DESFire EV2 Card

4 Byte & 7 Byte DESFire EV2

Changing UID

hf 14a apdu -s 00ab00010704203e32506680

04203e32506680 -> UID

Changing get version

hf 14a apdu -s 00ab00361c04010112001A0504010102011A0504203E32506680CEEDD155602719

Example:

[usb] pm3 –> hf 14a apdu -s 00ab00010704206666688888
[+] ( select )
[+] >>> 00AB00010704206666688888
[+] <<< 9000 | ..
[+] <<< status: 90 00 – Command successfully executed (OK).

[usb] pm3 –> hf search
[/] Searching for ISO14443-A tag…
[+]  UID: 04 20 66 66 68 88 88
[+] ATQA: 03 44
[+]  SAK: 20 [1]
[+] MANUFACTURER:    NXP Semiconductors Germany
[+] Possible types:
[+]    MIFARE DESFire CL2
[+]    MIFARE DESFire EV1 256B/2K/4K/8K CL2
[+]    MIFARE DESFire EV2 2K/4K/8K/16K/32K
[+]    MIFARE DESFire Light 640B
[+]    NTAG 4xx
[=] ————————– ATS ————————–
[+] ATS: 06 75 77 81 02 80 [ f0 00 ]
[=]      06……………  TL    length is 6 bytes
[=]         75…………  T0    TA1 is present, TB1 is present, TC1 is present, FSCI is 5 (FSC = 64)
[=]            77………  TA1   different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]
[=]               81……  TB1   SFGI = 1 (SFGT = 8192/fc), FWI = 8 (FWT = 1048576/fc)
[=]                  02…  TC1   NAD is NOT supported, CID is supported
[=] ——————– Historical bytes ——————–
[+]    80
[?] Hint: try `hf mfdes info`

Use magic command via APDU / Proxmark3 14a Raw command to change

Used ISO7816 AQDU

No magic gen1 backdoor commands