Mifare classic

[Gas]

Hi all,

here's my problem.
I am using Mifare Classic 1K. My goal would be to enter the memory of the card with the keys I know (factory default for the first time), write in the sector of my interest, modify key A, key B and the access bits of C1, C2, C3 so that if someone then goes to read the card again (eg. with Taginfo) you cannot read the contents of the sectors or even read C1, C2, C3, but read a series of "x" for example.
Of course I'll can read (and change) the contents through key A and / or key B and / or C1, C2, C3 because I know them.

It's possible to obtain all this?

Thanks

[Gas]

Hi Jonathan,

I appreciated your help because it unlocked me.

Many thanks

[Jonathan_Iglesias · Accepted solution]

Hi @Gas 

Hope you are doing great, 

 you can see below a series of 3 scripts I did for you, before  you see them please be careful with the AC in the sector trailer if you set them wrong you can make that sector unusable. also to be able to see the sector as in the last image of TagInfo you only need to do the first script, the second and third are just demonstrations that the block is secured.  you only need to change the default keys, since they are known the application try to use them that is why you can see the information in the application. if you change it it wont show like the in the image at the end of this. 

( SW used was RFIDDiscover for PC and reader used was a PEGODA reader from NXP) if you follow the datasheet you can use any reader or software that complies with the ISO14443-3

SCRIPT 1:

1.-activate the card in the ISO 14443-3 layer

2.-authenticate with key A to the desired block in this case I will use  Block 14.

3.-write information in Block 14 ( 11111111111111111111111111111111 ) 

4.-read trailer sector ( block 17 ) 

5.-write a new key (new key value :222222222222)and keeping the AC so it is required to have an authentication with key A in order to  interact with this sector as explained in the datasheet. 

STEP 1 :

Send to card: 26
Recv from card: 4400
Send to card: 9320
Recv from card: 8804686D89
Send to card: 93708804686D89
Recv from card: 04
Send to card: 9520
Recv from card: 5A435284CF
Send to card: 95705A435284CF
Recv from card: 08


STEP 2:
phalMfc_Authenticate--------ENTRY-------- bBlockNo=14 bKeyType=0A wKeyNumber=000F wKeyVersion=0000 pUid=04686D5A435284

phpalMifare_MfcAuthenticate--------ENTRY-------- bBlockNo=14 bKeyType=0A pKey=FFFFFFFFFFFF pUid=5A435284

STEP 3:

Send to card: A014
Recv from card: 0A
Send to card: 11111111111111111111111111111111
Recv from card: 0A


STEP 4:

Send to card: 3017
Recv from card: 000000000000FF078069FFFFFFFFFFFF


STEP 5:

Send to card: A017
Recv from card: 0A
Send to card: 222222222222FF078069FFFFFFFFFFFF
Recv from card: 0A

SCRIPT 2:

1.-activate the card in the ISO 14443-3 layer

2.-read sector 14 ( in this case it will fail because it requires a valid authentication with key A)

STEP 1:
Send to card: 26
Recv from card: 4400
Send to card: 9320
Recv from card: 8804686D89
Send to card: 93708804686D89
Recv from card: 04
Send to card: 9520
Recv from card: 5A435284CF
Send to card: 95705A435284CF
Recv from card: 08


STEP 2:

Send to card: 3014
Recv from card: Error, Error: PAL_MIFARE,NAK4

SCRIPT 3:



1.-Activate iso 14443-3 layer

2.-authenticate with new key A to block 14

3.-write some information

STEP1:


Send to card: 26
Recv from card: 4400
Send to card: 9320
Recv from card: 8804686D89
Send to card: 93708804686D89
Recv from card: 04
Send to card: 9520
Recv from card: 5A435284CF
Send to card: 95705A435284CF
Recv from card: 08


STEP 2:


phalMfc_Authenticate--------ENTRY-------- bBlockNo=14 bKeyType=0A wKeyNumber=0010 wKeyVersion=0000 pUid=04686D5A435284

phpalMifare_MfcAuthenticate--------ENTRY-------- bBlockNo=14 bKeyType=0A pKey=222222222222 pUid=5A435284


STEP 3:
Send to card: A014
Recv from card: 0A
Send to card: 11111111111111111111111111111111
Recv from card: 0A

how it looks in TagInfo( sector 5 is the one we used in the examples above and sector 4 is with default values):

BR

Jonathan