Trying to write to FUID but AMS doesn't recognise it

[jimsefton]

I followed the instructions to write the dump and key bins to the FUID but AMS never recognises it. As far as I can see there is just a single command and then the AMS should read it?

When I check it I get this:

[usb] pm3 --> hf mf info

[=] --- ISO14443-a Information -----------------------------
[+]  UID: 06 12 A5 DF
[+] ATQA: 00 04
[+]  SAK: 08 [1]

[=] --- Keys Information
[+] loaded 2 user keys
[+] loaded 61 hardcoded keys

[=] --- Fingerprint
[=] <n/a>

[=] --- Magic Tag Information

[+] Magic capabilities... Gen 4 GDM / USCUID ( Gen4 Magic Wakeup )

[=] --- PRNG Information
[+] Prng....... weak

Not sure how to debug this?

[jimsefton]

[usb] pm3 --> hf mf dump --ns
[+] Loaded binary key file `hf-mf-0612A5DF-key.bin`
[=] Reading sector access bits...
[=] .................
[+] Finished reading sector access bits
[=] Dumping all blocks from card...
[/]Sector... 15 block... 3 ( ok )
[+] Succeeded in dumping all blocks

[+] time: 10 seconds


[=] -----+-----+-------------------------------------------------+-----------------
[=]  sec | blk | data                                            | ascii
[=] -----+-----+-------------------------------------------------+-----------------
[=]    0 |   0 | 06 12 A5 DF 6E 08 04 00 05 B8 53 97 F9 5B 4C 90 | ....n.....S..[L.
[=]      |   1 | 41 30 30 2D 59 30 30 00 47 46 41 30 30 00 00 00 | A00-Y00.GFA00...
[=]      |   2 | 50 4C 41 00 00 00 00 00 00 00 00 00 00 00 00 00 | PLA.............
[=]      |   3 | 51 F2 18 4E E6 F4 FF 07 80 69 67 EC F8 02 83 AA | Q..N.....ig.....
[=]    1 |   4 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |   5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |   6 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |   7 | 13 AF 2D 9E AE 4B FF 07 80 69 F9 AF BE FC EF 2F | ..-..K...i...../
[=]    2 |   8 | 00 00 00 00 00 00 00 00 00 00 00 00 CD CC 4C 3E | ..............L>
[=]      |   9 | D2 0E 9B F8 25 9B 4D CC B1 5F E9 DA E1 A9 26 28 | ....%.M.._....&(
[=]      |  10 | 00 00 00 00 8C 0C 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  11 | 16 94 02 64 ED BB FF 07 80 69 AC 76 C4 F4 FD 06 | ...d.....i.v....
[=]    3 |  12 | 32 30 32 35 5F 31 31 5F 32 30 5F 30 39 5F 35 33 | 2025_11_20_09_53
[=]      |  13 | 32 35 5F 31 31 5F 32 30 5F 30 39 00 00 00 00 00 | 25_11_20_09.....
[=]      |  14 | 00 00 00 00 4A 01 00 00 00 00 00 00 00 00 00 00 | ....J...........
[=]      |  15 | AA 2F 2D 0A 78 89 FF 07 80 69 DD 53 A4 F1 6B CC | ./-.x....i.S..k.
[=]    4 |  16 | 02 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  19 | E7 29 EE 02 13 CD FF 07 80 69 4D 39 D1 9A 3B 16 | .).......iM9..;.
