Decode data stored in Mifare Classic 1k card

Hello Experts,

I have key A to access my own Mifare classic 1k card then I dump all 64 blocks from card (Card has 16 sector and 4 blocks per sector). I would like to understand the meaning of stored data (Itis a kind of time attendance recorded). I have been doing some research and googling around and found that this hex code may be encrypted by Crapto1. I would like to try manually decode or find some tools but did not find so far. Will you please suggest what should I do to make data stored a human readable (Time attendance recorded) or how to convert it?
You can see my card data dump below here.
Thank you very much.

CCA95964588804008500000000000000
5448414E415420204D2E202020202020
30303831383520202020202020202020
000000000000FF078069FFFFFFFFFFFF
39333331303031202020202020202020
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
102C2000000000000000000000000000
000000000000FF078069117995272803
0E0A04FFFFFFFFFFFFFFFFFFFFFFFFFF
061715071449201106171516434F2012
061915072549201106191517024F2012
000000000000FF078069117995272803
062215072649201106221516564F2012
062315070249201106231516494F2012
06241507104920110505150653492011
000000000000FF078069117995272803
05051517184F20120506150705492011
05061516434F20120507150706492011
05071516494F20120508150700492011
000000000000FF078069117995272803
05081516184F20120511150712492011
051115132249201105111513224F2012
05111516544F20120512150715492011
000000000000FF078069117995272803
05121518134F20120514151419492011
051515100749201105151516524F2012
051815103649201105181517074F2012
000000000000FF078069117995272803
051915071149201105191517014F2012
052115072549201105211517024F2012
052215072649201105221517004F2012
000000000000FF078069117995272803
052515103849201105251516494F2012
05251516494F20120526150717492011
05261516374F20120527150711492011
000000000000FF078069117995272803
05271516374F20120529150724492011
05291516294F20120530150949492011
05301516084F20120602150739492011
000000000000FF078069117995272803
06021516524F20120604150704492011
06041516394F20120605150715492011
06051514174F20120608151121492011
000000000000FF078069117995272803
06081518424F20120609150722492011
06091516574F20120610150716492011
06101516434F20120612150724492011
000000000000FF078069117995272803
06121516484F20120615150712492011
06151516484F20120616150704492011
061615070449201106161517024F2012
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803

Open in new window

trazodoneAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David Johnson, CD, MVPOwnerCommented:
Some milfare tools are available @
https://github.com/nfc-tools
btanExec ConsultantCommented:
See the manual on the section of 8.6 Memory organization and 8.7 Memory access for the specific bit representation. There are altogether 16 Sector with each sector having 4 set of two bytes (16), each representing a KeyA (4) + Access bits (3) + KeyB (6) format. By default it is all "FF" (hex) for each of the two byte slot as delivered originally or reset. And  Key B is optional.

They are not necessary "Key" per se. But do note that the first data block (block 0) of the first sector (sector 0). It contains the IC manufacturer data. This block is programmed and write protected in the production.
All sectors contain 3 blocks of 16 bytes for storing data (Sector 0 contains only two data
blocks and the read-only manufacturer block).
The data blocks can be configured by the access bits as
• read/write blocks
• value blocks
Value blocks can be used for e.g. electronic purse applications, where additional
commands like increment and decrement for direct control of the stored value are
provided.
http://www.nxp.com/documents/data_sheet/MF1S503x.pdf

Tools that can be useful - http://nfc-tools.org/index.php?title=Main_Page
Specific to Classic - http://nfc-tools.org/index.php?title=Libnfc:nfc-mfclassic
wyliecoyoteukIT directorCommented:
These cards are usually used for presenting credentials for identification.
The data is more commonly stored in a database back-end.
Only 762bytes are actually writable, and if they do represent values, you would need the relevant timekeeping application to know what they referred to.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

trazodoneAuthor Commented:
Hello,

Thank you for your replied. Yes the data was recorded in the back end but also writing on the card in case of DB disaster they will dump time stamp from card. I will show you the difference data between this card check IN and OUT.

