github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 13:53:55 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

updated text about configuration GDM

Browse source
This commit is contained in:
iceman1001 2023-03-26 03:08:01 +02:00
commit 5e8a08c714
1 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

23
doc/magic_cards_notes.md
View file

@ -535,9 +535,14 @@ The persistent memory is also writable. For that tag uses its own backdoor comma
for example to write, you must use a customer authentication byte, 0x80, to authenticate with an all zeros key, 0x0000000000. for example to write, you must use a customer authentication byte, 0x80, to authenticate with an all zeros key, 0x0000000000.
Then send the data to be written. Then send the data to be written.
This tag has simular commands to the [UFUID](#mifare-classic-directwrite-ufuid-version)
It seems to be developed by the same person.
** OBS ** ** OBS **
When writing to persistent memory it is possible to write _bad_ ACL and perm-brick the tag. When writing to persistent memory it is possible to write _bad_ ACL and perm-brick the tag.
** OBS **
It is possible to write a configuration that perma locks the tag, ie no more magic
### Identify ### Identify
^[Top](#top) ^[Top](#top)
@ -552,7 +557,8 @@ hf 14a info
* Auth: `80xx`+crc * Auth: `80xx`+crc
* Write: `A8xx`+crc, `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`+crc * Write: `A8xx`+crc, `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`+crc
* Read : `E000`+crc (unidentified) * Read config: `E000`+crc (unidentified)
* Write config: `E100`+crc
### Characteristics ### Characteristics
^[Top](#top) ^[Top](#top)
@ -561,6 +567,21 @@ hf 14a info
* Its magic part seem to be three identified custom command. * Its magic part seem to be three identified custom command.
* Auth command 0x80, with the key 0x0000000000, Write 0xA8 allows writing to persistent memory, Read 0xE0 which seems to return a configuration. This is unknown today what these bytes are. * Auth command 0x80, with the key 0x0000000000, Write 0xA8 allows writing to persistent memory, Read 0xE0 which seems to return a configuration. This is unknown today what these bytes are.
Read config:
1. sending custom auth with all zeros key
2. send 0xE000, will return the configuration bytes.
`results: 850000000000000000005A5A00000008`
Write config:
1. sending custom auth with all zeros key
2. send 0xE100
3. send 16 bytes
** Warning **
Example of configuration to Perma lock tag:
`85000000000000000000000000000008`
It is unknown what kind of block 0 changes the tag supports It is unknown what kind of block 0 changes the tag supports
* UID: 4b * UID: 4b
* ATQA/SAK: unknown * ATQA/SAK: unknown