Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
#1 2023-10-29 19:55:33
- Dose13
- Contributor
- Registered: 2019-09-26
- Posts: 29
Mifare plus - dump fails?
Hello,
as far as I understand I have a Mifare plus card.
[usb] pm3 --> hf 14a info
[+] UID: 14 0E 66 5F
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: hard
[=]
[=] --- Tag Signature
[=] IC signature public key name: NXP Mifare Classic MFC1C14_x
[=] IC signature public key value: 044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF
[=] Elliptic curve parameters: NID_secp128r1
[=] TAG IC Signature: 577669211292C6A487A5E85502FAA97163F541AE87A21FE083B243662B82AC6C
[+] Signature verification: successful
[?] Hint: try `hf mf` commandsRunning hf mfp info results in:
[usb] pm3 --> hf mfp info
[=] --- Tag Information ---------------------------
[!!] ? No card response.
[+] UID: 14 0E 66 5F
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: hard
[=]
[=] --- Tag Signature
[=] IC signature public key name: NXP Mifare Classic MFC1C14_x
[=] IC signature public key value: 044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF
[=] Elliptic curve parameters: NID_secp128r1
[=] TAG IC Signature: 577669211292C6A487A5E85502FAA97163F541AE87A21FE083B243662B82AC6C
[+] Signature verification: successful
[?] Hint: try `hf mf` commands
[!!] ? No card response.
[=] --- Fingerprint
[=] SIZE: 2K (4 UID)
[=] SAK: 2K 7b UID
[=] --- Security Level (SL)
[+] SL mode: SL1
[=] SL 1: backwards functional compatibility mode (with MIFARE Classic 1K / 4K) with an optional AES authenticationAs far as I understand this is a mifare plus tag that operates as a normal mfc tag but has a size of 2k and 18 Sectors.
[usb] pm3 --> hf mf autopwn
[=] MIFARE Classic EV1 card detected
[=] target sector 17 key type B -- using valid key [ 4B791BEA7BCC ] (used for nested / hardnested attack)
[+] loaded 56 keys from hardcoded default array
[=] running strategy 1
[=] Chunk 1,5s | found 34/36 keys (56)
[=] running strategy 2
[=] Chunk 1,3s | found 34/36 keys (56)
[+] target sector 0 key type A -- found valid key [ A0A1A2A3A4A5 ]
[+] target sector 1 key type A -- found valid key [ A0A1A2A3A4A5 ]
[+] target sector 2 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type A -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type B -- found valid key [ FFFFFFFFFFFF ]
[+] target sector 16 key type A -- found valid key [ 5C8FF9990DA2 ]
[+] target sector 16 key type B -- found valid key [ D01AFEEB890A ]
[+] target sector 17 key type A -- found valid key [ 75CCB59C9BED ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=] | | | Expected to brute force
[=] Time | #nonces | Activity | #states | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=] 0 | 0 | Start using 8 threads and AVX512F SIMD core | |
[=] 0 | 0 | Brute force benchmark: 1895 million (2^30,8) keys/s | 140737488355328 | 21h
[=] 0 | 0 | Loaded 351 RAW / 0 LZ4 / 0 BZ2 in 439 ms | 140737488355328 | 21h
[=] 0 | 0 | Using 239 precalculated bitflip state tables | 140737488355328 | 21h
[=] 3 | 112 | Apply bit flip properties | 9641922560 | 5s
[=] 4 | 224 | Apply bit flip properties | 1575305472 | 1s
[=] 5 | 335 | Apply bit flip properties | 1575305472 | 1s
[=] 6 | 447 | Apply bit flip properties | 1219019136 | 1s
[=] 7 | 559 | Apply bit flip properties | 1180857600 | 1s
[=] 8 | 668 | Apply bit flip properties | 1180857600 | 1s
[=] 8 | 780 | Apply bit flip properties | 1180857600 | 1s
[=] 9 | 890 | Apply bit flip properties | 1180857600 | 1s
[=] 10 | 1001 | Apply bit flip properties | 1180857600 | 1s
[=] 11 | 1113 | Apply bit flip properties | 1180857600 | 1s
[=] 11 | 1223 | Apply bit flip properties | 1180857600 | 1s
[=] 12 | 1334 | Apply bit flip properties | 1180857600 | 1s
[=] 13 | 1446 | Apply bit flip properties | 1180857600 | 1s
[=] 15 | 1556 | Apply Sum property. Sum(a0) = 144 | 66832920 | 0s
[=] 15 | 1556 | (Ignoring Sum(a8) properties) | 66832920 | 0s
[=] 15 | 1556 | Brute force phase completed. Key found: 8627C10A7014 | 0 | 0s
[+] target sector 0 key type B -- found valid key [ 8627C10A7014 ]
[=] Hardnested attack starting...
