Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2024-06-23 12:30:58

kelvin
Contributor
Registered: 2023-01-16
Posts: 2

Need help with mifare bcco incorrect problem

Hi,I have original mifare fob to copy,when I read a fob,shows " BCC0 incorrect, got 0x3b, expected 0x1b
[#] Aborting
[#] BCC0 incorrect, got 0x00, expected 0x01" and when I follow step using "hf mf autopwn"and restore with blank fob,weird thing is uid not changed,even though found all keys,anyone has idea what to do,any help will be appreciated.


  Client.... Iceman/master/v4.14831-908-g4fd8f378a 2022-08-24 11:14:02
    Bootrom... Iceman/master/v4.14831-908-g4fd8f378a 2022-08-24 11:13:47
    OS........ Iceman/master/v4.14831-908-g4fd8f378a 2022-08-24 11:13:54
    Target.... PM3 GENERIC


[usb|script] pm3 --> hf sea

[=]  IC signature public key name: NXP M[+]  UID: 84 C3 77 ED
[+] ATQA: 00 04
[+]  SAK: 08 [2]
[+] Possible types:
[+]    MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[#] BCC0 incorrect, got 0x3b, expected 0x1b
[#] Aborting
[#] BCC0 incorrect, got 0x00, expected 0x01
[#] Aborting
[=]
[=] --- Tag Signature
ifare Classic MFC1C14_x
[=] IC signature public key value: 044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF
[=]     Elliptic curve parameters: NID_secp128r1
[=]              TAG IC Signature: EAC64B5E0089DC7669FEA942B7665372707C400003F0CF11A76D0B73FB0899C9
[+]        Signature verification: successful
[?] Hint: try `hf mf` commands


[+] Valid ISO 14443-A tag found

[usb|script] pm3 --> hf mf auto
[#] BCC0 incorrect, got 0x00, expected 0x01
[#] Aborting
[!!] error:  selecting tag failed,  can't detect prng


