Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
#1 2019-02-07 17:16:19
- Gtpy
- Contributor
- From: GER
- Registered: 2017-10-24
- Posts: 32
[RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
I try to start simulate very easy only UID.
Before I only simulated with the "chameleonMini". Now I wanted to try the identical with the pm3 RDV4
pm3 --> hf 14a sim t 1 u 046E6EAA7A2280 v
[+] Emulating ISO/IEC 14443 type A tag with 7 byte UID (04 6E 6E AA 7A 22 80 )
[+] press pm3-button to abort simulation
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 06
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 06
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 06
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=2):
#db# 93 00
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 13
#db# Received unknown command (len=1):
#db# 93
#db# Received unknown command (len=1):
#db# 06
#db# Received unknown command (len=1):
#db# 06
#db# Emulator stopped. Trace length: 2645
pm3 --> hf list
Recorded Activity (TraceLen = 2645 bytes)
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 864 | Rdr |26 | | REQA
2228 | 4596 | Tag |44 00 | |
7546 | 8282 | Rdr |13 | |
6997320 | 6998376 | Rdr |26 | | REQA
6999548 | 7001916 | Tag |44 00 | |
7004826 | 7005754 | Rdr |13 | |
13995394 | 13996258 | Rdr |26 | | REQA
13997622 | 13999990 | Tag |44 00 | |
14002938 | 14004506 | Rdr |93 00! | | ANTICOLL
21005862 | 21006918 | Rdr |26 | | REQA
21008090 | 21010458 | Tag |44 00 | |
21013406 | 21013758 | Rdr |03! | |
21016594 | 21022482 | Tag |03 00 00 70 4a | |
21034184 | 21034728 | Rdr |03! | |
21037692 | 21043580 | Tag |03 00 00 70 4a | |
21044472 | 21044824 | Rdr |02 | |
21047148 | 21053036 | Tag |02 00 00 ac 10 | |
28030814 | 28031678 | Rdr |26 | | REQA
28033042 | 28035410 | Tag |44 00 | |
28038378 | 28039946 | Rdr |93 00! | | ANTICOLL
35163976 | 35164840 | Rdr |26 | | REQA
35166204 | 35168572 | Tag |44 00 | |
35171498 | 35172426 | Rdr |13 | |
42161572 | 42162628 | Rdr |26 | | REQA
42163800 | 42166168 | Tag |44 00 | |
42169098 | 42170666 | Rdr |93 00! | | ANTICOLL
49294722 | 49295586 | Rdr |26 | | REQA
49296950 | 49299318 | Tag |44 00 | |
49302282 | 49303850 | Rdr |93 00! | | ANTICOLL
56315778 | 56316642 | Rdr |26 | | REQA
56318006 | 56320374 | Tag |44 00 | |
56323322 | 56324442 | Rdr |93! | | ANTICOLL
63317248 | 63318304 | Rdr |26 | | REQA
63319476 | 63321844 | Tag |44 00 | |
63324778 | 63326026 | Rdr |93 | | ANTICOLL
70450378 | 70451434 | Rdr |26 | | REQA
70452606 | 70454974 | Tag |44 00 | |
70457930 | 70459178 | Rdr |93 | | ANTICOLL
77448286 | 77449342 | Rdr |26 | | REQA
77450514 | 77452882 | Tag |44 00 | |
77455818 | 77456554 | Rdr |13 | |
84445860 | 84446916 | Rdr |26 | | REQA
84448088 | 84450456 | Tag |44 00 | |
84453386 | 84454506 | Rdr |93! | | ANTICOLL
91578880 | 91579936 | Rdr |26 | | REQA
91581108 | 91583476 | Tag |44 00 | |
91586410 | 91587658 | Rdr |93 | | ANTICOLL
98576618 | 98577290 | Rdr |06! | |
105696258 | 105697122 | Rdr |26 | | REQA
105698486 | 105700854 | Tag |44 00 | |
105703802 | 105705498 | Rdr |93 00! | | ANTICOLL
112693832 | 112694888 | Rdr |26 | | REQA
112696060 | 112698428 | Tag |44 00 | |
112701338 | 112702074 | Rdr |13 | |
119691742 | 119692798 | Rdr |26 | | REQA
119693970 | 119696338 | Tag |44 00 | |
119699290 | 119700730 | Rdr |93 00! | | ANTICOLL
126689210 | 126689882 | Rdr |06! | |
133676254 | 133677310 | Rdr |26 | | REQA
133678482 | 133680850 | Tag |44 00 | |
133683776 | 133684320 | Rdr |03! | |
133687220 | 133693108 | Tag |03 00 00 70 4a | |
133704806 | 133705350 | Rdr |03! | |
133708122 | 133714010 | Tag |03 00 00 70 4a | |
133715066 | 133715418 | Rdr |02 | |
133717742 | 133723630 | Tag |02 00 00 ac 10 | |
140834120 | 140835176 | Rdr |26 | | REQA
