RfidResearchGroup / proxmark3

Iceman Fork - Proxmark3
http://www.icedev.se
GNU General Public License v3.0
3.86k stars 1.02k forks source link

HID Seos IY card not being detected (reads as MIFARE Classic) #1901

Closed JoeyEamigh closed 1 year ago

JoeyEamigh commented 1 year ago

Describe the bug I have a high frequency card labeled with HID Seos IY in the bottom left and XT in the bottom right. When I use hf search, it reads as an ISO 14443-A tag manufactured by HID with JCOP 31/41. Attempting to read any block or sector as if it is a MIFARE Classic 1k (as hf search recommends) results in an auth error, and autopwn hangs at darkside.

hf seos info returns some hex with no discernible pattern and nothing under tag information. smart info and smart reader return nothing. hf iclass reader returns iCLASS / Picopass card select failed (220) and emv search returns cannot send an APDU.

Both hf iclass list and emv list give me a bit of history between the card and readers, but most of it has warnings about parity errors.

Desktop:

pm3 --> hw version

 [ Proxmark3 RFID instrument ]

 [ CLIENT ]
  Iceman/master/v4.16191-33-ga074c4124 2023-02-05 15:56:08 a86d9d107
  compiled with............. GCC 12.2.1 20230111
  platform.................. Linux / x86_64
  Readline support.......... present
  QT GUI support............ present
  native BT support......... present
  Python script support..... present
  Lua SWIG support.......... present
  Python SWIG support....... present

 [ PROXMARK3 ]
  device.................... RDV4
  firmware.................. RDV4
  external flash............ present
  smartcard reader.......... present
  FPC USART for BT add-on... absent

 [ ARM ]
  bootrom: Iceman/master/v4.16191-33-ga074c4124 2023-02-05 15:56:06 a86d9d107
       os: Iceman/master/v4.16191-33-ga074c4124 2023-02-05 15:56:09 a86d9d107
  compiled with GCC 12.2.0

 [ FPGA ]
  LF image 2s30vq100 2022-03-23 17:21:05
  HF image 2s30vq100 2022-03-23 17:21:16
  HF FeliCa image 2s30vq100 2022-03-23 17:21:27
  HF 15 image 2s30vq100 2022-03-23 17:21:38

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev B
  --= Embedded Processor: ARM7TDMI
  --= Internal SRAM size: 64K bytes
  --= Architecture identifier: AT91SAM7Sxx Series
  --= Embedded flash memory 512K bytes ( 66% used )

hw status ``` pm3 --> hw status [#] Memory [#] BigBuf_size............. 40748 [#] Available memory........ 40748 [#] Tracing [#] tracing ................ 0 [#] traceLen ............... 78 [#] Current FPGA image [#] mode.................... HF image 2s30vq100 2022-03-23 17:21:16 [#] Flash memory [#] Baudrate................ 24 MHz [#] Init.................... OK [#] Memory size............. 2 mbits / 256 kb [#] Unique ID............... 0xD5697C30970E9E25 [#] Smart card module (ISO 7816) [#] version................. v4.13 [#] LF Sampling config [#] [q] divisor............. 95 ( 125.00 kHz ) [#] [b] bits per sample..... 8 [#] [d] decimation.......... 1 [#] [a] averaging........... yes [#] [t] trigger threshold... 0 [#] [s] samples to skip..... 0 [#] [#] LF T55XX config [#] [r] [a] [b] [c] [d] [e] [f] [g] [#] mode |start|write|write|write| read|write|write [#] | gap | gap | 0 | 1 | gap | 2 | 3 [#] ---------------------------+-----+-----+-----+-----+-----+-----+------ [#] fixed bit length (default) | 29 | 17 | 15 | 47 | 15 | N/A | N/A | [#] long leading reference | 29 | 17 | 18 | 50 | 15 | N/A | N/A | [#] leading zero | 29 | 17 | 18 | 40 | 15 | N/A | N/A | [#] 1 of 4 coding reference | 29 | 17 | 15 | 31 | 15 | 47 | 63 | [#] [#] HF 14a config [#] [a] Anticol override.... std ( follow standard ) [#] [b] BCC override........ std ( follow standard ) [#] [2] CL2 override........ std ( follow standard ) [#] [3] CL3 override........ std ( follow standard ) [#] [r] RATS override....... std ( follow standard ) [#] Transfer Speed [#] Sending packets to client... [#] Time elapsed................... 502ms [#] Bytes transferred.............. 64512 [#] Transfer Speed PM3 -> Client... 128509 bytes/s [#] Various [#] Max stack usage......... 4088 / 8480 bytes [#] Debug log level......... 1 ( error ) [#] ToSendMax............... 1 [#] ToSend BUFFERSIZE....... 2308 [#] Slow clock.............. 30970 Hz [#] Installed StandAlone Mode [#] LF HID26 standalone - aka SamyRun (Samy Kamkar) [#] Flash memory dictionary loaded [#] Mifare.................. 1468 / 2047 keys [#] T55x7................... 122 / 1023 keys [#] iClass.................. 28 / 511 keys ```
data tune ``` [=] ---------- LF Antenna ---------- [+] LF antenna: 71.09 V - 125.00 kHz [+] LF antenna: 33.59 V - 134.83 kHz [+] LF optimal: 71.09 V - 125.00 kHz [+] Approx. Q factor (*): 12.0 by frequency bandwidth measurement [+] Approx. Q factor (*): 12.4 by peak voltage measurement [+] LF antenna is OK [=] ---------- HF Antenna ---------- [+] HF antenna: 45.06 V - 13.56 MHz [+] Approx. Q factor (*): 7.9 by peak voltage measurement [+] HF antenna is OK ```

Additional context From what I can find, this seems to be an HID Seos 500x or 510x iClass. I can find very little information on it online, and I am unsure if that even is the card that I have.

Please let me know what data I need to provide in order to figure out what kind of card this is, and potentially read it. Thanks for all the hard work!

iceman1001 commented 1 year ago

SEOS protocol isn't public so no proper implementation in open source exists today. Hence there is only rudimentary support in the Proxmark3 client.