From 2d2207e0f680b4f1b3ba37d9c9114c00c41230f6 Mon Sep 17 00:00:00 2001 From: c-barron Date: Sat, 8 Aug 2026 11:58:15 -0700 Subject: [PATCH] Document USCUID-UL commands and fix hf_mf_uscuid_prog usage name The magic card notes listed "No implemented commands" for USCUID-UL, but hf_mfu_uscuid.py and hf_mf_uscuid_prog.lua both drive these cards (config, type, UID, signature, backdoor read/write). Document both scripts and how to set the tag signature, and correct the script name shown in the lua script's own usage text. --- CHANGELOG.md | 2 ++ client/luascripts/hf_mf_uscuid_prog.lua | 2 +- doc/magic_cards_notes.md | 21 ++++++++++++++++++++- 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d2f28c41e..d4cab4ea3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,8 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] +- Changed `magic_cards_notes.md` - documented the USCUID-UL helper scripts (`hf_mfu_uscuid` / `hf_mf_uscuid_prog`) and how to set the tag signature, replacing the outdated "No implemented commands" note (@c-barron) +- Fixed `hf_mf_uscuid_prog.lua` - corrected the script name shown in its usage text (@c-barron) - Added `hf felica seacauth1` command - Added `lf trovan` commands to support Trovan Animal ID (@iceman1001) - Added `hf mf gdmgetblk/gdmgethidblk/gdmsethidblk/gdmsetuid/gdmwipe/gdmsetsig` (@0x6r1an0y) diff --git a/client/luascripts/hf_mf_uscuid_prog.lua b/client/luascripts/hf_mf_uscuid_prog.lua index 344747f90..d0afe351e 100644 --- a/client/luascripts/hf_mf_uscuid_prog.lua +++ b/client/luascripts/hf_mf_uscuid_prog.lua @@ -44,7 +44,7 @@ example = [[ 3. script run hf_mf_uscuid_prog -S 0 ]] usage = [[ -script run hf_mf_uscuid_uid_prog [-h] [-u ] [-t] [-3] [-s ] [-w 1] [-R -B ] [-S -E ] [-g -c -b -2 -7 -d -a -n -r <0/1>] +script run hf_mf_uscuid_prog [-h] [-u ] [-t] [-3] [-s ] [-w 1] [-R -B ] [-S -E ] [-g -c -b -2 -7 -d -a -n -r <0/1>] ]] arguments = [[ -h this help diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md index 6c7daaf6f..ab3163040 100644 --- a/doc/magic_cards_notes.md +++ b/doc/magic_cards_notes.md @@ -2233,7 +2233,26 @@ hf 14a raw -akb 7 40; hf 14a raw -k 43; hf 14a raw -ck A2F2000000BD; hf 14a raw ^[Top](#top) -No implemented commands at time of writing +Two helper scripts drive USCUID-UL cards: + +* `script run hf_mfu_uscuid` (Python) - read/parse config, change emulated type, set UID, set signature, and raw backdoor read/write. +* `script run hf_mf_uscuid_prog` (Lua) - equivalent functionality. See `-h` for its options. + +Backdoor operations (set UID, set signature, raw hidden-block read/write) require the gen1a backdoor to be enabled - a config block starting with `7AFF`, see the [USCUID-UL configuration guide](#uscuid-ul-configuration-guide) - and a magic wakeup to be selected: for the Python script, `--gen1a` (`40`/`43`) or `--gdm` (`20`/`23`). + +Example - write the tag signature (32 bytes / 64 hexsymbols) using the `40:43` wakeup: + +``` +script run hf_mfu_uscuid -s --gen1a +``` + +Verify with `hf mfu info` and look for `Signature verification: successful`. + +The same result can be achieved manually with raw commands (magic wakeup, then write the eight signature pages `F8`-`FF`): + +``` +hf 14a raw -akb 7 40; hf 14a raw -k 43; hf 14a raw -ck A2F8<4 bytes>; ...; hf 14a raw -c A2FF<4 bytes> +``` ### libnfc commands