Skip to content

Proxmark3 – Adding Ultralight Support

by on October 11, 2013

Proxmark3

Introduction

The Proxmark3 appeared to be missing Mifare Ultralight support.  The ability to identify Ultralight cards was present within the ‘hf 14a reader‘ command. However the facility to read and write cards was sadly missing. But no worries as the protocol and instruction set is essentially the same as Mifare Classic; the only difference is standard Ultralight cards do not need authentication, and encryption and the Block size is 4 bytes long (Note: UltralightC cards are encrypted).

As of this morning the svn revision 814 now supports Mifare Ultralight thanks to a community supporter by the handle ‘midnitesnake’.

A simple ‘svn update‘ will update any current repository.  Else use the following command to grab the repository:

svn checkout http://proxmark3.googlecode.com/svn/trunk/ proxmark3

Demonstration

The end result, of reading an ultralight keycard from a hotel (the square brackets indicate whether the block is  write-protected/locked(1) or unlocked(0):

proxmark3> hf mf urdcard
Attempting to Read Ultralight...
#db# READ SECTOR FINISHED
isOk:01
Block 00: 04 34 ba 02
Block 01: f1 dd 25 80
Block 02: 68 48 00 00
Block 03: 00 00 00 00  [0]          
Block 04: ff ff ff ff  [0]          
Block 05: 00 00 00 00  [0]          
Block 06: 00 00 00 00  [0]          
Block 07: 00 00 00 00  [0]          
Block 08: 00 00 00 00  [0]          
Block 09: 00 00 00 00  [0]          
Block 0a: 00 00 00 00  [0]          
Block 0b: 00 00 00 00  [0]          
Block 0c: 45 5d 9d cc  [0]          
Block 0d: 5b 7e d2 f3  [0]          
Block 0e: 78 93 a8 cc  [0]          
Block 0f: 53 10 fa 22  [0]

Reading and writing specific blocks using the commands:

  • hf mf urdbl
  • hf mf wrbl
proxmark3> hf mf urdbl 15
--block no:0f          
#db# READ BLOCK FINISHED                 
isOk:01 data:53 10 fa 23           
proxmark3> hf mf uwrbl 15 5310fa22
--block no:0f          
--data: 53 10 fa 22           
#db# Data command: a2                 
#db# Data R: 0f 53 10 fa 22 fd 23                 
#db# WRITE BLOCK FINISHED                 
isOk:01          
proxmark3> hf mf urdbl 15
--block no:0f          
#db# READ BLOCK FINISHED                 
isOk:01 data:53 10 fa 22

Patch Location

For those interested the patch can be found here http://www.proxmark.org/forum/viewtopic.php?pid=8499#p8499

One Comment

Trackbacks & Pingbacks

  1. RFID | Pearltrees

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: