ikarus23 / MifareClassicTool

An Android NFC app for reading, writing, analyzing, etc. MIFARE Classic RFID tags.
http://www.icaria.de/mct/
GNU General Public License v3.0
4.71k stars 907 forks source link

starting the key mapper... #11

Closed feisec closed 10 years ago

feisec commented 10 years ago

when read nxp smartMX card P5CT072 ( MIFARE classic emulation ) key mapping cannot continue! MifareClassicTool 1.7.1 android 4.1.2

ikarus23 commented 10 years ago

First of all, thank you for the bug report!

Now I need some more information.

Thanks for your help!

feisec commented 10 years ago

sorry about my poor english and thanks so much for reply 1.not an app crash,no message,creating key map..please wait.. progress bar does not move,app can operate, 2.can read this tag with taginfo, key A founded? (A0-A5 MAD acces key,i dont konw that means) key B unknown key ACs is FF078069 3.ACR122U213,mfocgui,error reading block with key xxxxxxxxx,dumped a invalid dump file(all 0 in it) 4.yes,mifare classic can read/wirte another tag

part of P5CT072 pdf: In confguration B1 the contactless MIFARE Classic OS provided by Philips is implemented on the P5CT072. 1 Kbyte of the EEPROM can be accessed by the MIFARE Classic OS offering the same command set and functionality as a MIFARE 1K hardwired logic chip. The access conditions for the user OS to the MIFARE memory area can be confgured via the so called ACM (Access condition matrix). The MIFARE Classic OS offers a backward compatibility to support existing infrastructure based on the MIFARE Classic functionality.

feisec commented 10 years ago

I found out that use the right key mifare classic can read/wirte this tag sectors one by one security mechanism ?

ikarus23 commented 10 years ago

Thanks for all the information!

Did I get this right?

1.not an app crash,no message,creating key map..please wait... progress bar does not move,app can operate

Hmm this behaviour appears when there is an error while reading/authenticating (TagLostExeption). I'm not sure why it occurs. I will compile an testing version of MCT which will throw more debug messages. Maybe this way we can figure this out. But please be patient, I'm short on time :(

security mechanism ?

I don't think so. Maybe the emulation on the smartMX just differs from an original Mifare Classc tag. But I'm not sure...

mklostermeier commented 10 years ago

This problem may be due to timing issues. It is possible that tags emulating a Mifare Classic tag are slower than original Mifare Classic tags. Maybe inserting a delay between two commands will solve this issue.

feisec commented 10 years ago

just like you say, operations: Write Tag --> Write Block --> Enter Block, Sector, Data --> Select key file-->try more than one time--> Success Read Tag --> Select key file --> Select range (only one sector) --> Success Looking forward to the next update!

ikarus23 commented 10 years ago

I added a delay of 100ms between authentication attempts during key mapping. My (short) experience on playing with the timing were not the best. For me it sometimes leads to strange behaviour and I'm not quite sure why. I think that too long delays may lead to a timeout in the Android NFC system.

But test it for your self: http://tests.icaria.de/MifareClassicTool-1.7.1-testing.apk

feisec commented 10 years ago

It's very kind of you have maked the testing apk, i have tested the tag

1.the tag can read/write only one sector, if select two sector progress bar move half way and stoped (start mapping and read tag button change colar) -------key A A0A1A2A3A4A5 kay b B0B1B2B3B4B5 2.found out that smartmx tag can read and write by mifare classic tool when keya = keyb (mifare classic 1.7.1 can also do it)

ikarus23 commented 10 years ago

Hmm, that is pretty much what I expected. I will try some more tweaking on timing and provide you with another testing version. Please stand by and be patient (I have a lot to do :-/ ). And of course thank you for testing.

ikarus23 commented 10 years ago

Please try this: http://tests.icaria.de/MifareClassicTool-1.7.1-testing-2.apk But don't be surprised if it does not work.

feisec commented 10 years ago

Very glad to tell you testing2 apk can read/write the tag very well !!! perfect! All the problems have been solved. Thank you ! ps:what caused this issue?

ikarus23 commented 10 years ago

Great news! Thank you for your assistance! What I did: If the tag gets lost during authentication (TagLostException, most likely due to a timeout), the app will try to reconnect to it (with a delay of 500ms) until one attempt will succeed. The next version of MCT will have an preference panel in which you can turn on/off this behaviour.

ikarus23 commented 10 years ago

This is an alpha version of 1.7.2: http://tests.icaria.de/MifareClassicTool-1.7.1-testing-3.apk It has the new preference system implemented.

Can you confirm this?

feisec commented 10 years ago

great job,testing-3.apk can read/write emulated MFC card very well(Auto reconnect on) !

ikarus23 commented 10 years ago

Hehe, closing this issue (by accident) was fine. :) The code is merged in the master so the next version will contain this fix. Thank you for your help!