ikarus23 / mifareclassictool Goto Github PK

Peter reported via email:

However, there is a small error if the AC does not allow for Increment, and I do Increment the program shows that it worked (succes) and in fact, nothing has changed, because the AC does not offer such possibilities.

I will try to reproduce this bug and fix it within the next release.

I changed the block 0 in order to change the card uid, It look's it has changed but when I read the card It says "Tag found: ..." and shows always the same id

Until now you can't increment or decrement a value block. Sure if you got the write privilege you can increment/decrement by rewriting the value bock. But if you only have increment/decrement and no write privilege there is no way to manipulate the value with MCT. This has to change!

Hey,
I wanted to download your app through the play store with a Nexus 5 running android 4.4.4 but is written as not compatible with my android version
Can't this app work on android 4.4.x?

MCT has always been working flawless on my HTC M8 pre-lollipop. This weekend I updated the device to 5.0, since then MCT crashes immediately when reading or writing to a tag.

In some intents there are string extras that are just long string separated by "\n".
This strings should be replaced by string array extras. See:
https://developer.android.com/reference/android/content/Intent.html#putStringArrayListExtra%28java.lang.String,%20java.util.ArrayList%3Cjava.lang.String%3E%29

I tried to scan some encrypted sectors, providing in a file the corresponding keys but it never worked.

When I choose the standard "std.keys" and tip "Start Mapping and Read Tag", the tag would be correctly read.
But when I choose any other keys file I created, tag would not be read and I get a "No valid key found in chosen key file" Toast.

For instance I created a sample test.keys file with just one key "000000000000" and I got the same issue.
I checked the character encoding of my test files and they are encoded in UTF8 like the sample "std.keys" file.

Does anyone have an idea what I am doing wrong?

During the key mapping process:
If KeyB is readable there is no need to search for it. Just read it! This might speed up the mapping process. However, for every successful authentication of KeyA the sector trailer must be read.

If KeyB is readable, it will be displayed anyways, even if it was not in the key file.

when read nxp smartMX card P5CT072 ( MIFARE classic emulation ) key mapping cannot continue！
MifareClassicTool 1.7.1 android 4.1.2

Hi!

I've modified a little code to add a new option on dump's editor menu. Now I can write card directly from dump editor.
Is really anoying save dump before write when I'm making debug.

If you want i can commit it to the project.

Iceman wrote:

Ikarus, some hints,
if you look into the lualibs there is some more default keys.

I have small problem with MifareClassicTool, that whatever tag I put to my phone, LG F60, it says that's not an Mifare Classic Tag, but lower, under "Tag Type and Manufacturer" it shows "MIFARE Classic 1K, NXP", and so on with all 3 of my MIFARE 1K cards, all of them from different sources - One tag is genuine NXP tag, got as Krakow Transportation Card, one is chinese card bougt at eBay, and last one is from chained shops as point-gathering card.
When I put my MasterCard PayPass cards towards my phone, for older one I get JCOP41, IBM type, and for second I get "Mifare Classic 4k - emulated (6212 Classic), Nokia", but still got "Not a Mifare Classic tag!".
It's quite weird, because atqa/sak says all these three 1K cards have correct values, but app doesn't allow me even to read any of the tags :(

Screenshot below is when that chinese tag was near phone, but data (of course not the UID ;) ) is the same for all of three tags.

Known a list of devices that does not work. How about add a list that name a few devices that work perfectly with MCT?

First of all, thank you for the software maker. I am a Chinese middle school students. I M8 have the same problem. Please forgive my English is not very good. From the translation of

Hey there,
I'm using Samsung Galaxy S3 Mini with your newest MCT app - v 1.7.4. It always says that it can't find any working keys in my *.keys files. I'm sure they are right, because i'm also using it with ma USB Mifare NFC Tag.

Error looks like: "No valid key found in chosen key file"…
Can you help me? :)

I will try to manage the Todos with github

MCT crashes if a sector has the default Access Conditions.

