Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

  • Logged in as ikarus
  • Last visit: Today 11:22:42

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2023-11-29 14:19:45

fazer
Contributor
Registered: 2019-03-02
Posts: 140

MAD1 mifare.

Hello, I have just recovered an RFID bracelet for swimming pool access, I have the dump with the keys which are fine, there is a MAD which points to sector 04, in the documentation "AN10787" I see for my case 00 04 hex sector contains card holder information in ASCII format. With this cmd hf mf mad --aid 2ec0 -k 00008627C10A -b I get this from sector 04.
[=] -------------- AID 0x2ec0 ---------------
  [016] 0F E1 00 00 06 00 00 00 00 00 00 00 00 00 00 00
  [017] 00 00 00 00 80 FF FF 68 00 00 00 00 00 00 00 00
  [018] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

then: hf mf mad --be -k 00008627C10A -b
this: [=] ---------------- Listing ----------------
[=] 00 MAD v1
[=] 01 [0000] free
[=] 02 [0000] free
[=] 03 [0000] free
[=] 04 [C02E] Complete system for lockers, access control & electr. payment [Ojmar S.A.]

My question Aid 0x2ec0 in hex corresponds to the manufacturer's information?.
I saw that you could put information like name, gender, phone number, etc...

sector 0:
  "blocks": {
    "0": "3B127B792B080400036BDEA93F78F490",
    "1": "1500000000000000C02E000000000000",
    "2": "00000000000000000000000000000000",
    "3": "A0A1A2A3A4A5787788C18627C10A7014",



Thanks, have a good day.

Last edited by fazer (2023-11-29 14:21:43)

Offline

#2 2023-12-09 10:33:43

fazer
Contributor
Registered: 2019-03-02
Posts: 140

Re: MAD1 mifare.

Hello, I am trying to move forward with this Mad which points to sector 4, if I put a 04 in sector 0 with the Mad to have information on Card Holder Info data do you think it is feasible? regarding information Compelete system for lockers, access control & electr. payment [Ojmar S. A.] = i.e. big endian.Thank you in passing for easily obtaining this information with my proxmark3 "developer".
In sector 0 acl = 787788 "C1=GPB" & sector4 acl = 0F00FF "AA= GPB"

Thanks, have a good day.




Again, well I tried, no good, it gives me information on another sector. In addition, great, it must have the new 8bit crc, well I will continue reading this sector, in sector 1 I have all the information "session date" the TLV except that I have 03 but no FE in the sector but still an 03 for the end.

C0 value = entertainment & sports

Last edited by fazer (2023-12-09 11:33:18)

Offline

Quick reply

Write your message and submit

Board footer

Powered by FluxBB