mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-10-06 14:17:46 +00:00
iceman1001andClaude Opus 5
4cca8df3a0
restore refused UL-AES outright. The generic page plan assumes the last four pages are cfg0/cfg1/PWD/PACK, which on UL-AES are the AES keys, so the data loop walked over the lock page, both config pages and the key lock bits at 0x2D. Give UL-AES its own plan: user memory 0x04..0x27, and lock/cfg0/cfg1 behind -s. Key pages 0x30..0x37 are left alone, the dump only ever carries AESKey0 and 0x34..0x37 read back as zeros. info never printed the UL-AES config. ulaes_print_configuration() is called with 0x29 but its first branch tested for 0x2C, so cfg0 and cfg1 fell through to the bare return and only the CMAC page showed up. info also read page 0x34 as if it were an EV1 config page. That is the UIDRetrKey. Genuine silicon NAKs the read, but a magic or simulated card would have had its key printed as cfg0/cfg1/PWD/PACK. Tested on a UL-AES with AUTH0=4, PROT set and secure messaging on. Restore of an unmodified dump comes back byte identical; a dump carrying DEADBEEF at 0x27 and CAFEBABE at 0x2B writes 0x27 and leaves 0x2B alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