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=] | | | Expected to brute force
[=] Time | #nonces | Activity | #states | time
[=] ---------+---------+---------------------------------------------------------+-----------------+-------
[=] 0 | 0 | Start using 8 threads and AVX512F SIMD core | |
[=] 0 | 0 | Brute force benchmark: 1933 million (2^30,8) keys/s | 140737488355328 | 20h
[=] 0 | 0 | Loaded 351 RAW / 0 LZ4 / 0 BZ2 in 170 ms | 140737488355328 | 20h
[=] 0 | 0 | Using 239 precalculated bitflip state tables | 140737488355328 | 20h
[=] 3 | 112 | Apply bit flip properties | 9829748834304 | 85min
[=] 4 | 224 | Apply bit flip properties | 8543757402112 | 74min
[=] 5 | 334 | Apply bit flip properties | 8378623459328 | 72min
[=] 5 | 446 | Apply bit flip properties | 8378623459328 | 72min
[=] 6 | 558 | Apply bit flip properties | 8378623459328 | 72min
[=] 7 | 670 | Apply bit flip properties | 8378623459328 | 72min
[=] 8 | 780 | Apply bit flip properties | 8378623459328 | 72min
[=] 8 | 891 | Apply bit flip properties | 8378623459328 | 72min
[=] 9 | 1003 | Apply bit flip properties | 8378623459328 | 72min
[=] 10 | 1115 | Apply bit flip properties | 8378623459328 | 72min
[=] 11 | 1225 | Apply bit flip properties | 8378623459328 | 72min
[=] 12 | 1335 | Apply bit flip properties | 8378623459328 | 72min
[=] 13 | 1446 | Apply bit flip properties | 8378623459328 | 72min
[=] 13 | 1558 | Apply bit flip properties | 8378623459328 | 72min
[=] 15 | 1668 | Apply Sum property. Sum(a0) = 0 | 238813396992 | 2min
[=] 15 | 1775 | Apply bit flip properties | 238813396992 | 2min
[=] 16 | 1883 | Apply bit flip properties | 238813396992 | 2min
[=] 17 | 1994 | Apply bit flip properties | 101187551232 | 52s
[=] 18 | 2105 | Apply bit flip properties | 101187551232 | 52s
[=] 19 | 2211 | Apply bit flip properties | 101187551232 | 52s
[=] 20 | 2322 | Apply bit flip properties | 69676859392 | 36s
[=] 20 | 2430 | Apply bit flip properties | 69676859392 | 36s
[=] 21 | 2536 | Apply bit flip properties | 101185060864 | 52s
[=] 22 | 2536 | (1. guess: Sum(a8) = 256) | 101185060864 | 52s
[=] 22 | 2536 | Apply Sum(a8) and all bytes bitflip properties | 74706272256 | 39s
[=] 22 | 2536 | Brute force phase completed. Key found: 00008627C10A | 0 | 0s
[+] target sector 1 key type B -- found valid key [ 00008627C10A ]
[+] found keys:
[+] -----+-----+--------------+---+--------------+----
[+] Sec | Blk | key A |res| key B |res
[+] -----+-----+--------------+---+--------------+----
[+] 000 | 003 | A0A1A2A3A4A5 | D | 8627C10A7014 | H
[+] 001 | 007 | A0A1A2A3A4A5 | D | 00008627C10A | H
[+] 002 | 011 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 003 | 015 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 004 | 019 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 005 | 023 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 006 | 027 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 007 | 031 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 008 | 035 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 009 | 039 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 010 | 043 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 011 | 047 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 012 | 051 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 013 | 055 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 014 | 059 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 015 | 063 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 016 | 067 | 5C8FF9990DA2 | D | D01AFEEB890A | D
[+] 017 | 071 | 75CCB59C9BED | D | 4B791BEA7BCC | U
[+] -----+-----+--------------+---+--------------+----
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )
[?] MAD key detected. Try `hf mf mad` for more detailsIt seems that all keys were found, however the dump fails to an error and therefore only a partial dump is created.
