[Q] A way to read/write block 0x00 and change UID - NFC Hacking

Are there any apps out there for Android which can read and write (or better yet copy over) all the data on an NFC card including the infamous block 0x00?
I want to clone several cards which all rely on the UID to identify the user, this way I can do away with 3 cards in my wallet by copying them over to stamp sized stickers.

You should not do this and probably you can not. 0x00 is write protected by the manufacturer and by the specification of the chip you are using. Besides the reader may be reading something else other than the UID.
GIR said:
Are there any apps out there for Android which can read and write (or better yet copy over) all the data on an NFC card including the infamous block 0x00?
I want to clone several cards which all rely on the UID to identify the user, this way I can do away with 3 cards in my wallet by copying them over to stamp sized stickers.
Click to expand...
Click to collapse

GIR said:
Are there any apps out there for Android which can read and write (or better yet copy over) all the data on an NFC card including the infamous block 0x00?
I want to clone several cards which all rely on the UID to identify the user, this way I can do away with 3 cards in my wallet by copying them over to stamp sized stickers.
Click to expand...
Click to collapse
Officially you can not change the sector 0x00 (as long as I know for mifare type). The reason is simple the hardware is just not writeable in this sector.
However, it exists some chinese clone (always for mifare card, I do not know for over card types) where the block 0x00 is not write protected by hardware.
Moreover, a software exists for this kind of card to change the UID (look at "nfc-mfsetuid" command).
I do not know where to find/buy these chinese clones.

Related

MicroSD Wear Leveling?

Do microsd cards have wear leveling circuitry in them? they're so small and i can't find any documentation which talks about only the microsd cards.
I only found documentation where all the features of flash media was bundled together
This is an old post, but i wonder exactly the same.
Newbie16 said:
Do microsd cards have wear leveling circuitry in them? they're so small and i can't find any documentation which talks about only the microsd cards.
I only found documentation where all the features of flash media was bundled together
Click to expand...
Click to collapse
I just found this info here:
http // answerpot. com/ showthread.php?251530-MicroSD+card+%2F+NAND+wear+leveling+algorithm
Hi,
On a prototype device which we plan to mass produce for customer deployment, we are facing failures for the microSD card, using authentic SanDisk microSD cards. We ran through a couple of permutations of card manufacturers are it is related to the file allocation table.
I am using ext3 on the microSD card partition to run android.
Although MicroSD cards have built in wear leveling, it seems that many of them rely on a file allocation table to balance wear, such as the ones used by FAT. ext3 is a journaling filesystem; as such, it lacks a file allocation table, and adds a journal, which is a very high data turnover disk area. It seems that the sd card wear leveling tends to be crude, and may not be smart enough to move the physical location of the journal, which means that it is likely to fail quickly.
So, is there a solution to this issue, when using MicroSD cards with android?
Does the Micron POP memory device have some sort of built-in hardware wear leveling algorithm? Or is it in software and is the algorithms in the linux kernel sufficient to take NAND wear leveling into account?
Best regards,
Elvis Dowson
Click to expand...
Click to collapse
If this info is correct, apparently microsd indeed has wear laveling, but it won't work at all with ext3, or i guess any other filesytem without a file allocation table.
So, any of you using ext3 partitions will have a less lifespan memory card.
i wonder it also..
Is this still true in ext4?
0
this is the 4th time that recently bought authentic ( h2testw tested) 64 GB and 128 GB micro SD cards got corrupted.
I am totally bewildered and this has been the most frustrating ordeal for me. I am using these on my mobile running Nougat 7.0 . in all cases I use the microSD card formatted into two partitions ext4 for or app2SD (or link2sd depending on what you use) linked data & other exFAT partition which is my main data partition. I can broadly divide my card into three areas based on usages
mostly RO
here I store all my I useful personal data - movies family pictures and stuff. this area is mostly read only.
moderate RW
pictures and movies coming from my camera
High RW
this is the binded WhatsApp folder I did not use the word link because this is not a symbolic link in that sense -the target is a different file system folder.viz exFAT so it is a bind that connects a F2FS partition folder to exFAT and I use app2SD folder mount feature to get this done
now the problem -depending on my luck from 2 months to 8 months in using these cards there is data corruption.I will not be able to write in WhatsApp image directory- that is the symptom that got me looking into this. I ran a chkdsk. with /r /x options & finally error out giving me the message that it ran out of free blocks.
now now what are my options
<> if I recover as much data as possible and reformat the partition, would that it take care of of the problem and how to avoid this in the future
<>toss the card in the trash bin and buy another new card and think of a different partitioning strategy that will be prevent this
<>now coming to the most important question . what would prevent this situation from happening how about if
<<>> I change the partition type and use FAT32 or ext4 - would that changed the outcome anyway
<<>> I will create totally 4 ext4 partitions including 1 for app2SD and other three for mostly RO, moderate RW and hi RW . how would this pan out in context of wear leveling. A F A I K wear leveling is oblivious of existence of partitions and it would still move around blocks to balance out or will it respect partition boundaries this is for not SSD but micro SD card ?
<> I Wonder if there exists some kind of a virusware that deliberately eats away into file bytes and corrupts them - I use malwarebytes to scan but so far nothing has shown up.
<> is it possible at the level of firmware to disable wear leveling.

