github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-19 04:50:12 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Add iKey blanks

Browse source 
Too much stuff we don't know yet. The cloners cost too much.

Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com>
This commit is contained in:
team-orangeBlue 2023-04-11 18:08:07 +03:00 • committed by GitHub
commit 0b8514bab0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 42 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

43
doc/magic_cards_notes.md
View file

@ -15,6 +15,7 @@ Useful docs:
* [MIFARE Classic block0](#mifare-classic-block0) * [MIFARE Classic block0](#mifare-classic-block0)
* [MIFARE Classic Gen1A aka UID](#mifare-classic-gen1a-aka-uid) * [MIFARE Classic Gen1A aka UID](#mifare-classic-gen1a-aka-uid)
* [MIFARE Classic Gen1B](#mifare-classic-gen1b) * [MIFARE Classic Gen1B](#mifare-classic-gen1b)
* [MIFARE Classic Gen1A OTP/One Time Programming](#mifare-classic-gen1a-otp/one-time-programming)
* [MIFARE Classic DirectWrite aka Gen2 aka CUID](#mifare-classic-directwrite-aka-gen2-aka-cuid) * [MIFARE Classic DirectWrite aka Gen2 aka CUID](#mifare-classic-directwrite-aka-gen2-aka-cuid)
* [MIFARE Classic DirectWrite, FUID version aka 1-write](#mifare-classic-directwrite-fuid-version-aka-1-write) * [MIFARE Classic DirectWrite, FUID version aka 1-write](#mifare-classic-directwrite-fuid-version-aka-1-write)
* [MIFARE Classic DirectWrite, UFUID version](#mifare-classic-directwrite-ufuid-version) * [MIFARE Classic DirectWrite, UFUID version](#mifare-classic-directwrite-ufuid-version)
@ -264,7 +265,32 @@ hf 14a info
* Read: `40(7)`, `30xx` * Read: `40(7)`, `30xx`
* Write: `40(7)`, `A0xx`+crc, `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`+crc * Write: `40(7)`, `A0xx`+crc, `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`+crc
## MIFARE Classic Gen1A OTP/One Time Programming
^[Top](#top)
aka MF OTP 2.0
Similar to Gen1A, but after first block 0 edit, tag no longer replies to 0x40 command.
Initial UID is 00000000
All bytes are 00 from factory wherever possible.
### Identify
^[Top](#top)
Only possible before personalization.
```
hf 14a info
...
[+] Magic capabilities : Gen 1a
```
### Magic commands
^[Top](#top)
* Write: `40(7)`, `43`, `A0xx`+crc, `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`+crc
## MIFARE Classic DirectWrite aka Gen2 aka CUID ## MIFARE Classic DirectWrite aka Gen2 aka CUID
^[Top](#top) ^[Top](#top)
@ -414,6 +440,8 @@ hf 14a reader
## MIFARE Classic DirectWrite, FUID version aka 1-write ## MIFARE Classic DirectWrite, FUID version aka 1-write
^[Top](#top) ^[Top](#top)
aka. MF OTP
Same as MIFARE Classic DirectWrite, but block0 can be written only once. Same as MIFARE Classic DirectWrite, but block0 can be written only once.
Initial UID is AA55C396 Initial UID is AA55C396
@ -545,7 +573,7 @@ When writing to persistent memory it is possible to write _bad_ ACL and perm-bri
**OBS** **OBS**
It is possible to write a configuration that perma locks the tag, ie no more magic It is possible to write a configuration that perma locks the tag, i.e. no more magic
### Identify ### Identify
^[Top](#top) ^[Top](#top)
@ -844,6 +872,8 @@ See `--uid` and `--full`
## MIFARE Ultralight EV1 DirectWrite ## MIFARE Ultralight EV1 DirectWrite
^[Top](#top) ^[Top](#top)
aka. UL2
Similar to MFUL DirectWrite Similar to MFUL DirectWrite
### Identify ### Identify
@ -880,6 +910,12 @@ hf 14a info
* BCC: play blindly the block0 BCC0 and block2 BCC1 bytes, beware! * BCC: play blindly the block0 BCC0 and block2 BCC1 bytes, beware!
* ATS: 850000A00A000AC30004030101000B0316D7 * ATS: 850000A00A000AC30004030101000B0316D7
#### MIFARE Ultralight EV1 DirectWrite flavour 3
^[Top](#top)
* BCC: play blindly the block0 BCC0 and block2 BCC1 bytes, beware!
* ATS: 850000A000000A3C0004030101000E03
## MIFARE Ultralight C Gen1A ## MIFARE Ultralight C Gen1A
^[Top](#top) ^[Top](#top)
@ -919,6 +955,11 @@ hf 14a info
* ATS: 0A78008102DBA0C119402AB5 * ATS: 0A78008102DBA0C119402AB5
* Anticol shortcut (CL1/3000): fails * Anticol shortcut (CL1/3000): fails
**TODO**
* UL-X, UL-Y, UL-Z, ULtra, UL-5 ?
# NTAG # NTAG
^[Top](#top) ^[Top](#top)