Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

  • Logged in as ikarus
  • Last visit: Today 11:22:42

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

Pages: 1

Post reply

#1 2023-03-02 16:38:25

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Aztek tag

Hello, someone understand how to read and write an Aztek Tag.
I've searched on forum but i don't understand.
Sorry for my english.

Offline

#2 2023-03-02 18:09:47

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Hi, what kind of hardware are you using to try and read this badge.

Offline

#3 2023-03-03 07:16:01

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Re: Aztek tag

I try with a PM3

Offline

#4 2023-03-03 16:56:15

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Hello, pm3 easy ok normally you should be able to read this badge which cmd you are using.

Offline

#5 2023-03-03 21:02:32

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Re: Aztek tag

I only do this for now, because i don't know if it's complete

[usb] pm3 --> sc r hf_14a_aztek.lua
[+] executing lua C:\working\ProxSpace\pm3\proxmark3\client\luascripts/hf_14a_aztek.lua
[+] args ''

Found Card UID [05257B04F78A41]

blk | data             | xored
----+------------------+-------------------
 00 | 8805257B04F78A41 | 8805257B04F78A41 |
 01 | 0002000000000000 | 0002000000000000 |
 02 | F4D30B234D15B50E | F4D30B234D15B50E |0
 03 | 0000000000000000 | 55AA55AA55AA55AA |
 04 | 0000000000000000 | 55AA55AA55AA55AA |
 05 | 0000000000000000 | 55AA55AA55AA55AA |
 06 | 0000000000000000 | 55AA55AA55AA55AA |
 07 | 0000000000000000 | 55AA55AA55AA55AA |
 08 | 0000000000000000 | 55AA55AA55AA55AA |
 09 | 0000000000000000 | 55AA55AA55AA55AA |
 10 | 0000000000000000 | 55AA55AA55AA55AA |
 11 | 76986CD11C914826 | 2332397B493B1D8C |
 12 | AF21A58D2FD8C9F8 | FA8BF0277A729C52 |
 13 | DB954C4C7DF4A9DF | 8E3F19E6285EFC75 |
 14 | 5AD58067F4224704 | 0F7FD5CDA18812AE |
 15 | 0000000000000000 | 55AA55AA55AA55AA |
 16 | 20357BD7BA72A790 | 759F2E7DEFD8F23A |
 17 | 9E2855B854C87C01 | CB820012016229AB |
 18 | A38067DF0D88B2D6 | F62A32755822E77C |
 19 | 8008301220B89439 | D5A265B87512C193 |
 20 | 031867C0F9374B90 | 56B2326AAC9D1E3A |
----+------------------+-------------------

Dumped data into 05257B04F78A41.eml

Offline

#6 2023-03-04 11:57:19

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Hello, as there is more on this post I delete the text, too bad this post remains without follow-up.

Good day.

Last edited by fazer (2023-05-16 08:22:55)

Offline

#7 2023-03-04 18:28:43

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Re: Aztek tag

Thanks for your help but i can't find the script luxeodecode

Offline

#8 2023-03-04 18:39:06

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Re, & luxeo script?, ok I can see putting it on mega if you want. What & your uid to verify the known key

Last edited by fazer (2023-03-08 17:05:47)

Offline

#9 2023-03-05 08:19:15

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Re: Aztek tag

Thank for help help, but i can't dump with mfoc because it's not a mifare classic

Offline

#10 2023-03-05 10:56:29

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Hello, I do not know this Aztek badge with your PM3 have you made a self -research or HF Search to see the information of your badge. In the 14a azteck script that you launched had you try HF 14A -H & then HF 14A Info.
Good day.

Your pm3 easy & up to date?

Last edited by fazer (2023-03-05 12:59:19)

Offline

#11 2023-03-06 06:53:03

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Re: Aztek tag

[usb] pm3 --> HF 14A Info

[+]  UID: 05 25 7B 04 F7 8A 41
[+] ATQA: 00 44
[+]  SAK: 00 [2]
[+] MANUFACTURER: Infineon Technologies AG Germany
[+]    my-d(tm) command set SLE 66R01/16/32P (Type 2 Tag)
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities : NTAG21x
[?] Hint: try `hf mfu info`

Offline

#12 2023-03-06 10:16:07

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Hi, look at the end of the screen.
hf mfu info