140836348 | 140838716 | Tag |44 00 | |
140841642 | 140843210 | Rdr |93 00! | | ANTICOLL
147831468 | 147832524 | Rdr |26 | | REQA
147833760 | 147836128 | Tag |44 00 | |
147839050 | 147840170 | Rdr |93! | | ANTICOLL
154829002 | 154830058 | Rdr |26 | | REQA
154831230 | 154833598 | Tag |44 00 | |
154836538 | 154837274 | Rdr |13 | |
161962078 | 161963134 | Rdr |26 | | REQA
161964306 | 161966674 | Tag |44 00 | |
161969626 | 161970746 | Rdr |93! | | ANTICOLL
168959816 | 168960872 | Rdr |26 | | REQA
168962044 | 168964412 | Tag |44 00 | |
168967338 | 168968586 | Rdr |93 | | ANTICOLL
176093094 | 176094150 | Rdr |26 | | REQA
176095322 | 176097690 | Tag |44 00 | |
176100634 | 176102202 | Rdr |93 00! | | ANTICOLL
183090854 | 183091910 | Rdr |26 | | REQA
183093082 | 183095450 | Tag |44 00 | |
183098376 | 183098920 | Rdr |03! | |
183101820 | 183107708 | Tag |03 00 00 70 4a | |
183119390 | 183119934 | Rdr |03! | |
183122706 | 183128594 | Tag |03 00 00 70 4a | |
183129666 | 183130018 | Rdr |02 | |
183132470 | 183138358 | Tag |02 00 00 ac 10 | |
190115402 | 190116458 | Rdr |26 | | REQA
190117630 | 190119998 | Tag |44 00 | |
190122938 | 190124378 | Rdr |93 00! | | ANTICOLL
197248678 | 197249542 | Rdr |26 | | REQA
197250906 | 197253274 | Tag |44 00 | |
197256234 | 197257930 | Rdr |93 00! | | ANTICOLL
204246402 | 204247458 | Rdr |26 | | REQA
204248630 | 204250998 | Tag |44 00 | |
204253946 | 204255066 | Rdr |93! | | ANTICOLL
211244106 | 211245162 | Rdr |26 | | REQA
211246334 | 211248702 | Tag |44 00 | |
211251626 | 211252362 | Rdr |13 | |
218377126 | 218378182 | Rdr |26 | | REQA
218379354 | 218381722 | Tag |44 00 | |
218384666 | 218385402 | Rdr |13 | |
225374814 | 225375870 | Rdr |26 | | REQA
225377042 | 225379410 | Tag |44 00 | |
225382346 | 225383274 | Rdr |13 | |
232507940 | 232508804 | Rdr |26 | | REQA
232510168 | 232512536 | Tag |44 00 | |
232515466 | 232516394 | Rdr |13 | |
239505864 | 239506920 | Rdr |26 | | REQA
239508092 | 239510460 | Tag |44 00 | |
239513416 | 239513960 | Rdr |03! | |
239516924 | 239522812 | Tag |03 00 00 70 4a | |
239534474 | 239535722 | Rdr |93 | | ANTICOLL
246530376 | 246531240 | Rdr |26 | | REQA
246532604 | 246534972 | Tag |44 00 | |
246537914 | 246539610 | Rdr |93 00! | | ANTICOLL
253663582 | 253664638 | Rdr |26 | | REQA
253665810 | 253668178 | Tag |44 00 | |
253671142 | 253671494 | Rdr |03! | |
253674330 | 253680218 | Tag |03 00 00 70 4a | |
253691912 | 253692264 | Rdr |03! | |
253695228 | 253701116 | Tag |03 00 00 70 4a | |
253702210 | 253702562 | Rdr |02 | |
253705014 | 253710902 | Tag |02 00 00 ac 10 | |
260824066 | 260824930 | Rdr |26 | | REQA
260826294 | 260828662 | Tag |44 00 | |
260831626 | 260833194 | Rdr |93 00! | | ANTICOLL
267821662 | 267822718 | Rdr |26 | | REQA
267823890 | 267826258 | Tag |44 00 | |
267829184 | 267829728 | Rdr |03! | |
267832628 | 267838516 | Tag |03 00 00 70 4a | |
267850202 | 267851450 | Rdr |93 | | ANTICOLL
274846594 | 274847650 | Rdr |26 | | REQA
274848822 | 274851190 | Tag |44 00 | |
274854138 | 274855706 | Rdr |93 00! | | ANTICOLL
281979594 | 281980650 | Rdr |26 | | REQA
281981822 | 281984190 | Tag |44 00 | |
281987130 | 281988250 | Rdr |93! | | ANTICOLL
288977188 | 288978244 | Rdr |26 | | REQA
288979416 | 288981784 | Tag |44 00 | |
288984684 | 288985036 | Rdr |03! | |
288987936 | 288993824 | Tag |03 00 00 70 4a | |
289005482 | 289006602 | Rdr |93! | | ANTICOLL
296002376 | 296003432 | Rdr |26 | | REQA
296004604 | 296006972 | Tag |44 00 | |
296009914 | 296011034 | Rdr |93! | | ANTICOLL
303135276 | 303136332 | Rdr |26 | | REQA
303137568 | 303139936 | Tag |44 00 | |
303142842 | 303143962 | Rdr |93! | | ANTICOLL
310132902 | 310133958 | Rdr |26 | | REQA
310135130 | 310137498 | Tag |44 00 | |
310140442 | 310141178 | Rdr |13 | |
317266122 | 317266986 | Rdr |26 | | REQA
