I started experimenting around with my touchatag and some mifare cards. As I still
have some old cards from which are not in use anymore I wanted to clear or format them
to put my own data on them.

Sadly, they have no default keys but I managed to get around this problem and got
them with mfoc. I put them into the default_keys[] array in the mifare-classic-format.c
but it still complains about having no valid key:

"No known authentication key for sector 0"

I double-checked the keys I got from mfoc with the ones I put into the source but still
no success.

Is there some way to just check if the key I used was correct?

Or maybe another way to "clear" a mifare-card to default values?

Greetings,
Gesar

I am using Mifare classic 1K card in one of my RFID based project for college.
I want to store register number of the student in the tag , so that the reader should read this number for authentication & link to his database in back-end PC .

I tried to change the ID of the Tag its not possible to change . reader will always reads the deafault ID (58C4E09C) .

How can I store the data in the  tag so that the reader  will read at the data ( register number )whatever i stored during authentication time.

Please help...
Regards,
Girish Kuamr

I believe that somebody can help me with my issue.

I've got ACR122U-A2 NFC reader. Trying to copy Mifare Plus S 2K card.
At least the organization that uses this type of card posted so on their website.
My reader says that the card is Mifare Classic 1K, I'm not sure whom to believe.

I've got first four sectors (0,1,2 and 3). First (0) sector starts with repeating
the card's UID. Then there are few strange data rows. Any other sectors won't decrypt anyway.
I am working mostly in backtrack with MFOC, MFCUK and RFIDIOT tools.
I've tried DOZENS of different libraries versions and programs and flags under
Ubuntu, Backtrack, Fedora, Peppermint, Arch and few other distros.
I've got RFIDIOT bruteforce to work, but it would take forever to guess the key.
MFCUK seems to work too, but after 5 or 10 minutes of work it begins to show reading errors.
I left MFUCK for more than a day without any success.
MFOC just drops off with reader input/output fail in random time. The most probe I've got is around 1690++ probe, than reader hang

I've tried to setup speed in MFCUK and probes in MFOC, but errors occures anyway.

The funny is that site of the owner of the card says that it is 2K mifare plus S card, which
is not proved by all software I've got. Software says that it's mifare 1k card (but maybe it's a software mistake?). I am thinking about does 2k mifare plus S card have special additional security levels. I know that it might be AES encryption, I've got different sorts of AES certificates from the owner
company of the card, but I'm not sure when exactly I have to decode data. As I can understand, I should at first dump the card, and than decode its dump with some sort of certificate.

If somebody can help me, I am ready to supply all the needed information.

Thank you
Den

Please find the link to the initial version 0.1 of the Mifare Classic Key Recovery tool implementing "Dark Side" Attack and some-what stable tag fixation with DropField+ConstantDelay technique.

http://code.google.com/p/tk-libnfc-crap … loads/list

Tested on 2 European cards and on 1 Taipei EasyCard - none had default/known keys.

After getting the key with this tool, the other keys were friendly provided by Nested Attack from MFOC of Nethemba - these two tools should merge I propose

"Dark Side" attack relies on lsfr_common_prefix() beauty-of-art from Crapto1 3.1
Tag nonce fixation is not 100% proof, so it is helped with a cache/lookup of most common tag nonces.

The source file's header gives all the information needed, as well as requirements for Crapto1 and libnfc.

Code is GPL2 - and btw feel free to use, feel free to contribute, feel free to cite, feel free to contact.

Hope it helps, though I must admit the source code and and it's implementation is not yet in it's best shape .

Regards,
zveriu - http://andreicostin.com

Thank you and sorry for my bad english, it isn't my mother language.

I've found this log with either encrypted and unencrypted nonces:

key:              FF FF FF FF FF FF
UID:              2a 69 8d 43
nT:               3b ae 03 2d
nR+aR:           bb 03 1f 2d     7f cf 34 c3
{nR}+{aR}:   c4! 94 a1 d2   6e! 96 86! 42
aT:                  86 9d bb d5
{aT}:            84 66! 05! 9e!

My first step is to get the same {nR} knowing the nR, the UID and the key

I've already successfully calculated the aR and aT starting from the tag nonce. Now im trying to crypting them.

As I said im using an 8bit microcontroller so i cant even use an unique 48bit or 64bit variable but im trying to avoid this problem.

Anyone may give me some hints how to initialize the cipher step by step focusing also on the bit orientation (LSB/MSB) ?

this is what i've done:

-I've started to set up the cipher with the 48bit key (FF FF FF FF FF FF).
-I've added the nT and the UID shifting the cipher for each of the 32bits adding the new bit on the right
-adding the nR im filling up the {nR}

but i dont get expected results of course...

may somebody helps me? ThanKs!

sorry for my english and for my newbie questions

-AxxE-

CardId: 0EBDA9B3
Key: 0xFFFFFFFFFFFF
Key-A/Sector 0x00
Reader Challenge: 0xBB357BF3

To do this I send next commands:

R->C:  0x60 0x00
C->R: 0xFF 0x58 0x18 0x87
R->C: 0xF0 0x47 0xBA 0x7C 0x30 0x46 0x77 0x88
C->R: Frame wait time out or no TAG

Do you have some suggestion? Some ideea?

