Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
Hello, someone understand how to read and write an Aztek Tag.
I've searched on forum but i don't understand.
Sorry for my english.
Offline
Hi, what kind of hardware are you using to try and read this badge.
Offline
I try with a PM3
Offline
Hello, pm3 easy ok normally you should be able to read this badge which cmd you are using.
Offline
I only do this for now, because i don't know if it's complete
[usb] pm3 --> sc r hf_14a_aztek.lua
[+] executing lua C:\working\ProxSpace\pm3\proxmark3\client\luascripts/hf_14a_aztek.lua
[+] args ''
Found Card UID [05257B04F78A41]
blk | data | xored
----+------------------+-------------------
00 | 8805257B04F78A41 | 8805257B04F78A41 |
01 | 0002000000000000 | 0002000000000000 |
02 | F4D30B234D15B50E | F4D30B234D15B50E |0
03 | 0000000000000000 | 55AA55AA55AA55AA |
04 | 0000000000000000 | 55AA55AA55AA55AA |
05 | 0000000000000000 | 55AA55AA55AA55AA |
06 | 0000000000000000 | 55AA55AA55AA55AA |
07 | 0000000000000000 | 55AA55AA55AA55AA |
08 | 0000000000000000 | 55AA55AA55AA55AA |
09 | 0000000000000000 | 55AA55AA55AA55AA |
10 | 0000000000000000 | 55AA55AA55AA55AA |
11 | 76986CD11C914826 | 2332397B493B1D8C |
12 | AF21A58D2FD8C9F8 | FA8BF0277A729C52 |
13 | DB954C4C7DF4A9DF | 8E3F19E6285EFC75 |
14 | 5AD58067F4224704 | 0F7FD5CDA18812AE |
15 | 0000000000000000 | 55AA55AA55AA55AA |
16 | 20357BD7BA72A790 | 759F2E7DEFD8F23A |
17 | 9E2855B854C87C01 | CB820012016229AB |
18 | A38067DF0D88B2D6 | F62A32755822E77C |
19 | 8008301220B89439 | D5A265B87512C193 |
20 | 031867C0F9374B90 | 56B2326AAC9D1E3A |
----+------------------+-------------------
Dumped data into 05257B04F78A41.emlOffline
Hello, as there is more on this post I delete the text, too bad this post remains without follow-up.
Good day.
Last edited by fazer (2023-05-16 08:22:55)
Offline
Thanks for your help but i can't find the script luxeodecode
Offline
Re, & luxeo script?, ok I can see putting it on mega if you want. What & your uid to verify the known key
Last edited by fazer (2023-03-08 17:05:47)
Offline
Thank for help help, but i can't dump with mfoc because it's not a mifare classic
Offline
Hello, I do not know this Aztek badge with your PM3 have you made a self -research or HF Search to see the information of your badge. In the 14a azteck script that you launched had you try HF 14A -H & then HF 14A Info.
Good day.
Your pm3 easy & up to date?
Last edited by fazer (2023-03-05 12:59:19)
Offline
[usb] pm3 --> HF 14A Info
[+] UID: 05 25 7B 04 F7 8A 41
[+] ATQA: 00 44
[+] SAK: 00 [2]
[+] MANUFACTURER: Infineon Technologies AG Germany
[+] my-d(tm) command set SLE 66R01/16/32P (Type 2 Tag)
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities : NTAG21x
[?] Hint: try `hf mfu info`Offline
Hi, look at the end of the screen.
hf mfu info
Offline
[usb] pm3 --> hf mfu info
[=] --- Tag Information --------------------------
[=] -------------------------------------------------------------
[+] TYPE: INFINEON my-dÖ NFC (SLE 66RxxP) ( magic )
[+] UID: 05 25 7B 04 F7 8A 41
[+] UID[0]: 05, Infineon Technologies AG Germany
[+] Blocks 0-2: 00 00 00 00 00 00 00 00 00 00 00 00
[+] Lock: 00 00 - 0000000000000000
[+] OneTimePad: E1 10 7E 00 - 11100001000100000111111000000000
[=] --- NDEF Message
[+] Capability Container: E1 10 7E 00
[+] E1: NDEF Magic Number
[+] 10: version 0.1 supported by tag
[+] : Read access granted without any security / Write access granted without any security
[+] 7E: Physical Memory Size: 1008 bytes
[+] 00: Additional feature information
[+] 00000000
[+] xxx..... - 00: RFU ( ok )
[+] ...x.... - 00: don't support special frame
[+] ....x... - 00: don't support lock block
[+] .....xx. - 00: RFU ( ok )
[+] .......x - 00: IC don't support multiple block reads
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory...
[=] ------------------------------------------------------------Offline
Hi, you need your badge documentation to see if you can do anything with it or try asking for help on the forum.
Last edited by fazer (2023-03-06 19:48:16)
Offline
Hi, I forgot to tell you that you have to change a value in the luxeodecode script because there is a value for cryt =true
and decrypt=false.
Offline
slt Cedisov62, I am attaching an aztek badge Unciphered data
Header:
4C55582F550000000000000000002843
240204103C103C102100010000009EA4
2E02040A010001000000000000006972
CRC16/ARC = 0x7269 OK
DataA:
9F00C06100DAF1EA230354160020B426
C8000000000000000000000000000000
00007F7F7F7F7F1F1F1F0100FF032820
00000000200820010000000000005A7B
Version 0x009F
Credit : 2
CRC16/ARC = 0x7B5A OK
Date: 2023/03/14 16:20
DataB:
9E00C06100DAF03B221256080015B426
00000000000000000000000000000000
00007F7F7F7F7F1F1F1F0100FF034820
00000000200820010000000000003A8F
Version 0x009E
Credit : 0
CRC16/ARC = 0x8F3A OK
Date: 2022/12/16 08:15
Footer:
01000000000001D10000000000000000
DBFD32D48F4FB471DBFD32D48F4FB471
DBFD32D48F4FB471DBFD32D48F4FB471
DBFD32D48F4FB471DBFD32D48F4FB471
02000000000001E20000000000000000
DBFD32D48F4FB471DBFD32D48F4FB471
DBFD32D48F4FB471DBFD32D48F4FB471
DBFD32D48F4FB471DBFD32D48F4FB471
DBFD32D48F4FB471DBFD32D48F4FB471
DBFD32D48F4FB471DBFD32D48F4FB471
Last edited by fazer (2023-03-19 19:07:29)
Offline
Hi Fazer, i don't understand how do you do? I'm a newbie with PM3.
Could you explain me step by step
Thnak you for helping me
Offline
Slt Sedisov62, You just have to follow the tutorial above, everything & explain. You already need the complete dump of the aztek badge in the first time. When I see 14a info it seems that it is an ultralight mifare.
I see you may have had a file
Dumped data into 05257B04F78A41.eml. So with this .eml file you have to run the luxeodecode script. It will create a decrypt file but first you have to change in the script - Change the values here
emlfile = "05257B04F78A41".eml" -- file in
cipher = false -- if cipher=true, we encrypt, otherwise we decrypt . then the decrypt file will be in the pm3 folder, you have to change the values you want to recalculate the encrypted crcs so (true) then put it back (false) decrypt to verify crc error if there is ok encrypted & restore, here is basically be careful with all these files not to mix things up.
Good evening.
Last edited by fazer (2023-03-29 18:33:59)
Offline
Pages: 1