8 ms·
This is cool, but the most interesting part is the part that requires investigation, i.e., what do the compatibility tools write to the card to make it iOS-comp
by pm 2y ago
This is cool, but the most interesting part is the part that requires investigation, i.e., what do the compatibility tools write to the card to make it iOS-compatible? I've done some work with iOS NFC, but not enough to have experienced the undocumented quirks.
- ewpratten 2y agoYa, I have no clue tbh. This is one of those cases where I know I really should investigate further, but I'm taking this one step at a time. Perhaps digging in to the "why" will become a follow-up post
- stavros 2y agoBut what happens if you dump the card with the Proxmark? Surely you should be able to see some differences. Actually, I have all the components, so I'll try this now and report back.
- ewpratten 2y agoMy quick eye-skim didn't see much, but I'll do a byte-for-byte diff. I imagine its a difference in the NDEF headers? (but even that doesn't make sense, since I wrote the headers again from the pm3)
- stavros 2y agoWell it turns out I'm much worse at this than I thought, as I can't even figure out what kind of cards I have. I'm learning, though!
- ewpratten 2y agoHN formatting is going to do bad things here.. Here's the first 6 blocks of the card after I ran through the instructions of the post, then a ndefformat-only card (that never touched an iphone). [=] 0 | 0 | 00 56 78 BB 95 08 04 00 02 B2 1E 24 23 27 1E 1D | .Vx........$#'.. [=] | 1 | 14 01 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | ...�.�.�.�.�.�.� [=] | 2 | 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | .�.�.�.�.�.�.�.� [=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 C1 89 EC A9 7F 8C 2A | ......xw.......* [=] 1 | 4 | 00 00 03 12 D1 01 0E 55 04 65 77 70 72 61 74 74 | ....�..U.ewpratt [=] | 5 | 65 6E 2E 63 6F 6D FE 00 00 00 00 00 00 00 00 00 | en.com�......... [=] 0 | 0 | 00 56 78 BB 95 08 04 00 02 B2 1E 24 23 27 1E 1D | .Vx........$#'.. [=] | 1 | 14 01 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | ...�.�.�.�.�.�.� [=] | 2 | 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | .�.�.�.�.�.�.�.� [=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 C1 89 EC A9 7F 8C 2A | ......xw.......* [=] 1 | 4 | 03 00 FE 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..�............. [=] | 5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
- stavros 2y agoHere's mine: https://www.pastery.net/tckuyc+dausye/ https://www.pastery.net/tckuyc+dausye/
- ewpratten 2y agoYa, looks like the iPhone is tinkering with the NDEF message itself. If my Android phone wasn't dead, I'd love to compare an iPhone's write against the Android NFC Tools app's write. If anyone else has an iPhone, an Android phone, and a Proxmark, I'd be interested in seeing a three-way diff between them all. EDIT: I'm going to try to cross-post to the DT forum to see if anyone has ideas.
- stavros 2y agoI've got both phones next to me, what do you want me to do exactly?
- ewpratten 2y agoWipe the card. Make a dump after doing "hf mf ndefformat". Then make a dump after writing a payload from an iPhone. (since iPhone seems to want ndefformat anyways) Then wipe again and make a dump after writing from Android.
- stavros 2y agoHere you go: https://www.pastery.net/xajezk+gbkqqz+aqwygg+ukrdad/ https://www.pastery.net/xajezk+gbkqqz+aqwygg+ukrdad/
- ewpratten 2y agoThank you very much! Something's clearly up there. You can see that even IOS and Android disagree with each other on what NDEF should look like by a few bytes. Very interesting.
- ewpratten 2y agoProxmark's "auto" command should get you most of the way to knowing. Then check if any of the "hf mf c*" commands work on it (in which case, you have a gen1a magic card)
- stavros 2y agoNice, I didn't know about auto, thanks! It turns out I have some Gen 1a "magic" cards (as in, actually in a card form factor), and some tags that seem to be Gen 3, but not magic?
- ewpratten 2y agoThere's approx 4 generations of "Magic". Gen 1, 1a, 3 and 4 all use special commands to unlock and edit block 0. Gen 2 treats block 0 as always being r/w. This allows Android phones to directly write to it (but also makes it possible to lock the card). In terms of pm3 commands, "auto" tries everything. You might also want to use "lf search" or "hf search" to only try one of your antennas and not the other. The actual Magic part isn't really important here, since my phone doesn't even care about block 0. It just makes it easier to read and wipe the card when you have the extra command set at your disposal.
- stavros 2y agoThis is great, thanks! Do you know of any resource to learn more about Mifare cards? Is "beginning NFC" that you linked me to a good general resource?
- ewpratten 2y agoAll my knowledge is trial & error. I've found the people over in the DT forum are pretty helpful with the cloning and usage aspect of things: https://forum.dangerousthings.com https://forum.dangerousthings.com Additionally, Iceman's Discord people has tons of smart people: https://discord.com/invite/iceman https://discord.com/invite/iceman
- ewpratten 2y agoHm, its definitely blocks 0-2. All remaining blocks after that are identical. Going to look further at the actual data in the first 3 blocks momentarily.
- pm 2y agoI didn't intend for what I wrote to be a criticism; that's on me. I just found it funny the most interesting step was akin to "... and now you've drawn the animal", if you understand the reference.
- EricBetts 2y agoMy read of the proxmark code (https://github.com/RfidResearchGroup/proxmark3/blob/master/client/src/cmdhfmf.c#L6707 https://github.com/RfidResearchGroup/proxmark3/blob/master/c...) is that the `ndefformat` formatted the tag MAD (https://www.nxp.com/docs/en/application-note/AN10787.pdf https://www.nxp.com/docs/en/application-note/AN10787.pdf), which you'd do for NDEF, then had a single TLV TERMINATOR at the block where the NDEF message starts. Then he used NFC Tools to write on an NDEF text record (which iOS background reading would ignore) and maybe something else? After that he then used `ndefwrite` to write on a URL record. I wonder if he could have skipped the NFC Tools and written the URL record and gotten the same result. Proxmark dumps before and after using NFC Tools would be insightful.
- ChrisMarshallNY 2y agoI suspect the comment (above, at the time I wrote this), where they mention that Apple only wants partners to be usable, is the Ockham's Razor answer. Probably some "magic key" ID. But this is not my area of expertise. It's a cool story, though, and why I like hanging here. Considering getting a Proxmark and the NFC Tools app, just to play around.