526 Reply by johnboyjr

  • johnboyjr
  • Member
  • Offline
  • Registered: 2015-12-08
  • Posts: 79

Re: DaVinci Junior cartridge reset

strucktheman wrote:

So i finally found an android app which will read and write the card successfully permitting that you have the key for your tag.  There may be others out there but this is the only one that i could get to work.

I should note that the the page numbering on this app is done in HEX rather than Decimal.  So in order to change your spool length with this app you would write
page number 0A             
data content E0930400
page number 0B
data content E0930400
page number 14
data content E0930400

https://play.google.com/store/apps/deta … amp;hl=en0

its a start for now

so if I sent my card to some one they could get the password for me and I can just use my phone? If so would any one be willing to help me? I can pay you

527 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: DaVinci Junior cartridge reset

I would gladly retrieve passwords for you.

528 Reply by HyruleJedi86 (edited by HyruleJedi86 2016-02-21 02:09:44)

  • HyruleJedi86
  • Member
  • Offline
  • Registered: 2015-05-11
  • Posts: 113

Re: DaVinci Junior cartridge reset

strucktheman wrote:

So i finally found an android app which will read and write the card successfully permitting that you have the key for your tag.  There may be others out there but this is the only one that i could get to work.

I should note that the the page numbering on this app is done in HEX rather than Decimal.  So in order to change your spool length with this app you would write
page number 0A             
data content E0930400
page number 0B
data content E0930400
page number 14
data content E0930400

https://play.google.com/store/apps/deta … amp;hl=en0

If we had a full card and the password for that card, would it be possible to use this app to copy the card and save a copy of this version, then once the card is almost empty or empty recopy the original information back to the card. Essentially resetting it, the key being we know the password for the card?

529 Reply by crcasey

  • crcasey
  • Member
  • Offline
  • Registered: 2016-01-12
  • Posts: 46

Re: DaVinci Junior cartridge reset

Thanks for the link to the App.  I will download it and check it out on Monday.

I knew there had to be an app that knew about the key function on this chip.

-Cecil

strucktheman wrote:

So i finally found an android app which will read and write the card successfully permitting that you have the key for your tag.  There may be others out there but this is the only one that i could get to work.

I should note that the the page numbering on this app is done in HEX rather than Decimal.  So in order to change your spool length with this app you would write
page number 0A             
data content E0930400
page number 0B
data content E0930400
page number 14
data content E0930400

https://play.google.com/store/apps/deta … amp;hl=en0

its a start for now

530 Reply by strucktheman

  • strucktheman
  • Member
  • Offline
  • Registered: 2016-02-07
  • Posts: 25

Re: DaVinci Junior cartridge reset

@HyruleJedi86 once you have the password to your tag/card and have finished setting the all of the pages to your liking IE the temp and max length, all you would need to do is overwrite one page to take it back to a full card which would be page 14 on the app

531 Reply by HyruleJedi86

  • HyruleJedi86
  • Member
  • Offline
  • Registered: 2015-05-11
  • Posts: 113

Re: DaVinci Junior cartridge reset

Thanks allot, which mode did you use? For some reason it says my device isn't compatible with mifare classic.

532 Reply by strucktheman

  • strucktheman
  • Member
  • Offline
  • Registered: 2016-02-07
  • Posts: 25

Re: DaVinci Junior cartridge reset

HyruleJedi86 wrote:

Thanks allot, which mode did you use? For some reason it says my device isn't compatible with mifare classic.

Well the first step is to enter your password, which you need to select the key image in the top right corner of the home page on the app.  next you need to select the mifare ultralight/ntag option.  once on this page you need to check the Authenticate box and read your card.  after you can fill in the correct values for page number and data content.

533 Reply by jl-p

  • jl-p
  • Newbie
  • Offline
  • Registered: 2015-08-05
  • Posts: 3

Re: DaVinci Junior cartridge reset

I'm currently busy making an app to brute force the password. (for the time beeing). as long as we don't understand the algorithm
And add the colors and other things we find to configure on the cards.
First for android and if that is working (if a apple have a NFC Writer) the IOS and Windows Phone apps.

Johan

534 Reply by ese318

  • ese318
  • Member
  • Offline
  • Registered: 2016-01-29
  • Posts: 15

Re: DaVinci Junior cartridge reset

jl-p wrote:

I'm currently busy making an app to brute force the password. (for the time beeing). as long as we don't understand the algorithm
And add the colors and other things we find to configure on the cards.
First for android and if that is working (if a apple have a NFC Writer) the IOS and Windows Phone apps.

Johan

How would this work? Don't you have to scan the NFC card once for each attempt?

535 Reply by Manrobbie

  • Manrobbie
  • Member
  • Offline
  • Registered: 2016-02-21
  • Posts: 12

Re: DaVinci Junior cartridge reset

jl-p wrote:

I'm currently busy making an app to brute force the password. (for the time beeing). as long as we don't understand the algorithm
And add the colors and other things we find to configure on the cards.
First for android and if that is working (if a apple have a NFC Writer) the IOS and Windows Phone apps.

Johan

Please let us know when your app for android is up and running :)

536 Reply by XYLenTech

  • XYLenTech
  • Member
  • Offline
  • Registered: 2015-12-12
  • Posts: 23

Re: DaVinci Junior cartridge reset

jl-p wrote:

I'm currently busy making an app to brute force the password. (for the time beeing). as long as we don't understand the algorithm
And add the colors and other things we find to configure on the cards.
First for android and if that is working (if a apple have a NFC Writer) the IOS and Windows Phone apps.

