Introduction

The Proxmark3 appeared to be missing Mifare Ultralight support. The ability to identify Ultralight cards was present within the ‘hf 14a reader‘ command. However the facility to read and write cards was sadly missing. But no worries as the protocol and instruction set is essentially the same as Mifare Classic; the only difference is standard Ultralight cards do not need authentication, and encryption and the Block size is 4 bytes long (Note: UltralightC cards are encrypted).

As of this morning the svn revision 814 now supports Mifare Ultralight thanks to a community supporter by the handle ‘midnitesnake’.

A simple ‘svn update‘ will update any current repository. Else use the following command to grab the repository:

svn checkout http://proxmark3.googlecode.com/svn/trunk/ proxmark3

Demonstration

The end result, of reading an ultralight keycard from a hotel (the square brackets indicate whether the block is write-protected/locked(1) or unlocked(0):

proxmark3> hf mf urdcard Attempting to Read Ultralight... #db# READ SECTOR FINISHED isOk:01 Block 00: 04 34 ba 02 Block 01: f1 dd 25 80 Block 02: 68 48 00 00 Block 03: 00 00 00 00 [0] Block 04: ff ff ff ff [0] Block 05: 00 00 00 00 [0] Block 06: 00 00 00 00 [0] Block 07: 00 00 00 00 [0] Block 08: 00 00 00 00 [0] Block 09: 00 00 00 00 [0] Block 0a: 00 00 00 00 [0] Block 0b: 00 00 00 00 [0] Block 0c: 45 5d 9d cc [0] Block 0d: 5b 7e d2 f3 [0] Block 0e: 78 93 a8 cc [0] Block 0f: 53 10 fa 22 [0]

Reading and writing specific blocks using the commands:

hf mf urdbl

hf mf wrbl

proxmark3> hf mf urdbl 15 --block no:0f #db# READ BLOCK FINISHED isOk:01 data:53 10 fa 23 proxmark3> hf mf uwrbl 15 5310fa22 --block no:0f --data: 53 10 fa 22 #db# Data command: a2 #db# Data R: 0f 53 10 fa 22 fd 23 #db# WRITE BLOCK FINISHED isOk:01 proxmark3> hf mf urdbl 15 --block no:0f #db# READ BLOCK FINISHED isOk:01 data:53 10 fa 22

Patch Location

For those interested the patch can be found here http://www.proxmark.org/forum/viewtopic.php?pid=8499#p8499