search

RfidResearchGroup / ChameleonUltra

The new generation chameleon based on NRF52840 makes the performance of card emulation more stable. And gave the chameleon the ability to read, write, and decrypt cards.
https://chameleonultra.com
GNU General Public License v3.0
783 stars 137 forks source link

Reading Mifare security code blocks - zeroed key A #206

Open simonemarfo opened 4 months ago

simonemarfo commented 4 months ago

Hi all, I am having issues in with hf mf rdbl command. I have tried with different tags, but in all cases Key A in the security code blocks always comes up as zeroed. 

[USB] chameleon --> hw version
 - Chameleon Ultra, Version: v2.0 (v2.0.0-131-gc1eb213)
[USB] chameleon --> hf mf rdbl -a -k FFFFFFFFFFFF --blk 7
 - Data: 000000000000ff078069ffffffffffff
[USB] chameleon --> hf mf rdbl -b -k FFFFFFFFFFFF --blk 7
 - Data: 000000000000ff078069ffffffffffff

Here reported the partial dump of the same tag

00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000070: ffff ffff ffff ff07 8069 ffff ffff ffff  .........i......

To Reproduce

Steps to reproduce the behavior.

  1. Install latest FW ( and any previous for this matter )
  2. Read security code block (3, 7, ... ) with hf mf rdbl providing the correct auth key

Expected behavior

Key A should be readable and not zeroed