Johan

Sorry to burst your bubble, but I don't think that's realistic without some understanding of the UID-Password relationship.  The passwords are 4 bytes, each byte has 255 possible values.  That's just over 4 billion permutations.  Even if you could try 100 passwords per second it would still take over a year to test all possibilities.

537 Reply by martinez94199 (edited by martinez94199 2016-02-21 20:54:22)

  • martinez94199
  • Member
  • Offline
  • Registered: 2016-02-08
  • Posts: 14

Re: DaVinci Junior cartridge reset

i was able to clone a tag with android!

538 Reply by strucktheman

  • strucktheman
  • Member
  • Offline
  • Registered: 2016-02-07
  • Posts: 25

Re: DaVinci Junior cartridge reset

jl-p wrote:

I'm currently busy making an app to brute force the password. (for the time beeing). as long as we don't understand the algorithm
And add the colors and other things we find to configure on the cards.
First for android and if that is working (if a apple have a NFC Writer) the IOS and Windows Phone apps.

Johan

A brute force for android is not realistic, arduino maybe, but not everyone has a spare phone they can just let sit to crack a password.

539 Reply by ese318 (edited by ese318 2016-02-21 21:19:40)

  • ese318
  • Member
  • Offline
  • Registered: 2016-01-29
  • Posts: 15

Re: DaVinci Junior cartridge reset

martinez94199 wrote:

i was able to clone a tag with android!

After having gotten the password with a logic analyzer?

540 Reply by ese318

  • ese318
  • Member
  • Offline
  • Registered: 2016-01-29
  • Posts: 15

Re: DaVinci Junior cartridge reset

strucktheman wrote:
jl-p wrote:

I'm currently busy making an app to brute force the password. (for the time beeing). as long as we don't understand the algorithm
And add the colors and other things we find to configure on the cards.
First for android and if that is working (if a apple have a NFC Writer) the IOS and Windows Phone apps.

Johan

A brute force for android is not realistic, arduino maybe, but not everyone has a spare phone they can just let sit to crack a password.

Are you saying that you could leave the NFC chip in contact with the Ardiuno NFC shield and keep trying? (Yes, it would still take unrealistically long to do it this way, but that would still be interesting to know that multiple attempts could be made that way)

Thanks

541 Reply by strucktheman

  • strucktheman
  • Member
  • Offline
  • Registered: 2016-02-07
  • Posts: 25

Re: DaVinci Junior cartridge reset

you would just need to add a loop to the existing read sketch which only starts once the chip is present which increments the password with each attempt.

542 Reply by martinez94199

  • martinez94199
  • Member
  • Offline
  • Registered: 2016-02-08
  • Posts: 14

Re: DaVinci Junior cartridge reset

https://youtu.be/TPht11wVEQk

543 Reply by HyruleJedi86 (edited by HyruleJedi86 2016-02-21 22:22:08)

  • HyruleJedi86
  • Member
  • Offline
  • Registered: 2015-05-11
  • Posts: 113

Re: DaVinci Junior cartridge reset

That's a pretty simple process, how many bites do you need to do this? I wouldn't mind trying one of the NTAG 213s that are stickers.

Just out of curiosity, how does this bypass the password?

544 Reply by strucktheman

  • strucktheman
  • Member
  • Offline
  • Registered: 2016-02-07
  • Posts: 25

Re: DaVinci Junior cartridge reset

we did it......now for the masses

545 Reply by martinez94199

  • martinez94199
  • Member
  • Offline
  • Registered: 2016-02-08
  • Posts: 14

Re: DaVinci Junior cartridge reset

It should be 144 bytes, and I removed the password so that you don't have to worry about that anymore.

546 Reply by strucktheman

  • strucktheman
  • Member
  • Offline
  • Registered: 2016-02-07
  • Posts: 25

Re: DaVinci Junior cartridge reset

now to roll this into an android app which modifies the tag clone to change temp color and material

547 Reply by martinez94199

  • martinez94199
  • Member
  • Offline
  • Registered: 2016-02-08
  • Posts: 14

Re: DaVinci Junior cartridge reset

If you are able to do so feel free. If you need help or you need a file I might have let me know.

548 Reply by HyruleJedi86

  • HyruleJedi86
  • Member
  • Offline
  • Registered: 2015-05-11
  • Posts: 113

Re: DaVinci Junior cartridge reset

How do you load the tag file you shared to open in the app? I can't find a way to open the file and I can't find the folder where the app saves it's tags. Thanks for doing this!

549 Reply by martinez94199

  • martinez94199
  • Member
  • Offline
  • Registered: 2016-02-08
  • Posts: 14

Re: DaVinci Junior cartridge reset

Download the app on the phone, then download the file where ever you could find it. Now navigate to the file with a file browser and open it with the NFC cloner app. Then select 1 to 1 and place the new tag behind the phone to write it

550 Reply by HyruleJedi86

  • HyruleJedi86
  • Member
  • Offline
  • Registered: 2015-05-11
  • Posts: 113

Re: DaVinci Junior cartridge reset

When I select the app to open the file with it opens it to the main menu. Then I select one to one it says scan source tag. It's not loading the file for some reason into the app.