317268350 | 317270718 | Tag |44 00 | |
317273658 | 317274586 | Rdr |13 | |
324264030 | 324264894 | Rdr |26 | | REQA
324266258 | 324268626 | Tag |44 00 | |
324271594 | 324273162 | Rdr |93 00! | | ANTICOLL
331261534 | 331262590 | Rdr |26 | | REQA
331263762 | 331266130 | Tag |44 00 | |
331269094 | 331269446 | Rdr |03! | |
331272282 | 331278170 | Tag |03 00 00 70 4a | |
331289864 | 331290216 | Rdr |03! | |
331293180 | 331299068 | Tag |03 00 00 70 4a | |
331300162 | 331300514 | Rdr |02 | |
331302966 | 331308854 | Tag |02 00 00 ac 10 | |
338422346 | 338423402 | Rdr |26 | | REQA
338424574 | 338426942 | Tag |44 00 | |
338429896 | 338430440 | Rdr |03! | |
338433404 | 338439292 | Tag |03 00 00 70 4a | |
338450924 | 338451468 | Rdr |03! | |
338454304 | 338460192 | Tag |03 00 00 70 4a | |
338461250 | 338461602 | Rdr |02 | |
338464054 | 338469942 | Tag |02 00 00 ac 10 | |
345582080 | 345583136 | Rdr |26 | | REQA
345584308 | 345586676 | Tag |44 00 | |
345589610 | 345591178 | Rdr |93 00! | | ANTICOLL
352579712 | 352580576 | Rdr |26 | | REQA
352581940 | 352584308 | Tag |44 00 | |
352587242 | 352588362 | Rdr |93! | | ANTICOLL
359713098 | 359713962 | Rdr |26 | | REQA
359715326 | 359717694 | Tag |44 00 | |
359720650 | 359722218 | Rdr |93 00! | | ANTICOLL
366710858 | 366711914 | Rdr |26 | | REQA
366713086 | 366715454 | Tag |44 00 | |
366718378 | 366719114 | Rdr |13 | |
373708488 | 373709544 | Rdr |26 | | REQA
373710716 | 373713084 | Tag |44 00 | |
373715994 | 373716730 | Rdr |13 | |
380841508 | 380842372 | Rdr |26 | | REQA
380843736 | 380846104 | Tag |44 00 | |
380849050 | 380850618 | Rdr |93 00! | | ANTICOLL
387839142 | 387840198 | Rdr |26 | | REQA
387841370 | 387843738 | Tag |44 00 | |
387846682 | 387847802 | Rdr |93! | | ANTICOLL
394972416 | 394973472 | Rdr |26 | | REQA
394974644 | 394977012 | Tag |44 00 | |
394979912 | 394980264 | Rdr |03! | |
394983164 | 394989052 | Tag |03 00 00 70 4a | |
395000734 | 395001278 | Rdr |03! | |
395004050 | 395009938 | Tag |03 00 00 70 4a | |
395011010 | 395011362 | Rdr |02 | |
395013814 | 395019702 | Tag |02 00 00 ac 10 | |
402133450 | 402134506 | Rdr |26 | | REQA
402135678 | 402138046 | Tag |44 00 | |
402140986 | 402142554 | Rdr |93 00! | | ANTICOLL
409130442 | 409131498 | Rdr |26 | | REQA
409132670 | 409135038 | Tag |44 00 | |
409137978 | 409138714 | Rdr |13 | |
416263682 | 416264546 | Rdr |26 | | REQA
416265910 | 416268278 | Tag |44 00 | |
416271226 | 416272154 | Rdr |13 | |
423261606 | 423262662 | Rdr |26 | | REQA
423263834 | 423266202 | Tag |44 00 | |
423269146 | 423270266 | Rdr |93! | | ANTICOLL
430259226 | 430259706 | Rdr |06! | |
437242974 | 437244030 | Rdr |26 | | REQA
437245202 | 437247570 | Tag |44 00 | |
437250522 | 437251770 | Rdr |93 | | ANTICOLL
444240676 | 444241732 | Rdr |26 | | REQA
444242904 | 444245272 | Tag |44 00 | |
444248202 | 444249642 | Rdr |93 00! | | ANTICOLL
451373826 | 451374690 | Rdr |26 | | REQA
451376054 | 451378422 | Tag |44 00 | |
451381370 | 451382490 | Rdr |93! | | ANTICOLL
458371400 | 458372456 | Rdr |26 | | REQA
458373628 | 458375996 | Tag |44 00 | |
458378952 | 458379496 | Rdr |03! | |
458382460 | 458388348 | Tag |03 00 00 70 4a | |
458400010 | 458401130 | Rdr |93! | | ANTICOLL
465396296 | 465397352 | Rdr |26 | | REQA
465398524 | 465400892 | Tag |44 00 | |
465403802 | 465404730 | Rdr |13 | |
472529994 | 472530858 | Rdr |26 | | REQA
472532222 | 472534590 | Tag |44 00 | |
472537530 | 472538458 | Rdr |13 | |
479527114 | 479528170 | Rdr |26 | | REQA
479529342 | 479531710 | Tag |44 00 | |
479534650 | 479535770 | Rdr |93! | | ANTICOLL
486524938 | 486525418 | Rdr |06! | |
493508986 | 493509466 | Rdr |06! | |
pm3 -->
Smartphone and ACR122u recognize the "PM3" but my simple Konica printer doesn't recognize it at all.
