Proxmark3 community

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Mifare Desfire Light

New tag is out,  got one from @anon Thanks bro!

https://www.nxp.com/docs/en/data-sheet/MF2DLHX0.pdf

[usb] pm3 --> hf 14a info
 UID : 04 7D 0B 5A 34 61 80           
ATQA : 03 44          
 SAK : 20 [1]          
TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41          
MANUFACTURER : NXP Semiconductors Germany          
 ATS : 06 77 77 71 02 80 BE 6A           
       -  TL : length is 6 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 7 (FSC = 128)          
       - TA1 : different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]          
       - TB1 : SFGI = 1 (SFGT = 8192/fc), FWI = 7 (FWT = 524288/fc)          
       - TC1 : NAD is NOT supported, CID is supported          
[=] Answers to magic commands: NO           

Mackwa

Contributor

Registered: 2016-06-10

Posts: 51

Re: Mifare Desfire Light

anyone tried ISO7816 wrapped APDUs with MIFARE DESFire cards with proxmark before?
It's described in the linked datasheet at page 18 + 19

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Mifare Desfire Light

you can send raw bytes,  where you can send the "wrapped" style to test.   Its not implemented in code.

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Mifare Desfire Light

In order to work with Ev1, Ev2 and Light tags,  I swapped to wrapped apdu.
That make these commands work again against the formentioned tag types.  I haven't tested with the first gen 40 desfire tag.

hf mfdes info
hf mfdes enum

You use the apdu command to talk with a desfire tag quite easy now.

hf 14a apdu -h

artkrime

Contributor

Registered: 2021-04-18

Posts: 2

Re: Mifare Desfire Light

What's the status with Light cards? I have some equipment which uses these Desfire light cards to "refill" virtual credits, which then enables you to use YOUR equipment with their proprietary materials.

Would this mean the equipment in question has a reader/writer that changes the credit from 1 to 0? Or is it more probable that the card contains a serial number which the equipment verifies?

Each new set of materials comes with a "new" desfire light card to up the credits.

Below is what the card outputs. I have 3 new cards. Each has a different UID and TAG IC Signature, everything else is the same between cards. So cloning would probably be useless?

Any other ideas or suggestions on ways to approach this? I blanked out identifiable information, not sure if it's useful to anyone else or worth concealing for security.

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Mifare Desfire Light

You would need to start with looking at the data on the cards.

hf mfdes enum