Proxmark3 community

hheile

Contributor

Registered: 2014-03-03

Posts: 35

Mifare UID rewritable card - problems

hello community,

i have some questions and issues and maybe someone can clear what it is:

i have some mifare uid changable cards.

bootrom svn 848
os master v1.0.0-2-g7eb0f3d-suspect 2014-04-03 13:05
FPGA Image build on 2014/03/24 at 21:54:44

so i can read my cards UID

proxmark3> hf 14a read
ATQA : 04 00         
UID : b4 1a 02 99           
SAK : 08 [2]         
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1         
proprietary non iso14443a-4 card found, RATS not supported 

change the uid

proxmark3> hf mf csetuid 11223344
--wipe card:00 uid:11 22 33 44           
old UID:b4 1a 02 99 

proxmark3> hf 14a read
ATQA : 04 00         
UID : 11 22 33 44           
SAK : 08 [2]         
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1         
proprietary non iso14443a-4 card found, RATS not supported

i did a hf mf mifare on the master to get the first key
and a hf mf nested 0 1 A <key> to get the rest and a dumpkey.bin and a dumpdata.bin

so now i want to write this dump to the card and used
hf mf restore

and get:
Writing to block 23: 52 6d 2f 99 81 3a 70 f7 88 00 33 51 2d 08 7c 55           
#db# rand nonce len: 4                 
#db# auth uid: 11223344 nt: 01200145                 
#db# Authentication failed. Card timeout.                 
#db# Auth error                 
#db# WRITE BLOCK FINISHED                 
isOk:00

in every block.

so: how can i clear the card? i thought i can simply put the dump from the blank card back.
but same issue.

how can i rewrite the card? or format the card with the default image or clear the card or something?

thanks in advance

merlok

Contributor

Registered: 2011-05-16

Posts: 132

Re: Mifare UID rewritable card - problems

Hi,

I think it may happened if the code tried to put data to card with key A instead of key B.

Unfortunately, its not possible to fix that via command line. But you can easily change it via code)

here (cmdhfmf.c):

int CmdHF14AMfRestore(const char *Cmd)
............
    uint8_t keyType = 0;
...............
            UsbCommand c = {CMD_MIFARE_WRITEBL, {i*4 + j, keyType, 0}};