Only the UID is asked here.
With the "ChameleonMini" this is no problem at all.
Same problem if I try hf mf sim u 12345678 v
Are there any hints I can follow to get this work?
Last edited by Gtpy (2019-05-31 12:55:10)
Offline
#2 2019-02-07 17:17:47
- Gtpy
- Contributor
- From: GER
- Registered: 2017-10-24
- Posts: 32
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
pm3 --> hw version
Proxmark3 RFID instrument
[ CLIENT ]
client: iceman build for RDV40 with flashmem; smartcard;
[ ARM ]
bootrom: iceman/master/cd44ea27 2019-02-05 17:22:07
os: iceman/master/cd44ea27 2019-02-05 17:22:09
[ FPGA ]
LF image built for 2s30vq100 on 2018/ 9/ 8 at 13:57:51
HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23
[ Hardware ]
--= uC: AT91SAM7S512 Rev A
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 243913 bytes (47%) Free: 280375 bytes (53%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory
pm3 --> hw status
#db# Memory
#db# BIGBUF_SIZE.............40000
#db# Available memory........40000
#db# Tracing
#db# tracing ................0
#db# traceLen ...............2645
#db# Currently loaded FPGA image
#db# mode.................... HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23
#db# Flash memory
#db# Baudrate................24MHz
#db# Init....................OK
#db# Memory size.............2 mbits / 256kb
#db# Unique ID...............0xd567a882a70f7f26
#db# Smart card module (ISO 7816)
#db# version.................v3.10
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# [b] bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# LF T55XX config
#db# [a] startgap............31*8 (252)
#db# [b] writegap............25*8 (204)
#db# [c] write_0.............15*8 (124)
#db# [d] write_1.............47*8 (380)
#db# [e] readgap.............31*8 (252)
#db# USB Speed
#db# Sending USB packets to client...
#db# Time elapsed............1500ms
#db# Bytes transferred.......807936
#db# USB Transfer Speed PM3 -> Client = 538624 Bytes/s
#db# Various
#db# MF_DBGLEVEL.............1
#db# ToSendMax...............48
#db# ToSendBit...............8
#db# ToSend BUFFERSIZE.......2308
#db# Installed StandAlone Mode
#db# LF HID26 standalone - aka SamyRun (Samy Kamkar) Offline
#3 2019-04-10 21:29:02
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
There has been some fixes applied to the RRG repo as late as last night with regards to hf 14a sim hf mf sim
I suggest you pull latest / compile / flash and test again. Do please report back your findings!
Offline
#4 2019-04-11 06:08:01
- Gtpy
- Contributor
- From: GER
- Registered: 2017-10-24
- Posts: 32
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
iceman wrote:
There has been some fixes applied to the RRG repo as late as last night with regards to hf 14a sim hf mf sim
I suggest you pull latest / compile / flash and test again. Do please report back your findings!
Great. I’ll pull and test it this evening.
Offline
#5 2019-04-13 13:47:19
- Gtpy
- Contributor
- From: GER
- Registered: 2017-10-24
- Posts: 32
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
Looks better now. I’ll need to test it in 2 weeks on some real readers when I’m back in my office and have more test equipment.
Offline
#6 2019-06-18 21:27:57
- Sparrows
- Contributor
- Registered: 2019-06-17
- Posts: 5
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
Hi I have a similar problem:
I have a chinese mf1k lock.
Could program different cards to access it.
My Testcard:
[usb] pm3 --> hf search
[=] Checking for known tags...
UID : 00 DD DD 1B
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1
[=] proprietary non iso14443-4 card found, RATS not supported
[=] Answers to magic commands: NO
[+] Prng detection: WEAK
Use nested to create key file:
[usb] pm3 --> hf mf nested 1 0 A FFFFFFFFFFFF d
[+] Testing known keys. Sector count=16
[+] Chunk: 0,4s | found 32/32 keys (24)
[+] Time to check 23 known keys: 0 seconds
[+] enter nested attack
[+] time in nested: 0 seconds
[=] trying to read key B...
