Proxmark3 community

luan2245

Contributor

Registered: 2021-11-05

Posts: 2

Mifare Classic 1k EV1 with IC Signature and Decrease counter

Hello everyone, so, I'm looking for some insights on how to approach cloning or changing the balance of this card.

It is a Mifare classic 1k ev1 with ic signature, and it has balance inside;

I already got all the keys using the hardnested attack, then, the first thing I tried was to clone it to a gen1 magic card, but it didn't work because of the IC signature that I think is impossible to clone (?).

Then, I tried restoring the old balance dump, to the original card, the only changed blocks, were 5,6,12,13,14,16,17,18,20,24

but sadly, no success on blocks 5 and 6, cause they have these access conditions:
        "block5": "read AB; decrement transfer restore AB",
        "block6": "read AB; decrement transfer restore AB"

I looked it up a bit and I think this is an implementation of something called decrease counter? I'm not sure though.

So, I'm now looking for advice on how to approach this situation.

Is it possible to clone IC signature?
Is it possible to write the dumped data to blocks 5 and 6 of the original card?

There are any other solutions?

Any kind of help would be greatly appreciated, thanks in advance.
I have a proxmark easy btw

iceman

Administrator

Registered: 2013-04-25

Posts: 9,538

Website

Re: Mifare Classic 1k EV1 with IC Signature and Decrease counter

Look into something called  valueblock