Proxmark3 community

ikarus

Contributor

Registered: 2012-09-20

Posts: 249

Website

MIFARE Classic Tag Types

TL;DR: I want to document all the different MIFARE Classic tag types available.

Hi everyone,

in the past years I've seen many different MIFARE Classic tags and witnessed as new special tags have reached the market.
I find it terribly hard to get a good overview of what is available and what can be done with it.

I want to try to document all tag types in a "sort" document to give me and other users a quick overview. If this works, we
could try to make documents for other techniques as well. Each "finished" overview of a tag technique could be adapted
to a wiki page of the github repo.

In order to make this work, I need your help. There are a lot of MIFARE Classic tag types and I've not seen all of them.
The following section is some kind of template with some information I've noticed/researched over the past. Please comment on it
so I can update it. Also, parts with "???" need to be filled with the correct information. Furthermore, there might be false information
in the. So please correct me.

MIFARE Classic
==============


Offical Tag Types
-----------------

* MIFARE Classic Mini
  * Memory: 320 bytes
  * UID: 4 or 7 bytes
  * Sectors: 5
  * Blocks: 4 per sector
* MIFARE Classic 1K
  * Memory: 1024 bytes
  * UID: 4 or 7 bytes
  * Sectors: 16
  * Blocks: 4 per sector
* MIFARE Classic 4K
  * Memory: 4096 bytes
  * UID: 4 or 7 bytes
  * Sectors 40
  * Blocks: 4 in sectors 0 to 31, 16 in sectors 32 to 39
* MIFARE Plus 2K with Security Level 1 (SL1)
  * Memory: 2048 bytes
  * UID: 4 or 7 bytes, optional support for random UID
  * Sectors: ???
  * Blocks: ???
* MIFARE Plus 4K with Security Level 1 (SL1)
  * Memory: 4096 bytes
  * UID: 4 or 7 bytes, optional support for random UID
  * Sectors: ???
  * Blocks: ???

Magic/Special Tag Types
----------------------

There are special types of MIFARE Classic tag. Most of them aim to make the UID of a tag changeable. There are available in different memory an UID sizes:
* MIFARE Classic 1k with 4 or 7 bytes UID
* MIFARE Classic 4k with 4 or 7 bytes UID
* ??? MIFARE Classic 2k with 4 or 7 bytes UID

Most tag types can be divided into two groups:
* Special Commands: libnfc compatible reader or proxmark3 is needed
* Normal Commands: No special equipment is needed, Android and Windows Phone compatible

* Type 1
  * UID changeable with special command
  * Only the UID can be written with the special command
  * Locked Access Conditions can not be changed again
* Type 2
  * UID changeable with normal command
  * Whole block 0 can be written with a normal command
  * Card will break if BCC is not correct
  * Locked Access Conditions can not be changed again
* Type 3
  * UID changeable with special command
  * Only UID can be written with the special command
  * Locked Access Conditions can be reset by wiping the tag with a special command
* Type 4
  * UID changeable with normal command
  * Block 0 can be written with a normal command
  * Tags can be fixed if the BCC was wrong
  * Locked Access Conditions can not be changed
* Type 5
  * ???

I've also have a lot of questions:
Are there special tags with a size of 2K?
Whats the difference of the 1a and 1b tags mentioned in the "hf mf cwipe" command?
Are there special commands where the Access Conditions can be overwritten with a normal command?
Has anyone ever tried to fix a tag with a broken BCC? How does it work? Do you need a special command for this?
Are these all of the special tags? Did I miss one?
Are some to the tags not available? Was my research wrong? (I do not own all types of special tags)?

I hope you can help me with your experience on special tags to improve this overview. If this is "finished" we could
add a small section of all the attacks that are available for MIFARE Classic. It would be great to have a small cheat sheet
for all tag techniques (e.g. MF Ultralight, MF Ultralight C, MF Desfire, Ntag xxx, etc). But that's just a thought for now...

Last edited by ikarus (2017-12-11 21:54:21)

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: MIFARE Classic Tag Types

Hm,  not sure if you are actually wanting to document all HF based cards or just Mifare based / clones?.   There are one excel sheet somewhere on googledrive,  or on the files section that does this for you already.  I think it is Asper who compiled it.

Then you start focusing on magic tags and start listing them... 

For me, this is two complete different issues.   And no,  I rather not start changing the naming-convention for magic tags.
I had enough of those already.  Hence there is this confusion already.

So, I suggest you redefine your quest.

ikarus

Contributor

Registered: 2012-09-20

Posts: 249

Website

Re: MIFARE Classic Tag Types

As I said: I'm not sure if I want to document this for all types of tags. But want to start with MIFARE Classic!

Yes,  official MIFARE Classic tag types and special MIFARE Classic tag types are two different things. That's why each has its on heading.
(But both are MIFARE Classic compatible, even MIFARE Plus.)

I agree to keeping the naming-convetion for magic tags. However, to do that, I first need someone how can explain all the
already known  magic tag types. If Asper already did such a thing, and if you or him could provide me with the execl sheet you mentioned
I'm willing to update it (if needed) and to migrate it to a wiki page to help other users as well.

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: MIFARE Classic Tag Types

I think we should come up with a unified naming convention or atleast a classification.  Almost given up on the name convention idea.  Just too many and all mixed up in the supported functionality.