[Q] NFC smart cards like Mifare DESfire or SmartMX

Hi,
I'd like to create a App which I want to unlock with a NFC based smart card like a Mifare SmartMX or DESfire. So the user needs the card to do certain stuff within the application.
After the smart card is programmed with "java card" for example, is it possible to communicate with android? Is android even possible to deal with the cryptosystems?
Has anybody tried that before or knows something about it?
Thanks very much for ur help..
At the moment I'm using a galaxy nexus with android 4.0.4
cheers
-eiMer
I know NFC TagInfo ( play.google.com/store/apps/details?id=at.mroland.android.apps.nfctaginfo&hl=en ) is able to communicate with Desfire card (among with a lot of other kinds).
It can even read the secured data if it is given the correct keys.
The android SDK provides classes to handle Mifare Classic card but not Desfire AFAIK. I don't know if the used an external Desfire library or if they implemented the whole protocol by themselves (it seems to be a very big research group - founded by NXP - so they might have) but it is definitely possible to use Desfire cards with Android.
Thanks for your help.
Ill try to find out how they managed the communication.
If I get some results Ill post them here.
eiMer said:
After the smart card is programmed with "java card" for example, is it possible to communicate with android?
Click to expand...
Click to collapse
Smartcards and also DESFire communicate using the ISO14443-4 transmission protocol (also known as ISO-DEP). Android provides the class IsoDep to communicate with these cards. Depending on the card, you would then exchange either ISO7816-4 APDU commands (e.g. with your JavaCard applet or with the DESFire card in ISO 7816-4 framing mode) or proprietary commands (e.g. with DESFire native command set).
eiMer said:
Is android even possible to deal with the cryptosystems?
Click to expand...
Click to collapse
The Android API already provides support for a wide range of cipher suites, hash functions ... If that's not sufficient for your type of card, you could also implement your own algorithms.
Gildas35 said:
I know NFC TagInfo is able to communicate with Desfire card (among with a lot of other kinds).
Click to expand...
Click to collapse
Correct. I've implemented support for DESFire. For the moment, however, only authentication with the default key (DES, all zeros) is supported.
Gildas35 said:
The android SDK provides classes to handle Mifare Classic card but not Desfire AFAIK. I don't know if the used an external Desfire library or if they implemented the whole protocol by themselves (it seems to be a very big research group - founded by NXP - so they might have) but it is definitely possible to use Desfire cards with Android.
Click to expand...
Click to collapse
I've implemented the protocol myself (on top of the IsoDep class). The original DESFire protocol is pretty straight forward and there's lots of help on the web. When it comes to the EV1 extensions (improved cryptography) things get a bit more difficult.
br
Michael

