brmlab

User Tools

Site Tools

You are here: Hackerspace Prague » Projects » FreakCard
project:freakcard:start

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
project:freakcard:start [2018/11/09 11:39] – [High Frequency (HF) card] Desfire specs, notes about new Desfire EV2 abyssalproject:freakcard:start [2021/06/05 17:28] (current) – [Biometric NFC passport and emulation] abyssal
Line 25: Line 25:
   * old [[https://code.google.com/p/proxmark3/source/checkout | SVN repo from code.google.com]]   * old [[https://code.google.com/p/proxmark3/source/checkout | SVN repo from code.google.com]]
   * new [[https://github.com/Proxmark/proxmark3 | github repo]]   * new [[https://github.com/Proxmark/proxmark3 | github repo]]
 +  * [[https://github.com/iceman1001/proxmark3 || iceman's fork]] - needed for full Ultralight EV1 simulation, has some extra Desfire client stuff
  
 The best revision for OS code is rev 838 from old SVN repo. All the stuff that I checked that should work works. The best revision for OS code is rev 838 from old SVN repo. All the stuff that I checked that should work works.
Line 31: Line 32:
  
 There is also a library available for PC/SC readers that supports many kinds of cards, but you need specific reader for each separate card - https://github.com/islog/liblogicalaccess/wiki There is also a library available for PC/SC readers that supports many kinds of cards, but you need specific reader for each separate card - https://github.com/islog/liblogicalaccess/wiki
 +
 +======= Proxmark new versions - RDV4, EVO and pack with PN532 reader with Chameleon mini =======
 +
 +There are new versions of Proxmark, which are more compact, see the comparison table in the links at the bottom of the page
 +
 +  * https://lab401.com/collections/hardware/products/proxmark-3-rdv4
 +  * https://lab401.com/collections/hardware/products/proxmark-3-evo
 +  * https://lab401.com/collections/hardware/products/rfid-pentester-pack?variant=12470762307695 (has Proxmark + Chameleon + PN532 reader)
 +  * https://lab401.com/products/chameleon-mini-reve-rebooted
 +  * https://lab401.com/collections/hardware/products/usb-rfid-reader-writer-scl-3711
 +
 +======= PN532-based readers =======
 +
 +PN532 based readers:
 +
 +  * https://www.acs.com.hk/en/products/3/acr122u-usb-nfc-reader/
 +  * https://www.acs.com.hk/en/products/109/acr122t-usb-tokens-nfc-reader/
 +  * https://www.adafruit.com/product/789 - there are two board versions, one as Arduino shield, other has different pinout, but are in essence the same
 +  * [[http://nfc-tools.org/index.php/Devices_compatibility_matrix | compatibility matrix with libnfc]]
 +
 +======= Software for PN532 readers =======
 +
 +  * https://github.com/nfc-tools/libnfc
 +  * https://github.com/nfc-tools/libfreefare
 +  * [[https://github.com/KaiQ/dat | Desfire Access Tool]] - there is ''v2.0'' branch with new stuff and rewrite
 ====== Decision tree. ====== ====== Decision tree. ======
  
Line 282: Line 308:
  
