From c2a44b151d936622f2d045ec07ffb2f1bedf603b Mon Sep 17 00:00:00 2001 From: michael Date: Sun, 7 Jun 2026 20:32:17 -0700 Subject: [PATCH] Updated magic cards notes with UMC PWD/PACK info for the 06A0 version --- doc/magic_cards_notes.md | 79 ++++++++++++++++++++++++++++++---------- 1 file changed, 59 insertions(+), 20 deletions(-) diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md index 1b43873e5..d31b03b38 100644 --- a/doc/magic_cards_notes.md +++ b/doc/magic_cards_notes.md @@ -1126,17 +1126,17 @@ No implemented commands today ### Variations ^[Top](#top) -| Factory configuration | Name | -| --- | --- | -| 850000000000000000005A5A00000008 | GDM | -| 850000000000005A00FF005A00000008 | GDCUID | -| 850000000000005A0000005A5A5A0008 | UCUID | +| Factory configuration | Name | +| -------------------------------- | ------------- | +| 850000000000000000005A5A00000008 | GDM | +| 850000000000005A00FF005A00000008 | GDCUID | +| 850000000000005A0000005A5A5A0008 | UCUID | | 8500000000005A00005A005A005A0008 | "7 byte hard" | -| 7AFF850102015A00005A005A005A0008 | M1-7B | -| 7AFF85000000000000FF000000000008 | FUID | -| 7AFF000000000000BAFA358500000008 | PFUID | -| 7AFF000000000000BAFA000000000008 | UFUID | -| 7AFF0000000000000000000000000008 | ZUID | +| 7AFF850102015A00005A005A005A0008 | M1-7B | +| 7AFF85000000000000FF000000000008 | FUID | +| 7AFF000000000000BAFA358500000008 | PFUID | +| 7AFF000000000000BAFA000000000008 | UFUID | +| 7AFF0000000000000000000000000008 | ZUID | *Not all tags are the same!* UFUID, ZUID and PFUID* are not full implementations of USCUID - they only acknowledge the first 8 (except wakeup command) and last config byte(s). @@ -2209,11 +2209,11 @@ No implemented commands at time of writing ^[Top](#top) -| Factory configuration | Name | -| --- | --- | -| 850000A0 00000AC3 00040301 01000B03 | UL-11 | -| 850000A0 00000A3C 00040301 01000E03 | UL-21 | -| 850000A0 0A000A00 00000000 00000000 | UL-C | +| Factory configuration | Name | +| ----------------------------------- | ------- | +| 850000A0 00000AC3 00040301 01000B03 | UL-11 | +| 850000A0 00000A3C 00040301 01000E03 | UL-21 | +| 850000A0 0A000A00 00000000 00000000 | UL-C | | 850085A0 00000AA5 00040402 01000F03 | NTAG213 | | 850000A0 00000A5A 00040402 01001103 | NTAG215 | | 850000A0 00000AAA 00040402 01001303 | NTAG216 | @@ -2657,6 +2657,7 @@ Can emulate MIFARE Classic, Ultralight/NTAG families, 14b UID & App Data * [Set 14443B UID and ATQB](#set-14443b-uid-and-atqb) * [(De)Activate Ultralight mode](#deactivate-ultralight-mode) * [Select Ultralight mode](#select-ultralight-mode) +* [NTAG21X/I2C Notes](#ntag-notes) * [Set shadow mode (GTU)](#set-shadow-mode-gtu) * [Direct block read and write](#direct-block-read-and-write) * [(De)Activate direct write to block 0](#deactivate-direct-write-to-block-0) @@ -2794,6 +2795,12 @@ Default ``: `00000000` * Shadow mode: GTU * Backdoor password mode +## UMC Version/Factory Test + +The CF..CC command is commonly considered to be a way of determining UMC versions. The card in circulation in recent years (2024? to present) is 06A0. It has some quirks. The older (previous?) 03A0 is assumed to have a full working featureset. The arm source points to the command being a "factory test." It also lists other possible values: +- 6666 "Card type generic" +- 02AA "Card type limited functionality" + ### Proxmark3 commands ^[Top](#top) ^^[Gen4](#g4top) @@ -2822,7 +2829,7 @@ hf 14a raw -s -c -t 1000 CF00000000CE02 ... ``` -👉 **TODO** In Mifare Ultralight / NTAG mode, the special writes (`hf mfu restore` option `-s`, `-e`, `-r`) do not apply. Use `script run hf_mf_ultimatecard` for UID and signature, and `hf mfu wrbl` for PWD and PACK. +👉 **TODO** In Mifare Ultralight / NTAG mode, the special writes (`hf mfu restore` option `-s`, `-e`, `-r`) do not apply. Use `script run hf_mf_ultimatecard` for UID and signature, and `hf mfu wrbl` for [PWD](#set-ntag-pwd) and [PACK](#set-ntag-pack). ### Change ATQA / SAK @@ -3036,6 +3043,37 @@ Example: set maximum 63 blocks read/write for Mifare Classic 1K hf 14a raw -s -c -t 1000 CF000000006B3F ``` +### NTAG Notes + +^[Top](#top) ^^[Gen4](#g4top) + +**For UMC 06A0** + +Despite varying memory structures on their specs, the UMC derives things like the +PWD and PACK from fixed pages. The PWD is stored at E5 which matches the NTAG216/I2C transponders while the PACK is stored at 13 like an NTAG210. + +#### Set NTAG PWD + +``` +hf mfu wrbl -b e5 -d +``` +or +``` +hf 14a raw -s -c -t 1000 a2e5 +``` +or +``` +script run hf_mf_ultimatecard -p +``` +#### Set NTAG PACK +``` +hf mfu wrbl -b 13 -d <2-byte PACK>00 +``` +or +``` +hf 14a -s -c -t 1000 a213<2-byte PACK>0000 +``` + ### Set shadow mode (GTU) ^[Top](#top) ^^[Gen4](#g4top) @@ -3047,10 +3085,10 @@ This description of shadow modes wroted by seller at marketpalces: And these conclusions were made after a number of tests with UMC (new version, configured as MFC for example): | Mode | Buffer | Standart command (rdbl, wrbl e.t.c) | Backdoor command (gsetblk, ggetblk, gload e.t.c.) | -|------|--------|-----------------------------------------|---------------------------------------------------| -| 2,3 | buf23 | read/write from/to buf23 | read/write from/to buf23 | -| 0 | buf0 | read from buf0, write to buf0 and buf23 | read/write from/to buf23 | -| 4 | - | read from buf0, write to buf23 | read/write from/to buf23 | +| ---- | ------ | --------------------------------------- | ------------------------------------------------- | +| 2,3 | buf23 | read/write from/to buf23 | read/write from/to buf23 | +| 0 | buf0 | read from buf0, write to buf0 and buf23 | read/write from/to buf23 | +| 4 | - | read from buf0, write to buf23 | read/write from/to buf23 | Mode 1: For new card this mode looks like a bug. Reading/writing first two block use *buf23*. Reading other blocks use invalid region of memory and all returned data looks like pseudo-random. All acl looks like invalid. All data is readable by the keys and acl wich was written in *buf0*. Any writing operations in this mode use copy of *buf0* and only it. It`s not affected any other buffers. So if you change keys or/and acl you will must use new keys to read data. @@ -3280,6 +3318,7 @@ hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC1910101112131 hf 14a raw -s -c -t 1000 CF00000000F001010000000003000978009102DABC19101011121314151644000001FB ``` + ### Version and Signature ^[Top](#top) ^^[Gen4](#g4top)