[-] No tag detected or other tag communication error

[usb|script] pm3 --> hf mf auto
[!] no known key was supplied, key recovery might fail
[+] loaded 42 keys from hardcoded default array
[=] running strategy 1
[#] BCC0 incorrect, got 0x3b, expected 0x1b
[#] Aborting
[#] ChkKeys_fast: Can't select card (ALL)
[=] Chunk 0.1s | found 0/32 keys (42)
[=] running strategy 2
[=] Chunk 1.9s | found 25/32 keys (42)
[+] target sector   0 key type A -- found valid key [ A0A1A2A3A4A5 ] (used for nested / hardnested attack)
[+] target sector   1 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   1 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  15 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  15 key type B -- found valid key [ FFFFFFFFFFFF ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 4 threads and AVX2 SIMD core                |                 |
[=]        0 |       0 | Brute force benchmark: 256 million (2^27.9) keys/s      | 140737488355328 |    6d
[=]        9 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    6d
[#] BCC0 incorrect, got 0x00, expected 0x01
[#] Aborting
[#] AcquireEncryptedNonces: Can't select card (ALL)
[#] BCC0 incorrect, got 0x00, expected 0x01
[#] Aborting
[#] AcquireEncryptedNonces: Can't select card (ALL)
[#] BCC0 incorrect, got 0x00, expected 0x01
[#] Aborting
[#] AcquireEncryptedNonces: Can't select card (ALL)
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[=]       14 |     112 | Apply bit flip properties                               |    661002125312 | 43min
[=]       15 |     224 | Apply bit flip properties                               |    566362636288 | 37min
[=]       16 |     336 | Apply bit flip properties                               |    308768997376 | 20min
[=]       17 |     448 | Apply bit flip properties                               |    306022285312 | 20min
[=]       18 |     558 | Apply bit flip properties                               |    268356517888 | 17min
[=]       19 |     670 | Apply bit flip properties                               |    256417234944 | 17min
[=]       20 |     779 | Apply bit flip properties                               |    155915747328 | 10min
[=]       21 |     889 | Apply bit flip properties                               |    105099304960 |  7min
[=]       22 |     999 | Apply bit flip properties                               |    104778768384 |  7min
[=]       24 |    1110 | Apply bit flip properties                               |    104778768384 |  7min
[=]       25 |    1219 | Apply bit flip properties                               |    104778768384 |  7min
[=]       26 |    1327 | Apply bit flip properties                               |     86673989632 |  6min
[=]       27 |    1439 | Apply bit flip properties                               |     86673989632 |  6min
[=]       27 |    1548 | Apply bit flip properties                               |     86673989632 |  6min
[=]       28 |    1658 | Apply bit flip properties                               |     86673989632 |  6min
[=]       29 |    1768 | Apply bit flip properties                               |     86673989632 |  6min
[=]       31 |    1876 | Apply Sum property. Sum(a0) = 192                       |        57213640 |    0s
[=]       32 |    1986 | Apply bit flip properties                               |        57213640 |    0s
[=]       32 |    2094 | Apply bit flip properties                               |        87866632 |    0s
[=]       33 |    2205 | Apply bit flip properties                               |        62942244 |    0s
[=]       34 |    2313 | Apply bit flip properties                               |        62942244 |    0s
[=]       35 |    2313 | (1. guess: Sum(a8) = 256)                               |        62942244 |    0s
[=]       35 |    2313 | Apply Sum(a8) and all bytes bitflip properties          |        54960292 |    0s
[=]       36 |    2313 | Brute force phase completed.  Key found: 958E3FC38C60   |               0 |    0s
[+] target sector   0 key type B -- found valid key [ 958E3FC38C60 ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 4 threads and AVX2 SIMD core                |                 |
[=]        0 |       0 | Brute force benchmark: 225 million (2^27.7) keys/s      | 140737488355328 |    7d
[=]        6 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    7d
[#] AcquireEncryptedNonces: Auth2 error len=1
[=]       10 |     112 | Apply bit flip properties                               |    883836715008 | 66min
[=]       11 |     224 | Apply bit flip properties                               |     75083341824 |  6min
[=]       12 |     336 | Apply bit flip properties                               |     49928192000 |  4min
[=]       13 |     448 | Apply bit flip properties                               |     38863339520 |  3min
[=]       14 |     559 | Apply bit flip properties                               |     38863339520 |  3min
[=]       15 |     671 | Apply bit flip properties                               |     12939057152 |   58s
[=]       16 |     780 | Apply bit flip properties                               |     12924476416 |   58s
[#] AcquireEncryptedNonces: Auth2 error len=1
[=]       17 |     892 | Apply bit flip properties                               |     12896914432 |   57s
[=]       18 |    1002 | Apply bit flip properties                               |     12896914432 |   57s
[=]       19 |    1113 | Apply bit flip properties                               |     12896914432 |   57s
[=]       20 |    1225 | Apply bit flip properties                               |     12896914432 |   57s
[=]       21 |    1332 | Apply bit flip properties                               |      6010071040 |   27s
[=]       22 |    1441 | Apply bit flip properties                               |      6010071040 |   27s
[=]       23 |    1552 | Apply bit flip properties                               |      6010071040 |   27s
[=]       23 |    1661 | Apply bit flip properties                               |      6010071040 |   27s
[=]       27 |    1768 | Apply Sum property. Sum(a0) = 64                        |       277953664 |    1s
[=]       27 |    1877 | Apply bit flip properties                               |       157662320 |    1s
[=]       28 |    1987 | Apply bit flip properties                               |       157662320 |    1s