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 1 | ffffffffffff | 1 |
|002| ffffffffffff | 1 | ffffffffffff | 1 |
|003| ffffffffffff | 1 | ffffffffffff | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| ffffffffffff | 1 | ffffffffffff | 1 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| ffffffffffff | 1 | ffffffffffff | 1 |
|011| ffffffffffff | 1 | ffffffffffff | 1 |
|012| ffffffffffff | 1 | ffffffffffff | 1 |
|013| ffffffffffff | 1 | ffffffffffff | 1 |
|014| ffffffffffff | 1 | ffffffffffff | 1 |
|015| ffffffffffff | 1 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
[+] saving keys to binary file hf-mf-00DDDD1B-key.bin dump:
[usb] pm3 --> hf mf dump
[=] Reading sector access bits...
................
[+] Finished reading sector access bits
[=] Dumping all blocks from card...
[+] successfully read block 0 of sector 0.
[+] successfully read block 1 of sector 0.
[+] successfully read block 2 of sector 0.
[+] successfully read block 3 of sector 0.
[+] successfully read block 0 of sector 1.
[+] successfully read block 1 of sector 1.
...
...
[+] successfully read block 3 of sector 15.
[+] time: 17 seconds
[+] Succeded in dumping all blocks
[+] saved 1024 bytes to binary file hf-mf-00DDDD1B-data.bin
[+] saved 64 blocks to text file hf-mf-00DDDD1B-data.eml
[+] saved to json file hf-mf-00DDDD1B-data.json
[+] Valid ISO14443-A tag foundeload:
[usb] pm3 --> hf mf eload hf-mf-00DDDD1B-data
[+] loaded 1024 bytes from text file hf-mf-00DDDD1B-data.eml
[=] Copying to emulator memory
................................................................
[+] Loaded 64 blocks from file: hf-mf-00DDDD1B-data Try to simulate:
[usb] pm3 --> hf mf sim
[=] Mifare | UID N/A
[=] Options [ numreads: 0, flags: 16 (0x10) ]
#db# 4B UID: 00dddd1b The lock doesn't recognize my pmRDV4.
Only NXP TagInfo from my phone recognize it ... tryed different positions from antenna to PCD but no success.
TagInfo:
** TagInfo scan (version 4.24.4) 2019-06-18 22:08:13 **
Report Type: External
-- IC INFO ------------------------------
# IC manufacturer:
Unknown Manufacturer
# IC type:
Unknown Mifare class IC, possibly cloned
-- NDEF ------------------------------
# No NDEF data storage populated:
-- EXTRA ------------------------------
# Memory size:
1 kB
* 16 sectors, with 4 blocks per sector
* 64 blocks, with 16 bytes per block
-- FULL SCAN ------------------------------
# Technologies supported:
ISO/IEC 14443-3 (Type A) compatible
# Android technology information:
Tag description:
* TAG: Tech [android.nfc.tech.NfcA, android.nfc.tech.MifareClassic, android.nfc.tech.NdefFormatable]
* Maximum transceive length: 253 bytes
* Default maximum transceive time-out: 618 ms
# Detailed protocol information:
ID: 00:DD:DD:1B
ATQA: 0x0400
SAK: 0x08
# Memory content:
Sector 0 (0x00)
[00] r-- 00 DD DD 1B 1B 08 04 00 62 63 64 65 66 67 68 69 |␀..␛␛␈␄␀bcdefghi|
[01] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[02] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[03] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 1 (0x01)
[04] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[05] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[06] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[07] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 2 (0x02)
[08] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[09] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[0A] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[0B] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 3 (0x03)
[0C] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[0D] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[0E] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[0F] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 4 (0x04)
[10] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[11] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[12] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[13] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 5 (0x05)
[14] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[15] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[16] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[17] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 6 (0x06)
[18] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[19] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[1A] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[1B] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 7 (0x07)
[1C] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[1D] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[1E] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[1F] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 8 (0x08)
[20] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[21] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[22] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[23] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 9 (0x09)
[24] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[25] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[26] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[27] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 10 (0x0A)
[28] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[29] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[2A] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[2B] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 11 (0x0B)
[2C] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[2D] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[2E] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[2F] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 12 (0x0C)
[30] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[31] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[32] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[33] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 13 (0x0D)
[34] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[35] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[36] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[37] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 14 (0x0E)
[38] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[39] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[3A] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[3B] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
Sector 15 (0x0F)
[3C] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[3D] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[3E] rwi 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀␀|
[3F] wxx FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
Factory default key Factory default key (readable)
r/R=read, w/W=write, i/I=increment,
d=decr/transfer/restore, x=r+w, X=R+W
data block: r/w/i/d:key A|B, R/W/I:key B only,
I/i implies d, *=value block
trailer (order: key A, AC, key B): r/w:key A,
W:key B, R:key A|B, (r)=readable key
AC: W implies R+r, R implies r
--------------------------------------Maybe someone from this cool community can give me a hint for the right direction.
ah sorry
hw tune:
usb] pm3 --> hw tune
[=] Measuring antenna characteristics, please wait...