 Ultralight EV1 and NTAG2/1 can be [[https://lab401.com/blogs/academy/magic-ntag-21x-getting-started | copied onto Magic NTAG21x]] with proxmark. Ultralight EV1 and NTAG2/1 can be [[https://lab401.com/blogs/academy/magic-ntag-21x-getting-started | copied onto Magic NTAG21x]] with proxmark.
 +
 +== Magic NTAG2x, magic Ultralight C and magic Desfire ==
 +
 +[[http://proxmark3.tictail.com/ | IceSql]] sells "magic" cards to simulate NTAG2/NTAG1, Ultralight EV1 and others.
 +
 +There is a special [[https://lab401.com/blogs/academy/magic-ntag-21x-getting-started | Lua script for proxmark to program them]].
 +
 +Information about the cards from proxmark (hf mfu i):
 +
 +<code>
 +proxmark3> hf mfu i
 +
 +--- Tag Information ---------          
 +-------------------------------------------------------------          
 +      TYPE : MIFARE Ultralight (MF0ICU1) <magic>          
 +       UID : 11 22 33 55 66 77 88            
 +    UID[0] : 11, Emosyn-EM Microelectronics USA          
 +      BCC0 : 44, crc should be 88          
 +      BCC1 : FF, crc should be CC          
 +  Internal : FF, not default          
 +      Lock : ff ff  - 1111111111111111          
 +OneTimePad : ff ff ff ff  - 11111111111111111111111111111111
 +          
 +          
 +proxmark3> hf mfu i
 +
 +--- Tag Information ---------          
 +-------------------------------------------------------------          
 +      TYPE : MIFARE Ultralight C (MF0ULC) <magic>          
 +       UID : 00 00 00 00 00 00 00            
 +    UID[0] : 00, no tag-info available          
 +      BCC0 : 00, crc should be 88          
 +      BCC1 : 00, Ok          
 +  Internal : 00, not default          
 +      Lock : 00 00  - 0000000000000000          
 +OneTimePad : 00 00 00 00  - 00000000000000000000000000000000
 +          
 +--- UL-C Configuration          
 + Higher Lockbits [40/0x28] : 00 00 00 00  - 0000000000000000          
 +         Counter [41/0x29] : 00 00 00 00  - 0000000000000000          
 +           Auth0 [42/0x2A] : 00 00 00 00  default          
 +           Auth1 [43/0x2B] : 00 00 00 00  read and write access restricted          
 +         deskey1 [44/0x2C] : 00 00 00 00  []          
 +         deskey1 [45/0x2D] : 00 00 00 00  []          
 +         deskey2 [46/0x2E] : 00 00 00 00  []          
 +         deskey2 [47/0x2F] : 00 00 00 00  []          
 +
 + 3des key : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00           
 +</code>
 +
 +This shop sells [[https://www.rfxsecure.com/product/gen2-uid-changeable-fobs-1k-mf-4k-mf-ul-ul-c-df-ntag21x/ | lot of different changeable UID cards and keyfobs, 4-byte and 7-byte, including UID changeable Desfire]]/
 +
 +== Magic Desfire ==
 +
 +The "magic Desfire" is far from real Desfire, e.g.
 +
 +  * writing NDEF file seems to succeed, but read fails, you get just zeros
 +  * libfreefare segfaults with the magic Desfire
 +  * any SELECT APDU is responded to with OK, but there are no real applications
 +
 +In short, waste of money.
 +
 +Setting UID on magic Desfire with Proxmark:
 +
 +<code>
 +hf 14a raw -s -c 02 00 ab 00 00 07 UID
 +</code>
  
 == other mifare cards == == other mifare cards ==
Line 337: Line 430:
 Proxmark can read them and so can some android phones. Proxmark can read them and so can some android phones.
  
-They contain UID and 64 bytes of data. Reading with proxmark can be done with:+They contain UID and 4-byte blocks of data. Reading with proxmark can be done with:
  
