How to send APDU to Mifare Classic 1k card?

Question

What I'm trying to achieve is send the APDU command to the MIFARE Classic 1K card to change its keys A and B.

I managed to establish a connection to the card and use the default key ( FFFFFFFFFFFF ) to read block 0 and block 1. I used the HID MifareSamples application for this.

Now I would like to change the key from the default to another. I found a solution here in stackoverflow ( Mifare Change KEY A and B ), which suggests that I should send this APDU:

New key A = 00 11 22 33 44 55 Access bit is not overwritten Key B is not (so FF FF FF FF FF FF)

=> Write to sector trailer 00 11 22 33 44 55 FF 0F 00 FF FF FF FF FF FF FF

I found a good JSmartCard Explorer tool that allows you to send APDUs to cards. Then I read the PCSC specifications. 3.2.2.1.4 "Key loading keys" and we understand that the command should look something like this:

 FF 82 00 00 18 00 11 22 33 44 55 FF 0F 00 FF FF FF FF FF FF FF 

But, unfortunately, the JSmartCard tool failed with the error: "The command is not allowed (there is no current EF)."

What am I doing wrong? How to change a key?

Answer 1

First of all, MIFARE Classic cards do not use APDU commands. Therefore, you are not sending APDUs to the card, but to the card reader (which translates them into MIFARE Classic commands). The APDU commands to be processed by the reader usually begin with an FF class byte.

In MIFARE Classic cards, the keys (A and B) and access conditions for each sector are stored in the sector trailer (the last block of each sector). The MIFARE Classic 1K card has 16 sectors with 4 blocks each.

So, if you want to set the keys and access conditions for sector 0, you will need to write them to block 3 (the last block of sector 0). The PC / SC standard defines a write command (UPDATE BINARY) for memory cards as:

 FF D6 XXYY 10 ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ 

Where XXYY is the address of the block, and ZZ... is the data that should be written to the block.

Sector trailer format (see this answer for more details ):

 <key A> | access bits | general purpose byte | <key B> 

So, to install

• key A = 00 11 22 33 44 55
• key B = 66 77 88 99 AA BB
• access bits = 787788 (the sector trailer is writable only using key B; access bits / GPB can be read using keys A or B; data blocks are written only using key B; data blocks can be read using key A or B)
• GPB set to 69

for sector 0, you should use the following write command:

 FF D6 0003 10 001122334455 787788 69 66778899AABB 

Please note that you cannot partially update the sector trailer; you always need to create and record a trailer for the entire sector.