[+] Generating binary key file
[+] Found keys have been dumped to /home/dose/hf-mf-140E665F-key-001.bin
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[#] Block 4 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 1 block 0
[#] Block 5 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 5 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 6 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 6 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 7 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 7 Cmd 0x30 Wrong response len, expected 18 got 0
[-] ⛔ fast dump reported back failure w KEY A, swapping to KEY B
[#] Block 8 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 2 block 0
[#] Block 9 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 9 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 10 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 10 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 11 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 11 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 12 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 3 block 0
[#] Block 13 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 13 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 14 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 14 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 15 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 15 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 16 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 4 block 0
[#] Block 17 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 17 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 18 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 18 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 19 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 19 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 20 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 5 block 0
[#] Block 21 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 21 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 22 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 22 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 23 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 23 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 24 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 6 block 0
[#] Block 25 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 25 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 26 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 26 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 27 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 27 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 28 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 7 block 0
[#] Block 29 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 29 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 30 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 30 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 31 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 31 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 32 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 8 block 0
[#] Block 33 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 33 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 34 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 34 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 35 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 35 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 36 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 9 block 0
[#] Block 37 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 37 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 38 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 38 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 39 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 39 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 40 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 10 block 0
[#] Block 41 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 41 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 42 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 42 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 43 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 43 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 44 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 11 block 0
[#] Block 45 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 45 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 46 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 46 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 47 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 47 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 48 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 12 block 0
[#] Block 49 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 49 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 50 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 50 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 51 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 51 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 52 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 13 block 0
[#] Block 53 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 53 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 54 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 54 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 55 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 55 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 56 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 14 block 0
[#] Block 57 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 57 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 58 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 58 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 59 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 59 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 60 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 15 block 0
[#] Block 61 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 61 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 62 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 62 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 63 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 63 Cmd 0x30 Wrong response len, expected 18 got 0
[-] ⛔ fast dump reported back failure w KEY B
[-] ⛔ Dump file is PARTIAL complete
[=] downloading card content from emulator memory
[+] saved 1024 bytes to binary file /home/dose/hf-mf-140E665F-dump-001.bin
[+] saved to json file /home/dose/hf-mf-140E665F-dump-001.json
[=] autopwn execution time: 48 secondsFor completeness hf mf mad results in:
[usb] pm3 --> hf mf mad
[=] Authentication ( ok )
[#] Auth error
[=] --- MIFARE App Directory Information ----------------
[=] -----------------------------------------------------
[=] ------------ MAD v1 details -------------
[!] ⚠️ Card publisher not present 0x00
[=] ---------------- Listing ----------------
[=] 00 MAD v1
[=] 01 [2EC0] (unknown)
[=] 02 [0000] free
[=] 03 [0000] free
[=] 04 [0000] free
[=] 05 [0000] free
[=] 06 [0000] free
[=] 07 [0000] free
[=] 08 [0000] free
[=] 09 [0000] free
[=] 10 [0000] free
[=] 11 [0000] free
[=] 12 [0000] free
[=] 13 [0000] free
[=] 14 [0000] free
[=] 15 [0000] freeAny ideas how I can get a full dump of the card?
Thank's in advance!
Last edited by Dose13 (2023-10-29 19:58:45)
Offline
#2 2023-10-29 20:12:31
- Dose13
- Contributor
- Registered: 2019-09-26
- Posts: 29
Re: Mifare plus - dump fails?
Running the hf mf eview --2k command results in the following:
[usb] pm3 --> hf mf eview --2k
[=] downloading emulator memory
[=] -----+-----+-------------------------------------------------+-----------------
[=] sec | blk | data | ascii
[=] -----+-----+-------------------------------------------------+-----------------
[=] 0 | 0 | 14 0E 66 5F 23 88 04 00 C8 24 00 20 00 00 00 20 | ..f_#....$. ...
[=] | 1 | EA 00 C0 2E 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 2 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 C1 86 27 C1 0A 70 14 | ......xw...'..p.
[=] 1 | 4 | 0D 4C 00 00 06 00 00 00 00 00 00 00 00 FF FF FF | .L..............
[=] | 5 | 00 00 00 00 80 FF FF 38 00 00 00 00 00 00 00 00 | .......8........
[=] | 6 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 7 | A0 A1 A2 A3 A4 A5 0F 00 FF AA 00 00 86 27 C1 0A | .............'..
[=] 2 | 8 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 9 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 11 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 3 | 12 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 13 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 14 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 15 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 4 | 16 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 19 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 5 | 20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 21 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 22 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 23 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 6 | 24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 27 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 7 | 28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 31 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 8 | 32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 35 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 9 | 36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 39 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 10 | 40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 42 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 43 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 11 | 44 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 45 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 46 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 47 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 12 | 48 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 49 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 51 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 13 | 52 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 53 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 54 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 55 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 14 | 56 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 57 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 58 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 59 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 15 | 60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 61 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 62 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 63 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 16 | 64 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 65 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 66 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 67 | 5C 8F F9 99 0D A2 70 F0 F8 69 D0 1A FE EB 89 0A | \.....p..i......
