MIFARE Classic 1K How to locate the Value Block

Question

Could someone help me identify the value blocks of a MIFARE Classic 1K card? I understand that the first 4 bytes contain the value in hexadecimal format, but I cannot identify which ones they are.

I was searching on the internet and trying to deduct the balance from the card to be able to verify which block was modified and find the block in which the balance is stored but I was not able to do so.

[=] -----+-----+-------------------------------------------------+-----------------
[=]  sec | blk | data                                            | ascii
[=] -----+-----+-------------------------------------------------+-----------------
[=]    0 |   0 | D5 E5 3A 39 33 88 04 00 43 22 A4 27 00 11 09 16 | ..:93...C".'....
[=]      |   1 | 00 00 00 00 00 04 3C 00 0A 17 4C 49 4D 41 20 20 | ......<...LIMA
[=]      |   2 | 00 00 00 00 00 00 00 00 00 39 3A E5 D5 03 01 00 | .........9:.....
[=]      |   3 | 50 ED C8 2B 71 03 70 F8 78 00 51 F1 94 E4 2E AD | P..+q.p.x.Q.....
[=]    1 |   4 | 00 55 DF 8A 0C 5A 40 00 00 00 00 00 00 00 00 00 | .U...Z@.........
[=]      |   5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 97 37 | ...............7
[=]      |   6 | 00 00 00 00 00 00 00 00 00 39 3A E5 D5 03 01 00 | .........9:.....
[=]      |   7 | 7A 61 AB 92 E0 71 07 88 7F 00 51 F1 94 E4 2E AD | za...q....Q.....
[=]    2 |   8 | 20 FC 01 00 00 00 00 28 31 69 78 01 12 CB 01 2F |  ......(1ix..../
[=]      |   9 | 72 75 60 00 00 00 00 00 00 00 00 00 00 79 4F 9A | ru`..........yO.
[=]      |  10 | 9C 31 2D 02 00 43 28 45 CC CC CC CC CC CC CC CC | .1-..C(E........
[=]      |  11 | BB 8B 43 92 56 A5 07 88 7F 00 51 F1 94 E4 2E AD | ..C.V.....Q.....
[=]    3 |  12 | 20 FC 01 00 00 00 00 28 31 69 78 01 12 CB 01 2F |  ......(1ix..../
[=]      |  13 | 72 75 60 00 00 00 00 00 00 00 00 00 00 79 4F 9A | ru`..........yO.
[=]      |  14 | 9B 31 2D 02 00 43 0A 3A A9 20 60 20 00 15 E2 88 | .1-..C.:. ` ....
[=]      |  15 | DB DC DB E5 AE FB 07 88 7F 00 51 F1 94 E4 2E AD | ..........Q.....
[=]    4 |  16 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  19 | CB 1F 7E AA 2F 5F 07 88 7F 00 51 F1 94 E4 2E AD | ..~./_....Q.....
[=]    5 |  20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  21 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  22 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  23 | 06 79 10 A9 4A 46 07 88 7F 00 51 F1 94 E4 2E AD | .y..JF....Q.....
[=]    6 |  24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  27 | 29 AF CC A7 3E 3E 07 88 7F 00 51 F1 94 E4 2E AD | )...>>....Q.....
[=]    7 |  28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  31 | FF 1B CC 61 31 B4 07 88 7F 00 51 F1 94 E4 2E AD | ...a1.....Q.....
[=]    8 |  32 | 00 FC 00 00 10 00 08 00 03 02 22 00 00 00 00 00 | ..........".....
[=]      |  33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 5C A2 D1 | .............\..
[=]      |  34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  35 | A9 2F 40 77 23 58 07 88 7F 00 51 F1 94 E4 2E AD | ./@w#X....Q.....
[=]    9 |  36 | 00 00 00 00 10 00 08 00 03 22 22 00 00 00 00 00 | ........."".....
[=]      |  37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 BE 1A 34 | ...............4
[=]      |  38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  39 | 9A 9D BD 89 12 0D 07 88 7F 00 51 F1 94 E4 2E AD | ..........Q.....
[=]   10 |  40 | 7E 00 00 E1 01 3B 31 2D 91 A0 60 60 00 09 62 C2 | ~....;1-..``..b.
[=]      |  41 | A0 00 0C C0 00 00 00 00 00 00 00 00 00 F8 AB E4 | ................
[=]      |  42 | 7E 00 00 E1 01 3B 31 2D AD 00 60 C0 00 0F A2 88 | ~....;1-..`.....
[=]      |  43 | F4 29 2C F4 A1 C0 07 88 7F 00 51 F1 94 E4 2E AD | .),.......Q.....
[=]   11 |  44 | 82 00 16 10 00 00 00 00 00 00 00 00 00 98 D0 E5 | ................
[=]      |  45 | 7E 00 00 D1 01 34 31 2D AD 00 C0 C0 00 06 42 D1 | ~....41-......B.
[=]      |  46 | 00 00 13 00 00 00 00 00 00 00 00 00 00 6A 99 9E | .............j..
[=]      |  47 | 14 56 96 A4 F4 77 07 88 7F 00 51 F1 94 E4 2E AD | .V...w....Q.....
[=]   12 |  48 | 7E 00 00 D1 01 AC 31 2D 91 A0 C0 60 00 0F A2 B7 | ~.....1-...`....
[=]      |  49 | 02 00 13 00 00 00 00 00 00 00 00 00 00 90 8E CC | ................
[=]      |  50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  51 | 73 D2 32 10 40 10 07 88 7F 00 51 F1 94 E4 2E AD | [email protected].....
[=]   13 |  52 | E3 D5 FB 44 E1 0C F7 71 46 83 AB DA DB E9 61 5F | ...D...qF.....a_
[=]      |  53 | 2B F2 3E 15 FF DF FC 4B CE 09 E6 08 92 E7 D4 AD | +.>....K........
[=]      |  54 | 4E F0 F7 2D 24 A2 D3 25 07 8F 8A 14 E3 71 CB B0 | N..-$..%.....q..
[=]      |  55 | DE 38 BE C2 27 92 07 88 7F 00 51 F1 94 E4 2E AD | .8..'.....Q.....
[=]   14 |  56 | 18 74 C1 7C 4A 6F F4 03 84 A6 49 0E AD 1A D8 6B | .t.|Jo....I....k
[=]      |  57 | 0F 54 93 32 11 BB C3 78 EB CB F3 76 10 0E 7A EE | .T.2...x...v..z.
[=]      |  58 | 3C B6 AA BE 00 80 BA 42 4F C5 6D 25 A9 73 B4 58 | <......BO.m%.s.X
[=]      |  59 | 0C A4 F7 AA E0 CA 07 88 7F 00 51 F1 94 E4 2E AD | ..........Q.....
[=]   15 |  60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=]      |  61 | 60 FF FF 7F 9F 00 00 80 60 FF FF 7F 0F F0 0F F0 | `.......`.......
[=]      |  62 | 61 FF FF 7F 9E 00 00 80 61 FF FF 7F 0F F0 0F F0 | a.......a.......
[=]      |  63 | 69 71 F1 AF 66 6B 66 98 79 00 9B E4 6F 65 F6 A7 | iq..fkf.y...oe..
[=] -----+-----+-------------------------------------------------+-----------------

