MIFARE DESFire® Compatible Modifiable UID / ATQA / SAK / ATS / APDU
MIFARE DESFire® remains the industry standard for ultra-high security badges. As of yet - the MIFARE DESFire® remains invulnerable to all channels of analysis.
The inner workings of the MIFARE DESFire® cards remain under NDA lock and key, making it incredibly difficult to reverse engineer the protocols.
Lab401's MIFARE DESFire® EV2 Compatible Modifiable UID / ATQA / SAK / ATS / APDU Card emulates a MIFARE DESFire® card, allowing you to set not only a custom UID, but also customise the ATQA, SAK, ATS and APDU values.
This means you are able to modify the card to simulate multiple types of DESFire® cards (EV1, EV2, etc).
Please note, this card does
not emulate any other MIFARE DESFire® features.
Badges come in a white PVC card format.
-
Badges come in a white PVC card format.
- Proxmark 3 compatible
Hands on with the MIFARE DESFire® EV2 Compatible Modifiable UID / ATQA / SAK / ATS / APDU Card
Changing the UID
Using your Proxmark 3, you can issue the following command:
Change UID Command
hf 14a raw -s -c -t 1000 cf00000000CD00<uid>
Example: Set UID to 11223344556677
hf 14a raw -s -c -t 1000 cf00000000CD0011223344556677
Setting up ATS:
Setup ATS Command
hf 14a raw -s -c -t 1000 cf0000000034< Length > < ATS >
* The length is set to 0, indicating that ATS is not sent
* When SAK is 20, 28, be sure to set ATS, otherwise you can't read the card.
* The last two digits of ATS are CRC, which cannot be counted into the length
Example: Modify ATS to 060675781028002F0
hf 14a raw -s -c -t 1000 cf000000003406067577810280
Setting up ATQA and SAK:
Setup ATQA / SAK Command
hf 14a raw -s -c -t 1000 cf0000000035<ATQA><SAK>
* Note that ATQA is inverted on the Proxmark
Example: Set ATQA to 00 44 and SAK to 28
hf 14a raw -s -c -t 1000 cf0000000035440028
Important Note:
This is an advanced card. Please ensure that you understand the implications of the commands you are sending, and perform dry-runs before any command execution. Incorrect configuration values can and will make your cards unresponsive.
Lab401 cannot provide support or refunds under any circumstances for cards that were 'bricked' due to incorrect commands.