Reading/Writing MiFare Ultralight on Nexus S (ICS)

Hi,
I'm looking for a way to read & write on a Mifare Ultralight. I know a couple of applications available on the Play Store allow the possibility to read them, but I didn't find any application allowing me to write back (for example, change the data and save it back).
Is there a way to do so?
Also, is it possible to plug in the Android to my computer to use the NFC capabilities and to code in another language than Java? (some kind of bridge)
Thanks a lot for your support!
jpmonette said:
Hi,
I'm looking for a way to read & write on a Mifare Ultralight. I know a couple of applications available on the Play Store allow the possibility to read them, but I didn't find any application allowing me to write back (for example, change the data and save it back).
Is there a way to do so?
Also, is it possible to plug in the Android to my computer to use the NFC capabilities and to code in another language than Java? (some kind of bridge)
Thanks a lot for your support!
Click to expand...
Click to collapse
Have you tried NXP NFC Writer app? As of now there is no way to use your phone as a USB NFC reader.
Well I have both TagWriter and TagInfo. I can read the content of my NFC chip with TagInfo, but I can't with TagWriter. That's why I'm looking for something else to do the job, but can't find much on the Play Store.
jpmonette said:
Well I have both TagWriter and TagInfo. I can read the content of my NFC chip with TagInfo, but I can't with TagWriter. That's why I'm looking for something else to do the job, but can't find much on the Play Store.
Click to expand...
Click to collapse
Is the tag write locked? Formatting Classic 1K tags to NDEF is part of the standard NFC/NDEF libraries on Android. This allows full write access.
If you're trying to do it without NDEF then you have a different set of issues you'll need to deal with.
Nfc task launcher
Sent from my Nocturnal HOX
krohnjw said:
Is the tag write locked? Formatting Classic 1K tags to NDEF is part of the standard NFC/NDEF libraries on Android. This allows full write access.
If you're trying to do it without NDEF then you have a different set of issues you'll need to deal with.
Click to expand...
Click to collapse
Well, some pages are writable, some others aren't. Still, I can't get it to work with any apps I found (also the one people suggested in here).