Michael Fehr · Accepted Answer · 2024-09-25 06:32:51Z

0

This code is taken from an old but still working Android/Java project: "Mifare Classic Tool" by Gerhard Klostermeier, available on GitHub: https://github.com/ikarus23/MifareClassicTool.

To make it short: the value within a value block is byte encoded in the regular byte order and the inverted one. The key to identify a Value Block is to go through each sector (if you don't know where a Value Block is located) and run a test on the data.

In the commons.java file you find this method, it returns true when a Value Block is identified. To read or write such a byte sequence there are 2 classes as well: ValueBlockTool.java and ValueBlocksToInt.java.

/**
 * Check if the given block (hex string) is a value block.
 * NXP has PDFs describing what value blocks are. Google something
 * like "nxp MIFARE classic value block" if you want to have a
 * closer look.
 * @param hexString Block data as hex string.
 * @return True if it is a value block. False otherwise.
 */
public static boolean isValueBlock(String hexString) {
    byte[] b = Common.hex2Bytes(hexString);
    if (b != null && b.length == 16) {
        // Google some NXP info PDFs about MIFARE Classic to see how
        // Value Blocks are formatted.
        // For better reading (~ = invert operator):
        // if (b0=b8 and b0=~b4) and (b1=b9 and b9=~b5) ...
        // ... and (b12=b14 and b13=b15 and b12=~b13) then
        return (b[0] == b[8] && (byte) (b[0] ^ 0xFF) == b[4]) &&
            (b[1] == b[9] && (byte) (b[1] ^ 0xFF) == b[5]) &&
            (b[2] == b[10] && (byte) (b[2] ^ 0xFF) == b[6]) &&
            (b[3] == b[11] && (byte) (b[3] ^ 0xFF) == b[7]) &&
            (b[12] == b[14] && b[13] == b[15] &&
                (byte) (b[12] ^ 0xFF) == b[13]);
    }
    return false;
}

answered Sep 25, 2024 at 6:32

Michael Fehr

6,5023 gold badges24 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Dante Ramirez Over a year ago

Thanks for the explanation and reference to the Mifare Classic Tool project. I have reviewed the ValueBlockTool.java and ValueBlocksToInt.java files. I have identified blocks 61 and 62 in sector 15 as value blocks using the isValueBlock() method. However, the decoded values are extremely large (e.g. 2147483488), when the actual balance should be 8.93. Could there be an additional conversion or scaling that I am missing? I appreciate any further guidance.

Collectives™ on Stack Overflow

MIFARE Classic 1K How to locate the Value Block

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related