From 9ca0f9d16b88ec1c0f1d5c8d5ac8523ef1021fa8 Mon Sep 17 00:00:00 2001 From: michael Date: Thu, 2 Jul 2026 13:16:53 -0700 Subject: [PATCH 1/3] Improved UMC version detection/reporting in the lua script, added notes about 6666 having the same PACK issue and a reminder than the Ultralight EV1 plays by the same rules (pw/pack wise). --- client/luascripts/hf_mf_ultimatecard.lua | 13 +++++++------ doc/magic_cards_notes.md | 11 +++++++---- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/client/luascripts/hf_mf_ultimatecard.lua b/client/luascripts/hf_mf_ultimatecard.lua index e9e2fbed6..ca8d2609a 100644 --- a/client/luascripts/hf_mf_ultimatecard.lua +++ b/client/luascripts/hf_mf_ultimatecard.lua @@ -15,7 +15,7 @@ local _ug4_version = '' local _packpage = 'E6' copyright = '' author = 'Nathan Glaser' -version = 'v1.0.6' +version = 'v1.0.7' date = 'Created - Jan 2022' desc = 'This script enables easy programming of an Ultimate Mifare Magic card' example = [[ @@ -184,23 +184,24 @@ end --- -- Probe UMC revision robustly. CFCC occasionally returns a truncated -- frame (e.g. 3F/7F), so retry until we get a well-formed 5-byte version. --- New "UG4" replies 00 00 00 06 A0 -> PACK page 0x13; clean non-06A0 reads +-- Some (06A0, 6666) UMC versions -> PACK page 0x13; others are assumed fine -- and an unprobeable card fall back to page 0xE6. local function detect_packpage() if _ug4_version ~= '' then return end -- already classified this run for i = 1, 5 do - local v = (send("CF".._key.."CC") or ''):sub(1,10) - if #v == 10 and v:find('^%x+$') then -- exactly 5 hex bytes + local v = (send("CF".._key.."CC") or ''):sub(1,-5):sub(-4) + if v:find('^%x+$') then -- exactly 5 hex bytes _ug4_version = v:upper() + print("Detected UMC version: ".._ug4_version) break end end - if _ug4_version == '00000006A0' then + if _ug4_version == '06A0' or _ug4_version == '6666' then _packpage = '13' else _packpage = 'E6' if _ug4_version == '' then - print('[!] Warning: could not confirm UMC revision (CC probe corrupted); using PACK page 0xE6') + print("[!] Warning: unable to confirm config (".._ug4_version .."); using PACK page 0xE6") end end end diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md index c6a6592fc..cbc4818b9 100644 --- a/doc/magic_cards_notes.md +++ b/doc/magic_cards_notes.md @@ -3083,10 +3083,9 @@ hf 14a raw -s -c -t 1000 CF000000006B3F ^[Top](#top) ^^[Gen4](#g4top) -**For UMC 06A0** +**For UMC 06A0 and 6666** -Despite varying memory structures on their specs, the UMC derives things like the -PWD and PACK from fixed pages. The PWD is stored at E5 which matches the NTAG216/I2C transponders while the PACK is stored at 13 like an NTAG210. +Despite varying memory structures on their specs, the UMC derives things like the PWD and PACK from fixed pages. The PWD is stored at E5 which matches the NTAG216/I2C transponders while the PACK is stored at 13 like an NTAG210 or an Ultralight EV1. #### Set NTAG PWD @@ -3103,12 +3102,16 @@ script run hf_mf_ultimatecard -p ``` #### Set NTAG PACK ``` -hf mfu wrbl -b 13 -d <2-byte PACK>00 +hf mfu wrbl -b 13 -d <2-byte PACK>0000 ``` or ``` hf 14a -s -c -t 1000 a213<2-byte PACK>0000 ``` +or +``` +script run hf_mf_ultimatecard -a <2-byte PACK> +``` ### Set shadow mode (GTU) From bef2afcccf3d182409d98484d24a9c086d181893 Mon Sep 17 00:00:00 2001 From: michael Date: Fri, 3 Jul 2026 09:04:05 -0700 Subject: [PATCH 2/3] Added version numbers to ginfo output. Also, fixed version detection for short version response and updated magic card notes. --- client/src/cmdhfmf.c | 12 ++++++------ doc/magic_cards_notes.md | 2 ++ 