Card emulation on Galaxy S3 olympics

Just read this article
http://global.samsungtomorrow.com/?p=16659
The interesting thing is that they must have been using the hidden API to be able to use card emulation.
From my experience with hotel nfc cards they often are Mifare UltraLight cards.
Maybe they are giving out special phones using a custom ROM made by samsung that has this enabled.
I'm currently checking the 4.1 sources to see if anything can be done with that.
So what do you guys think about this? If someone with access to this phone could dump the rom it could be easily checked with the current S3 and see the diff.
This is interesting but I think we will have to wait. The article says only 40 VIPs will get it to start, the odds of any of them dumping the the ROM is slim to none.
Fredro said:
Just read this article
http://global.samsungtomorrow.com/?p=16659
The interesting thing is that they must have been using the hidden API to be able to use card emulation.
From my experience with hotel nfc cards they often are Mifare UltraLight cards.
Maybe they are giving out special phones using a custom ROM made by samsung that has this enabled.
I'm currently checking the 4.1 sources to see if anything can be done with that.
So what do you guys think about this? If someone with access to this phone could dump the rom it could be easily checked with the current S3 and see the diff.
Click to expand...
Click to collapse
They have the Holiday Inn app on their phone, as shown on Engadget. I think there are already apps that let you copy NFC card data to your phone.
Product F(RED) said:
They have the Holiday Inn app on their phone, as shown on Engadget. I think there are already apps that let you copy NFC card data to your phone.
Click to expand...
Click to collapse
Indeed copying the card is no problem, though it's the ability to use the phone to emulate the card that is interesting
Fredro said:
Indeed copying the card is no problem, though it's the ability to use the phone to emulate the card that is interesting
Click to expand...
Click to collapse
All it does is transmit what was copied on the card via NFC. But in my experience most hotels don't use NFC yet; they still use magnetic strip cards, which by the way can still be easily copied. Just because they're encrypted doesn't mean you can't just copy the raw encrypted data to another card. Check this out:
Product F(RED) said:
All it does is transmit what was copied on the card via NFC. But in my experience most hotels don't use NFC yet; they still use magnetic strip cards, which by the way can still be easily copied. Just because they're encrypted doesn't mean you can't just copy the raw encrypted data to another card. Check this out:
Click to expand...
Click to collapse
I've been to several new hotels which indeed use NFC Ultralight cards.
I'm saying that, to be able to use this data you've copied from a card onto your phone, you need to be able to make the phone emulate the same card as the one you copied from. And that is the interesting part.
I'm working on a patch for 4.1.1 (galaxy nexus) that will enable this option, same as the phones used at this olympic hotel.
Google Wallet works in the same way, doesn't it? Card emulation is built into Android, but for an application (like Google Wallet) to use it, it must hold the access keys to the secure element.
Samsung controls the secure element in the S3; writing an application that can access the secure element is no problem for them.
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
LoveNFC said:
Google Wallet works in the same way, doesn't it? Card emulation is built into Android, but for an application (like Google Wallet) to use it, it must hold the access keys to the secure element.
Samsung controls the secure element in the S3; writing an application that can access the secure element is no problem for them.
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
Click to expand...
Click to collapse
yes, it's correct that samsung has control over who has access to it, but it's easy to "add yourself" if you patch the software.
About the keys for each sector, this is no problem because the ultralight cards dont use any encryption, even for the classic cards the protection is broken. So this doesn't really matter, the point is that people should be able to create their own cards inside the phone for their own usage for example.
Fredro said:
I've been to several new hotels which indeed use NFC Ultralight cards.
I'm saying that, to be able to use this data you've copied from a card onto your phone, you need to be able to make the phone emulate the same card as the one you copied from. And that is the interesting part.
I'm working on a patch for 4.1.1 (galaxy nexus) that will enable this option, same as the phones used at this olympic hotel.
Click to expand...
Click to collapse
Please kindly let me know if you succeed in patching the galaxy nexus, as I really want to use my phone as a nfc to open my building entrance door!
any. outhosur
Fredro said:
yes, it's correct that samsung has control over who has access to it, but it's easy to "add yourself" if you patch the software.
About the keys for each sector, this is no problem because the ultralight cards dont use any encryption, even for the classic cards the protection is broken. So this doesn't really matter, the point is that people should be able to create their own cards inside the phone for their own usage for example.
Click to expand...
Click to collapse
Sometimes I totally no idea why RFID card or NFC tag emulation so complicated.
fordiy said:
Sometimes I totally no idea why RFID card or NFC tag emulation so complicated.
Click to expand...
Click to collapse
cuz of the thousands of geezers who wanna abuse cards or nfs tags
LoveNFC said:
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
Click to expand...
Click to collapse
I've succesfully copied and cracked a Mifare classic card, thus accessing all the data in the sectors. It took me just over 10 minutes for a single card. But my interest is also, how can I put this card dump file on my phone and let the NFC chip push/emulate this card dump as a Mifare card?
See also http://forum.xda-developers.com/showthread.php?t=1706057
Is there any reason it has to be your phone? Could you write the info to a mifare tag, and get the same effect? This would allow you to clone the card to a paper sticker.
sysadmn said:
Is there any reason it has to be your phone? Could you write the info to a mifare tag, and get the same effect? This would allow you to clone the card to a paper sticker.
Click to expand...
Click to collapse
The Problem is that you can't change the ID of the card. Most applications check (only) for the ID as it is (falsely) seen by many as unique and unspoofable. So an card emulator able to let you change the ID as handy as a smartphone would be really really nice
nookieman said:
The Problem is that you can't change the ID of the card. Most applications check (only) for the ID as it is (falsely) seen by many as unique and unspoofable. So an card emulator able to let you change the ID as handy as a smartphone would be really really nice
Click to expand...
Click to collapse
But this feature is normally not accessible in the phones - partly also because of these reasons.
You would have to obtain keys to the ecure element from the operator or the handset manufacturer and will surely not give it to you if you are not a bank or someone of a similar size
---------- Post added at 02:38 PM ---------- Previous post was at 02:32 PM ----------
Perhaps you could also try to use an unofficial ROM, but I am not sure if that solves the problem
In order to emulate MIFARE Ultralight, you need the first UID byte = 0x04. NXP Semiconductors have introduced a restriction in their interface chips such that UID0 is hardwired to 0x08, meaning "random UID" according to their specifications. So even if hidden Android API get released, it will still not be possible to use the phone itself for MIFARE Ultralight tag emulation. However, EMUTAG emulator on emutag.com totally solves the problem by being portable, and can emulate any UID with almost no restrictions* (see Manual).
yeah its right.. i agree with you

