Programming MIFARE 1k S50 Classic proximity cards

Access to the NFC MIFARE card memory

Implemented on

MIFARE cards

the security mechanism assumes that access to each memory sector must be performed using a security key. The access security key can take any value with a length of 6B. Two keys (keyA, keyB) can be used for each memory sector.

Why does the card allow two keys to be programmed for one sector? Two keys allow you to configure access conditions to a selected memory sector so that data reading is performed with a different key than writing.

It is worth remembering that the default (factory) value of the A key for reading/writing information is

FF FF FF FF FF FF

. A key with this value can be used to change the content of data blocks and modify the values of both access keys.

Memory organization of the MIFARE S50 proximity card

Memory

MIFARE 1k cards

is divided into 16 sectors (0 - 15). Each sector has 4 memory blocks with a length of 16B. The memory available for writing user data is located in the first three blocks of each sector (0-3). The fourth block is intended for configuring access to sector data. The exception is the first block of the first sector (block no. 0 of the card), which contains data written to the card during the production process (e.g. unique UID).

By design, the factory memory block is intended only for reading, but it is worth mentioning that it is possible to purchase it

MIFARE cards with programmable zero block

MIFARE 1k cards with programmable UID

allow you to clone your MIFARE S50 card. You can read more about this in

technical article on our blog

When referring to selected memory cells, we use the numbering of subsequent blocks without division into sectors. The indexes of subsequent blocks in which information can be saved are as follows:

1, 2 (sector 0)

4,5,6 (sector 1)

8,9,10 (sector 2)

12,13,14 (sector 3)

etc. up to sector no. 15

To sum up,

MIFARE 1k contactless cards

they have 1024B of memory (16 x 4 x 16B = 1024), of which 752B is available for data recording (2 x 16B + 15 x 3 x 16B = 752B).

Data recording on NFC cards

Data on

MIFARE contactless cards

are saved as 16B strings in hexadecimal (HEX) format. This means that each of the sixteen written bytes can take values from 00 to FF (in decimal notation this corresponds to values from 0 to 255).

Configuration of the MIFARE security mechanism

We mentioned that access to the data of the selected sector requires knowledge of the value of the access key with a length of 6B. We also know that it is possible to use two keys (keyA, keyB).

The values of the access keys must be saved in the card memory, independently for each sector. This is what the fourth block (block 3) of each of the sixteen memory sectors is for.

The memory block responsible for configuring access to the sector is the same length as any other memory block, i.e. 16B. The memory of the technical block was managed in the following way:

6B – keyA

4B – access configuration

6B – keyB

The issue of access keys (keyA, keyB) has been presented previously and should not require additional explanation. What is meant by access configuration?

The indicated 4B describe the conditions for access to sector memory using defined keys, in particular they allow you to determine which of the keys will be used to read/write data.

The access configuration value must be calculated based on the card manufacturer's algorithm. The most popular configuration includes:

FF 07 80 69 – reading and writing using both keys

EF 07 81 69 – reading with both keys, writing not possible

FE 17 80 69 – reading with both keys, writing with keyB

EF 06 91 69 – reading and writing with keyB

FE 16 90 69 – reading with keyB, no writing possible

Summary

The article presents basic information that should allow you to start working with

MIFARE S50 1k proximity cards

. It is worth knowing that the programming model

MIFARE S70 4k cards

is very close. Of course

4k card

has more memory, which results in minor differences in the way it is organized.

You are interested in programming

MIFARE S70 4k cards

? We encourage you to leave a comment. Chętnie poruszymy ten temat w jednym z kolejnych wpisów na naszym blogu.

Access to the NFC MIFARE card memory

Implemented on

MIFARE cards

It is worth remembering that the default (factory) value of the A key for reading/writing information is

FF FF FF FF FF FF

. A key with this value can be used to change the content of data blocks and modify the values of both access keys.

Memory organization of the MIFARE S50 proximity card

Memory

MIFARE 1k cards

By design, the factory memory block is intended only for reading, but it is worth mentioning that it is possible to purchase it

MIFARE cards with programmable zero block

MIFARE 1k cards with programmable UID

allow you to clone your MIFARE S50 card. You can read more about this in

technical article on our blog

When referring to selected memory cells, we use the numbering of subsequent blocks without division into sectors. The indexes of subsequent blocks in which information can be saved are as follows:

1, 2 (sector 0)

4,5,6 (sector 1)

8,9,10 (sector 2)

12,13,14 (sector 3)

etc. up to sector no. 15

To sum up,

MIFARE 1k contactless cards

they have 1024B of memory (16 x 4 x 16B = 1024), of which 752B is available for data recording (2 x 16B + 15 x 3 x 16B = 752B).

Data recording on NFC cards

Data on

MIFARE contactless cards

are saved as 16B strings in hexadecimal (HEX) format. This means that each of the sixteen written bytes can take values from 00 to FF (in decimal notation this corresponds to values from 0 to 255).

Configuration of the MIFARE security mechanism

We mentioned that access to the data of the selected sector requires knowledge of the value of the access key with a length of 6B. We also know that it is possible to use two keys (keyA, keyB).

The values of the access keys must be saved in the card memory, independently for each sector. This is what the fourth block (block 3) of each of the sixteen memory sectors is for.

The memory block responsible for configuring access to the sector is the same length as any other memory block, i.e. 16B. The memory of the technical block was managed in the following way:

6B – keyA

4B – access configuration

6B – keyB

The issue of access keys (keyA, keyB) has been presented previously and should not require additional explanation. What is meant by access configuration?

The indicated 4B describe the conditions for access to sector memory using defined keys, in particular they allow you to determine which of the keys will be used to read/write data.

The access configuration value must be calculated based on the card manufacturer's algorithm. The most popular configuration includes:

FF 07 80 69 – reading and writing using both keys

EF 07 81 69 – reading with both keys, writing not possible

FE 17 80 69 – reading with both keys, writing with keyB

EF 06 91 69 – reading and writing with keyB

FE 16 90 69 – reading with keyB, no writing possible

Summary

The article presents basic information that should allow you to start working with

MIFARE S50 1k proximity cards

. It is worth knowing that the programming model

MIFARE S70 4k cards

is very close. Of course

4k card

has more memory, which results in minor differences in the way it is organized.

You are interested in programming

MIFARE S70 4k cards

? We encourage you to leave a comment. Chętnie poruszymy ten temat w jednym z kolejnych wpisów na naszym blogu.

Introduction to programming MIFARE 1k proximity cards

Introduction to programming MIFARE 1k proximity cards