Proxmark3 community

textext

Contributor

Registered: 2018-08-07

Posts: 2

Help with understanding a snoop

Hello pips
Here is a trace from a clone<->reader communication where the clone gets rejected (even though it has the same block/KEYs as the accepted tag). I am trying to understand why it rejects the clone.

      Start |        End | Src | Data (! denotes parity error)                                   | CRC | Annotation         |
------------|------------|-----|-----------------------------------------------------------------|-----|--------------------|
          0 |        992 | Rdr | 52                                                              |     | WUPA
  132208416 |  132209408 | Rdr | 52                                                              |     | WUPA
  132210644 |  132213012 | Tag | 02  00                                                          |     | 
  132233360 |  132235824 | Rdr | 93  20                                                          |     | ANTICOLL

If I look from 142377952, I see a correct auth trace with block 0 with:
nT
nR⊕ks1
aT⊕ks3
Giving the correct key A

Also, at 329186784, is it really trying to auth with sector 37 using KEY B? (The computation of nT, nR⊕ks1, aT⊕ks3 does not give the correct KEY B.)

Thanks a lot ::

Last edited by textext (2018-08-09 13:37:23)