Updated magic cards notes with UMC PWD/PACK info for the 06A0 version

2026-07-25 23:31:41 +00:00 · 2026-06-07 20:32:17 -07:00
parent 0b84d3bd3c
commit c2a44b151d
1 changed files with 59 additions and 20 deletions
@@ -1126,17 +1126,17 @@ No implemented commands today
 ### Variations

 ^[Top](#top)
-| Factory configuration | Name |
-| --- | --- |
-| 850000000000000000005A5A00000008 | GDM |
-| 850000000000005A00FF005A00000008 | GDCUID |
-| 850000000000005A0000005A5A5A0008 | UCUID |
+| Factory configuration            | Name          |
+| -------------------------------- | ------------- |
+| 850000000000000000005A5A00000008 | GDM           |
+| 850000000000005A00FF005A00000008 | GDCUID        |
+| 850000000000005A0000005A5A5A0008 | UCUID         |
 | 8500000000005A00005A005A005A0008 | "7 byte hard" |
-| 7AFF850102015A00005A005A005A0008 | M1-7B |
-| 7AFF85000000000000FF000000000008 | FUID |
-| 7AFF000000000000BAFA358500000008 | PFUID |
-| 7AFF000000000000BAFA000000000008 | UFUID |
-| 7AFF0000000000000000000000000008 | ZUID |
+| 7AFF850102015A00005A005A005A0008 | M1-7B         |
+| 7AFF85000000000000FF000000000008 | FUID          |
+| 7AFF000000000000BAFA358500000008 | PFUID         |
+| 7AFF000000000000BAFA000000000008 | UFUID         |
+| 7AFF0000000000000000000000000008 | ZUID          |

 *Not all tags are the same!* UFUID, ZUID and PFUID* are not full implementations of USCUID - they only acknowledge the first 8 (except wakeup command) and last config byte(s).

@@ -2209,11 +2209,11 @@ No implemented commands at time of writing

 ^[Top](#top)

-| Factory configuration | Name |
-| --- | --- |
-| 850000A0 00000AC3 00040301 01000B03 | UL-11 |
-| 850000A0 00000A3C 00040301 01000E03 | UL-21 |
-| 850000A0 0A000A00 00000000 00000000 | UL-C |
+| Factory configuration               | Name    |
+| ----------------------------------- | ------- |
+| 850000A0 00000AC3 00040301 01000B03 | UL-11   |
+| 850000A0 00000A3C 00040301 01000E03 | UL-21   |
+| 850000A0 0A000A00 00000000 00000000 | UL-C    |
 | 850085A0 00000AA5 00040402 01000F03 | NTAG213 |
 | 850000A0 00000A5A 00040402 01001103 | NTAG215 |
 | 850000A0 00000AAA 00040402 01001303 | NTAG216 |
@@ -2657,6 +2657,7 @@ Can emulate MIFARE Classic, Ultralight/NTAG families, 14b UID & App Data
 * [Set 14443B UID and ATQB](#set-14443b-uid-and-atqb)
 * [(De)Activate Ultralight mode](#deactivate-ultralight-mode)
 * [Select Ultralight mode](#select-ultralight-mode)
+* [NTAG21X/I2C Notes](#ntag-notes)
 * [Set shadow mode (GTU)](#set-shadow-mode-gtu)
 * [Direct block read and write](#direct-block-read-and-write)
 * [(De)Activate direct write to block 0](#deactivate-direct-write-to-block-0)
@@ -2794,6 +2795,12 @@ Default `<passwd>`: `00000000`
 * Shadow mode: GTU
 * Backdoor password mode

+## UMC Version/Factory Test
+
+The CF..CC command is commonly considered to be a way of determining UMC versions. The card in circulation in recent years (2024? to present) is 06A0. It has some quirks. The older (previous?) 03A0 is assumed to have a full working featureset. The arm source points to the command being a "factory test." It also lists other possible values:
+- 6666 "Card type generic"
+- 02AA "Card type limited functionality"
+
 ### Proxmark3 commands

 ^[Top](#top) ^^[Gen4](#g4top)
@@ -2822,7 +2829,7 @@ hf 14a raw -s -c -t 1000 CF00000000CE02
 ...
 ```

-👉 **TODO** In Mifare Ultralight / NTAG mode, the special writes (`hf mfu restore` option `-s`, `-e`, `-r`) do not apply. Use `script run hf_mf_ultimatecard` for UID and signature, and `hf mfu wrbl` for PWD and PACK.
+👉 **TODO** In Mifare Ultralight / NTAG mode, the special writes (`hf mfu restore` option `-s`, `-e`, `-r`) do not apply. Use `script run hf_mf_ultimatecard` for UID and signature, and `hf mfu wrbl` for [PWD](#set-ntag-pwd) and [PACK](#set-ntag-pack).

 ### Change ATQA / SAK

@@ -3036,6 +3043,37 @@ Example: set maximum 63 blocks read/write for Mifare Classic 1K
 hf 14a raw -s -c -t 1000 CF000000006B3F
 ```

+### NTAG Notes
+
+^[Top](#top) ^^[Gen4](#g4top)
+
+**For UMC 06A0**
+
+Despite varying memory structures on their specs, the UMC derives things like the
+PWD and PACK from fixed pages. The PWD is stored at E5 which matches the NTAG216/I2C transponders while the PACK is stored at 13 like an NTAG210.
+
+#### Set NTAG PWD
+
+```
+hf mfu wrbl -b e5 -d <new 4-byte PWD>
+```
+or
+```
+hf 14a raw -s -c -t 1000 a2e5<new 4-byte PWD>
+```
+or
+```
+script run hf_mf_ultimatecard -p <new 4-byte PWD>
+```
+#### Set NTAG PACK
+```
+hf mfu wrbl -b 13 -d <2-byte PACK>00
+```
+or
+```
+hf 14a -s -c -t 1000 a213<2-byte PACK>0000
+```
+
 ### Set shadow mode (GTU)

 ^[Top](#top) ^^[Gen4](#g4top)
@@ -3047,10 +3085,10 @@ This description of shadow modes wroted by seller at marketpalces:
 And these conclusions were made after a number of tests with UMC (new version, configured as MFC for example):

 | Mode | Buffer | Standart command (rdbl, wrbl e.t.c)     | Backdoor command (gsetblk, ggetblk, gload e.t.c.) |
-|------|--------|-----------------------------------------|---------------------------------------------------|
-| 2,3  |  buf23 | read/write from/to buf23                | read/write from/to buf23                          |
-|  0   |  buf0  | read from buf0, write to buf0 and buf23 | read/write from/to buf23                          |
-|  4   |   -    | read from buf0, write to buf23          | read/write from/to buf23                          |
+| ---- | ------ | --------------------------------------- | ------------------------------------------------- |
+| 2,3  | buf23  | read/write from/to buf23                | read/write from/to buf23                          |
+| 0    | buf0   | read from buf0, write to buf0 and buf23 | read/write from/to buf23                          |
+| 4    | -      | read from buf0, write to buf23          | read/write from/to buf23                          |

 Mode 1: For new card this mode looks like a bug. Reading/writing first two block use *buf23*. Reading other blocks use invalid region of memory and all returned data looks like pseudo-random. All acl looks like invalid. All data is readable by the keys and acl wich was written in *buf0*. Any writing operations in this mode use copy of *buf0* and only it. It`s not affected any other buffers. So if you change keys or/and acl you will must use new keys to read data.

@@ -3280,6 +3318,7 @@ hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC1910101112131
 hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000001FB
 ```

+
 ### Version and Signature

 ^[Top](#top) ^^[Gen4](#g4top)