Skip to content

MIFARE Ultralight C

MIFARE Ultralight C

  • 3DES Authentication

Documentation

MIFARE Ultralight C Gen1A

  • Password Authentication

Example Key: 49454D4B41455242214E4143554F5946h

MIFARE Ultralight C DirectWrite

MIFARE Ultralight C Magic

Change UID Card:

[usb] pm3 --> hf mfu setuid --uid 01020304050607
[=] Please ignore possible transient BCC warnings
[usb] pm3 --> hf mfu info

[=] --- Tag Information --------------------------
[+]       TYPE: MIFARE Ultralight C (MF0ULC) ( magic  )
[+]        UID: 01 02 03 04 05 06 07
[+]     UID[0]: 01, Motorola UK
[+]       BCC0: 88 ( ok )
[+]       BCC1: 00 ( ok )
[+]   Internal: 00 ( not default )
[+]       Lock: 00 00  - 0000000000000000
[+] OneTimePad: FF FF FF FF  - 11111111111111111111111111111111

--- UL-C Configuration
 Higher Lockbits [40/0x28]: 00 00 00 00  - 0000000000000000
         Counter [41/0x29]: 00 00 00 00  - 0000000000000000
           Auth0 [42/0x2A]: 00 00 00 00  default
           Auth1 [43/0x2B]: FF FF FF FF  write access restricted
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory...
[=] ------------------------------------------------------------
[#] Warning: HF field is off
[#] Warning: HF field is off
[!!] Error: tag didn't answer to READ magic

MIFARE Ultralight Nano

  • ISO/IEC 14443A & NFC Forum Type 2 Tag
  • 40 byte user memory
  • ECC-supported NXP originality signature
  • Usage
    • Single use

Documentation

Proxmark Commands

Read a Ultralight Nano:

[usb] pm3 --> hf mfu info

[=] --- Tag Information --------------------------
[+]       TYPE: MIFARE Ultralight Nano 40bytes (MF0UNH00)
[+]        UID: 04 89 FC 6A F6 59 80
[+]     UID[0]: 04, NXP Semiconductors Germany
[+]       BCC0: F9 ( ok )
[+]       BCC1: 45 ( ok )
[+]   Internal: 48 ( default )
[+]       Lock: 00 C0  - 0000000011000000
[+] OneTimePad: 00 00 00 00  - 00000000000000000000000000000000

[=] --- Tag Silicon Information
[=]        Wafer Counter: 17514189 ( 0x10B3ECD )
[=]    Wafer Coordinates: x 137, y 252 (0x89, 0xFC)
[=]            Test Site: 2

[=] --- Tag Version
[=]        Raw bytes: 00 04 03 01 02 00 0B 03
[=]        Vendor ID: 04, NXP Semiconductors Germany
[=]     Product type: Ultralight
[=]  Product subtype: 01, 17 pF
[=]    Major version: 02
[=]    Minor version: 00
[=]             Size: 0B, (64 <-> 32 bytes)
[=]    Protocol type: 03, ISO14443-3 Compliant

[=] --- Tag Configuration
[=]   cfg0 [7/0x07]: 00 00 00 00
[=]                     - strong modulation mode disabled
[=]                     - page 0 and above need authentication
[=]   cfg1 [8/0x08]: 00 00 00 00
[=]                     - Unlimited password attempts
[=]                     - NFC counter disabled
[=]                     - NFC counter not protected
[=]                     - user configuration writeable
[=]                     - write access is protected with password
[=]                     - 00, Virtual Card Type Identifier is not default
[=]   PWD  [9/0x09]: 00 00 00 00 - (cannot be read)
[=]   PACK [10/0x0A]: 00 00       - (cannot be read)
[=]   RFU  [10/0x0A]:       00 00 - (cannot be read)

[+] --- Known EV1/NTAG passwords
[!] password not known
[?] Hint: try `hf mfu pwdgen -r` to get see known pwd gen algo suggestions
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory...
[=] ------------------------------------------------------------