[=]       29 |    2096 | Apply bit flip properties                               |       113873424 |    1s
[=]       29 |    2096 | (1. guess: Sum(a8) = 0)                                 |       113873424 |    1s
[=]       30 |    2096 | Apply Sum(a8) and all bytes bitflip properties          |        96970312 |    0s
[=]       30 |    2096 | Brute force phase completed.  Key found: 4C16B0DE6937   |               0 |    0s
[+] target sector  12 key type A -- found valid key [ 4C16B0DE6937 ]
[#] BCC0 incorrect, got 0x00, expected 0x01
[#] Aborting
[#] Auth error
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 4 threads and AVX2 SIMD core                |                 |
[=]        0 |       0 | Brute force benchmark: 214 million (2^27.7) keys/s      | 140737488355328 |    8d
[=]        6 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    8d
[=]        9 |     112 | Apply bit flip properties                               |   1049655246848 | 82min
[=]       10 |     223 | Apply bit flip properties                               |    381815226368 | 30min
[=]       11 |     335 | Apply bit flip properties                               |    250833682432 | 20min
[=]       12 |     447 | Apply bit flip properties                               |    187400732672 | 15min
[=]       13 |     558 | Apply bit flip properties                               |    175798370304 | 14min
[=]       14 |     668 | Apply bit flip properties                               |    143983919104 | 11min
[=]       15 |     778 | Apply bit flip properties                               |     61172989952 |  5min
[=]       16 |     889 | Apply bit flip properties                               |     29021415424 |  2min
[=]       17 |    1001 | Apply bit flip properties                               |     25523193856 |  2min
[=]       18 |    1109 | Apply bit flip properties                               |     25523193856 |  2min
[=]       19 |    1221 | Apply bit flip properties                               |     24850980864 |  2min
[=]       21 |    1330 | Apply Sum property. Sum(a0) = 80                        |      1805270144 |    8s
[=]       23 |    1438 | Apply bit flip properties                               |       889737344 |    4s
[=]       24 |    1549 | Apply bit flip properties                               |       889737344 |    4s
[=]       25 |    1656 | Apply bit flip properties                               |       614650496 |    3s
[=]       25 |    1768 | Apply bit flip properties                               |       614650496 |    3s
[=]       26 |    1768 | (Ignoring Sum(a8) properties)                           |       614650496 |    3s
[=]       27 |    1768 | Brute force phase completed.  Key found: 1C701C049297   |               0 |    0s
[+] target sector  12 key type B -- found valid key [ 1C701C049297 ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 4 threads and AVX2 SIMD core                |                 |
[=]        0 |       0 | Brute force benchmark: 214 million (2^27.7) keys/s      | 140737488355328 |    8d
[=]        6 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    8d
[#] BCC0 incorrect, got 0x3b, expected 0x1b
[#] Aborting
[#] AcquireEncryptedNonces: Can't select card (ALL)
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[=]        9 |     112 | Apply bit flip properties                               |    763870838784 | 60min
[=]       11 |     224 | Apply bit flip properties                               |    372581105664 | 29min
[=]       12 |     335 | Apply bit flip properties                               |    239064285184 | 19min
[=]       13 |     447 | Apply bit flip properties                               |    155772010496 | 12min
[=]       14 |     559 | Apply bit flip properties                               |    135085441024 | 11min
[=]       15 |     670 | Apply bit flip properties                               |    123731591168 | 10min
[=]       16 |     782 | Apply bit flip properties                               |     80162758656 |  6min
[=]       17 |     893 | Apply bit flip properties                               |     50166341632 |  4min
[=]       18 |    1005 | Apply bit flip properties                               |     35208339456 |  3min
[=]       19 |    1115 | Apply bit flip properties                               |     34536128512 |  3min
[=]       20 |    1226 | Apply bit flip properties                               |     34536128512 |  3min
[=]       22 |    1336 | Apply Sum property. Sum(a0) = 112                       |      7085741568 |   33s
[=]       24 |    1448 | Apply bit flip properties                               |     11873623040 |   55s
[=]       25 |    1557 | Apply bit flip properties                               |     11873623040 |   55s
[=]       26 |    1667 | Apply bit flip properties                               |      3249663232 |   15s
[=]       26 |    1779 | Apply bit flip properties                               |      3249663232 |   15s
[=]       27 |    1887 | Apply bit flip properties                               |      3249663232 |   15s
[=]       28 |    1997 | Apply bit flip properties                               |      3249663232 |   15s
[=]       28 |    1997 | (Ignoring Sum(a8) properties)                           |      3249663232 |   15s
[=]       40 |    1997 | Brute force phase completed.  Key found: 727EF3C81B88   |               0 |    0s
[+] target sector  13 key type A -- found valid key [ 727EF3C81B88 ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 4 threads and AVX2 SIMD core                |                 |
[=]        0 |       0 | Brute force benchmark: 230 million (2^27.8) keys/s      | 140737488355328 |    7d
[=]        6 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    7d
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[#] AcquireEncryptedNonces: Auth1 error
[=]        9 |     112 | Apply bit flip properties                               |    222417108992 | 16min
[=]       10 |     224 | Apply bit flip properties                               |    176163667968 | 13min
[=]       12 |     334 | Apply bit flip properties                               |    104469741568 |  8min
[=]       13 |     446 | Apply bit flip properties                               |    104469741568 |  8min
[=]       14 |     558 | Apply bit flip properties                               |     93549969408 |  7min
