loaded 596 bytes from binary file `/home/motoko/hf-mfu-040F6D5A906B80-dump.bin`
[=] Detected new mfu dump format
[=] MIFARE Ultralight override, will use 149 blocks ( 596 bytes )
[=] Uploading to emulator memory
[=] ...
[?] You are ready to simulate. See `hf mfu sim -h`
[?] Try `hf mfu sim -t 7` to simulate an Amiibo.
[=] Done!

[usb] pm3 --> hf search
 ?  Searching for ISO14443-A tag...          
[=] ---------- ISO14443-A Information ----------
[+]  UID: 04 0F 6D 5A 90 6B 80   ( double )
[+] ATQA: 00 44
[+]  SAK: 00 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+]    MIFARE Ultralight
[+]    MIFARE Ultralight C
[+]    MIFARE Ultralight EV1
[+]    MIFARE Ultralight Nano
[+]    MIFARE Ultralight AES
[+]    MIFARE Hospitality
[+]    NTAG 2xx
[=] proprietary non iso14443-4 card found, RATS not supported
[=] 

[?] Hint: try `hf mfu info`


[+] Valid ISO 14443-A tag found

Set UID failure

[usb] pm3 --> hf mfu setuid 04 EC 5F 92 E4 62 80
hf mfu setuid: unexpected argument "04"
hf mfu setuid: unexpected argument "EC"
hf mfu setuid: unexpected argument "5F"
hf mfu setuid: unexpected argument "92"
hf mfu setuid: unexpected argument "E4"
hf mfu setuid: unexpected argument "62"
hf mfu setuid: unexpected argument "80"
[!] ⚠️  Try 'hf mfu setuid --help' for more information.

[usb] pm3 --> hf mfu setuid 04EC5F92E46280
hf mfu setuid: unexpected argument "04EC5F92E46280"
[!] ⚠️  Try 'hf mfu setuid --help' for more information.

[usb] pm3 --> hf mfu setuid -h

Set UID on MIFARE Ultralight tag.
This only works for `magic Ultralight` tags.

usage:
    hf mfu setuid [-h] [-u <hex>]

options:
    -h, --help                     This help
    -u, --uid <hex>                New UID (7 hex bytes)

examples/notes:
    hf mfu setuid --uid 11223344556677

iceman · 2024-10-13 07:04:40

Your call to setuid is wrong and if you read the help text it tells you in clear text how to call it.

Motoko.Iwakura · 2024-10-13 21:09:29

Hello, Iceman - thank you so much for taking the time to reply... please forgive my ignorance, I feel ashamed that I might not be seeing something clearly that I should be. I'm still unable to set the UID properly. I'm getting this message "[=] Please ignore possible transient BCC warnings"

[usb] pm3 --> hf mfu setuid --uid 04 EC 5F 92 E4 62 80
hf mfu setuid: unexpected argument "EC"
hf mfu setuid: unexpected argument "5F"
hf mfu setuid: unexpected argument "92"
hf mfu setuid: unexpected argument "E4"
hf mfu setuid: unexpected argument "62"
hf mfu setuid: unexpected argument "80"
[!] ⚠️ Try 'hf mfu setuid --help' for more information.

[usb] pm3 --> hf mfu setuid --uid 04EC5F92E46280
[=] Please ignore possible transient BCC warnings
[usb] pm3 --> hf mfu info

[=] --- Tag Information --------------------------
[+] TYPE: NTAG 215 504bytes (NT2H1511G0DU)
[+] UID: 04 0F 6D 5A 90 6B 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] BCC0: EE ( ok )
[+] BCC1: 21 ( ok )
[+] Internal: 48 ( default )
[+] Lock: 00 00 - 0000000000000000
[+] OTP: E1 10 3E 00 - 11100001000100000011111000000000

[=] --- NDEF Message
[+] Capability Container: E1103E00
[+] E1: NDEF Magic Number
[+] 10: version 0.1 supported by tag
[+] : Read access granted without any security / Write access granted without any security
[+] 3E: Physical Memory Size: 496 bytes
[+] 3E: NDEF Memory Size: 496 bytes
[+] 00: Additional feature information
[+] 00000000
[+] 000 .... - RFU
[+] ...0 ... - Don't support special frame
[+] ....0 .. - Don't support lock block
[+] .....00 - RFU
[+] .......0 - IC don't support multiple block reads

[=] --- Tag Counter
[=] [02]: 00 00 00
[+] - BD tearing ( ok )

[=] --- Tag Signature
[=] IC signature public key name: NXP NTAG21x (2013)
[=] IC signature public key value: 04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61
[=] Elliptic curve parameters: NID_secp128r1
[=] TAG IC Signature: 16A7BF9A38B395D762B4FAC99F0298F33C77DB23DF0191B2DC6425FE19B00805
[+] Signature verification ( successful )

[=] --- Tag Silicon Information
[=] Wafer Counter: 17658379 ( 0x10D720B )
[=] Wafer Coordinates: x 15, y 109 (0x0F, 0x6D)
[=] Test Site: 2

[=] --- Tag Version
[=] Raw bytes: 0004040201001103
[=] Vendor ID: 04, NXP Semiconductors Germany
[=] Product type: NTAG
[=] Product subtype: 02, 50pF
[=] Major version: 01
[=] Minor version: 00
[=] Size: 11, (512 <-> 256 bytes)
[=] Protocol type: 03, ISO14443-3 Compliant

[=] --- Tag Configuration
[=] cfg0 [131/0x83]: 040000FF
[=] - strong modulation mode disabled
[=] - pages don't need authentication
[=] cfg1 [132/0x84]: 00050000
[=] - Unlimited password attempts
[=] - NFC counter disabled
[=] - NFC counter not protected
[=] - user configuration writeable
[=] - write access is protected with password
[=] - 05, Virtual Card Type Identifier is default
[=] PWD [133/0x85]: 00000000 ( cannot be read )
[=] PACK [134/0x86]: 0000 ( cannot be read )
[=] RFU [134/0x86]: 0000 ( cannot be read )

[+] --- Known EV1/NTAG passwords
[+] Password... FFFFFFFF pack... 0000
[=]
[=] --- Fingerprint
[=] n/a

I'm also trying to wipe it and getting an "Auth error"

[usb] pm3 --> hf mfu wipe
[+] TYPE: NTAG 215 504bytes (NT2H1511G0DU)
[#] Auth error

iceman · 2024-10-14 11:15:18

You need a magic tag to be able to change its uid.
And try reading the help text for the wipe command. You be surprised how much one can learn reading those texts.

Proxmark3 community

Announcement

#1 2024-10-13 01:34:47

hf mfu help

#2 2024-10-13 07:04:40

Re: hf mfu help

#3 2024-10-13 21:09:29

Re: hf mfu help

#4 2024-10-14 11:15:18

Re: hf mfu help

Board footer