[=] 17 | 68 | 48 31 43 4D 38 36 17 24 20 54 29 00 00 00 00 00 | H1CM86.$ T).....
[=] | 69 | 57 76 69 21 12 92 C6 A4 87 A5 E8 55 02 FA A9 71 | Wvi!.......U...q
[=] | 70 | 63 F5 41 AE 87 A2 1F E0 83 B2 43 66 2B 82 AC 6C | c.A.......Cf+..l
[=] | 71 | 75 CC B5 9C 9B ED 70 F0 F8 69 4B 79 1B EA 7B CC | u.....p..iKy..{.
[=] 18 | 72 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 73 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 74 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 75 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 19 | 76 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 77 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 78 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 79 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 20 | 80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 81 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 82 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 83 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 21 | 84 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 85 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 86 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 87 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 22 | 88 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 89 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 90 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 91 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 23 | 92 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 93 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 94 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 95 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 24 | 96 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 97 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 98 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 99 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 25 | 100 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 101 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 102 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 103 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 26 | 104 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 105 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 106 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 107 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 27 | 108 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 109 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 110 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 111 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 28 | 112 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 113 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 114 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 115 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 29 | 116 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 117 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 118 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 119 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 30 | 120 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 121 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 122 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 123 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 31 | 124 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 125 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 126 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 127 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] -----+-----+-------------------------------------------------+-----------------
[?] cyan = value block with decoded value
[?] MAD key detected. Try `hf mf mad` for more detailsI wonder if this is the entire dump?
Offline
#3 2023-10-30 21:07:46
- Dose13
- Contributor
- Registered: 2019-09-26
- Posts: 29
Re: Mifare plus - dump fails?
When looking at the emulator view it seems that sector 17 contains all the information. I am able to read block 68:
[usb] pm3 --> hf mf rdbl --blk 68 -b -k 4b791bea7bcc
[=] # | sector 17 / 0x11 | ascii
[=] ----+-------------------------------------------------+-----------------
[=] 68 | 48 31 43 4D 38 36 17 24 20 54 29 00 00 00 00 00 | H1CM86.$ T)..... However it is not possible to read the content with key A:
[usb] pm3 --> hf mf rdbl --blk 68 -k 75ccb59c9bed
[#] Block 68 Cmd 0x30 Cmd Error 04
[#] Read block errorIt is also not possible to write to that block, neither with key A nor key B:
[usb] pm3 --> hf mf wrbl -b --blk 68 -k 4b791bea7bcc -d 48315355373803252127990000000000
[=] Writing block no 68, key B - 4B791BEA7BCC
[=] data: 48 31 53 55 37 38 03 25 21 27 99 00 00 00 00 00
[-] ⛔ Write ( fail )
[?] Maybe access rights? Try specify keytype `hf mf wrbl -a ...` instead
[usb] pm3 --> hf mf wrbl -a --blk 68 -k 75ccb59c9bed -d 48315355373803252127990000000000
[=] Writing block no 68, key A - 75CCB59C9BED
[=] data: 48 31 53 55 37 38 03 25 21 27 99 00 00 00 00 00
[-] ⛔ Write ( fail )
[?] Maybe access rights? Try specify keytype `hf mf wrbl -b ...` insteadAny ideas?
Offline
#4 2023-10-30 22:26:01
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Mifare plus - dump fails?
if you run info, you might recognize some data
hf 14a infoOffline
#5 2023-10-30 22:52:28
- Dose13
- Contributor
- Registered: 2019-09-26
- Posts: 29
Re: Mifare plus - dump fails?
The output did not ring a bell. ...
[usb] pm3 --> hf 14a info
[+] UID: 14 0E 66 5F
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: hard
[=]
[=] --- Tag Signature
[=] IC signature public key name: NXP Mifare Classic MFC1C14_x
[=] IC signature public key value: 044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF
[=] Elliptic curve parameters: NID_secp128r1
[=] TAG IC Signature: 577669211292C6A487A5E85502FAA97163F541AE87A21FE083B243662B82AC6C
[+] Signature verification: successful
[?] Hint: try `hf mf` commandsOffline
#6 2023-10-31 03:48:10
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Mifare plus - dump fails?
take a look on the data one more time...
