{"id":844,"date":"2020-10-19T09:37:24","date_gmt":"2020-10-19T13:37:24","guid":{"rendered":"https:\/\/dc540.org\/xxx\/?p=844"},"modified":"2020-12-08T15:57:27","modified_gmt":"2020-12-08T20:57:27","slug":"decoding-mifare-data-pointless","status":"publish","type":"post","link":"https:\/\/dc540.org\/xxx\/2020\/10\/decoding-mifare-data-pointless\/","title":{"rendered":"Decoding MIFARE data — pointless?"},"content":{"rendered":"\n

Now that I can read, dump and clone cards, of course my natural inclinations lead me toward the next goalpost, which is determining what hidden data can be retrieved from the cards. All indications from that forums were that the issue date\/time, expiration date\/time and room number are stored somewhere on the card, so I knew vaguely what I was looking for, but still had some learning to do.<\/p>\n\n\n\n

I wrote a quick script to dump what I know about the cards, which makes it easier to add further definitions as I learn the more detailed structure of the data:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Here’s what I’ve learned so far:<\/p>\n\n\n\n

All of the MIFARE cards in my collection (63 of them at last count) have sixteen sector of data. Sector 0 is three blocks and if my understanding is correct, contains immutable manufacturer and other ata. This makes sense, as the very first thing in sector 0 is the UID of the card. What else is that hex data in sector 0? Dunno. Here’s a sector 0 example:<\/p>\n\n\n\n

FD65D88A<\/strong>CA880400C825002000000017
E7C0995613BD20D15F58EA614C1020B6
8A000400010000000000000000000000<\/p>\n\n\n\n

The bolded hex is the card’s UID.<\/p>\n\n\n\n

Sectors 1 through 15 are all four blocks of hex, structured identically. The first block is the keys and access bits. For each sector, there are two keys defined. The access bits define which key or keys are required to read from, or write to, that sector. Example: <\/p>\n\n\n\n

2A2C13CC242AFF078069FFFFFFFFFFFF
02D7C800000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000<\/p>\n\n\n\n

In this case, Key A is 2A2C13CC242A, Key B is FFFFFFFFFFFF, and the access bits field is FF078069, which I found is a very common schema. <\/p>\n\n\n\n

The remaining three blocks are data, and here’s where it gets fuzzy. I believe that there is no structure whatsoever to that data. No standard, no default, no pattern. In fact, the bulk of cards had no data stored in most sectors. And I have yet to find a discernible pattern in the data that is stored. I have looked for hex-to-decimal date translations, and so far been unlucky.<\/p>\n\n\n\n

Here’s the breakdown of “data stored in sectors”:<\/p>\n\n\n\n

Of my 63 cards:<\/p>\n\n\n\n