The warning should check a memory flag which is marked 'dirty' if any changes have actually occurred to the opened dump. At least for file based dumps. The flag should always be dirty for dumps read from a card (i.e. not yet saved to file).

Otherwise, the user is constantly reminded of changes when viewing file based dumps.

• Make "transfer" optional
• Add a possibility to "transfer"
• Add a possibility to "restore"

it would be nice to write whole card from dump/hex/xml with given key b.
i could throw away my usb reader then :-)
atm, it's only possible to write empty card.

Read and dump tags as fast as possible. Some things needed for this feature will be:

• Key files that contain mapping information
• A faster read behavior that makes use of the extended key files
• A possibility to directly dump the tag data after reading

"systemcrash" had some ideas about the new key file format:

I wanted to add something to this idea: namely, the ability to use key-files that can specify which sectors they apply to, which should accelerate, or obviate key-mapping. The idea is to specify which key-files to use for reading/writing dumps. If using specified Keys on targeted sectors does not work, the default behaviour should be to fall back to building key-maps as it does today, on a per key/sector basis. e.g. say the user specifies targeted keys for 0A, 0B and 1B, but needs to read 0A, 0B 1A, 1B, 2A 2B. Those keys could be tried for the other sectors as necessary, especially if there are no other keys in the file.

Today it goes something like
# this is a comment

FFFFFFFFFFFF

It could be extended to something like one of the following - whichever best suits the internal workings:
# this is a comment
# keys start without a # comment, and end with optional colon then number to specify
# at which sectors they should be used and optionally Key A/B in brackets ( )

FFFFFFFFFFFF:0-1(A,B)

Or
# this is a comment
# keys start without a # comment

FFFFFFFFFFFF:0A,0B,1A,1B,7A,7B

or
# this is a comment
# keys start without a # comment

FFFFFFFFFFFF;A:1,2,3,4,5,6,7;B1,2,3,4,5,6,7

or
# this is a comment
# keys start without a # comment

FFFFFFFFFFFF;A:1-7,8,9;B1-7,10,12

Maybe not via app but via an extra tool (script). But first I have to look
at the formats of .eml or .mdf files...

Number of 'clicks' can/should be reduced for specific actions:

when comparing dumps from within the dump editor, you land at the "diff tool, choose a dump..." screen, with the first already chosen. The only choice left being, "choose a dump" (or of course, back action). This second "choose a dump" should automatically be invoked.

Selecting "Write dump" from within dump editor. The only choice being "write...". This should automatically be invoked, and take the user to the select sector popup.

When ever i try and read a mifare card key a is visible but everything else has dashes

Replace the "ugly" radio button based layout with tabs.

I get the "No Mifare Support" message on my HTC One X

This phone should have support as it can correctly read and write data to Mifare1k cards as shown here
(wrote a URL then erased it). I normally use 'NFC TagInfo' and 'TagstandWriter' to read and write tags respectively

Phone is running android version 4.1.1

Any ideas?

... Just to make the code more readable.

Until now it is only possible to create the key map for a range of sectors.

This is also needed to be more efficient. If the user chooses to write only the first and the last sector of an dump with e.g. 16 sectors, the key map for all 16 sectors will be created. That's baaad...

For some rare cases Android returns the wrong tag size (e.g. 1K instead of 4K).
Therefore an option where the user can force MCT to use a custom tag size is needed.

Galaxy s5 900P says it is not compatble with mifare classic. If it won't be just add to the documentation.

It did show some strings with generic info and card uid.

I want to check if it is feasible to brute force the key in a reasonable timeframe. Is the bottleneck the card or the CPU? I believe that mfcuk currently uses this method to obtain keys but is available only on x86 platform.

If it is feasible, I could contribute to the development of the feature, it is quite simple to implement, cycling all possible combinations through the existing authenticate() function in MCReader and recording those that return true.

Thanks.

I own an S3 and an S4, but they read the same card differently. On the S3 it is recognized, and on the S4 not. The S4 shows the same ATAQA, SAK and RF Technology as the S3. I guess tha ataq[1] may not be 0 on the s4?

hexadec wrote:

And it's very annoying, that the back button exit immediately (in the key editor too), and there is no question if I really wanted to do that, or a button to go back and save.

