diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md index f1dd35b15..9a10b023e 100644 --- a/doc/magic_cards_notes.md +++ b/doc/magic_cards_notes.md @@ -485,19 +485,19 @@ If the card is an Ultimate Magic Card, it returns 30 bytes. Special commands summary: ``` - CF 32 <00-03> // Configure GTU shadow mode - CF 34 <1b length><0-16b ATS> // Configure ATS - CF 35 <2b ATQA><1b SAK> // Configure ATQA/SAK (swap ATQA bytes) - CF 68 <00-02> // Configure UID length - CF 69 <00-01> // (De)Activate Ultralight mode - CF 6A <00-??> // Select Ultralight mode - CF C6 // Dump configuration - CF CC // ??? - CF CD <1b block number><16b block data> // Backdoor write 16b block - CF CE <1b block number> // Backdoor read 16b block - CF F0 <30b configuration data> // Configure all params in one cmd - CF F1 <30b configuration data> // Configure all params in one cmd (and fuse??) - CF FE <4b new_password> // change password +CF 32 <00-03> // Configure GTU shadow mode +CF 34 <1b length><0-16b ATS> // Configure ATS +CF 35 <2b ATQA><1b SAK> // Configure ATQA/SAK (swap ATQA bytes) +CF 68 <00-02> // Configure UID length +CF 69 <00-01> // (De)Activate Ultralight mode +CF 6A <00-03> // Select Ultralight mode +CF C6 // Dump configuration +CF CC // Factory test, returns 6666 +CF CD <1b block number><16b block data> // Backdoor write 16b block +CF CE <1b block number> // Backdoor read 16b block +CF F0 <30b configuration data> // Configure all params in one cmd +CF F1 <30b configuration data> // Configure all params in one cmd and fuse the configuration permanently +CF FE <4b new_password> // change password ``` Default ``: `00000000` @@ -627,7 +627,7 @@ hf 14b reader => UID 00010203 => ATQB 0405060708090A -### Set Ultralight mode +### (De)Activate Ultralight mode ``` hf 14a raw -s -c -t 1000 CF69<1b param> @@ -651,7 +651,19 @@ In this mode, if SAK=`00` and ATQA=`0044`, it acts as an Ultralight card hf 14a raw -s -c -t 1000 CF6A<1b param> ``` -πŸ‘‰ **TODO** should correspond to selection of EV1/ULC/... mode in the GUI. + * `` + * `00`: UL EV1 + * `01`: NTAG + * `02`: UL-C + * `03`: UL + +⚠ it supposes Ultralight mode was activated (cf command `69`) + +Example: set Ultralight mode to Ultralight-C, default pwd +``` +hf 14a raw -s -c -t 1000 CF000000006A02 +``` +Now the card supports the 3DES UL-C authentication. ### Set shadow mode (GTU) This mode is divided into four states: off (pre-write), on (on restore), don’t care, and high-speed read and write. @@ -739,7 +751,7 @@ Example: Write factory configuration, using default password hf 14a raw -s -c -t 1000 CF00000000F000000000000002000978009102DABC191010111213141516040008004F6B ``` -πŸ‘‰ **TODO** Variant with command `F1` sets configuration and fuses it ? +⚠ Variant with command `F1` instead of `F0` will set and fuse permanently the configuration. Backdoor R/W will still work. ## MIFARE Classic Super