MIFARE DESFire® Compatible Modifiable UID / ATQA / SAK / ATS / APDU

€40.00
€40.00
€0
Sold out
Quantity must be 1 or more

INTRODUCTION

MIFARE DESFire® remains the industry standard for ultra-high security badges. As of yet - the MIFARE DESFire® remains invulnerable to all channels of analysis.

The inner workings of the MIFARE DESFire® cards remain under NDA lock and key, making it incredibly difficult to reverse engineer the protocols.

Lab401's MIFARE DESFire® EV1 / EV2 Compatible Modifiable UID / ATQA / SAK / ATS / APDU Card emulates a MIFARE DESFire® card, allowing you to set not only a custom UID, but also customise the ATQA, SAK, ATS and APDU values.

This means you are able to modify the card to simulate multiple types of DESFire® cards (EV1, EV2, etc).

Please note, this card does not emulate any other MIFARE DESFire® features.

Badges come in a white PVC card format.

Technical Specifications
Feature Information Notes
Chipset MIFARE DESFire® EV1 / EV2
Memory Size N/A UID Emultion only - no memory
UID Size 4-Byte / 7-Byte
UID Modifiable ✔️
Packaging 1x White PVC card format
Write Capabilities
UID Modifiable Unlock Required DirectWrite / Block 0 One Time Write Notes
✔️
Device Compatibility
Compatibility UID R/W Config Notes
Flipper Zero ❌ ❌
Proxmark / iCopy-X ✔️ ✔️
Android & iOS ✔️ ✔️ Requires MTools
LibNFC ✔️ ✔️ Requires raw commands
ChameleonUltra ✔️ ✔️ Requires MTools

Hands on with the MIFARE DESFire® EV1 /EV2 Compatible Modifiable UID / ATQA / SAK / ATS / APDU Card

Changing the UID
Using your Proxmark 3, you can issue the following command: 

Change UID Command
hf 14a raw -s -c -t 1000 cf00000000CD00<uid>

Example: Set UID to 11223344556677
 hf 14a raw -s -c -t 1000 cf00000000CD0011223344556677

Setting up ATS:

Setup ATS Command
hf 14a raw -s -c -t 1000 cf0000000034< Length > < ATS >
* The length is set to 0, indicating that ATS is not sent
* When SAK is 20, 28, be sure to set ATS, otherwise you can't read the card.
* The last two digits of ATS are CRC, which cannot be counted into the length

Example: Modify ATS to 060675781028002F0
 hf 14a raw -s -c -t 1000 cf000000003406067577810280

Setting up ATQA and SAK:

Setup ATQA / SAK Command 
hf 14a raw -s -c -t 1000 cf0000000035<ATQA><SAK>
* Note that ATQA is inverted on the Proxmark

Example: Set ATQA to 00 44 and SAK to 28
 hf 14a raw -s -c -t 1000 cf0000000035440028

Live Demonstration - Proxmark commands

Hands on with the MIFARE DESFire® EV1 /EV2 Compatible Modifiable UID / ATQA / SAK / ATS / APDU Card - LibNFC Commands

Using LibNFC with pn53x-tamashell, you can issue commands directly to the card.

Starting Tamashell

This will open an interactive session with your PN53x-based NFC reader.

LibNFC: Set UID to 11223344556677

LibNFC: Setting ATS

  • The length is set to 0, indicating that ATS is not sent
  • When SAK is 20, 28, be sure to set ATS, otherwise you can't read the card.
  • The last two digits of ATS are CRC, which cannot be counted into the length
Example: Modify ATS to 060675781028002F0

LibNFC: Setting ATQA and SAK

Note that ATQA is inverted on the Proxmark and LibNFC

Example: Set ATQA to 00 44 and SAK to 28

Live Demonstration - LibNFC commands

IMPORTANT:

This is an advanced card. Please ensure that you understand the implications of the commands you are sending, and perform dry-runs before any command execution. Incorrect configuration values can and will make your cards unresponsive.

Lab401 cannot provide support or refunds under any circumstances for cards that were 'bricked' due to incorrect commands.

Go to full site