Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Help with PDOL challenge #5

Closed
merdeux50 opened this issue Mar 5, 2021 · 8 comments
Closed

Help with PDOL challenge #5

merdeux50 opened this issue Mar 5, 2021 · 8 comments

Comments

@merdeux50
Copy link

Hello,

I’ve recently gotten a nfc copy cat and am struggling to understand how to run the read_replay_spoof .ino

could someone please clarify what “ Make a right format challenge using the card PDOL to extract more data(track 2)” means? And how I should go editing the ino?

ive successfully got my cards pdol with the acr122 and cardpeek what next?

@salmg
Copy link
Contributor

salmg commented Mar 7, 2021

If you got the pdol from the acr122 means that you got the track 2 as well.

Just add the track 2 to the token variable. There is an example in the code such as

char token[19] = {0x44,0x12,0x34,0x15,0x01,0x12,0x03,0x12,0xd2,0x41,0x12,0x01,0x10,0x12,0x09,0x99,0x99,0x99,0x1f};

and then emulate it.

@merdeux50
Copy link
Author

merdeux50 commented Mar 7, 2021

Thank you for your reply, yes I can use it. But what’s the point in having bought the nfc copy cat with the ability to extract it through the pn 352 if I have to use another device?

How can I successfully use the copy cat?

Is there a pdf or document that explains the process?

@salmg
Copy link
Contributor

salmg commented Mar 7, 2021

The PDOL function was designed to challenge the card, to be able to extract track 2, NFC Copy Cat has to send the correct challenge at least in format to the card. That is what PDOL does. Basically it generates the "GET PROCESSING OPTIONS" command in format, so the card can answer with the track 2

Really you do not have to edit the code to work; this code is ready to use, if you press a button and it will spoof data, if you press the second one, it will try yo read the card automatically.

If you want to learn about what is pdol: https://www.emvco.com/wp-content/uploads/2017/05/EMV_v4.3_Book_3_Application_Specification_20120607062110791.pdf

If you want to learn more about the tool: https://salmg.net/2020/04/13/nfc-copy-cat-magstripe-nfc/ or

@merdeux50
Copy link
Author

merdeux50 commented Mar 8, 2021

Thank you!

I will read all I can to understand the communication with the card.
It seems after trying the CheckPDOL I get (This card is not active btw...)

9.934 -> Command: 0x00 0xA4 0x04 0x00 0x0E 0x32 0x50 0x41 0x59 0x2E 0x53 0x59 0x53 0x2E 0x44 0x44 0x46 0x30 0x31 0x00
09:17:50.006 -> Card answer: 0x6F 0x23 0x84 0x0E 0x32 0x50 0x41 0x59 0x2E 0x53 0x59 0x53 0x2E 0x44 0x44 0x46 0x30 0x31 0xA5 0x11 0xBF 0x0C 0x0E 0x61 0x0C 0x4F 0x07 0xA0 0x00 0x00 0x00 0x03
09:17:50.006 -> -----
09:17:50.331 -> Command: 0x00 0xA4 0x04 0x00 0x07 0xA0 0x00 0x00 0x00 0x03 0x10 0x10 0x00
09:17:50.443 -> Card answer: 0x6F 0x5E 0x84 0x07 0xA0 0x00 0x00 0x00 0x03 0x10 0x10 0xA5 0x53 0x50 0x0B 0x56 0x69 0x73 0x61 0x20 0x43 0x72 0x65 0x64 0x69 0x74 0x87 0x01 0x01 0x9F 0x38 0x18
09:17:50.443 -> -----
09:17:50.443 -> -->PDOL found: 0x18 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
09:17:50.443 -> -----
09:17:50.757 -> Command: 0x80 0xA8 0x00 0x00 0x23 0x83 0x21 0x00
09:17:50.793 -> Card answer: 0x6F 0x00
09:17:50.793 -> -----
09:17:51.084 -> Command: 0x00 0xB2 0x01 0x0C 0x00
09:17:51.117 -> Card answer: 0x6A 0x83

I’ve compared with cardpeek, the commands sent are the same. Copy cat gets error responses for some reason.

@merdeux50
Copy link
Author

Any insight regarding the pdol check?

@merdeux50
Copy link
Author

merdeux50 commented Mar 18, 2021

After reading most of the documents I found. I’m realizing that the script is fine.
For some reason the cards responses to the APDU and visa is too short for it to get the normal pdol.

There is a communication error somewhere.

The PN532 board is unreliable, it recognizes the board 1 out of 30 times.

Honestly guy, this is supposed to be for students and people that want to learn?
I’ve had an extremely uninterested and lazy response from all of you guys here. Giving me lazy responses.

Just take the money and run type of mentality. Pay 120$ with shipping for a 3$ elechouse pn532 and a MagSpoof that doesn’t work.

I’m disappointed

@wero1414
Copy link
Member

Hi @merdeux50 im really sorry about the timming on answering your issue, i must say our technical team is quite small and we're now focused on a new product, The Hunter Cat NFC we have noticed on the past the problem with the PN532 board sometimes it works in a bad way, talking in other topic, the maspoof should work as thats something that we always test on our product line

@merdeux50
Copy link
Author

I noticed a crucial thing missing from your wiki which solved most of my issues.

I was using the Adafruit PN532 library, I changed it to salm pn532 library and it works better now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants