HF - Mifare UltraLight

contents

hf-mifare-ultralight.md

Ultralight C (3DES authentication)
Ultralight EV1
NTAG2

Chinese backdoor#

pm3 --> hf 14a raw -p -b 7 40pm3 --> hf 14a raw -p 43pm3 --> hf 14a raw -p -c a200599821200x40, init backdoor mode0x41, wipe fills card with 0xFF0x42, fills card with 0x000x43, no authentication needed.  issue a 0x3000 to read block 0, or write block.0x44, fills card with 0x55

Simulate#

hf 14a sim 2 <7-byte tag>

References#

MIFARE® Ultralight® - NXP