Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] Redo magic cards notes #2003

Closed
wants to merge 31 commits into from
Closed

[WIP] Redo magic cards notes #2003

wants to merge 31 commits into from

Conversation

team-orangeBlue
Copy link
Contributor

Documentation about magic cards has now been moved into a separate folder, and split into 3 files.

These new documents should cover magic tags in a more grouped way - country-specific.
Each document now follows its' own naming scheme appropriate for its' region.
That being said, some modifications may be required.

Brief detailed changelog:

  • Made new folder: /doc/magic_cards
    • and moved magic cards documents inside
  • Original file:
    • Extra (Russian) aka's REMOVED
    • Gen4 GDM REMOVED
  • Russian magic:
    • Info about LF tags (H5.5/H7), HF tags (ULtra; UL-5; MF3) ADDED
  • Chinese magic:
    • Info about LF tags (ID82xx; ID5200; etc); HF tags (GDM; KUID; etc.) ADDED

@team-orangeBlue
Completely remove the magic cards doc for repurposing
b669761 
The document containing all magic cards will be replaced with 3 documents in the magic_cards folder:
1. `magic_cards_notes.md`, which will contain globally recognized magic tags.
2. `chinese_magic_notes.md`, which will contain magic tags mainly recognized, available and used in China.
3. `russian_magic_notes.md`, which will contain magic tags recognized, available and used in Russia.

Files 2 and 3 will be made from scratch.

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
New magic cards docs
f20326a 
The magic cards document has been expanded, split and moved to a separate folder.
See previous commit for more details

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Add table of contents to country-specific magic tags
21e42d7 
Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Add UL2
3b4040d 
Oops, I forgot...

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Formatting fix
9bce826 
Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Merge branch 'RfidResearchGroup:master' into master
08d94c2
@github-actions
Copy link

github-actions bot commented Jun 6, 2023

You are welcome to add an entry to the CHANGELOG.md as well

@team-orangeBlue
Critical styling fix
78ebb80 
(I am not a `make style` user)

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Copy link
Contributor Author

Midway comment: I have noticed active research on Chinese LF 82xx tags. When they will be implemented into PM3, I will update the notes again.

@team-orangeBlue team-orangeBlue marked this pull request as draft June 26, 2023 17:26
@team-orangeBlue
Copy link
Contributor Author

PR drafted.

Active research was noticed on QL88 (Mifare Classic EV1 cloning tag - custom keyed) and HUID ("FUID++" - custom keyed). When there will be more information, PR will be updated and undrafted.

@iceman1001 iceman1001 changed the title Redo magic cards notes WIP - Redo magic cards notes Jun 26, 2023
@iceman1001 iceman1001 changed the title WIP - Redo magic cards notes [WIP] Redo magic cards notes Jun 26, 2023
@team-orangeBlue
Merge branch 'RfidResearchGroup:master' into master
510dec2
@team-orangeBlue
Big chinese update
31e337e 
Added info about a lot of Copykey/拷贝齐 magic chips.

Signed-off-by: team-orangeBlue <[email protected]>
@iceman1001 iceman1001 added the wip Work in progress. Not ready for merging label Jul 23, 2023
@team-orangeBlue
USCUID/magic85 rewrite
0e4814b 
Now all chips are unified!
Explained configuration, backdoor blocks, default configurations for chips, etc. Waiting for updates!

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Explain functionality of Magic85 config
9cf63f6 
Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue team-orangeBlue mentioned this pull request Aug 18, 2023
Closed
@team-orangeBlue
Copy link
Contributor Author

Hey guys, whoever's keeping track! We got some info on Copykey chips (HUID, QL88), but it is incomplete and has mismatches. We've got to narrow that down for now.
If you're wondering what's special, here you go:

  1. HUID
  • Okay, it's custom keyed using mystery KDF, but it is same as QL88. But if on QL88 you can crack it, here you can't do much. :P
  • Apparently this is just renamed CUID. Observing behavior from Copykey cloner, the sector 0 ACL write protects block 0 and the ACL. Wow!..
  1. QL88
  • So I got the original SAK88-IC tag for "QinLin neighbor technology". And also a CPUK-X (horizontal epoxy). Much to my surprise they showed up as QL88 magic too. So same signature sector madness, same Prng: hard. However no custom keys on the Sak88.
  • Very odd, of course. However if you know QL88 you know that the signature sector on it has a header of "SBH111" in ASCII. This is not the case for the rest of the tags. Also sector 16, unlike on real Classic EV1 chips is completely functional.
    • Also block 0 manufacturer data is always the same: 88980020 000000F8. Also SAK88 is only used in block 0, not anticollision.

Soo.. fun day - are these QL88 tags some ripoff classic EV1 tags? Well, we're yet to find out.

@team-orangeBlue
Copy link
Contributor Author

team-orangeBlue commented Sep 3, 2023 •
edited
Loading

I'm required to add a word of warning here and in the .md's later: do NOT run hardnested on your QL88s!