[=]       15 |     670 | Apply bit flip properties                               |     93549969408 |  7min
[=]       16 |     782 | Apply bit flip properties                               |     93549969408 |  7min
[=]       17 |     892 | Apply bit flip properties                               |     83477741568 |  6min
[=]       18 |    1001 | Apply bit flip properties                               |     83477741568 |  6min
[=]       21 |    1113 | Apply Sum property. Sum(a0) = 128                       |     31226710016 |  2min
[=]       23 |    1223 | Apply bit flip properties                               |     41437511680 |  3min
[=]       25 |    1331 | Apply bit flip properties                               |     64902316032 |  5min
[=]       26 |    1441 | Apply bit flip properties                               |     64902316032 |  5min
[=]       28 |    1550 | Apply bit flip properties                               |      8625926144 |   37s
[=]       28 |    1658 | Apply bit flip properties                               |      8625926144 |   37s
[=]       29 |    1766 | Apply bit flip properties                               |      8625926144 |   37s
[=]       30 |    1875 | Apply bit flip properties                               |      8625926144 |   37s
[=]       30 |    1875 | (Ignoring Sum(a8) properties)                           |      8625926144 |   37s
[=]       79 |    1875 | Brute force phase: 100.00%                                 |   5352973139968 |    6h
[+] target sector  13 key type B -- found valid key [ 727EF3C81B88 ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 4 threads and AVX2 SIMD core                |                 |
[=]        0 |       0 | Brute force benchmark: 225 million (2^27.7) keys/s      | 140737488355328 |    7d
[=]        6 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    7d
[#] AcquireEncryptedNonces: Auth1 error
[=]        9 |     112 | Apply bit flip properties                               |    174004027392 | 13min
[=]       10 |     222 | Apply bit flip properties                               |     84415275008 |  6min
[=]       11 |     334 | Apply bit flip properties                               |     67213320192 |  5min
[=]       12 |     444 | Apply bit flip properties                               |     46015836160 |  3min
[=]       13 |     555 | Apply bit flip properties                               |     38157029376 |  3min
[=]       14 |     663 | Apply bit flip properties                               |     38157029376 |  3min
[=]       15 |     775 | Apply bit flip properties                               |     34456375296 |  3min
[=]       16 |     884 | Apply bit flip properties                               |     32648613888 |  2min
[=]       17 |     996 | Apply bit flip properties                               |     25158744064 |  2min
[=]       19 |    1106 | Apply bit flip properties                               |     25158744064 |  2min
[=]       20 |    1217 | Apply bit flip properties                               |     25158744064 |  2min
[=]       22 |    1325 | Apply Sum property. Sum(a0) = 128                       |     21292699648 |  2min
[=]       24 |    1435 | Apply bit flip properties                               |     21135179776 |  2min
[=]       25 |    1544 | Apply bit flip properties                               |     21135179776 |  2min
[=]       27 |    1653 | Apply bit flip properties                               |       433544736 |    2s
[=]       28 |    1761 | Apply bit flip properties                               |       297090624 |    1s
[=]       29 |    1870 | Apply bit flip properties                               |       297090624 |    1s
[=]       30 |    1979 | Apply bit flip properties                               |       297090624 |    1s
[=]       30 |    1979 | (Ignoring Sum(a8) properties)                           |       297090624 |    1s
[+] target sector  14 key type A -- found valid key [ 727EF3C81B88 ]
[#] Auth error
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]          |         |                                                         | Expected to brute force
[=]  Time    | #nonces | Activity                                                | #states         | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=]        0 |       0 | Start using 4 threads and AVX2 SIMD core                |                 |
[=]        0 |       0 | Brute force benchmark: 230 million (2^27.8) keys/s      | 140737488355328 |    7d
[=]        6 |       0 | Using 235 precalculated bitflip state tables            | 140737488355328 |    7d
[#] AcquireEncryptedNonces: Auth1 error
[=]        9 |     112 | Apply bit flip properties                               |    280272240640 | 20min
[=]       10 |     224 | Apply bit flip properties                               |     46794510336 |  3min
[=]       11 |     336 | Apply bit flip properties                               |     11710838784 |   51s
[=]       12 |     448 | Apply bit flip properties                               |      9417847808 |   41s
[=]       13 |     559 | Apply bit flip properties                               |      4153818368 |   18s
[=]       14 |     670 | Apply bit flip properties                               |      3468317696 |   15s
[=]       15 |     780 | Apply bit flip properties                               |      3468317696 |   15s
[=]       16 |     889 | Apply bit flip properties                               |      3283536896 |   14s
[=]       17 |     999 | Apply bit flip properties                               |      3283536896 |   14s
[=]       18 |    1107 | Apply bit flip properties                               |      3283536896 |   14s
[=]       20 |    1217 | Apply Sum property. Sum(a0) = 120                       |      1766124416 |    8s
[=]       22 |    1328 | Apply bit flip properties                               |      1766124416 |    8s
[=]       23 |    1438 | Apply bit flip properties                               |      1766124416 |    8s
[=]       24 |    1548 | Apply bit flip properties                               |      1766124416 |    8s
[=]       24 |    1548 | (Ignoring Sum(a8) properties)                           |      1766124416 |    8s
[=]       28 |    1548 | Brute force phase completed.  Key found: CB9484347063   |               0 |    0s
[+] target sector  14 key type B -- found valid key [ CB9484347063 ]