Below is card check IN on Date=24-Jun-2015 Time=10.22 (24 hours system)
970E3DE4408804008500000000000000
4E4954495241542020532E2020202020
30303838303520202020202020202020
000000000000FF078069FFFFFFFFFFFF
39333331303031202020202020202020
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
102C2000000000000000000000000000
000000000000FF078069FFFFFFFFFFFF
1D1F02FFFFFFFFFFFFFFFFFFFFFFFFFF
06021518344F20120603150650492011
06031516024F20120604151010492011
000000000000FF078069117995272803
06051512344920110605151240492011
06051516024F20120609150853492011
06091517554F20120610151022492011
000000000000FF078069FFFFFFFFFFFF
06101519594F20120611150918492011
06111523134F20120612150937492011
06121517104F20120613151142492011
000000000000FF078069117995272803
06131519044F20120615151307492011
06151518004F20120616150954492011
06161519004F20120617150923492011
000000000000FF078069117995272803
06171518264F20120618151258492011
06181519094F20120619150919492011
06191521354F20120623150723492011
000000000000FF078069117995272803
06231516514F20120624151022492011
05111516254F20120512150806492011
05121517074F201205121517094F2012
000000000000FF078069117995272803
051315095649201105131518484F2012
05141508174F20120514150817492011
05141516044F20120515150916492011
000000000000FF078069117995272803
05151517144F20120516151014492011
05161516174F20120518151023492011
05181519024F20120519150927492011
000000000000FF078069117995272803
05191518294F20120520150651492011
05201516004F20120521150715492011
05211516164F20120522150805492011
000000000000FF078069117995272803
05221516054F20120523150933492011
05231518364F20120526150943492011
05261518464F20120527150903492011
000000000000FF078069117995272803
05271518164F20120528150722492011
05281516224F20120529150954492011
05291517194F20120602150933492011
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803

Open in new window

Below is card check OUT on Date=24-Jun-2015 Time=19.08 (24 hours system)
970E3DE4408804008500000000000000
4E4954495241542020532E2020202020
30303838303520202020202020202020
000000000000FF078069FFFFFFFFFFFF
39333331303031202020202020202020
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
102C2000000000000000000000000000
000000000000FF078069FFFFFFFFFFFF
1D203DFFFFFFFFFFFFFFFFFFFFFFFFFF
06021518344F20120603150650492011
06031516024F20120604151010492011
000000000000FF078069117995272803
06051512344920110605151240492011
06051516024F20120609150853492011
06091517554F20120610151022492011
000000000000FF078069FFFFFFFFFFFF
06101519594F20120611150918492011
06111523134F20120612150937492011
06121517104F20120613151142492011
000000000000FF078069117995272803
06131519044F20120615151307492011
06151518004F20120616150954492011
06161519004F20120617150923492011
000000000000FF078069117995272803
06171518264F20120618151258492011
06181519094F20120619150919492011
06191521354F20120623150723492011
000000000000FF078069117995272803
06231516514F20120624151022492011
06241519084F20120512150806492011
05121517074F201205121517094F2012
000000000000FF078069117995272803
051315095649201105131518484F2012
05141508174F20120514150817492011
05141516044F20120515150916492011
000000000000FF078069117995272803
05151517144F20120516151014492011
05161516174F20120518151023492011
05181519024F20120519150927492011
000000000000FF078069117995272803
05191518294F20120520150651492011
05201516004F20120521150715492011
05211516164F20120522150805492011
000000000000FF078069117995272803
05221516054F20120523150933492011
05231518364F20120526150943492011
05261518464F20120527150903492011
000000000000FF078069117995272803
05271518164F20120528150722492011
05281516224F20120529150954492011
05291517194F20120602150933492011
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
000000000000FF078069117995272803

Open in new window


You can see the difference at line 9 and line 30 between 2 dumps below

LINE 9
IN     1D1F02FFFFFFFFFFFFFFFFFFFFFFFFFF
OUT 1D203DFFFFFFFFFFFFFFFFFFFFFFFFFF


LINE 30
IN     05111516254F20120512150806492011
OUT 06241519084F20120512150806492011

I have been trying to convert to find relation ship but not success. Will you please suggest if any info found?

