mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-02-26 00:55:19 +08:00
updated text about configuration GDM
This commit is contained in:
parent
ec7c0fb485
commit
5e8a08c714
1 changed files with 22 additions and 1 deletions
|
@ -535,9 +535,14 @@ The persistent memory is also writable. For that tag uses its own backdoor comma
|
|||
for example to write, you must use a customer authentication byte, 0x80, to authenticate with an all zeros key, 0x0000000000.
|
||||
Then send the data to be written.
|
||||
|
||||
This tag has simular commands to the [UFUID](#mifare-classic-directwrite-ufuid-version)
|
||||
It seems to be developed by the same person.
|
||||
|
||||
** OBS **
|
||||
When writing to persistent memory it is possible to write _bad_ ACL and perm-brick the tag.
|
||||
|
||||
** OBS **
|
||||
It is possible to write a configuration that perma locks the tag, ie no more magic
|
||||
|
||||
### Identify
|
||||
^[Top](#top)
|
||||
|
@ -552,7 +557,8 @@ hf 14a info
|
|||
|
||||
* Auth: `80xx`+crc
|
||||
* Write: `A8xx`+crc, `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`+crc
|
||||
* Read : `E000`+crc (unidentified)
|
||||
* Read config: `E000`+crc (unidentified)
|
||||
* Write config: `E100`+crc
|
||||
|
||||
### Characteristics
|
||||
^[Top](#top)
|
||||
|
@ -561,6 +567,21 @@ hf 14a info
|
|||
* Its magic part seem to be three identified custom command.
|
||||
* Auth command 0x80, with the key 0x0000000000, Write 0xA8 allows writing to persistent memory, Read 0xE0 which seems to return a configuration. This is unknown today what these bytes are.
|
||||
|
||||
Read config:
|
||||
1. sending custom auth with all zeros key
|
||||
2. send 0xE000, will return the configuration bytes.
|
||||
`results: 850000000000000000005A5A00000008`
|
||||
|
||||
Write config:
|
||||
1. sending custom auth with all zeros key
|
||||
2. send 0xE100
|
||||
3. send 16 bytes
|
||||
|
||||
** Warning **
|
||||
Example of configuration to Perma lock tag:
|
||||
`85000000000000000000000000000008`
|
||||
|
||||
|
||||
It is unknown what kind of block 0 changes the tag supports
|
||||
* UID: 4b
|
||||
* ATQA/SAK: unknown
|
||||
|
|
Loading…
Reference in a new issue