[+] found keys:

[+] -----+-----+--------------+---+--------------+----
[+]  Sec | Blk | key A        |res| key B        |res
[+] -----+-----+--------------+---+--------------+----
[+]  000 | 003 | A0A1A2A3A4A5 | D | 958E3FC38C60 | H
[+]  001 | 007 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  002 | 011 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  003 | 015 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  004 | 019 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  005 | 023 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  006 | 027 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  007 | 031 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  008 | 035 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  009 | 039 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  010 | 043 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  011 | 047 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  012 | 051 | 4C16B0DE6937 | H | 1C701C049297 | H
[+]  013 | 055 | 727EF3C81B88 | H | 727EF3C81B88 | H
[+]  014 | 059 | 727EF3C81B88 | H | CB9484347063 | H
[+]  015 | 063 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] -----+-----+--------------+---+--------------+----
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA  )
[?] MAD key detected. Try `hf mf mad` for more details


[+] Generating binary key file
[+] Found keys have been dumped to hf-mf-84C377ED-key.bin
[=] FYI! --> 0xFFFFFFFFFFFF <-- has been inserted for unknown keys where res is 0
[+] transferring keys to simulator memory (Cmd Error: 04 can occur)
[#] Cmd Error 07
[#] wrong response len 0 (expected 18)
[#] Cmd Error 04
[#] wrong response len 0 (expected 18)
[=] fast dump reported back failure w KEY A,  swapping to KEY B
[=] fast dump reported back failure w KEY B
[=] Dump file is PARTIAL complete
[=] downloading the card content from emulator memory
[+] saved 1024 bytes to binary file hf-mf-84C377ED-dump.bin
[+] saved 64 blocks to text file hf-mf-84C377ED-dump.eml
[+] saved to json file hf-mf-84C377ED-dump.json
[=] autopwn execution time: 286 seconds