[=]    5 |  20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  21 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  22 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  23 | 5D 2C 26 07 C5 74 FF 07 80 69 E1 71 9A 9E 27 8A | ],&..t...i.q..'.
[=]    6 |  24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  27 | 4B C0 16 7C 4D B3 FF 07 80 69 DF 8B 49 B3 6D 73 | K..|M....i..I.ms
[=]    7 |  28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  31 | 66 7E F6 1C 18 E3 FF 07 80 69 34 7C 66 2C F5 96 | f~.......i4|f,..
[=]    8 |  32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  35 | 4B D9 CB 41 3B E8 FF 07 80 69 78 7E EF 3B 37 3C | K..A;....ix~.;7<
[=]    9 |  36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  39 | D7 77 56 DD 68 1F FF 07 80 69 44 9A CE 0F C2 40 | .wV.h....iD....@
[=]   10 |  40 | 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  42 | 3E 56 B3 F6 6B A9 20 EE 80 7D 2C 89 77 35 C7 95 | >V..k. ..},.w5..
[=]      |  43 | A0 1A C4 CD 92 35 FF 07 80 69 76 7F D0 10 40 A2 | .....5...iv...@.
[=]   11 |  44 | F2 B7 AD 84 D0 B5 E0 68 B9 DD 91 8E CD DF 36 A5 | .......h......6.
[=]      |  45 | 96 7E 1F 96 6F DC 39 0B D9 CB 97 39 06 CE B2 CD | .~..o.9....9....
[=]      |  46 | 7E 0D 34 0A 1B DF EA 3D 43 85 4D 61 1B 54 67 F9 | ~.4....=C.Ma.Tg.
[=]      |  47 | EB 58 26 D3 5A B3 FF 07 80 69 1B 5A 8B 35 15 E5 | .X&.Z....i.Z.5..
[=]   12 |  48 | EC 9F 25 EF A1 2F D2 FB C2 DE 96 2C 95 44 63 A7 | ..%../.....,.Dc.
[=]      |  49 | 9A 72 CE 96 36 B3 B5 9B 00 45 A3 89 ED 6C 06 B4 | .r..6....E...l..
[=]      |  50 | 66 75 B5 67 E1 EA 42 E4 C7 0E C3 0F 1F B3 52 5E | fu.g..B.......R^
[=]      |  51 | 85 43 00 D5 5B 5D FF 07 80 69 AE 1F BB D3 40 83 | .C..[]...i....@.
[=]   13 |  52 | CE B1 6F D2 1A 46 85 A8 EB 12 B5 83 1D DA 52 74 | ..o..F........Rt
[=]      |  53 | 5E BD 7E FF 03 F3 E9 C7 B7 72 6B 80 41 E3 FD 6C | ^.~......rk.A..l
[=]      |  54 | E9 00 36 10 A0 FB 8C C2 FB A3 63 92 0E C4 60 1B | ..6.......c...`.
[=]      |  55 | 25 AF 83 10 6B E5 FF 07 80 69 96 64 3C 65 D5 CB | %...k....i.d<e..
[=]   14 |  56 | 5A 6D 1B BA 7B D4 99 20 23 90 AA 6F 8D 25 D9 95 | Zm..{.. #..o.%..
[=]      |  57 | D5 8F 45 2C 8C 3B 12 9A 7A 2D 15 7B 92 35 8F DF | ..E,.;..z-.{.5..
[=]      |  58 | F7 D4 D0 F1 25 4F 1F 8F A9 8F 91 D3 7D 45 05 DA | ....%O......}E..
[=]      |  59 | 21 95 4A 82 3F 60 FF 07 80 69 0E F5 7F 00 F3 04 | !.J.?`...i......
[=]   15 |  60 | C2 25 6C F8 E2 D6 68 19 33 6D AB 9A F1 AE 6F 5E | .%l...h.3m....o^
[=]      |  61 | 5C DE 2B A9 05 A3 08 FB 16 B4 89 83 26 E4 70 4F | \.+.........&.pO
[=]      |  62 | CB 8A C5 71 C1 DF 7D A3 97 A0 A1 18 51 4C 9A 7C | ...q..}.....QL.|
[=]      |  63 | D0 59 53 40 C8 74 FF 07 80 69 6D 63 3C 5E 69 82 | .YS@.t...imc<^i.
[=] -----+-----+-------------------------------------------------+-----------------

