-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Description
Describe the bug
staticnested seem to ignore keyB when recovering WLD2.
To Reproduce
Steps to reproduce the behavior:
- Find a WLD2 card and set option byte to "08778F69",example blk 3 "FFFFFFFFFFFF08778F690F3B71686563".
- Run "hf mf autopwn".
- Get a message "[+] Target block 0 key type B"without any key.
Expected behavior
Set any option byte to "08778F69",then KeyB is unable to recover.
Screenshots
Desktop (please complete the following information):
- OS: Windows11 23H2 22631.5335 running ProxSpace
- inside proxmark3 client run the following commands and paste the output here.
- hw version
[usb] pm3 --> hw version
[ Proxmark3 ]
[ Client ]
Iceman/master/v4.20469-115-gd933e329c-suspect 2025-07-17 23:09:34 63bf1f090
Compiler.................. MinGW-w64 13.2.0
Platform.................. Windows (64b) / x86_64
Readline support.......... present
QT GUI support............ present
Native BT support......... absent
Python script support..... present ( 3.11.5 )
Python SWIG support....... present
Lua script support........ present ( 5.4.6 )
Lua SWIG support.......... present
[ Model ]
Device.................... device / fw mismatch
Firmware.................. RDV4
External flash............ present
Smartcard reader.......... absent
FPC USART for BT add-on... absent
[ ARM ]
Bootrom.... Iceman/master/v4.20469-115-gd933e329c-suspect 2025-07-17 23:08:55 63bf1f090
OS......... Iceman/master/v4.20469-115-gd933e329c-suspect 2025-07-17 23:09:01 63bf1f090
Compiler... GCC 12.2.0
[ FPGA ]
fpga_pm3_hf.ncd image 2s30vq100 17-07-2025 23:08:13
fpga_pm3_lf.ncd image 2s30vq100 17-07-2025 23:08:13
fpga_pm3_felica.ncd image 2s30vq100 17-07-2025 23:08:13
fpga_pm3_hf_15.ncd image 2s30vq100 17-07-2025 23:08:13
[ Hardware ]
--= uC: AT91SAM7S512 Rev A
--= Embedded Processor: ARM7TDMI
--= Internal SRAM size: 64K bytes
--= Architecture identifier: AT91SAM7Sxx Series
--= Embedded flash memory 512K bytes ( 77% used )
-
hw status
[#] Memory
[#] BigBuf_size............. 37820
[#] Available memory........ 37820
[#] Tracing
[#] tracing ................ 0
[#] traceLen ............... 188
[#] Current FPGA image
[#] mode.................... fpga_pm3_hf.ncd image 2s30vq100 17-07-2025 23:08:13
[#] Flash memory
[#] Baudrate................ 24 MHz
[#] Init.................... ok
[#] Mfr ID / Dev ID......... EF / 13
[#] JEDEC Mfr ID / Dev ID... EF / 4014
[#] Memory size............. 1024 kB (16 pages * 64k)
[#] Unique ID (be).......... 0x305C6AD375B068DC
[#] Smart card module (ISO 7816)
[#] version................. ( fail )
[#] LF Sampling config
[#] [q] divisor............. 95 ( 125.00 kHz )
[#] [b] bits per sample..... 8
[#] [d] decimation.......... 1
[#] [a] averaging........... yes
[#] [t] trigger threshold... 0
[#] [s] samples to skip..... 0
[#]
[#] LF T55XX config
[#] [r] [a] [b] [c] [d] [e] [f] [g]
[#] mode |start|write|write|write| read|write|write
[#] | gap | gap | 0 | 1 | gap | 2 | 3
[#] ---------------------------+-----+-----+-----+-----+-----+-----+------
[#] fixed bit length (default) | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] long leading reference | 29 | 17 | 15 | 47 | 15 | n/a | n/a |
[#] leading zero | 29 | 17 | 15 | 40 | 15 | n/a | n/a |
[#] 1 of 4 coding reference | 29 | 17 | 15 | 31 | 15 | 47 | 63 |
[#]
[#] HF 14a config
[#] [a] Anticol override........... std ( follow standard )
[#] [b] BCC override............... std ( follow standard )
[#] [2] CL2 override............... std ( follow standard )
[#] [3] CL3 override............... std ( follow standard )
[#] [r] RATS override.............. std ( follow standard )
[#] [m] Magsafe polling............ disabled
[#] [p] Polling loop annotation.... disabled 00000000000000000000000000000000
[#] Transfer Speed
[#] Sending packets to client...
[#] Time elapsed................... 500ms
[#] Bytes transferred.............. 293376
[#] Transfer Speed PM3 -> Client... 586752 bytes/s
[#] Various
[#] Max stack usage..... 3520 / 8480 bytes
[#] Debug log level..... 1 ( error )
[#] ToSendMax........... 39
[#] ToSend BUFFERSIZE... 2308
[#] Slow clock.......... 30346 Hz
[#] Installed StandAlone Mode
[#] LF HID26 standalone - aka SamyRun (Samy Kamkar)
[#] Flash memory dictionary loaded
[#] Mifare... 0 keys - dict_mf.bin
[#] T55xx.... 0 keys - dict_t55xx.bin
[#] iClass... 0 keys - dict_iclass.bin
[#] UL-C..... 0 keys - dict_mfulc.bin
[#] UL-AES... 0 keys - dict_mfulaes.bin -
hw tune
[usb] pm3 --> hw tune
[=] -------- Reminder ----------------------------
[=] hw tune doesn't actively tune your antennas.
[=] It's only informative.
[=] Measuring antenna characteristics...
[/] 10
[=] -------- LF Antenna ----------
[!] LF antenna............ unusable
[=] -------- HF Antenna ----------
[+] 13.56 MHz............. 26.07 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage.......... 4.5
[+] HF antenna ( ok )
[-] All values are zero. Not showing LF tuning graph
[=] Q factor must be measured without tag on the antenna
Additional context
I removed my LF antenna myself,not linked to this problem.