Thank you
btanExec ConsultantCommented:
Pardon me, to correct my prev posting each block in each sector is 16 bytes hence the format is KeyA (6bytes) + Access bits (4bytes) + KeyB (6bytes) format. Therefore, in every two char in the string that you shared is one byte (hex represented, 8 bits). So it looks to be for

> LINE 9 there is change only to KeyA (no change to Access bit and KeyB, the latter is optional so it is default value when the card is roll out). It is KeyA's second and third byte changed.
LINE 9
 IN     1D1F02FFFFFFFFFFFFFFFFFFFFFFFFFF
 OUT 1D203DFFFFFFFFFFFFFFFFFFFFFFFFFF

> LINE 30, likewise, there is change to KeyA and this time it is the 5bytes of the key except the 3rd byte.
 LINE 30
 IN     05111516254F20120512150806492011
 OUT 06241519084F20120512150806492011

As for the change and its use, you have to find out what it is used for and allocated key assigned (may be access to some location or used as e-purse etc). In specific, the card has 16 sector with each sector containing a total of 4 blocks with
(a) 3 blocks of 16 bytes for storing data (Sector 0 contains only two data blocks and the read-only manufacturer block). Those value blocks allow performing electronic purse functions (valid commands: read, write, increment, decrement, restore, transfer). (section 8.6.2)
(b) The sector trailer or the last sector is the last block (block 3) that hold the key and access right (read/write) to the key (section 8.6.3)

The pdf shared in prev post is good info if you want to drill specific but it cannot tell you the appl etc (at least this is just Mifare card and not Java Card with applet which can be more complicated ...). Some possible appl include Public transportation 􀂄 Access management 􀂄 Electronic toll collection 􀂄 Car parking 􀂄 School and campus cards 􀂄 Employee cards 􀂄 Internet cafés 􀂄 Loyalty
trazodoneAuthor Commented:
Hello btan,

This meant that this card does not store any time attendance data?
Gerwin Jansen, EE MVETopic Advisor Commented:
Which kind of application is using these cards?

Any documentation available on that  time writing application / backend itself?

OUT 06241519084F20120512150806492011 (MMDDYYHH24MM)

There is your 'out' timestamp - just in plain text.

If you look at the 'in' timestamp - looks like a different timestamp to me, maybe just some initial timestamp for that employee? The time when the card was created/programmed initially maybe? Check your backend for that.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
trazodoneAuthor Commented:
Hello Gerwin,

Awsome. You are correct! I forfot to find Decimal number from dump data. Now I can trace all time stamp from this card. This card record IN and OUT 32 days backward from present day.

Thank you so much
trazodoneAuthor Commented:
I've requested that this question be closed as follows:

Accepted answer: 0 points for trazodone's comment #a40854314

for the following reason:

Awesome. Thank you.
Gerwin Jansen, EE MVETopic Advisor Commented:
You're welcome, however in closing this question, you should not choose your own comment with 0 points but the comment(s) that helped you solve the issue and award points. Thanks.
btanExec ConsultantCommented:
Hope to have assisted you...didn't see that behind for LINE 30 which is a value block. But LINE 9 is the trailer block (not value block) and apparently the access is not changed except the key - but probably someone has made changes to authentication...Regardless, glad you know it. Below in case you need

Accepting a single comment
http://support.experts-exchange.com/customer/portal/articles/608621
Accepting multiple solutions
http://support.experts-exchange.com/customer/portal/articles/608596
Answered the question yourself
http://support.experts-exchange.com/customer/portal/articles/626549
Answered the question yourself but with the experts help
http://support.experts-exchange.com/customer/portal/articles/626862
trazodoneAuthor Commented:
Thank you
btan for good learning resource
Gerwin for revealing what I want
btanExec ConsultantCommented:
thanks for sharing
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Encryption

From novice to tech pro — start learning today.