....
[+] LF antenna: 71,38 V - 125.00 kHz
[+] LF antenna: 38,81 V - 134.00 kHz
[+] LF optimal: 71,38 V - 125,00 kHz
[+] LF antenna is OK
[+] HF antenna: 47,73 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.[usb] pm3 --> hw version
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman
[ PROXMARK RDV4 ]
external flash: present
smartcard reader: present
[ PROXMARK RDV4 Extras ]
FPC USART for BT add-on support: absent
[ ARM ]
bootrom: RRG/Iceman/master/45dc0fbc 2019-06-18 21:28:17
os: RRG/Iceman/master/45dc0fbc 2019-06-18 21:28:27
[ FPGA ]
LF image built for 2s30vq100 on 2019/ 4/18 at 9:35:32
HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23
[ Hardware ]
--= uC: AT91SAM7S512 Rev A
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 251581 bytes (48%) Free: 272707 bytes (52%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory Flashed latest RRG repo fresh before testing.
Offline
#7 2019-06-19 00:30:50
- mwalker
- Moderator
- Registered: 2019-05-11
- Posts: 318
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
I am assuming its a valid UID
The first byte in a 4 byte UID can have special meaning.
Given the UID was #db# 4B UID: 00dddd1b
From NXP Documents.
UID0 hex Definition Range
08 RID: UID1, UID2 and UID3 are dynamically generated appr. 16 million
during or after each Power-On-Reset (POR)
x0… x7 Proprietary use (e.g. used for MIFARE products) appr. 2.1 billion
18…78, 98…E8 Proprietary use (i.e. used for MIFARE products) appr. 218 million
x9...xE Proprietary use (i.e. used for MIFARE products) appr. 1.6 billion
xF Fixed number, non-unique appr. 268 million
88 Cascade Tag -
F8 RFU -Could it be the entire BLK0 was not copied?
What does, the following show ?
lf mf eget 0
Last edited by mwalker (2019-06-19 07:14:02)
Offline
#8 2019-06-19 07:05:52
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
try setting the t parameter for your simulation cmds.
Offline
#9 2019-06-19 11:07:30
- Sparrows
- Contributor
- Registered: 2019-06-17
- Posts: 5
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
@mwalker:
Yes it is a valid UID
I could reprogram the lock to use one of my other 1k cards with another UID.
Output hf mf eget 0:
[usb] pm3 --> hf mf eget 0
data[ 0]:00 DD DD 1B 1B 08 04 00 62 63 64 65 66 67 68 69 @iceman:
try to use the t parameter 1 for 1k
But no success to emulate the card at the reader.
[usb] pm3 --> hf mf sim t 1
[=] Mifare 1K | UID N/A
[=] Options [ numreads: 0, flags: 272 (0x110) ]
#db# Mifare 1K
#db# 4B UID: 00dddd1b Last edited by Sparrows (2020-05-29 09:51:53)
Offline
#10 2019-06-19 11:36:42
- mwalker
- Moderator
- Registered: 2019-05-11
- Posts: 318
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
So if you write that same data to a magic card or a cuid then it works ?
Not sure this is much help (I am learning as I go) and seems to be what you have done.
I dont have a real mifare reader to test.
I took a "blank" mifare classic 1k, all keys FF
then run this sequence
hf mf chk *1 ? t
hf mf dump 1
hf mf eload hf-mf-4FC2B3D4-data
hf mf sim t 1
then used my phone and NFC Tools and it detected the sim ok, it said it was a valid mifare and showed the correct UID
This was on my rdv4 with rrg image.
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman
[ PROXMARK RDV4 ]
external flash: present
smartcard reader: present
[ PROXMARK RDV4 Extras ]
FPC USART for BT add-on support: absent
[ ARM ]
bootrom: RRG/Iceman/master/30f10f78-dirty-unclean 2019-05-28 19:13:47
os: RRG/Iceman/master/430742a3-dirty-unclean 2019-05-31 23:02:38
[ FPGA ]
LF image built for 2s30vq100 on 2019/ 4/18 at 9:35:32
HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23
[ Hardware ]
--= uC: AT91SAM7S512 Rev A
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 249224 bytes (48%) Free: 275064 bytes (52%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory
Does your reader need anything specific? e.g. NDEF? That said, I would still expect it to find the mifare.
Offline
#11 2019-06-19 21:48:10
- Sparrows
- Contributor
- Registered: 2019-06-17
- Posts: 5
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
If I write the dump to a magic card it works.
But I doesn't understand why simulate against a real reader is not possible (or easy enough for me as a beginner 
).