after restore data to a blank fob[usb|script] pm3 --> hf mf restore --1k --uid 84C377ED
[+] loaded 1024 bytes from binary file hf-mf-84C377ED-dump.bin
[=] Restoring hf-mf-84C377ED-dump.bin to card
[=] block   0: E6 84 87 F3 16 88 04 00 46 8E 45 55 4D 70 41 04
[=] block   1: 2E 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block   2: 00 00 00 00 00 00 00 00 31 52 31 52 31 52 00 00
[=] block   3: A0 A1 A2 A3 A4 A5 78 77 88 C1 95 8E 3F C3 8C 60
[=] block   4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block   5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block   6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block   7: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block   8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block   9: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  11: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  12: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  13: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  14: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 3, replacing by default values
[=] block  15: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  17: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  18: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  19: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  21: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  22: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 5, replacing by default values
[=] block  23: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  24: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  25: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  26: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 6, replacing by default values
[=] block  27: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  28: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  29: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  31: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  33: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  34: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  35: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  36: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  37: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  38: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 9, replacing by default values
[=] block  39: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  41: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  42: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 10, replacing by default values
[=] block  43: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  44: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  45: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  46: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 11, replacing by default values
[=] block  47: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] block  48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  49: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 12, replacing by default values
[=] block  51: 4C 16 B0 DE 69 37 FF 07 80 69 1C 70 1C 04 92 97
[=] block  52: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  53: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  54: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 13, replacing by default values
[=] block  55: 72 7E F3 C8 1B 88 FF 07 80 69 72 7E F3 C8 1B 88
[=] block  56: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  57: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  58: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 14, replacing by default values
[=] block  59: 72 7E F3 C8 1B 88 FF 07 80 69 CB 94 84 34 70 63
[=] block  60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  61: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[=] block  62: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[!] Invalid Access Conditions on sector 15, replacing by default values
[=] block  63: FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF
[=] Done!
[usb|script] pm3 --> hf mf auto
[!] no known key was supplied, key recovery might fail
[+] loaded 42 keys from hardcoded default array
[=] running strategy 1
[=] .
[=] Chunk 2.0s | found 25/32 keys (42)
[=] running strategy 2
[=] Chunk 1.9s | found 25/32 keys (42)
[+] target sector   0 key type A -- found valid key [ A0A1A2A3A4A5 ] (used for nested / hardnested attack)
[+] target sector   1 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   1 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   2 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   3 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   4 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   5 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   6 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   7 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   8 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector   9 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  10 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  11 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  15 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector  15 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] Found 1 key candidates

[+] Target block    0 key type B -- found valid key [ 958E3FC38C60 ]

[+] target sector   0 key type B -- found valid key [ 958E3FC38C60 ]
[+] Found 1 key candidates

[+] Target block   48 key type A -- found valid key [ 4C16B0DE6937 ]

[+] target sector  12 key type A -- found valid key [ 4C16B0DE6937 ]
[+] target sector  12 key type B -- found valid key [ 1C701C049297 ]
[+] Found 1 key candidates

[+] Target block   52 key type A -- found valid key [ 727EF3C81B88 ]

[+] target sector  13 key type A -- found valid key [ 727EF3C81B88 ]
[+] target sector  13 key type B -- found valid key [ 727EF3C81B88 ]
[+] target sector  14 key type A -- found valid key [ 727EF3C81B88 ]
[+] target sector  14 key type B -- found valid key [ CB9484347063 ]

[+] found keys:

[+] -----+-----+--------------+---+--------------+----
[+]  Sec | Blk | key A        |res| key B        |res
[+] -----+-----+--------------+---+--------------+----
[+]  000 | 003 | A0A1A2A3A4A5 | D | 958E3FC38C60 | N
[+]  001 | 007 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  002 | 011 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  003 | 015 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  004 | 019 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  005 | 023 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  006 | 027 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  007 | 031 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  008 | 035 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  009 | 039 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  010 | 043 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  011 | 047 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+]  012 | 051 | 4C16B0DE6937 | N | 1C701C049297 | A
[+]  013 | 055 | 727EF3C81B88 | N | 727EF3C81B88 | R
[+]  014 | 059 | 727EF3C81B88 | R | CB9484347063 | A
[+]  015 | 063 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] -----+-----+--------------+---+--------------+----
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA  )
[?] MAD key detected. Try `hf mf mad` for more details


[+] Generating binary key file
[+] Found keys have been dumped to hf-mf-E68487F3-key.bin
[=] FYI! --> 0xFFFFFFFFFFFF <-- has been inserted for unknown keys where res is 0
[+] transferring keys to simulator memory (Cmd Error: 04 can occur)
[=] downloading the card content from emulator memory
[+] saved 1024 bytes to binary file hf-mf-E68487F3-dump.bin
[+] saved 64 blocks to text file hf-mf-E68487F3-dump.eml
[+] saved to json file hf-mf-E68487F3-dump.json
[=] autopwn execution time: 9 seconds

uid did not match with original fob,what should I do to resolve this?

Offline

#2 2024-09-11 18:29:07

quterydyf
Contributor
Registered: 2023-02-15
Posts: 23

Re: Need help with mifare bcco incorrect problem

Are you sure you are writing to a magic fob?

Offline

Board footer

Powered by FluxBB