Issue 12 in mfoc: Patch for Mifare Classic Mini

[mf...@googlecode.com]

Status: New
Owner: ----
Labels: Type-Defect Priority-Medium

New issue 12 by FireFart: Patch for Mifare Classic Mini
http://code.google.com/p/mfoc/issues/detail?id=12

Attached is a Patch to support Mifare Classic Mini tags. Would be great if
you can include it.

Sample output:
firefart@Laptop:~/mfoc-0.10.7/src$ ./mfoc -O test.mfd
Found Mifare Classic Mini tag
ISO/IEC 14443A (106 kbps) target:
ATQA (SENS_RES): 00 04
* UID size: single
* bit frame anticollision supported
UID (NFCID1): XX XX XX XX
SAK (SEL_RES): 09
* Not compliant with ISO/IEC 14443-4
* Not compliant with ISO/IEC 18092

Fingerprinting based on MIFARE type Identification Procedure:
* MIFARE Mini 0.3K
* SmartMX with MIFARE 1K emulation
Other possible matches based on ATQA & SAK values:

Try to authenticate to all sectors with default keys...
Symbols: '.' no key found, '/' A key found, '\' B key found, 'x' both keys
found
[Key: ffffffffffff] -> [.....]
[Key: a0a1a2a3a4a5] -> [/....]
[Key: d3f7d3f7d3f7] -> [/....]
[Key: 000000000000] -> [/....]
[Key: b0b1b2b3b4b5] -> [/....]
[Key: 4d3a99c351dd] -> [/....]
[Key: 1a982c7e459a] -> [/....]
[Key: aabbccddeeff] -> [/....]
[Key: 714c5c886e97] -> [/....]
[Key: 587ee5f9350f] -> [/....]
[Key: a0478cc39091] -> [/....]
[Key: 533cb6c723f6] -> [/....]
[Key: 8fd0a4f256e9] -> [/....]
[Key: b4c132439eef] -> [x....]

Sector 00 - FOUND_KEY [A] Sector 00 - FOUND_KEY [B]
Sector 01 - UNKNOWN_KEY [A] Sector 01 - UNKNOWN_KEY [B]
Sector 02 - UNKNOWN_KEY [A] Sector 02 - UNKNOWN_KEY [B]
Sector 03 - UNKNOWN_KEY [A] Sector 03 - UNKNOWN_KEY [B]
Sector 04 - UNKNOWN_KEY [A] Sector 04 - UNKNOWN_KEY [B]


Using sector 00 as an exploit sector
Sector: 1, type A, probe 0, distance 12022 .....
Found Key: A [1b28835a9bdf]
Sector: 2, type A, probe 0, distance 12022 .....
Found Key: A [b94f10488015]
Sector: 3, type A, probe 0, distance 12020 .....
Found Key: A [f04898d03e33]
Sector: 4, type A, probe 0, distance 12024 .....
Found Key: A [23406e5056aa]
Sector: 1, type B, probe 0, distance 12020 .....
Sector: 1, type B, probe 1, distance 12020 .....
Found Key: B [28539669015e]
Sector: 2, type B, probe 0, distance 12026 .....
Found Key: B [aa988bc4eb3e]
Sector: 3, type B, probe 0, distance 12020 .....
Found Key: B [7332014c8fd1]
Sector: 4, type B, probe 0, distance 12020 .....
Sector: 4, type B, probe 1, distance 12070 .....
Sector: 4, type B, probe 2, distance 12022 .....
Sector: 4, type B, probe 3, distance 12022 .....
Sector: 4, type B, probe 4, distance 12024 .....
Found Key: B [696c351df482]
Auth with all sectors succeeded, dumping keys to a file!
Block 19, type A, key 23406e5056aa :00 00 00 00 00 00 78 77 88 00
00 00 00 00 00 00
Block 18, type A, key 23406e5056aa :55 01 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 17, type A, key 23406e5056aa :00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 01
Block 16, type A, key 23406e5056aa :00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 15, type A, key f04898d03e33 :00 00 00 00 00 00 78 77 88 00
00 00 00 00 00 00
Block 14, type A, key f04898d03e33 :55 01 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 13, type A, key f04898d03e33 :00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 01
Block 12, type A, key f04898d03e33 :00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 11, type A, key b94f10488015 :00 00 00 00 00 00 78 77 88 0c
00 00 00 00 00 00
Block 10, type A, key b94f10488015 :55 01 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 09, type A, key b94f10488015 :00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 01
Block 08, type A, key b94f10488015 :00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 07, type A, key 1b28835a9bdf :00 00 00 00 00 00 78 77 88 28
00 00 00 00 00 00
Block 06, type A, key 1b28835a9bdf :55 01 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 05, type A, key 1b28835a9bdf :01 00 00 01 00 00 80 01 00 01
00 00 00 00 80 01
Block 04, type A, key 1b28835a9bdf :01 00 00 01 00 00 80 01 00 01
00 00 00 00 80 00
Block 03, type A, key a0a1a2a3a4a5 :00 00 00 00 00 00 78 77 88 c1
00 00 00 00 00 00
Block 02, type A, key a0a1a2a3a4a5 :00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00
Block 01, type A, key a0a1a2a3a4a5 :62 00 48 88 49 88 4a 88 4b 88
00 00 00 00 00 00
Block 00, type A, key a0a1a2a3a4a5 :XX XX XX XX XX XX XX XX XX XX
XX XX XX XX XX XX