I am not sure if the reader need anything specific.
hf 14a sniff:
[usb] pm3 --> hf 14a sniff
#db# Starting to sniff
#db# maxDataLen=3, Uart.state=0, Uart.len=0
#db# traceLen=165 , Uart.output[0]=00000096
[usb] pm3 --> hf mf list
[+] Recorded Activity (TraceLen = 165 bytes)
[=]
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 224 | Rdr |01 | |
9541872 | 9542224 | Rdr |02 | |
28621184 | 28622304 | Rdr |96 | |
66818304 | 66819040 | Rdr |16 | |
66820612 | 66822980 | Tag |04 00 | |
66834832 | 66835184 | Rdr |03 | |
66838644 | 66844468 | Tag |00 dd dd 1b 1b | |
74602128 | 74602864 | Rdr |16 | |
77000896 | 77001248 | Rdr |02 | |
79399680 | 79400032 | Rdr |02 | |
81798464 | 81799584 | Rdr |96 | |
84197248 | 84197984 | Rdr |16 | |
86596032 | 86596768 | Rdr |16 | |
88994800 | 88995152 | Rdr |02 | |
96191152 | 96191504 | Rdr |02 | |
98589936 | 98591056 | Rdr |96 | |
[usb] pm3 --> hf mf list
[+] Recorded Activity (TraceLen = 167 bytes)
[=]
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 1120 | Rdr |96 | |
19118368 | 19118720 | Rdr |02 | |
28680944 | 28682064 | Rdr |96 | |
28683252 | 28685620 | Tag |04 00 | |
38246576 | 38246928 | Rdr |02 | |
47809120 | 47810240 | Rdr |96 | |
57373456 | 57374576 | Rdr |96 | |
66934272 | 66934624 | Rdr |02 | |
66936580 | 66938948 | Tag |04 00 | |
76504544 | 76505280 | Rdr |16 | |
76506852 | 76509220 | Tag |04 00 | |
76521072 | 76521424 | Rdr |03 | |
76523392 | 76523680 | Rdr |00 | |
76524884 | 76530708 | Tag |00 dd dd 1b 1b | |
84290660 | 84291108 | Tag |04 | |
91484704 | 91485824 | Rdr |96 | | Someone has a clue on how to proceed here?
Offline
#12 2019-06-20 10:39:09
- Mackwa
- Contributor
- Registered: 2016-06-10
- Posts: 51
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
try to get a better output from "hf 14a sniff" + list,
seems that your sniff is incomplete.
try to experiment with antenna and tag distance to the reader
Offline
#13 2019-06-21 23:28:52
- Sparrows
- Contributor
- Registered: 2019-06-17
- Posts: 5
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
didn't get a better sniff at the reader. 
But sniff between smartphone (nfc tools) and card looks fine:
[usb] pm3 --> hf list
[+] Recorded Activity (TraceLen = 3957 bytes)
[=]
Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer
iso14443a - All times are in carrier periods (1/13.56Mhz)
Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
0 | 46240 | Rdr |f0 25 d4 00 27 23 60 bb 14 b6 f7 7c f2 1a 00 00 00 32 | |
| | |46 66 6d 01 01 12 02 02 07 ff 03 02 00 13 04 01 64 07 | |
| | |01 03 cd c1 | ok |
210176 | 211232 | Rdr |26 | | REQA
7770208 | 7816448 | Rdr |f0 25 d4 00 07 39 8f b6 4a 89 da 7c d0 61 00 00 00 32 | |
| | |46 66 6d 01 01 12 02 02 07 ff 03 02 00 13 04 01 64 07 | |
| | |01 03 4e df | ok |
7980496 | 7981552 | Rdr |26 | | REQA
22803152 | 22849392 | Rdr |f0 25 d4 00 4c fb 72 5f 5a 37 72 ff 40 27 00 00 00 32 | |
| | |46 66 6d 01 01 12 02 02 07 ff 03 02 00 13 04 01 64 07 | |
| | |01 03 f2 52 | ok |
23013280 | 23014336 | Rdr |26 | | REQA
23015540 | 23017908 | Tag |04 00 | |
23024832 | 23027296 | Rdr |93 20 | | ANTICOLL
23028484 | 23034308 | Tag |00 dd dd 1b 1b | |
23041232 | 23051696 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
23052948 | 23056468 | Tag |08 b6 dd | |
23144064 | 23148832 | Rdr |50 00 57 cd | ok | HALT
23199712 | 23200704 | Rdr |52 | | WUPA
23201956 | 23204324 | Tag |04 00 | |
23211248 | 23221712 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
23222964 | 23226484 | Tag |08 b6 dd | |
23273792 | 23278560 | Rdr |50 00 57 cd | ok | HALT
23323296 | 23324288 | Rdr |52 | | WUPA
23325540 | 23327908 | Tag |04 00 | |
23334832 | 23345296 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
23346548 | 23350068 | Tag |08 b6 dd | |
23399312 | 23404016 | Rdr |60 00 f5 7b | ok | AUTH-A(0)
23406036 | 23410772 | Tag |70 45 a9 76 | |
23417376 | 23426688 | Rdr |26 22! 80! ce 6a! 57! 50 0b! | !crc| REQA
23471840 | 23476608 | Rdr |50 00 57 cd | ok | HALT