I've tried to launch the app on my phone which does not NFC.
Would love to use the features and tools such as the ACL converter since some people are doing projects which are not on the phone. (Arduino, Raspberry Pi etc. )

A user with disabled NFC can use MCT in editor only mode. This choice is not remembered. This leads to the annoying situation that the dialog pops up every time checkNfc() is called.

Choose key files -> Map keys to sectors of the first tag
-> Remember this key map for the next tags to read them
as quick as possible -> dump the tags with time stamp.

... Just to make the code more readable.

Hi,

I have Samsung Galaxy SII (without NFC module)
I have external card reader (ACR122U) connected via USB. Reader in represented in system on /dev/bus/usb/002/002 and working fine in other aplications.
I would like to use MifareClassicTool because I heared that this is the best app for reading/writing data.

Can I bypass error message when MCT starts? I use MCT in newest version (1.7.2). Maybe some older version haven't that message?

Maybe can you add a feature, that supports external devices?

Please help me.
Best regards,
Kris

ACR122U Drivers for android:
http://www.acs.com.hk/en/driver/3/acr122u-usb-nfc-reader/

The special card can be write by the acr122u,but can't be write by the MCT.

e.g. http://www.lokaligo.com/ or http://weblate.org/en/

iceman wrote:

you can also add

ATQA : 01 0f
SAK : 01 [2]
TYPE : NXP TNP3xxx Game item
size: 1K

to your tag identification list.

have you considered adding support for the ACR 122 ??
it would be amazing for my s4 and other devices!!

I updated to the last version.
It has erased my dumps and all my key files.

Android 4.4.4

according to this post: http://www.proxmark.org/forum/viewtopic.php?pid=6849#p6849

last 2 bytes of sector0-block0 identify for sure tag production's week and year and this can be a quite good method to identify counterfait cards (this information is not present in any mifare document) so you can find clones which have random bytes in that position while penultimate byte must be >0 and <52 (max weeks in 1 year - obviously no HEX numbers allowed) and last byte can be from 00 to 13 (2000-2013); I checked many cards (NXP and Gemplus MPCOS) and ONLY mifare clones (ex. chinese cards) did not meet that WW/YY "rule" (they have numbers greater than 52 or 13 or hexadecimal values);

i've checked it on sample of 85 production transportation cards and it seem to be true 👍

Could you add a menu in the dump editor, which can convert ASCII text to hexadecimal format?
(Eg. A dialog with an edittext, and it copies the converted text to the clipboard, the user needs to paste it only.)
And it's very annoying, that the back button exit immediately (in the key editor too), and there is no question if I really wanted to do that, or a button to go back and save.

(Sorry for my bad English, I hope you can understand it :-) )

It would be great to implement support for other Tags like e.g. Mifare Ultralight or Topas 512.

And because of this MCT would be able to work on phones that support tags except the Mifare Classic ones, like Nexus 4 or 5 .....

(this could be configurable based on a number of things)

After read tag, you're left with a dump in the editor. Save, and you need to provide a filename.

Perhaps suggest a hinted filename of e.g.

{Mifare Card ID}{current_date}{current_time}

48642B3B_20150115_234215.txt

Suggest .txt extension, since the dumps are text based.

domints said:

But I've found simple way to check which controller is used by phone - just run command
adb shell ls /system/lib/libnfc*
And if there's file with bcm or brcm in name it uses Broadcomm chip. For NXP's (compatible) chip I think there should be file with "pn" in name.

domints also said:

I think you could look for file /system/lib/libnfc-nxp.so , but I'm not sure.
I'm sure, that for broadcomm chip in /dev folder there's file called bcm2079x, and for NXP's pn544 (I think the most popular if not the only used in android NXP's chip) there's file called pn544

The NFC hardware is working normal on my Nexus 4, But it pops up a dialog saying No Mifare Support onCreate.
I cloned this project and I'll check that out.