Attachments:
mfoc.patch 3.2 KB

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

[mf...@googlecode.com]

Comment #1 on issue 12 by marco.ro...@gmail.com: Patch for Mifare Classic
Mini
http://code.google.com/p/mfoc/issues/detail?id=12

how have to use this patch? how can implement on my mfoc? please help me :-)

[mf...@googlecode.com]

Comment #2 on issue 12 by FireFart: Patch for Mifare Classic Mini
http://code.google.com/p/mfoc/issues/detail?id=12

On a Linux machine:
git clone https://code.google.com/p/mfoc/
cd mfoc
wget -O
mfoc.patch "https://mfoc.googlecode.com/issues/attachment?aid=120000000&name=mfoc.patch&token=XXXXXXXXX"
(Copy your link here, don't forget the ")
patch -p1 < mfoc.patch

Done. Just compile your code and it should work.

[mf...@googlecode.com]

Comment #3 on issue 12 by marco.ro...@gmail.com: Patch for Mifare Classic
Mini
http://code.google.com/p/mfoc/issues/detail?id=12

Dear FireFart,
using my eeepc with xubuntu, mfoc 0.10.7 ( patched ) , libnfc 1.7.1 and an
ACR122UA9 reader, unfortunately I have no success..

Found Mifare Classic Mini tag
ISO/IEC 14443A (106 kbps) target:
ATQA (SENS_RES): 00 04
* UID size: single
* bit frame anticollision supported

UID (NFCID1): c6 f4 85 8d

SAK (SEL_RES): 09
* Not compliant with ISO/IEC 14443-4
* Not compliant with ISO/IEC 18092

Fingerprinting based on MIFARE type Identification Procedure:
* MIFARE Mini 0.3K
* SmartMX with MIFARE 1K emulation
Other possible matches based on ATQA & SAK values:

Try to authenticate to all sectors with default keys...
Symbols: '.' no key found, '/' A key found, '\' B key found, 'x' both keys
found
[Key: ffffffffffff] -> [.....]
[Key: a0a1a2a3a4a5] -> [/....]
[Key: d3f7d3f7d3f7] -> [/....]
[Key: 000000000000] -> [/....]
[Key: b0b1b2b3b4b5] -> [/....]
[Key: 4d3a99c351dd] -> [/....]
[Key: 1a982c7e459a] -> [/....]
[Key: aabbccddeeff] -> [/....]
[Key: 714c5c886e97] -> [/....]
[Key: 587ee5f9350f] -> [/....]
[Key: a0478cc39091] -> [/....]
[Key: 533cb6c723f6] -> [/....]
[Key: 8fd0a4f256e9] -> [/....]
[Key: b4c132439eef] -> [x....]

Sector 00 - FOUND_KEY [A] Sector 00 - FOUND_KEY [b]
Sector 01 - UNKNOWN_KEY [A] Sector 01 - UNKNOWN_KEY [b]
Sector 02 - UNKNOWN_KEY [A] Sector 02 - UNKNOWN_KEY [b]
Sector 03 - UNKNOWN_KEY [A] Sector 03 - UNKNOWN_KEY [b]
Sector 04 - UNKNOWN_KEY [A] Sector 04 - UNKNOWN_KEY [b]

Using sector 00 as an exploit sector

Sector: 1, type A, probe 0, distance 35518 .....
Sector: 1, type A, probe 1, distance 29455 .....
Sector: 1, type A, probe 2, distance 28687 .....
Sector: 1, type A, probe 3, distance 26627 .....
Sector: 1, type A, probe 4, distance 30635 .....
Sector: 1, type A, probe 5, distance 36160 .....
Sector: 1, type A, probe 6, distance 35983 .....
Sector: 1, type A, probe 7, distance 47605 .....
Sector: 1, type A, probe 8, distance 31707 .....
Sector: 1, type A, probe 9, distance 26155 .....
Sector: 1, type A, probe 10, distance 29404 ...