Desfire Ev1 ( MF3ICD81 ) BUG! BUG?

[wei wu]

AuthenticateAES
[succeed]

// 28 applications, DFName = "fake1" ... "fake28"
for aid := 1 to 28
CreateApplication(aid := 1 to 28, fid := 0x1234 + aid, filename := "fake" + aid)
end for
[succeed]

GetApplicationIDs
[succeed] 000001 ~ 00001C

GetDFName
first frame succeed
second frame return c1 (PICC_INTEGRITY_ERROR)

subcommands all respond to cd (PICC_DISABLED_ERROR)

---

+ 0  |  - 0

[wei wu]

[MFDF_AuthenticateAES]
r 00

[GetApplicationIDs]
s 5a
r 00 01 00 00 02 00 00 03 00 00 ...
s af
r ... 1c 00 00 cmac

[GetDFName]
s 6a
s af 01 00 00 34 12 66 61 6b 65 31
s af
r c1

---

+ 0  |  - 0

[wei wu]

make corrections:
[GetApplicationIDs] 6a
[GetDFName] 6d

---

+ 0  |  - 0

[Author]

Posts