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c index bbe36d391..c2c1954be 100644 --- a/client/src/cmdhfmf.c +++ b/client/src/cmdhfmf.c @@ -8830,7 +8830,7 @@ static int CmdHF14AGen4Info(const char *cmd) { uint8_t uid_len = resp[1]; res = mfG4GetFactoryTest(pwd, resp, &resplen, false); - if (res == PM3_SUCCESS && resplen > 2) { + if (res == PM3_SUCCESS && resplen >= 2) { PrintAndLogEx(INFO, ""); PrintAndLogEx(INFO, _CYAN_("Factory test")); @@ -8839,19 +8839,19 @@ static int CmdHF14AGen4Info(const char *cmd) { } if (memcmp(resp + resplen - 2, "\x66\x66", 2) == 0) { - PrintAndLogEx(INFO, "Card type... Generic"); + PrintAndLogEx(INFO, "Card type... Generic (%02X%02X)", resp[resplen - 2], resp[resplen - 1]); } else if (memcmp(resp + resplen - 2, "\x02\xAA", 2) == 0) { - PrintAndLogEx(INFO, "Card type... " _RED_("Limited functionality")); + PrintAndLogEx(INFO, "Card type... " _RED_("Limited functionality (%02X%02X)"), resp[resplen - 2], resp[resplen - 1]); } else if (memcmp(resp + resplen - 2, "\x03\xA0", 2) == 0) { - PrintAndLogEx(INFO, "Card type... Old card version"); + PrintAndLogEx(INFO, "Card type... Old card version (%02X%02X)", resp[resplen - 2], resp[resplen - 1]); } else if (memcmp(resp + resplen - 2, "\x06\xA0", 2) == 0) { - PrintAndLogEx(INFO, "Card type... " _GREEN_("New card version")); + PrintAndLogEx(INFO, "Card type... " _GREEN_("New card version (%02X%02X)"), resp[resplen - 2], resp[resplen - 1]); } else { - PrintAndLogEx(INFO, "Card type... " _RED_("unknown %02X%02X"), resp[resplen - 2], resp[resplen - 1]); + PrintAndLogEx(INFO, "Card type... " _RED_("unknown (%02X%02X)"), resp[resplen - 2], resp[resplen - 1]); } } diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md index cbc4818b9..6c7daaf6f 100644 --- a/doc/magic_cards_notes.md +++ b/doc/magic_cards_notes.md @@ -2837,6 +2837,8 @@ The CF..CC command is commonly considered to be a way of determining UMC version - 6666 "Card type generic" - 02AA "Card type limited functionality" +**NOTE**: Some versions (eg, 6666) return just the version + crc (4-bytes) others (eg, 06A0) return a zero padded version + crc (7-bytes). + ### Proxmark3 commands ^[Top](#top) ^^[Gen4](#g4top) From e04adc2fc9a9914d1cbfaac14d444f96841eb45d Mon Sep 17 00:00:00 2001 From: michael Date: Fri, 3 Jul 2026 11:46:17 -0700 Subject: [PATCH 3/3] Added notes to hf mfu restore/dump about UMC pw/pack issues --- client/src/cmdhfmfu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c index 50220fc24..a8db1b935 100644 --- a/client/src/cmdhfmfu.c +++ b/client/src/cmdhfmfu.c @@ -3502,7 +3502,9 @@ static int CmdHF14AMfUDump(const char *Cmd) { "hf mfu dump -k AABBCCDD -> dump whole tag using pwd AABBCCDD\n" "hf mfu dump -p 10 -> start at page 10 and dump rest of blocks\n" "hf mfu dump -p 10 -q 2 -> start at page 10 and dump two blocks\n" - "hf mfu dump --key 00112233445566778899AABBCCDDEEFF" + "hf mfu dump --key 00112233445566778899AABBCCDDEEFF\n" + "\n" + "Note: Dumping a NTAG/UL tag to a UMC will likely result in incorrect PWD and PACK\n" ); void *argtable[] = { @@ -4006,7 +4008,9 @@ static int CmdHF14AMfURestore(const char *Cmd) { "Restore MIFARE Ultralight/NTAG dump file (bin/eml/json) to tag.\n", "hf mfu restore -f myfile -s -> special write\n" "hf mfu restore -f myfile -k AABBCCDD -s -> special write, use key\n" - "hf mfu restore -f myfile -k AABBCCDD -ser -> special write, use key, write dump pwd, ..." + "hf mfu restore -f myfile -k AABBCCDD -ser -> special write, use key, write dump pwd, ...\n" + "\n" + "Note: Restoring a NTAG/UL dump to a UMC will likely result in incorrect PWD and PACK\n" ); void *argtable[] = {