INTRODUCTION
MIFARE DESFire® remains the industry standard for ultra-high security badges. As of yet - the MIFARE DESFire® remains invulnerable to all channels of analysis.
The inner workings of the MIFARE DESFire® cards remain under NDA lock and key, making it incredibly difficult to reverse engineer the protocols.
Lab401's MIFARE DESFire® Compatible UID Modifiable Emulator Card is a card that emulates a MIFARE DESFire® card, allowing you to set a custom UID.
This card will allow for bypass on systems that authenticate based off the UID.
Technical Specifications
| Feature |
Information |
Notes |
| Chipset |
MIFARE DESFire® EV1 / EV2 |
|
| Memory Size |
N/A |
UID Emultion only - no memory |
| UID Size |
4-Byte / 7-Byte |
|
| UID Modifiable |
✔️ |
|
| Packaging |
1x White PVC card format |
|
Write Capabilities
| UID Modifiable |
Unlock Required |
DirectWrite / Block 0 |
One Time Write |
Notes |
| ✔️ |
|
|
|
|
Device Compatibility
| Compatibility |
UID |
R/W |
Config |
Notes |
| Flipper Zero |
❌ |
|
❌ |
|
| Proxmark / iCopy-X |
✔️ |
|
✔️ |
|
| Android & iOS |
✔️ |
|
✔️ |
Requires MTools |
| LibNFC |
✔️ |
|
✔️ |
Requires raw commands |
| ChameleonUltra |
✔️ |
|
✔️ |
Requires MTools |
Hands on: See the card in action
Proxmark / iCopy-X
Modification of the UID is simple, thanks to a raw 14443 command.
Using your Proxmark 3, you can issue the following command:
hf 14a raw -s -c 02 00 ab 00 00 07 xx xx xx xx xx xx xx
Where xx xx xx xx xx xx xx is your target UID.
For 4-byte cards, your UID will be 4-bytes, for 7-byte cards, the UID will be 7-bytes.
Likewise, you can also use set the UID on Windows/MacOS/Linux via LibNFC and a LibNFC compatible reader/writer.
LibNFC
The UID can be changed in LibNFC by sending raw commands via pn53x-tamashell:
$ pn53x-tamashell
> 4a 01 00
> 42 02 00 ab 00 00 07 XX XX XX XX XX XX XX
Where xx xx xx xx xx xx xx is your target UID.
For 4-byte cards, your UID will be 4-bytes, for 7-byte cards, the UID will be 7-bytes.
IMPORTANT:
The UID of MIFARE DESFire® Compatible UID Modifiable tags is comprised of two parts: the UID itself, and the BCC. The BCC is a checksum value calculated from the UID. If the BCC is incorrect, tag will be rejected by the reader.
Most RFID tools, such as the Proxmark, LibNFC, MCT etc automatically calculate the BCC when the UID is modified. If you are modifying the UID by hand, it is vital that the BCC is correctly calculated.
Lab401 cannot provide support or refunds under any circumstances for cards that were 'bricked' due to incorrect UID/BCC configuration.
