Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2015-05-31 21:31:18

iceman
Administrator
Registered: 2013-04-25
Posts: 6,276
Website

[MY D lean/Infineon] Istanbul public transportation 3times tag.

I ran into a unknown tag from Infineon the other day in Istanbul, Turkey.
After a minor bugfix in the magic-test,  this is what we have.

Since infineon uses uid[1] to specify between models, the high nibble (0x7)   UID[1] == 7F,  is not known today.
someone ran into this model before?!!?

TAGINFO :

pm3 --> hf 14a re
 UID : 05 7F 51 6B 65 54 E9
ATQA : 00 44
 SAK : 00 [2]
TYPE : INFINEON my-dÖ move lean (SLE 66R01L)
MANUFACTURER : Infineon Technologies AG Germany
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NO


pm3 --> hf mfu in

--- Tag Information ---------
-------------------------------------------------------------
      TYPE : INFINEON my-dÖ move lean (SLE 66R01L)
       UID : 05 7F 51 6B 65 54 E9
    UID[0] : 05, Infineon Technologies AG Germany
      BCC0 : A3, Ok
      BCC1 : B3, Ok
  Internal : 15, not default
      Lock : 00 C0  - 1100000000000000
OneTimePad : 03 00 00 00  - 00000000000000000000000000000011

Since the tag is unknown, the dump command defaults to 16...
DUMP:

pm3 --> hf mfu dump
TYPE : Unknown 000000
Reading tag memory...

Block#  | Data        |lck| Ascii
---------------------------------
00/0x00 | 05 7F 51 A3 |   |
01/0x01 | 6B 65 54 E9 |   |
02/0x02 | B3 15 00 C0 |   |
03/0x03 | 03 00 00 00 | 0 | ♥
04/0x04 | 02 00 00 03 | 0 | ☻
05/0x05 | 03 0F 03 07 | 0 | ♥☼♥
06/0x06 | 95 59 58 B4 | 0 | òYX┤
07/0x07 | 7D 57 BE 92 | 0 | }W¥Æ
08/0x08 | 30 30 30 35 | 0 | 0005
09/0x09 | 2D 4E 53 54 | 0 | -NST
10/0x0A | 02 F5 1D 11 | 0 | ☻§↔◄
11/0x0B | 24 02 EC 80 | 0 | $☻ýÇ
12/0x0C | 00 00 00 00 | 0 |
13/0x0D | 00 00 00 00 | 0 |
14/0x0E | 11 05 00 00 | 1 | ◄♣
15/0x0F | 60 97 34 22 | 1 | `ù4"
---------------------------------

Written on tag:
--------------------------------------
1105 0000 6097 3422

P151405452  -  057f516B6554E9 

Where the last number is the UID.

Last edited by iceman (2015-06-01 16:31:27)


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#2 2015-05-31 22:15:47

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

It is known: SLE 66R01L (my-d move lean); UID1 info (from Infineon datasheets):
zqExOx.gif
It is also described in this list.

New info to update your commands wink

Last edited by asper (2015-05-31 22:25:23)

Offline

#3 2015-06-01 05:25:39

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,300

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

some good info here
it appears the lean is just 16 pages. smile

Offline

#4 2015-06-01 09:55:19

iceman
Administrator
Registered: 2013-04-25
Posts: 6,276
Website

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

I saw your addons Marshmellow,   great!

Now we only need to add the NFC part of it for that my_d tag...
Didn't seem like the my_d tags supported version|authentication

Last edited by iceman (2015-06-01 09:58:43)


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#5 2015-06-01 15:04:27

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,300

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

What NFC part?  for the my_d_move_nfc vs my_d_move?  i think that is just an initialization difference.

Offline

#6 2015-06-01 15:10:58

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,300

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

i don't see any mention of version, but there are 8 byte keys and password modes mentioned for some of the tags: SLE 66RxxS especially.

Haven't found the actual command set yet for the auth though.

Offline

#7 2015-06-01 15:19:50

iceman
Administrator
Registered: 2013-04-25
Posts: 6,276
Website

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

dunno,  I haven't read any datasheets yet, however I was refering to the "hf mfu info" command needs to print ndef_cc  for this new tag since it is ndef_Cc compliant


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#8 2015-06-01 15:21:22

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,300

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

it will.  all tags will now.

