Topic: Read MiZip tag

Hi everybody,

Since few days I try to read a NFC key known as Mizip tag, who seems to be equivalent of Mifare Mini 0.3k.
I first launch mfoc to try to find keys unfortunately It was only able to retrieve key A from sector 0. After few research on forum I was able to find key B from sector 0. My question is now: How it is possible to retrieve key from other sectors ? I have read that it is possible find them with the uid of the tag. Unfortunately, I don't find the algorithm over internet...

The output of mfoc:

Found Mifare Classic Mini tag
ISO/IEC 14443A (106 kbps) target:
    ATQA (SENS_RES): 00  04  
* UID size: single
* bit frame anticollision supported
       UID (NFCID1): 66  78  82  8d  
      SAK (SEL_RES): 09  
* Not compliant with ISO/IEC 14443-4
* Not compliant with ISO/IEC 18092

Fingerprinting based on MIFARE type Identification Procedure:
* MIFARE Mini 0.3K
* SmartMX with MIFARE 1K emulation
Other possible matches based on ATQA & SAK values:

Try to authenticate to all sectors with default keys...
Symbols: '.' no key found, '/' A key found, '\' B key found, 'x' both keys found
[Key: a0a1a2a3a4a5] -> [/....]
[Key: b4c132439eef] -> [x....]
[Key: 11c91aceed1f] -> [x....]
[Key: ffffffffffff] -> [x....]
[Key: a0a1a2a3a4a5] -> [x....]
[Key: d3f7d3f7d3f7] -> [x....]
[Key: 000000000000] -> [x....]
[Key: b0b1b2b3b4b5] -> [x....]
[Key: 4d3a99c351dd] -> [x....]
[Key: 1a982c7e459a] -> [x....]
[Key: aabbccddeeff] -> [x....]
[Key: 714c5c886e97] -> [x....]
[Key: 587ee5f9350f] -> [x....]
[Key: a0478cc39091] -> [x....]
[Key: 533cb6c723f6] -> [x....]
[Key: 8fd0a4f256e9] -> [x....]

Sector 00 - Found   Key A: a0a1a2a3a4a5 Found   Key B: b4c132439eef
Sector 01 - Unknown Key A               Unknown Key B
Sector 02 - Unknown Key A               Unknown Key B
Sector 03 - Unknown Key A               Unknown Key B
Sector 04 - Unknown Key A               Unknown Key B


Using sector 00 as an exploit sector
Sector: 1, type A, probe 0, distance 41496 .....

Thanks for your help smile

Re: Read MiZip tag

KEY A

a0a1a2a3a4a5
6F6AD8A8EF9D
CD0D4BBAF4??
840A??224A71
570235A22??8

smile

KEY B

b4c132439eef
73A1E22B5AAC
F16A??86B0CC
28C0750E??23
??9E415FAF70

Re: Read MiZip tag

Thank you marco.rossinol!
Can you tell me how did you find that ?  What about the "??" in the keys ?

Re: Read MiZip tag

I am facing the same problem with a Mifare Classic Mini 0.3k tag : infinite probes in mfoc.
I tried to give mfoc the keys marco mentionned but mfoc does not seem to understand the '?' character in the keys :

28C0750E??23 becomes 000028C0750E.

Any hint?

Re: Read MiZip tag

for information, I found the spec doc of this type of tag : smartcardworld.com / download / mifare_S20_datasheet.pdf

Re: Read MiZip tag

Khaliloo, thanks for the datasheet. Hopes it will bring us some information about the keys