failed to write trailer block 3 
xnfc_initiator_transceive_bytes: Timeout

I tried to overwrite the card with the empty dump I got from http://www.libnfc.org/_media/libnfc/doc … xample.zip
but it went like this:

thomas@pluto ~ $ nfc-mfclassic w b Downloads/14f1f9d7.mfd clean
Connected to NFC reader: ACS ACR122U 00 00 / ACR122U103 - PN532 v1.6 (0x07)
Found MIFARE Classic card:
    ATQA (SENS_RES): 00  04  
       UID (NFCID1): ec  c3  66  d3  
      SAK (SEL_RES): 08  
Guessing size: seems to be a 1024-byte card
Writing 64 blocks |nfc_initiator_transceive_bytes: Timeout
failed to write trailer block 3 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 7 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 11 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 15 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 19 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 23 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 27 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 31 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 35 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 39 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 43 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 47 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 51 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 55 
xnfc_initiator_transceive_bytes: Timeout
failed to write trailer block 59 
x.|
Done, 4 of 64 blocks written.
thomas@pluto ~ $ nfc-mfclassic w b tim-100 Downloads/14f1f9d7.mfd 
Connected to NFC reader: ACS ACR122U 00 00 / ACR122U103 - PN532 v1.6 (0x07)
Expected MIFARE Classic card with UID starting as: 14f1f9d7
Found MIFARE Classic card:
    ATQA (SENS_RES): 00  04  
       UID (NFCID1): ec  c3  66  d3  
      SAK (SEL_RES): 08  
Guessing size: seems to be a 1024-byte card
Writing 64 blocks |nfc_initiator_transceive_bytes: Mifare Authentication Error
!
Error: authentication failed for block 00
thomas@pluto ~ $ nfc-mfclassic w b tim-100
Connected to NFC reader: ACS ACR122U 00 00 / ACR122U103 - PN532 v1.6 (0x07)
Found MIFARE Classic card:
    ATQA (SENS_RES): 00  04  
       UID (NFCID1): ec  c3  66  d3  
      SAK (SEL_RES): 08  
Guessing size: seems to be a 1024-byte card
Writing 64 blocks |nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
nfc_initiator_transceive_bytes: Mifare Authentication Error
!
Error: authentication failed for block 00
thomas@pluto ~ $ mifare-classic-format 
Found Mifare Classic 1k with UID ecc366d3. Format [yN] y
Formatting 16 sectors [.mifare-classic-format: No known authentication key for sector 0

I also added the keys that were used to write to the card to the default keys of mifare-classic-format.
I'm using a touchatag pad 072f:2200 with the acsccid 1.0.2 driver.

1.Changeable UID Mifare 1K
Works exactly like the Mifare Classic 1K, with 16 Sectors and 4 Blocks each Sector, but the Sector 0 Block 0 known as
Manufacturers Block where the Chip UID is stored, can be re programmed to any UID you wish.

2.Proxmark3
We supply the Proxmark3 for the development,and the price is:190USD.
If you need please contact with us: security_rfid@hotmail.com

Ringo

root@root:~# pcsc_scan
PC/SC device scanner
V 1.4.16 (c) 2001-2009, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.5.3
Scanning present readers...
0: ACS ACR122U 00 00

Sun Nov 27 12:14:22 2011
Reader 0: ACS ACR122U 00 00
  Card state: Card inserted,
  ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 01 00 00 00 00 6A

ATR: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 01 00 00 00 00 6A
+ TS = 3B --> Direct Convention
+ T0 = 8F, Y(1): 1000, K: 15 (historical bytes)
  TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0
-----
  TD(2) = 01 --> Y(i+1) = 0000, Protocol T = 1
-----
+ Historical bytes: 80 4F 0C A0 00 00 03 06 03 00 01 00 00 00 00
  Category indicator byte: 80 (compact TLV data object)
    Tag: 4, len: F (initial access data)
      Initial access data: 0C A0 00 00 03 06 03 00 01 00 00 00 00
+ TCK = 6A (correct checksum)

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 01 00 00 00 00 6A
    Philips MIFARE Standard (1 Kbytes EEPROM)
    http://www.nxp.com/products/identificat … e/classic/
    RFID - ISO 14443 Type A - Transport for London Oyster
    ACOS5/1k Mirfare

I want to write ndef data on a mifare tag. I think I need to format the mifare tag first to get this working. I've already have read the sticky thread about this topic. Unfortunatly all links are unreachable.
I have downloaded a ndef mifare dump file but I cannot write this dump file to my tag. I always get a message that nfc-mfclassic is unable to read textrecord_hello_world.ndef. Why?

Is there any other possibility to format a mifare tag to work with ndef messages?

I was trying to write the example NDEF data that is present at the below link in Mifare 1K tag.

But when I try to read with my Tag read application (Propritory), it is saying NDEF data not found.
Is there any procedure to write the NDEF data into Mifare1K?
If you have any example NDEF raw data, pls provide me.

Note: I started writing the NDEF data from the Block 1 of Sector 0 (as Block 0 of the sector 0 contains "Manufacturer data".
I am using ACR 122 tag reader/writer.

Thanks,
Nagendra

ACR122U Get Data
Get UID
< FF CA 00 00 00
> 90 00
> UID: 13 29 DF 97

Get ATS
< FF CA 01 00 00
> 6A 81
Function not supported

ACR122U Get ATR
> ATR Value: 3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 01 00 00 00 00 6A
> Active Protocol: T=CL
> Card Type: ISO 14443A, Part3 (Mifare 1K)

ACR122U Load Authentication Keys
< FF 82 00 00 06 FF FF FF FF FF FF
> 90 00
< Key Structure: 00    < Key Number: 00
< Key: FF FF FF FF FF FF
Load Authentication Keys Success

ACR122U Authentication
< FF 86 00 00 05 01 00 03 60 00
> 63 00
Operation failed

What it is wrong? Now i cannot so anything with it..Hope anyone can help me or give an ideas.Tq

I can't fine anything about that here. I have these cards here right now, and I cannot read / write them.

See: http://www.mifare.net/index.php/download_file/view/120/