mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-10-01 06:28:37 +00:00
iceman1001andClaude Opus 5
4d4dd32354
The simulation answers SetConfiguration. The option byte travels in the clear and the data behind it is enciphered with a CRC32, the same shape ChangeKey uses, and card level master key authentication is required (M134034 9.4.9). Option 0x00, the configuration byte, is kept in the card image header. Both bits it defines are one way on a card -- the spec says "cannot be reset" of each -- so they are only ever set, never cleared, and a reader that sends a zero byte afterwards gets an OK and no change, which is what the silicon does. bit 0 disables FormatPICC, and that command now refuses from then on. bit 1 switches anticollision to a random id: a 4 byte id whose first byte is the 0x08 random tag and whose other three are the random number, with a single cascade level (M134034 6.5). The real UID is then only reachable through GetCardUID, which is the reason that command exists. A card draws the number at RF reset; the nearest thing here is the start of a simulation, since that is when the anticollision answers are built, so it is stable across activations within one run and different across runs -- measured 08 01 9A C9 four times in a row, then 08 01 BB 96 and 08 01 DC 26 and 08 01 FC 8E on three restarts. Simulating that needed the 4 byte case adding to the UID length the simulation accepts, which previously took only 7 and 10 and refused to start otherwise. Option 0x02 replaces the ATS. It lands in the image, so it takes effect the next time the simulation starts rather than mid-run, because the ATS is one of the answers precompiled before the reader is listened to. Option 0x01, the default key new applications are created with, is refused with 91 9E rather than accepted and ignored. Storing it needs two fields the card image does not have, and adding them moves every table in it. A reader that sets a default key and then finds new applications keyed with zeros is worse off than one told the option is not there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>