Offline

#9 2015-06-01 15:33:21

iceman
Administrator
Registered: 2013-04-25
Posts: 6,276
Website

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

good.
Any ideas on the data dump?  Doesn't look encrypted.
its a 3 times pass,  10 turkish lira  (0x0A) , 
the onetimepad could be used,  since I stamped it twice of the three times allowed.


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#10 2015-06-01 15:51:08

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,300

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

Need more examples and surrounding info.

Offline

#11 2015-06-01 16:09:36

iceman
Administrator
Registered: 2013-04-25
Posts: 6,276
Website

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

Lets see if there is some people visiting Istanbul in this forum then.


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#12 2019-06-08 13:05:19

honza
Contributor
Registered: 2019-06-03
Posts: 2

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

To bad that in 4 years, none answered (considering the huge touristic attraction of Istanbul).
I hope i can start back the conversation with my dump if you are still interested.


this is a used 1-pass (Birgeç)

proxmark3> hf mfu dump
TYPE : INFINEON my-d move lean (SLE 66R01L)          
Reading tag memory...          

 Block#  | Data        |lck| Ascii          
---------+-------------+---+------          
  0/0x00 | 05 73 10 ee |   |           
  1/0x01 | 82 fa 54 e9 |   |           
  2/0x02 | c5 15 00 c0 |   |           
  3/0x03 | 01 00 00 00 | 0 | ....          
  4/0x04 | 02 00 00 03 | 0 | ....          
  5/0x05 | 01 12 06 14 | 0 | ....          
  6/0x06 | f7 29 87 ee | 0 | .)..          
  7/0x07 | e3 ab 57 43 | 0 | ..WC          
  8/0x08 | 4b 44 45 2d | 0 | KDE-          
  9/0x09 | 59 4b 44 00 | 0 | YKD.          
 10/0x0A | 01 31 05 0c | 0 | .1..          
 11/0x0B | 3a 01 65 77 | 0 | :.ew          
 12/0x0C | 02 66 26 00 | 0 | .f&.          
 13/0x0D | 4b bf 5c 67 | 0 | K.\g          
 14/0x0E | 11 50 00 01 | 1 | .P..          
 15/0x0F | 31 08 29 34 | 1 | 1.)4          
---------------------------------    

this is another but i don't know what kind and how much used.

proxmark3> hf mfu dump
TYPE : INFINEON my-d move lean (SLE 66R01L)          
Reading tag memory...          

 Block#  | Data        |lck| Ascii          
---------+-------------+---+------          
  0/0x00 | 05 7f b1 43 |   |           
  1/0x01 | 13 ca 54 e9 |   |           
  2/0x02 | 64 15 00 c0 |   |           
  3/0x03 | 01 00 00 00 | 0 | ....          
  4/0x04 | 02 00 00 03 | 0 | ....          
  5/0x05 | 01 12 06 14 | 0 | ....          
  6/0x06 | 52 ef a8 24 | 0 | R..$          
  7/0x07 | 12 28 4f 49 | 0 | .(OI          
  8/0x08 | 4b 44 45 2d | 0 | KDE-          
  9/0x09 | 59 4b 44 00 | 0 | YKD.          
 10/0x0A | 01 31 05 0c | 0 | .1..          
 11/0x0B | 3a 01 1e 62 | 0 | :..b          
 12/0x0C | 02 66 26 00 | 0 | .f&.          
 13/0x0D | fc 15 8b ab | 0 | ....          
 14/0x0E | 11 57 00 01 | 1 | .W..          
 15/0x0F | 31 08 29 33 | 1 | 1.)3          
---------------------------------

Offline

#13 2019-12-09 08:58:02

smlyclts
Contributor
Registered: 2019-12-02
Posts: 10

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

hello guys
20191209-105340.jpg

Offline

#14 2019-12-10 10:09:17

iceman
Administrator
Registered: 2013-04-25
Posts: 6,276
Website

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

I think I have some istanbul tickets aswell layin' around


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#15 2019-12-10 10:15:58

smlyclts
Contributor
Registered: 2019-12-02
Posts: 10

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

iceman wrote:

I think I have some istanbul tickets aswell layin' around


I have these cards, is there anything I can do for you?

Offline

#16 2019-12-10 16:34:06

iceman
Administrator
Registered: 2013-04-25
Posts: 6,276
Website

Re: [MY D lean/Infineon] Istanbul public transportation 3times tag.

Not really,  you would need to do as in this thread http://www.proxmark.org/forum/viewtopic.php?id=5126
gather specific pairs of data. UID/ PWD.


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

Board footer

Powered by FluxBB