Offline

#13 2023-03-06 12:53:40

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Re: Aztek tag

[usb] pm3 --> hf mfu info

[=] --- Tag Information --------------------------
[=] -------------------------------------------------------------
[+]       TYPE: INFINEON my-dÖ NFC (SLE 66RxxP) ( magic  )
[+]        UID: 05 25 7B 04 F7 8A 41
[+]     UID[0]: 05, Infineon Technologies AG Germany
[+] Blocks 0-2: 00 00 00 00 00 00 00 00 00 00 00 00
[+]       Lock: 00 00  - 0000000000000000
[+] OneTimePad: E1 10 7E 00  - 11100001000100000111111000000000

[=] --- NDEF Message
[+] Capability Container: E1 10 7E 00
[+]   E1: NDEF Magic Number
[+]   10: version 0.1 supported by tag
[+]        : Read access granted without any security / Write access granted without any security
[+]   7E: Physical Memory Size: 1008 bytes
[+]   00: Additional feature information
[+]   00000000
[+]   xxx..... - 00: RFU ( ok )
[+]   ...x.... - 00: don't support special frame
[+]   ....x... - 00: don't support lock block
[+]   .....xx. - 00: RFU ( ok )
[+]   .......x - 00: IC don't support multiple block reads
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory...
[=] ------------------------------------------------------------

Offline

#14 2023-03-06 19:44:00

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Hi, you need your badge documentation to see if you can do anything with it or try asking for help on the forum.

Last edited by fazer (2023-03-06 19:48:16)

Offline

#15 2023-03-08 17:10:22

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Hi, I forgot to tell you that you have to change a value in the luxeodecode script because there is a value for cryt =true
and decrypt=false.

Offline

#16 2023-03-17 18:49:39

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

slt Cedisov62, I am attaching an aztek badge Unciphered data


Header:   
4C55582F550000000000000000002843   
240204103C103C102100010000009EA4   
2E02040A010001000000000000006972   
CRC16/ARC = 0x7269 OK   

DataA:   
9F00C06100DAF1EA230354160020B426   
C8000000000000000000000000000000   
00007F7F7F7F7F1F1F1F0100FF032820   
00000000200820010000000000005A7B   
Version 0x009F   
Credit : 2   
CRC16/ARC = 0x7B5A OK   
Date: 2023/03/14 16:20   

DataB:   
9E00C06100DAF03B221256080015B426   
00000000000000000000000000000000   
00007F7F7F7F7F1F1F1F0100FF034820   
00000000200820010000000000003A8F   
Version 0x009E   
Credit : 0   
CRC16/ARC = 0x8F3A OK   
Date: 2022/12/16 08:15   

Footer:   
01000000000001D10000000000000000   
DBFD32D48F4FB471DBFD32D48F4FB471   
DBFD32D48F4FB471DBFD32D48F4FB471   
DBFD32D48F4FB471DBFD32D48F4FB471   
02000000000001E20000000000000000   
DBFD32D48F4FB471DBFD32D48F4FB471   
DBFD32D48F4FB471DBFD32D48F4FB471   
DBFD32D48F4FB471DBFD32D48F4FB471   
DBFD32D48F4FB471DBFD32D48F4FB471   
DBFD32D48F4FB471DBFD32D48F4FB471

Last edited by fazer (2023-03-19 19:07:29)

Offline

#17 2023-03-27 18:32:13

cedisov62
Contributor
Registered: 2018-09-28
Posts: 10

Re: Aztek tag

Hi Fazer, i don't understand how do you do? I'm a newbie with PM3.
Could you explain me step by step
Thnak you for helping me

Offline

#18 2023-03-29 17:42:11

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: Aztek tag

Slt Sedisov62, You just have to follow the tutorial above, everything & explain. You already need the complete dump of the aztek badge in the first time. When I see 14a info it seems that it is an ultralight mifare.

I see you may have had a file
Dumped data into 05257B04F78A41.eml. So with this .eml file you have to run the luxeodecode script. It will create a decrypt file but first you have to change in the script - Change the values here
emlfile = "05257B04F78A41".eml" -- file in
cipher = false -- if cipher=true, we encrypt, otherwise we decrypt . then the decrypt file will be in the pm3 folder, you have to change the values you want to recalculate the encrypted crcs so (true) then put it back (false) decrypt to verify crc error if there is ok encrypted & restore, here is basically be careful with all these files not to mix things up.
Good evening.

Last edited by fazer (2023-03-29 18:33:59)

Offline

Pages: 1

Post reply

Quick reply

Write your message and submit

Board footer

Powered by FluxBB