Skip to content

staticnested faild to find a KeyB #2938

@hjh70526

Description

@hjh70526

Describe the bug
staticnested seem to ignore keyB when recovering WLD2.

To Reproduce
Steps to reproduce the behavior:

  1. Find a WLD2 card and set option byte to "08778F69",example blk 3 "FFFFFFFFFFFF08778F690F3B71686563".
  2. Run "hf mf autopwn".
  3. Get a message "[+] Target block 0 key type B"without any key.

Expected behavior
Set any option byte to "08778F69",then KeyB is unable to recover.

Screenshots

Image

Desktop (please complete the following information):

  • OS: Windows11 23H2 22631.5335 running ProxSpace
  • inside proxmark3 client run the following commands and paste the output here.
  • hw version
    [usb] pm3 --> hw version

[ Proxmark3 ]

[ Client ]
Iceman/master/v4.20469-115-gd933e329c-suspect 2025-07-17 23:09:34 63bf1f090
Compiler.................. MinGW-w64 13.2.0
Platform.................. Windows (64b) / x86_64
Readline support.......... present
QT GUI support............ present
Native BT support......... absent
Python script support..... present ( 3.11.5 )
Python SWIG support....... present
Lua script support........ present ( 5.4.6 )
Lua SWIG support.......... present

[ Model ]
Device.................... device / fw mismatch
Firmware.................. RDV4
External flash............ present
Smartcard reader.......... absent
FPC USART for BT add-on... absent

[ ARM ]
Bootrom.... Iceman/master/v4.20469-115-gd933e329c-suspect 2025-07-17 23:08:55 63bf1f090
OS......... Iceman/master/v4.20469-115-gd933e329c-suspect 2025-07-17 23:09:01 63bf1f090
Compiler... GCC 12.2.0

[ FPGA ]
fpga_pm3_hf.ncd image 2s30vq100 17-07-2025 23:08:13
fpga_pm3_lf.ncd image 2s30vq100 17-07-2025 23:08:13
fpga_pm3_felica.ncd image 2s30vq100 17-07-2025 23:08:13
fpga_pm3_hf_15.ncd image 2s30vq100 17-07-2025 23:08:13

[ Hardware ]
--= uC: AT91SAM7S512 Rev A
--= Embedded Processor: ARM7TDMI
--= Internal SRAM size: 64K bytes
--= Architecture identifier: AT91SAM7Sxx Series
--= Embedded flash memory 512K bytes ( 77% used )

  • hw status
    [#] Memory
    [#] BigBuf_size............. 37820
    [#] Available memory........ 37820
    [#] Tracing
    [#] tracing ................ 0
    [#] traceLen ............... 188
    [#] Current FPGA image
    [#] mode.................... fpga_pm3_hf.ncd image 2s30vq100 17-07-2025 23:08:13
    [#] Flash memory
    [#] Baudrate................ 24 MHz
    [#] Init.................... ok
    [#] Mfr ID / Dev ID......... EF / 13
    [#] JEDEC Mfr ID / Dev ID... EF / 4014
    [#] Memory size............. 1024 kB (16 pages * 64k)
    [#] Unique ID (be).......... 0x305C6AD375B068DC
    [#] Smart card module (ISO 7816)
    [#] version................. ( fail )
    [#] LF Sampling config
    [#] [q] divisor............. 95 ( 125.00 kHz )
    [#] [b] bits per sample..... 8
    [#] [d] decimation.......... 1
    [#] [a] averaging........... yes
    [#] [t] trigger threshold... 0
    [#] [s] samples to skip..... 0
    [#]
    [#] LF T55XX config
    [#] [r] [a] [b] [c] [d] [e] [f] [g]
    [#] mode |start|write|write|write| read|write|write
    [#] | gap | gap | 0 | 1 | gap | 2 | 3
    [#] ---------------------------+-----+-----+-----+-----+-----+-----+------
    [#] fixed bit length (default) | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
    [#] long leading reference | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
    [#] leading zero | 29 | 17 | 15 | 40 | 15 | n/a | n/a |
    [#] 1 of 4 coding reference | 29 | 17 | 15 | 31 | 15 | 47 | 63 |
    [#]
    [#] HF 14a config
    [#] [a] Anticol override........... std ( follow standard )
    [#] [b] BCC override............... std ( follow standard )
    [#] [2] CL2 override............... std ( follow standard )
    [#] [3] CL3 override............... std ( follow standard )
    [#] [r] RATS override.............. std ( follow standard )
    [#] [m] Magsafe polling............ disabled
    [#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
    [#] Transfer Speed
    [#] Sending packets to client...
    [#] Time elapsed................... 500ms
    [#] Bytes transferred.............. 293376
    [#] Transfer Speed PM3 -> Client... 586752 bytes/s
    [#] Various
    [#] Max stack usage..... 3520 / 8480 bytes
    [#] Debug log level..... 1 ( error )
    [#] ToSendMax........... 39
    [#] ToSend BUFFERSIZE... 2308
    [#] Slow clock.......... 30346 Hz
    [#] Installed StandAlone Mode
    [#] LF HID26 standalone - aka SamyRun (Samy Kamkar)
    [#] Flash memory dictionary loaded
    [#] Mifare... 0 keys - dict_mf.bin
    [#] T55xx.... 0 keys - dict_t55xx.bin
    [#] iClass... 0 keys - dict_iclass.bin
    [#] UL-C..... 0 keys - dict_mfulc.bin
    [#] UL-AES... 0 keys - dict_mfulaes.bin

  • hw tune
    [usb] pm3 --> hw tune

[=] -------- Reminder ----------------------------
[=] hw tune doesn't actively tune your antennas.
[=] It's only informative.
[=] Measuring antenna characteristics...
[/] 10

[=] -------- LF Antenna ----------
[!] LF antenna............ unusable

[=] -------- HF Antenna ----------
[+] 13.56 MHz............. 26.07 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage.......... 4.5
[+] HF antenna ( ok )

[-] All values are zero. Not showing LF tuning graph

[=] Q factor must be measured without tag on the antenna

Additional context
I removed my LF antenna myself,not linked to this problem.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions