Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2019-07-07 12:48:28

iceman
Administrator
Registered: 2013-04-25
Posts: 9,518
Website

Mifare Desfire Light

New tag is out,  got one from @anon Thanks bro!

https://www.nxp.com/docs/en/data-sheet/MF2DLHX0.pdf

[usb] pm3 --> hf 14a info
 UID : 04 7D 0B 5A 34 61 80           
ATQA : 03 44          
 SAK : 20 [1]          
TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41          
MANUFACTURER : NXP Semiconductors Germany          
 ATS : 06 77 77 71 02 80 BE 6A           
       -  TL : length is 6 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 7 (FSC = 128)          
       - TA1 : different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]          
       - TB1 : SFGI = 1 (SFGT = 8192/fc), FWI = 7 (FWT = 524288/fc)          
       - TC1 : NAD is NOT supported, CID is supported          
[=] Answers to magic commands: NO           

Offline

#2 2019-07-08 13:05:05

Mackwa
Contributor
Registered: 2016-06-10
Posts: 51

Re: Mifare Desfire Light

anyone tried ISO7816 wrapped APDUs with MIFARE DESFire cards with proxmark before?
It's described in the linked datasheet at page 18 + 19

Offline

#3 2019-07-08 19:55:17

iceman
Administrator
Registered: 2013-04-25
Posts: 9,518
Website

Re: Mifare Desfire Light

you can send raw bytes,  where you can send the "wrapped" style to test.   Its not implemented in code.

Offline

#4 2020-03-19 12:28:43

iceman
Administrator
Registered: 2013-04-25
Posts: 9,518
Website

Re: Mifare Desfire Light

In order to work with Ev1, Ev2 and Light tags,  I swapped to wrapped apdu.
That make these commands work again against the formentioned tag types.  I haven't tested with the first gen 40 desfire tag.

hf mfdes info
hf mfdes enum

You use the apdu command to talk with a desfire tag quite easy now.

hf 14a apdu -h

Offline

#5 2021-04-18 22:20:14

artkrime
Contributor
Registered: 2021-04-18
Posts: 2

Re: Mifare Desfire Light

What's the status with Light cards? I have some equipment which uses these Desfire light cards to "refill" virtual credits, which then enables you to use YOUR equipment with their proprietary materials.

Would this mean the equipment in question has a reader/writer that changes the credit from 1 to 0? Or is it more probable that the card contains a serial number which the equipment verifies?

Each new set of materials comes with a "new" desfire light card to up the credits.

Below is what the card outputs. I have 3 new cards. Each has a different UID and TAG IC Signature, everything else is the same between cards. So cloning would probably be useless?

Any other ideas or suggestions on ways to approach this? I blanked out identifiable information, not sure if it's useful to anyone else or worth concealing for security.

yUg7M6L.png

Offline

#6 2021-04-19 09:53:52

iceman
Administrator
Registered: 2013-04-25
Posts: 9,518
Website

Re: Mifare Desfire Light

You would need to start with looking at the data on the cards.

hf mfdes enum

Offline

Board footer

Powered by FluxBB