 <code> <code>
-hf 15 dumpmemory+pm3 --> hf 15 reader 
 + UID  : E0 16 24 66 1E C1 A5 AD           
 + TYPE : EM-Marin SA (Skidata); EM4233 [IC id = 09] 23,5pF CustomerID-102           
 +pm3 --> hf 15 dump 
 +[=] Using UID as filename           
 +Reading memory from tag UID E0 16 24 66 1E C1 A5 AD           
 +....................................................[-] Tag returned Error 15: Unknown error.           
 + 
 +           
 +block#   | data         |lck| ascii           
 +---------+--------------+---+----------           
 +  0/0x00 | 3F 08 1A 4D  | 0 | ?..M           
 +  1/0x01 | 82 18 60 20  | 0 | ..`            
 +  2/0x02 | 00 38 00 50  | 0 | .8.P           
 +  3/0x03 | 1C 48 33 00  | 0 | .H3.           
 +  4/0x04 | 1B 00 00 00  | 0 | ....           
 +  5/0x05 | 00 00 00 00  | 0 | ....           
 +  6/0x06 | 00 00 00 00  | 0 | ....           
 +  7/0x07 | 00 00 00 00  | 0 | ....           
 +  8/0x08 | 00 00 00 00  | 0 | ....           
 +  9/0x09 | 00 00 00 00  | 0 | ....           
 + 10/0x0A | 00 00 00 00  | 0 | ....           
 + 11/0x0B | 00 00 00 00  | 0 | ....           
 + 12/0x0C | 00 00 00 00  | 0 | ....           
 + 13/0x0D | 00 00 00 00  | 0 | ....           
 + 14/0x0E | 00 00 00 00  | 0 | ....           
 + 15/0x0F | 00 00 00 00  | 0 | ....           
 + 16/0x10 | 00 00 00 00  | 0 | ....           
 + 17/0x11 | 00 00 00 00  | 0 | ....           
 + 18/0x12 | 00 00 00 00  | 0 | ....           
 + 19/0x13 | 00 00 00 00  | 0 | ....           
 + 20/0x14 | 00 00 00 00  | 0 | ....           
 + 21/0x15 | 00 00 00 00  | 0 | ....           
 + 22/0x16 | 00 00 00 00  | 0 | ....           
 + 23/0x17 | 00 00 00 00  | 0 | ....           
 + 24/0x18 | 00 00 00 00  | 0 | ....           
 + 25/0x19 | 00 00 00 00  | 0 | ....           
 + 26/0x1A | 00 00 00 00  | 0 | ....           
 + 27/0x1B | 00 00 00 00  | 0 | ....           
 + 28/0x1C | 2A 80 53 42  | 0 | *.SB           
 + 29/0x1D | 1F 90 53 42  | 0 | ..SB           
 + 30/0x1E | 33 00 00 00  | 0 | 3...           
 + 31/0x1F | 00 00 00 00  | 0 | ....           
 + 32/0x20 | 00 00 00 00  | 0 | ....           
 + 33/0x21 | 00 00 00 00  | 0 | ....           
 + 34/0x22 | 00 00 00 00  | 0 | ....           
 + 35/0x23 | 00 00 00 00  | 0 | ....           
 + 36/0x24 | 00 00 00 00  | 0 | ....           
 + 37/0x25 | 00 00 00 00  | 0 | ....           
 + 38/0x26 | 00 00 00 00  | 0 | ....           
 + 39/0x27 | 00 00 00 00  | 0 | ....           
 + 40/0x28 | 00 00 00 00  | 0 | ....           
 + 41/0x29 | 00 00 00 00  | 0 | ....           
 + 42/0x2A | 22 00 E1 23  | 0 | "..#           
 + 43/0x2B | C0 05 1B 01  | 0 | ....           
 + 44/0x2C | 4A 5C A0 1D  | 0 | J\..           
 + 45/0x2D | 1A 30 00 12  | 0 | .0..           
 + 46/0x2E | 50 E7 AB EC  | 0 | P...           
 + 47/0x2F | 60 00 00 00  | 0 | `...           
 + 48/0x30 | 00 00 40 7B  | 0 | ..@{           
 + 49/0x31 | 00 68 20 15  | 0 | .h .           
 + 50/0x32 | 00 00 00 00  | 0 | ....           
 + 51/0x33 | 00 00 00 00  | 0 | ....           
 </code> </code>
  
-Latest proxmark 2.3.0 has some basic ISO 15693 simulation functionality, but it's not working properly yet.+Rfxsecure.com sells magic ISO-15693 cards with changeable UID. Either you need the iso15_magic from RRG repo or "hf 15 csetuid" from the official repo. The official repo's client segfaults on this right now, although it seems to change UID before segfault (signed/unsigned integer confusion, negative received octet count, etc). Proxmark developers have abysmal code standards and can't even use tags in repos.
  
-AFAIK there are no "Chinese backdoored clones" that would allow changing of UID.+Changing UID, depending on repo (you need iso15_magic from RRG + read15.lua) or the segfaulting official repo with "hf 15 csetuid":
  
 +<code>
 +proxmark3> hf 15 reader
 +#db# 12 octets read from IDENTIFY request:          
 +#db# NoErr CrcOK          
 +#db# 00 00 bf a5 c1 1e 66 24          
 +#db# 16 e0 56 a3          
 +#db# UID = E01624661EC1A5BF          
 +proxmark3> hf 15 csetuid E01624661EC1A5CA
 +          
 +new UID | e0 16 24 66 1e c1 a5 ca           
 +Using backdoor Magic tag function          
 +received -1 octets          
 +
 +Thread 4 "WorkerThread" received signal SIGSEGV, Segmentation fault.
 +
 +</code>
 +
 +With the magic scripts:
 +
 +<code>
 +script run iso15_magic.lua -u E004013344556677
 +</code>
  
 +Neither will work on the first time likely. Retry at least 3 times. Same with "hf 15 dump" and "hf 15 restore".
  
