MIFARE Ultralight C
MIFARE Ultralight C¶
- 3DES Authentication
MIFARE Ultralight C Gen1A¶
- Password Authentication
Example Key: 49454D4B41455242214E4143554F5946h
MIFARE Ultralight C DirectWrite¶
MIFARE Ultralight C Magic¶
Change UID Card:
[usb] pm3 --> hf mfu setuid --uid 01020304050607
[=] Please ignore possible transient BCC warnings
[usb] pm3 --> hf mfu info
[=] --- Tag Information --------------------------
[+] TYPE: MIFARE Ultralight C (MF0ULC) ( magic )
[+] UID: 01 02 03 04 05 06 07
[+] UID[0]: 01, Motorola UK
[+] BCC0: 88 ( ok )
[+] BCC1: 00 ( ok )
[+] Internal: 00 ( not default )
[+] Lock: 00 00 - 0000000000000000
[+] OneTimePad: FF FF FF FF - 11111111111111111111111111111111
--- UL-C Configuration
Higher Lockbits [40/0x28]: 00 00 00 00 - 0000000000000000
Counter [41/0x29]: 00 00 00 00 - 0000000000000000
Auth0 [42/0x2A]: 00 00 00 00 default
Auth1 [43/0x2B]: FF FF FF FF write access restricted
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory...
[=] ------------------------------------------------------------
[#] Warning: HF field is off
[#] Warning: HF field is off
[!!] Error: tag didn't answer to READ magic
MIFARE Ultralight Nano¶
- ISO/IEC 14443A & NFC Forum Type 2 Tag
- 40 byte user memory
- ECC-supported NXP originality signature
- Usage
- Single use
Proxmark Commands¶
Read a Ultralight Nano:
[usb] pm3 --> hf mfu info
[=] --- Tag Information --------------------------
[+] TYPE: MIFARE Ultralight Nano 40bytes (MF0UNH00)
[+] UID: 04 89 FC 6A F6 59 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] BCC0: F9 ( ok )
[+] BCC1: 45 ( ok )
[+] Internal: 48 ( default )
[+] Lock: 00 C0 - 0000000011000000
[+] OneTimePad: 00 00 00 00 - 00000000000000000000000000000000
[=] --- Tag Silicon Information
[=] Wafer Counter: 17514189 ( 0x10B3ECD )
[=] Wafer Coordinates: x 137, y 252 (0x89, 0xFC)
[=] Test Site: 2
[=] --- Tag Version
[=] Raw bytes: 00 04 03 01 02 00 0B 03
[=] Vendor ID: 04, NXP Semiconductors Germany
[=] Product type: Ultralight
[=] Product subtype: 01, 17 pF
[=] Major version: 02
[=] Minor version: 00
[=] Size: 0B, (64 <-> 32 bytes)
[=] Protocol type: 03, ISO14443-3 Compliant
[=] --- Tag Configuration
[=] cfg0 [7/0x07]: 00 00 00 00
[=] - strong modulation mode disabled
[=] - page 0 and above need authentication
[=] cfg1 [8/0x08]: 00 00 00 00
[=] - Unlimited password attempts
[=] - NFC counter disabled
[=] - NFC counter not protected
[=] - user configuration writeable
[=] - write access is protected with password
[=] - 00, Virtual Card Type Identifier is not default
[=] PWD [9/0x09]: 00 00 00 00 - (cannot be read)
[=] PACK [10/0x0A]: 00 00 - (cannot be read)
[=] RFU [10/0x0A]: 00 00 - (cannot be read)
[+] --- Known EV1/NTAG passwords
[!] password not known
[?] Hint: try `hf mfu pwdgen -r` to get see known pwd gen algo suggestions
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory...
[=] ------------------------------------------------------------