Offline
#7 2023-11-01 21:04:35
- Dose13
- Contributor
- Registered: 2019-09-26
- Posts: 29
Re: Mifare plus - dump fails?
Still not sure. I read in the datasheet that mfp should follow the iso14443-4 protocol. The pm3 output states that it is a non proprietary iso14443-4 card.
The ISO/IEC 14443-4 Protocol (also known as T=CL) is used in many processor cards.
This protocol is used for the MIFARE Plus with the following security levels: ...
If this means that it does not follow the mfp or mfc datasheet that might be the issue. Was this the hint that you wanted to give me?
Offline
#8 2023-11-02 02:00:48
- iceman
- Administrator
- Registered: 2013-04-25
- Posts: 9,538
- Website
Re: Mifare plus - dump fails?
you missed the mark
Offline
#9 2024-02-06 15:23:04
- JohnDoePM
- Contributor
- Registered: 2018-07-08
- Posts: 49
Re: Mifare plus - dump fails?
Dear community,
despite of the weeks passed, let me board here:
[=] Session log /home/john/.proxmark3/logs/log_20240206141530.txt
[+] loaded `/home/john/.proxmark3/preferences.json`
[+] Using UART port /dev/ttyACM0
[+] Communicating with PM3 over USB-CDC
8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 "Y8888P" [ ☕ ]
[ Proxmark3 RFID instrument ]
MCU....... AT91SAM7S512 Rev B
Memory.... 512 KB ( 62% used )
Client.... Iceman/master/v4.17768-380-g6566021f3 2024-02-05 14:33:47
Bootrom... Iceman/master/v4.17768-380-g6566021f3-suspect 2024-02-05 14:34:34
OS........ Iceman/master/v4.17768-380-g6566021f3-suspect 2024-02-05 14:34:56
Target.... PM3 GENERIC
[usb] pm3 --> hf 14a info
[+] UID: 33 DA DB AE
[+] ATQA: 00 02
[+] SAK: 18 [2]
[+] Possible types:
[+] MIFARE Classic 4K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection....... hard
....
[+] generating binary key file
[+] found keys have been dumped to `/home/john/hf-mf-12345678-key-004.bin`
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[#] Block 8 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 2 block 0
[#] Block 9 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 9 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 10 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 10 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 11 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 11 Cmd 0x30 Wrong response len, expected 18 got 0
[-] ⛔ fast dump reported back failure w KEY A, swapping to KEY B
[#] Block 4 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 1 block 0
[#] Block 5 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 5 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 6 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 6 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 7 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 7 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 16 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 4 block 0
[#] Block 17 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 17 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 18 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 18 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 19 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 19 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 20 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 5 block 0
[#] Block 21 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 21 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 22 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 22 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 23 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 23 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 24 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 6 block 0
[#] Block 25 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 25 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 26 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 26 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 27 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 27 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 28 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 7 block 0
[#] Block 29 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 29 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 30 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 30 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 31 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 31 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 32 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 8 block 0
[#] Block 33 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 33 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 34 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 34 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 35 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 35 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 36 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 9 block 0
[#] Block 37 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 37 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 38 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 38 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 39 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 39 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 40 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 10 block 0
[#] Block 41 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 41 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 42 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 42 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 43 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 43 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 44 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 11 block 0
[#] Block 45 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 45 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 46 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 46 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 47 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 47 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 48 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 12 block 0
[#] Block 49 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 49 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 50 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 50 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 51 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 51 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 52 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 13 block 0
[#] Block 53 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 53 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 54 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 54 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 55 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 55 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 56 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 14 block 0
[#] Block 57 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 57 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 58 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 58 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 59 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 59 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 60 Cmd 0x30 Cmd Error 04
[#] Error No rights reading sector 15 block 0
[#] Block 61 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 61 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 62 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 62 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 63 Cmd 0x30 Wrong response len, expected 18 got 0
[#] Block 63 Cmd 0x30 Wrong response len, expected 18 got 0
[-] ⛔ fast dump reported back failure w KEY B
[-] ⛔ Dump file is PARTIAL complete
[=] downloading card content from emulator memory
[+] saved 1024 bytes to binary file `/home/john/hf-mf-12345678-dump-004.bin`
[+] saved to json file `/home/john/hf-mf-33DADBAE-dump-004.json`
[=] autopwn execution time: 119 seconds
[usb] pm3 --> All keys (4) have been successfully found. But the dump at the end of "hf mf autopwn" fails. Does anybody have a solution for that? I hope that I can exclude bad adjustment between the card and the device.
Best regards
JD.
Offline
Pages: 1