I had 2 chips both of which I have cracked using hardnested, but I could not write block 0. At all. Ever. Even with copykey. It said "write success" when the UID wasn't changed.
I don't think I was scammed: I paid a normal amount per chip; the enclosure looked fine; sector 17 data seems to be decent, so on, etc. And the KDF keys were correct after all, right?
That being said, if you stil want to poke into your tags and you have a copykey, send a dump with data to the device using a PC and sniff the write twice (emulate a classic 1k tag with a proxmark but dont run eclr). You should get around 10.3K of trace - run mfkey32 on (for QL88:) 17th auth attempt; (for HUID:) 23rd auth attempt. Tested on Copykey X5 m. 10-11 v. 230329-230513

Oh by the way I read some of the PM3 help text and now know how to detect any 82xx LF chip. Oh also HUID is just a CUID rev.5. At least that's what I got. So don't get your hopes up with it being a revolution.

@team-orangeBlue
Quick fill-up commit
2c8fc61 
More info to be added in some hours

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Update for copykey tags
d14fd8e 
Added NSCK, Ultralight chips. Detailed whatever should have been detailed (ql88 write protect bug, HUID=CUID, how to detect ID8265/F8268/K8678 using proxmark), etc...

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
EM ID discovery added
4303065 
If you set an H5.5/H7 ID to 3F0096F87E you will see it show up as T55x7. 
Block 0 will always show up as `E0158801`, and downlink mode will show up as random stuff. Inconsistent.

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Add names, add SID
9521ac3 
SID isn't MFC1K nor mifare, so it's an "Other tag".
Added names for CUID (CAID, SUID)

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
GTU->UMC, TCOS, corrections
488f374 
More coverage on 06A0 variant of UMC card (warning about password, warning about shadow mode).
Added 14B magic TCOS card by Tianaxin. Not all commands present.

Fixed some grammar mistakes. Removed garbage. Added missing definitions.

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Copy link
Contributor Author

Okay, added some stuff to the main document.

It includes:

  1. Now there are warnings about 06A0 UMC card use. Or - shadow mode on must be "04", FE command doesn't work so use F0, etc.
  2. Added Tianaxin TCOS card. Most of the magic is there. The full document can be found HERE.
  3. Removed some "aka"'s, "DESFire 4b"'s 0008-20 is now FM1208-9 (but wrong ATS, not mentioned, but still).

@team-orangeBlue
QL88 update
fb4688a 
Is it.. not magic..? 4th tag tested with copykey. UID still NOT CHANGING!!!

Signed-off-by: team-orangeBlue <[email protected]>
@iceman1001
Copy link
Collaborator

time to merge?

@team-orangeBlue
Copy link
Contributor Author

time to merge?

Probably is.
I'll add another config for USCUID (FUID), then do an audit of what I made.
If you consider something to be wrong, you're more than welcome to point it out.

One problem is that I deleted the original magic notes and as such, its' edit history. May be a problem.

@iceman1001
Copy link
Collaborator

Yes,

the split between different countries is unwanted.

We want one document and it should be the original named one.

@team-orangeBlue
Correction 0: remove akas
c46f7f6 
My original idea was to add "aka ..." to all chips. Now however I think that this is probably not the smartest way to realize this. Probably going to add a subcategory.

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 1: add low frequency chips.
9d7e407 
Because why not. The market is no smaller.

ID82xx is for China.
H series is for Russia.

Feel free to contribute! It'll help a lot.

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 2: 14b magic
b8bcd72 
It's not what we want, eh.. but is there standartization in 14B, either way?
Of course not. So make it the tiananxin(天安信) reader tester card. At least it is part 4 compliant

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 2 followup
991eaf8 
Removed useless header and added to Table of Contents

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 3: add data to classic chips
229287f 
Added AKAs.
Renamed some points (otp2).
Filled up USCUID (previous GDM).
Added Furui supercard.

More to come..

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 4: ultralight updated, CN
b30b7e5 
Copykey password added

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 5: russian ultralight chips added
b79956b 
Also I added the DF 4b as fm1208-9..? why?

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 5 followup
53a5c40 
Oh no, one extra ^Top!
No biggie.

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 3 followup
1768a47 
Another one...

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Correction 6: smartcards
ae6c62e 
Are we.. done yet?
QL88...

Signed-off-by: team-orangeBlue <[email protected]>
@team-orangeBlue
Merge branch 'RfidResearchGroup:master' into NotesRevised
c5f3656
@team-orangeBlue
Merge branch 'master' into NotesRevised
0dd4f7a 
No more conflicts
@team-orangeBlue
Revert "Completely remove the magic cards doc for repurposing"
ca3ca1f 
This reverts commit b669761.
We need this file..
@team-orangeBlue
Merge pull request #1 from team-orangeBlue/NotesRevised
e1d36a5 
Notes revised.
And fixed.
Finally.
@team-orangeBlue
Copy link
Contributor Author

PR will be ready by tomorrow.

1, in a different PR. By reverting the deletion I essentially threw all blame on me, which is obviously not something we need.
2, in a single file.

@team-orangeBlue team-orangeBlue mentioned this pull request Nov 9, 2023
Merged
@team-orangeBlue
Copy link
Contributor Author

PR closed because I suck with using git broke the repository.
See #2169.

@team-orangeBlue team-orangeBlue deleted the master branch November 9, 2023 11:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
wip Work in progress. Not ready for merging
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@team-orangeBlue @iceman1001