 +Note on cloned skipass ISO-15693 cards - they have counter in sector 2, so as soon as your cloned cards will desync, one of them will stop working.
 ==== Low Frequency card ==== ==== Low Frequency card ====
 Emulation in general: http://www.t4f.org/en/projects/open-rfid-tag/55 this looks like a very nice generic emulator for LF, some hw guru could look into assembling it? lukash willing to help :) Emulation in general: http://www.t4f.org/en/projects/open-rfid-tag/55 this looks like a very nice generic emulator for LF, some hw guru could look into assembling it? lukash willing to help :)
Line 446: Line 626:
 Usage around: building access system Usage around: building access system
  
-This information pertains to model Paradox C704. Full decoding in proxmark is not implemented, but the modulation is Fc/8/10 FSK, thus raw data transmitted by the tag can be read with:+This information pertains to model Paradox C704. Full decoding in proxmark is implemented, in the latest git version. The modulation is Fc/8/10 FSK, thus raw data transmitted by the tag can be read with:
  
 <code> <code>
 proxmark3> lf read proxmark3> lf read
 proxmark3> data samples 40000 proxmark3> data samples 40000
-proxmark3> data fskdemod+loaded 40000 samples           
 +proxmark3> data plot 
 +proxmark3> lf paradox demod 
 +Paradox TAG ID: 000328176 (Full ID: 0ca05dadf) - FC: 50 - Card: 33142 - Checksum: b7 - RAW: 0f555555a5995566a699a6aa          
 </code> </code>
  
 Emulate: Emulate:
  
-Not implemented in proxmark code, but the HID Prox emulation is very similar. Code in CmdHIDsimTAG() function of armsrc/lfops.c can be modified to transmit Paradox code. Frame marker needs to be modified to use 0x1F instead of 0x1D. The bits after frame marker do not seem to employ Manchester encoding.+Latest proxmark code has clone Paradox to T5577 command. Iceman's fork has emulation. 
 + 
 +<code> 
 +pm3 --> lf paradox sim 50 33142 
 +Simulating Paradox - Facility Code: 50, CardNumber: 33142 
 +</code> 
  
 === T55x7 universal emulation card === === T55x7 universal emulation card ===
Line 489: Line 678:
   * [[http://www.hidglobal.com/technology.php?tech_cat=4&subcat_id=10]]   * [[http://www.hidglobal.com/technology.php?tech_cat=4&subcat_id=10]]
  
-===== Radio chips XXX =====+===== Biometric passports with ISO-14443A NFC chip, chip emulation ===== 
 + 
 +Passports can be read with [[http://rfidiot.org/ | RFIdiot]], e.g. 
 + 
 +<code> 
 +python2 mrpkey.py -g -R READER_LIBNFC 'L898902C<36908061940619406236<<<<<<<<<<<<<08' 
 +</code> 
 + 
 +Note the code is old, you need python2 and some patching to make it run. 
 + 
 +There is also attempt at emulation of passport - https://is.muni.cz/th/tc83s/ (in Slovak). It has code for emulation for first Proxmark. 
 + 
 +Run with in proxmark3 shell (use old client, old bootloader, old fullimage) 
 + 
 +<code> 
 +hf 14a sim 5 01020304 
 +</code> 
 + 
 +It is quite difficult to build now, also you will definitely need JTAG adapter as you would otherwise brick Proxmark in process. 
 + 
 +Everything on passport chip is plaintext except fingerprint.
  
-  * hcs300 ( KEELOQ ) +Prebuilt image (flash bootloader.elf and fullimage.elf in one session):
-    * Can be broken XXX +
-  * NXP UCODE (passive UHF) +
-  * NXP ICODE (HF) +
-  * NXP HITAG (LF)+
  
 +{{ :project:freakcard:passport_emulator.zip |}}
 ===== RF Theory and antennas ===== ===== RF Theory and antennas =====
 [[http://ww1.microchip.com/downloads/en/AppNotes/00710c.pdf|Microchip antenna/coil design guide ]] [[http://ww1.microchip.com/downloads/en/AppNotes/00710c.pdf|Microchip antenna/coil design guide ]]
Line 691: Line 897:
   * [[http://www.backtrack-linux.org/wiki/index.php/RFID_Cooking_with_Mifare_Classic|RFID_Cooking_with_Mifare_Classic]]   * [[http://www.backtrack-linux.org/wiki/index.php/RFID_Cooking_with_Mifare_Classic|RFID_Cooking_with_Mifare_Classic]]
   * [[http://www.acs.com.hk/en/products/109/acr122t-usb-tokn-nfc-reader/|ACR122T USB reader with PN532 PIN]] (functional equivalent of Touchatag)   * [[http://www.acs.com.hk/en/products/109/acr122t-usb-tokn-nfc-reader/|ACR122T USB reader with PN532 PIN]] (functional equivalent of Touchatag)
 +
project/freakcard/start.1541763567.txt.gz · Last modified: 2018/11/09 11:39 by abyssal