23523184 | 23524176 | Rdr |52 | | WUPA
23525428 | 23527796 | Tag |04 00 | |
23534720 | 23545184 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
23546436 | 23549956 | Tag |08 b6 dd | |
23584608 | 23589312 | Rdr |60 00 f5 7b | ok | AUTH-A(0)
23591332 | 23596068 | Tag |e7 a2 15 d3 | |
23602656 | 23611968 | Rdr |b6! f8 b6! 2a 9c! d0 18 14 | !crc|
23659472 | 23664240 | Rdr |50 00 57 cd | ok | HALT
23703936 | 23704928 | Rdr |52 | | WUPA
23706180 | 23708548 | Tag |04 00 | |
23715472 | 23725936 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
23727188 | 23730708 | Tag |08 b6 dd | |
23772448 | 23777152 | Rdr |60 00 f5 7b | ok | AUTH-A(0)
23779172 | 23783908 | Tag |72 ef 3b b6 | |
23790496 | 23799872 | Rdr |2b 67 2f! f2 77 13! 4b 5d | !crc|
23840656 | 23845424 | Rdr |50 00 57 cd | ok | HALT
23888848 | 23889840 | Rdr |52 | | WUPA
23891092 | 23893460 | Tag |04 00 | |
23900384 | 23910848 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
23912100 | 23915620 | Tag |08 b6 dd | |
23953248 | 23958016 | Rdr |50 00 57 cd | ok | HALT
23997136 | 23998128 | Rdr |52 | | WUPA
23999380 | 24001748 | Tag |04 00 | |
24008672 | 24019136 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
24020388 | 24023908 | Tag |08 b6 dd | |
24065392 | 24070096 | Rdr |60 00 f5 7b | ok | AUTH-A(0)
24072116 | 24076852 | Tag |b4 57 12 1a | |
24083456 | 24092768 | Rdr |31 f9 c6 88! ca! d1! ae d1 | !crc|
24132816 | 24137584 | Rdr |50 00 57 cd | ok | HALT
24182368 | 24183360 | Rdr |52 | | WUPA
24184612 | 24186980 | Tag |04 00 | |
24193904 | 24204368 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
24205620 | 24209140 | Tag |08 b6 dd | |
24243808 | 24248512 | Rdr |60 00 f5 7b | ok | AUTH-A(0)
24250532 | 24255204 | Tag |45 2b a6 55 | |
24261872 | 24271184 | Rdr |8a! a1 d7 21! 5a! d1! b0! 55 | !crc|
24328512 | 24333280 | Rdr |50 00 57 cd | ok | HALT
24374208 | 24375200 | Rdr |52 | | WUPA
24376452 | 24378820 | Tag |04 00 | |
24385744 | 24396208 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
24397460 | 24400980 | Tag |08 b6 dd | |
24442288 | 24446992 | Rdr |60 00 f5 7b | ok | AUTH-A(0)
24449012 | 24453684 | Tag |54 25 81 41 | |
24460336 | 24469712 | Rdr |b7 3e a2 14 2a f7! ae! 0b | !crc|
24512224 | 24516992 | Rdr |50 00 57 cd | ok | HALT
24561232 | 24562224 | Rdr |52 | | WUPA
24563476 | 24565844 | Tag |04 00 | |
24572768 | 24583232 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
24584484 | 24588004 | Tag |08 b6 dd | |
24629024 | 24633792 | Rdr |50 00 57 cd | ok | HALT
24673552 | 24674544 | Rdr |52 | | WUPA
24675796 | 24678164 | Tag |04 00 | |
24685088 | 24695552 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
24696804 | 24700324 | Tag |08 b6 dd | |
26456016 | 26460784 | Rdr |50 00 57 cd | ok | HALT
26499056 | 26500048 | Rdr |52 | | WUPA
26501300 | 26503668 | Tag |04 00 | |
26510592 | 26521056 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
26522308 | 26525828 | Tag |08 b6 dd | |
28270656 | 28275424 | Rdr |50 00 57 cd | ok | HALT
28307648 | 28308640 | Rdr |52 | | WUPA
28309892 | 28312260 | Tag |04 00 | |
28319184 | 28329648 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
28330900 | 28334420 | Tag |08 b6 dd | |
30059184 | 30063952 | Rdr |50 00 57 cd | ok | HALT
30096400 | 30097392 | Rdr |52 | | WUPA
30098660 | 30101028 | Tag |04 00 | |
30107952 | 30118416 | Rdr |93 70 00 dd dd 1b 1b 70 05 | ok | SELECT_UID
30119668 | 30123188 | Tag |08 b6 dd | |
31848176 | 31852944 | Rdr |50 00 57 cd | ok | HALT My chameleonMini has also no chance at the reader.
Last edited by Sparrows (2019-06-21 23:30:10)
Offline
#14 2019-07-27 22:24:02
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: [RDV4] Simulate with PM3 RDV4 [hf 14a sim / hf mf sim]
Try pulling latest source (compile/flash) and test. There was a fix not long ago merged. It might help you out.
Take care for messages when flashing, you must flash bootrom first, then flash fullimage.
Offline