[Read Before Posting] NFC, Mifare, Android and FAQs

Please take a moment to read through this before posting, not only is a brief description of NFC and some of its uses included but also you will find a few of the more commonly asked questions. Over time these will be added to accommodate new or recurring queries that are being seen in this thread. If you have come to the thread to ask about emulating, copying or bypassing your Mifare card head down to the FAQs below .
What Is NFC
Near Field Communication (NFC) is a technology that was built upon Radio Frequency Identification (RFID). It allows for the storage of data without the need for a direct power supply. When a reader such as a NFC enabled phone comes within range (usually an inch or less) data can be read/written from/to the tag.
Objects containing NFC can be found in two varieties, active or passive. Passive devices are ones that contains data but do not read and generally will not have their own power supply. These are found in NFC tags such as those in Credit/Debit cards, Student or ID cards, Library books and passports among many. For a much larger of scannable objects see here. Their are also active devices, these can read information stored on other NFC devices and for the majority of us here these will be our phones. These active devices can also usually alter the data found on tags or transmit/exchange data with other active devices.
Uses for NFC
NFC has many uses both commercial and on a development/hobby level, here are just a few:
Contactless payment
Transfer of data from phone to phone
Share and log on to WI-FI
Sharing contact information
Automating tasks
Storing bitcoin wallets
Disabling alarms
Send Wake-On-Lan commands
FAQs
How can I emulate, copy, edit or bypass my Mifare card (student ID, work ID, Bus pass etc)?
The short answer: you can't
The long answer: There are numerous reasons why you may have had issues finding this information on XDA. Primarily because it is not possible from the vast majority of phones and for good reason. Mifare as mentioned above is a security layer for NFC cards and therefore the process isn't as simple as just downloading an app, scanning a security card and then forgetting about it. Secondly depending on the type of tag you are trying to use this is either A) illegal or B) against your companies, service provider, school's security policy and as such you will not find this information on XDA.
Your options from here are: look elsewhere for this information, just use your card as instructed or speak to your IT department about adding another form of NFC tag to the system, I for instance have an NFC tag implanted in my hand which my IT department was more than happy to add to my user profile at university. More information on this can be found here.
Click to expand...
Click to collapse
How can I hack my Bus pass, Oyster card etc to add more credit or extend its expiration date?
See the answer above ^
Click to expand...
Click to collapse
How can I unlock my Android phone using NFC
See "NFC LockscreenOffEnabler" for Xposed
Click to expand...
Click to collapse
How can I make Android trigger an event when I scan an NFC tag?
For simple commands you can use apps such as NFC Tools or Trigger.
For more complicated tasks a combination of Tasker and Locale can be used to launch just about any chain of events upon finding a specific tag. Of course alternatives do exist, so be sure to check out a few of the other projects around the site
Click to expand...
Click to collapse

Categories

Resources