[=] Called with no save option
[usb] pm3 -->

[scourge411]

Your dump is slightly different than the binary tag blob in the repo (assuming you used the most recent PLA/PLA Basic/Yellow/0612A5DF/hf-mf-0612A5DF-dump.bin file)

The differences are the block ACLs, which the AMS shouldn't care about, at least in the limited testing I've done.
(The tag dump doesn't have an ACL for block 2 for some reason, so that's why it's diff is different)

Is this a single write FUID tag? Or is it one where you can rewrite block 0 again until you seal it?

I don't have a proxmark, so I have no idea how it identifies the various tag types, but I would have expected it to either not know it was a writable tag (since it's already been written once), or for it to say:

[+] Magic capabilities... Write Once / FUID

if it's a 'locked' tag. Not

[+] Magic capabilities... Gen 4 GDM / USCUID ( Gen4 Magic Wakeup )

What does hf mf gdmcfg -gdm or hf mf gdmcfg --gdm say for the tag? Does it match any of the configs listed in the pm3 docs here?
pm3 FUID magic docs

Do you have a link to where you got the tag from?

diff --git a/tmp/tag-lib.hex b/tmp/tag.hex
index cb79339..e8eb6c6 100644
--- a/tmp/tag-lib.hex
+++ b/tmp/tag.hex
@@ -1,64 +1,64 @@
0612A5DF6E08040005B85397F95B4C90
4130302D593030004746413030000000
504C4100000000000000000000000000
51F2184EE6F4[-878-]{+FF0+}78[-7-]{+0+}6967ECF80283AA
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
13AF2D9EAE4B{+FF+}0{+78+}0[-000000-]{+69+}F9AFBEFCEF2F
000000000000000000000000CDCC4C3E
D20E9BF8259B4DCCB15FE9DAE1A92628
000000008C0C00000000000000000000
16940264EDBB[-878-]{+FF0+}78[-7-]{+0+}69AC76C4F4FD06
323032355F31315F32305F30395F3533
32355F31315F32305F30390000000000
000000004A0100000000000000000000
AA2F2D0A7889[-878-]{+FF0+}78[-7-]{+0+}69DD53A4F16BCC
02000100000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
E729EE0213CD[-878-]{+FF0+}78[-7-]{+0+}694D39D19A3B16
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
5D2C2607C574[-878-]{+FF0+}78[-7-]{+0+}69E1719A9E278A
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
4BC0167C4DB3[-878-]{+FF0+}78[-7-]{+0+}69DF8B49B36D73
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
667EF61C18E3[-878-]{+FF0+}78[-7-]{+0+}69347C662CF596
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
4BD9CB413BE8[-878-]{+FF0+}78[-7-]{+0+}69787EEF3B373C
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
D77756DD681F[-878-]{+FF0+}78[-7-]{+0+}69449ACE0FC240
01000000000000000000000000000000
00000000000000000000000000000000
3E56B3F66BA920EE807D2C897735C795
A01AC4CD9235[-878-]{+FF0+}78[-7-]{+0+}69767FD01040A2
F2B7AD84D0B5E068B9DD918ECDDF36A5
967E1F966FDC390BD9CB973906CEB2CD
7E0D340A1BDFEA3D43854D611B5467F9
EB5826D35AB3[-878-]{+FF0+}78[-7-]{+0+}691B5A8B3515E5
EC9F25EFA12FD2FBC2DE962C954463A7
9A72CE9636B3B59B0045A389ED6C06B4
6675B567E1EA42E4C70EC30F1FB3525E
854300D55B5D[-878-]{+FF0+}78[-7-]{+0+}69AE1FBBD34083
CEB16FD21A4685A8EB12B5831DDA5274
5EBD7EFF03F3E9C7B7726B8041E3FD6C
E9003610A0FB8CC2FBA363920EC4601B
25AF83106BE5[-878-]{+FF0+}78[-7-]{+0+}6996643C65D5CB
5A6D1BBA7BD499202390AA6F8D25D995
D58F452C8C3B129A7A2D157B92358FDF
F7D4D0F1254F1F8FA98F91D37D4505DA
21954A823F60[-878-]{+FF0+}78[-7-]{+0+}690EF57F00F304
C2256CF8E2D66819336DAB9AF1AE6F5E
5CDE2BA905A308FB16B4898326E4704F
CB8AC571C1DF7DA397A0A118514C9A7C
D0595340C874[-878-]{+FF0+}78[-7-]{+0+}696D633C5E6982

[jimsefton]

[usb] pm3 --> hf mf gdmcfg --gdm

[+] ------------------- GDM Gen4 Configuration -----------------------------------------
[+] 7AFF85000000000000FF000000000008
[+] 7AFF............................ Magic wakeup enabled with GDM cfg block access
[+] ....85.......................... Magic wakeup style GDM 20(7)/23
[+] ......000000.................... unknown
[+] ............00.................. Key B use allowed when readable by ACL
[+] ..............00................ CUID Disabled
[+] ................00.............. n/a
[+] ..................FF............ MFC EV1 perso. 4B UID from Block 0
[+] ....................00.......... Shadow mode disabled
[+] ......................00........ Magic auth disabled
[+] ........................00...... Static encrypted nonce disabled
[+] ..........................00.... MFC EV1 signature disabled
[+] ............................00.. n/a
[+] ..............................08 SAK

It's a standard FUID card as far as I know, from aliexpress.

[scourge411]

No idea then; If I had a proxmark, I'd try seeing if it responded to the various raw magic commands, and see if any of them result in the expected output for the different types of magic tag/cards.

Like, does this command set in the pm3 magic card docs do anything on your tag:

[+] 0A
[usb] pm3 --> hf 14a raw -k -a 23
[+] 0A
[usb] pm3 --> hf 14a raw -c -k -a A000
[+] 0A
[usb] pm3 --> hf 14a raw -c -k -a B502454EBC0804000168AA8947CE4D1D <- Writing 0 block with the backdoor command
[+] 0A
[usb] pm3 --> hf 14a raw -c -a 5000
[usb] pm3 --> hf mf rdbl --blk 0

Trying those raw commands through the craptastic chameleon ultra I have results in "no HF tag found", but I have no idea if that's because the CU doesn't support the raw command correctly, or if the tag isn't responding to them.