ChameleonMini icon indicating copy to clipboard operation
ChameleonMini copied to clipboard

Reading Chameleon in emulated Mifare Classic 1k fails sometimes

Open Jamo332 opened this issue 6 years ago • 4 comments

I am using the ChameleonMini with the firmware version "ChameleonMini RevG 180228 using LUFA 151115 compiled with AVR-GCC 5.4.0. Based on the open-source NFC tool ChameleonMini. https://github.com/emsec/ChameleonMini commit 7ab8d3b" together with a card reader ACR122U. As software i am using the newest Kali-Version (everything updated) with old kernel 4.3.3-5 (in order to avoid a kernel bug). I have cloned a Mifare Classic 1k-card onto the Chameleon and in most cases reading from the Chameleon works just fine but at random times i get errors. If i use the original card reading is always successful. The chameleon was set to "config=MF_CLASSIC_1K".

For testing i am using the command "nfc-mfclassic r a testoutput originalcarddump". My test card has custom keys on the first two blocks, all other blocks have the default key FFFFFFFFFFFF. I tested the chameleon in different positions and tried it always 51 times. Test1: battery up, 46x ok, 5x authentication fail Test2: battery down, 47x ok, 4x authentication fail Test3: battery down with 5mm distance, 49x ok, 2x authentication fail Test4: battery down (again), 4x ok, 3x authentication fail, 33x unable to read block, 1x failed to read trailer block Test5: battery up (again), 42x ok, 8x unable to read block, 1x Mifare Authentication Failed Test6: same setup as Test5, just tried 1001 times, 628x ok, 229x unable to read block, 83x Mifare Authentication Failed, 61x failed to read trailer block

Original card: original card on the reader , 51x ok

I have included the log files of all tests and pictures how the chameleon was placed on the reader for each test. In Test4 the chameleon was placed like a card would be placed as the best possible position, but with this i had the worst results. No matter what i tried with a normal physical card i wasn't able to reproduce similar behaviour as with the chameleon.

Perhaps it is possible to improve the emulation.

chameleon-test1.txt chameleon-test2.txt chameleon-test3.txt chameleon-test4.txt chameleon-test5.txt chameleon-test6.txt test1 test2 test3 test4 test5 cardreader

Jamo332 avatar May 01 '18 16:05 Jamo332

Hi, Try this: disconnect the USB and give it a go on battery mode. Also, make sure that logging is set to OFF

Peterthegreat avatar May 03 '18 16:05 Peterthegreat

Hi,

this is very interesting. I tried it again, both being connected with usb and without usb, just in battery mode. The logging is always set to OFF. In battery mode the results are a lot better, yet not perfect.

Here are my results for 1001 tries: Battery mode 966 ok 29 Mifare Authentication Failed 1 failed to read trailer block 5 unable to read block

USB 530 ok 70 Mifare Authentication Failed 85 failed to read trailer block 315 unable to read block 1 no tag was found

Jamo332 avatar May 04 '18 11:05 Jamo332

I still do not know how i should go further when I have key a & b in the output of the chameleon mini reve. I also have many times read the data sheet but understand a little bit of it because is in english and my english is not so good. I still don't know how to put key & a & b on a card when I get key a&b from the chameleon mini reve.Can somebody help me out whit some advice .

yaxax avatar Apr 02 '19 11:04 yaxax

@yaxax Take a look at #126 . I didn't worked on Git, so the code is lost for now. Good luck

Peterthegreat avatar Apr 02 '19 11:04 Peterthegreat