From 54f067a21ab6d6dc8a4b7479d1978157c1c280df Mon Sep 17 00:00:00 2001 From: jof Lassoff Date: Mon, 9 Mar 2026 23:36:54 +0000 Subject: [PATCH 1/3] mfc: dic: Vanderbilt ACT --- client/dictionaries/mfc_default_keys.dic | 262 +++++++++++++++++++++++ 1 file changed, 262 insertions(+) diff --git a/client/dictionaries/mfc_default_keys.dic b/client/dictionaries/mfc_default_keys.dic index dc526e43a..cf9010bac 100644 --- a/client/dictionaries/mfc_default_keys.dic +++ b/client/dictionaries/mfc_default_keys.dic @@ -3252,3 +3252,265 @@ E058DC0E2C34 # Yerevan Transport 26ABFC3C24FB # +# Vanderbilt Industries, ACT Line +# "ACTact" in ASCII -- appears to hold creds in Sector 1, Block 4 +414354616374 +4D61071B7254 +34016FAC127D +# "Acces"+N Keys, Blocks 0x00-0xFF +416363657300 +416363657301 +416363657302 +416363657303 +416363657304 +416363657305 +416363657306 +416363657307 +416363657308 +416363657309 +41636365730A +41636365730B +41636365730C +41636365730D +41636365730E +41636365730F +416363657310 +416363657311 +416363657312 +416363657313 +416363657314 +416363657315 +416363657316 +416363657317 +416363657318 +416363657319 +41636365731A +41636365731B +41636365731C +41636365731D +41636365731E +41636365731F +416363657320 +416363657321 +416363657322 +416363657323 +416363657324 +416363657325 +416363657326 +416363657327 +416363657328 +416363657329 +41636365732A +41636365732B +41636365732C +41636365732D +41636365732E +41636365732F +416363657330 +416363657331 +416363657332 +416363657333 +416363657334 +416363657335 +416363657336 +416363657337 +416363657338 +416363657339 +41636365733A +41636365733B +41636365733C +41636365733D +41636365733E +41636365733F +416363657340 +416363657341 +416363657342 +416363657343 +416363657344 +416363657345 +416363657346 +416363657347 +416363657348 +416363657349 +41636365734A +41636365734B +41636365734C +41636365734D +41636365734E +41636365734F +416363657350 +416363657351 +416363657352 +416363657353 +416363657354 +416363657355 +416363657356 +416363657357 +416363657358 +416363657359 +41636365735A +41636365735B +41636365735C +41636365735D +41636365735E +41636365735F +416363657360 +416363657361 +416363657362 +416363657363 +416363657364 +416363657365 +416363657366 +416363657367 +416363657368 +416363657369 +41636365736A +41636365736B +41636365736C +41636365736D +41636365736E +41636365736F +416363657370 +416363657371 +416363657372 +416363657373 +416363657374 +416363657375 +416363657376 +416363657377 +416363657378 +416363657379 +41636365737A +41636365737B +41636365737C +41636365737D +41636365737E +41636365737F +416363657380 +416363657381 +416363657382 +416363657383 +416363657384 +416363657385 +416363657386 +416363657387 +416363657388 +416363657389 +41636365738A +41636365738B +41636365738C +41636365738D +41636365738E +41636365738F +416363657390 +416363657391 +416363657392 +416363657393 +416363657394 +416363657395 +416363657396 +416363657397 +416363657398 +416363657399 +41636365739A +41636365739B +41636365739C +41636365739D +41636365739E +41636365739F +4163636573A0 +4163636573A1 +4163636573A2 +4163636573A3 +4163636573A4 +4163636573A5 +4163636573A6 +4163636573A7 +4163636573A8 +4163636573A9 +4163636573AA +4163636573AB +4163636573AC +4163636573AD +4163636573AE +4163636573AF +4163636573B0 +4163636573B1 +4163636573B2 +4163636573B3 +4163636573B4 +4163636573B5 +4163636573B6 +4163636573B7 +4163636573B8 +4163636573B9 +4163636573BA +4163636573BB +4163636573BC +4163636573BD +4163636573BE +4163636573BF +4163636573C0 +4163636573C1 +4163636573C2 +4163636573C3 +4163636573C4 +4163636573C5 +4163636573C6 +4163636573C7 +4163636573C8 +4163636573C9 +4163636573CA +4163636573CB +4163636573CC +4163636573CD +4163636573CE +4163636573CF +4163636573D0 +4163636573D1 +4163636573D2 +4163636573D3 +4163636573D4 +4163636573D5 +4163636573D6 +4163636573D7 +4163636573D8 +4163636573D9 +4163636573DA +4163636573DB +4163636573DC +4163636573DD +4163636573DE +4163636573DF +4163636573E0 +4163636573E1 +4163636573E2 +4163636573E3 +4163636573E4 +4163636573E5 +4163636573E6 +4163636573E7 +4163636573E8 +4163636573E9 +4163636573EA +4163636573EB +4163636573EC +4163636573ED +4163636573EE +4163636573EF +4163636573F0 +4163636573F1 +4163636573F2 +4163636573F3 +4163636573F4 +4163636573F5 +4163636573F6 +4163636573F7 +4163636573F8 +4163636573F9 +4163636573FA +4163636573FB +4163636573FC +4163636573FD +4163636573FE +4163636573FF From ad3885a9bb56b15b4b73c6ad679743c5598e3044 Mon Sep 17 00:00:00 2001 From: jof Lassoff Date: Tue, 10 Mar 2026 15:49:39 +0000 Subject: [PATCH 2/3] Add Vanderbilt ACT pattern-based key generation to hf mf keygen - Implements mfc_algo_vanderbilt_one() and mfc_algo_vanderbilt_all() - Generates keys using 'Acces' + block ID pattern (416363657300-4163636573FF) - Supports all 40 sectors for 4K cards - Eliminates need for 256+ keys in dictionary file - Keys generated dynamically on-demand --- common/generator.c | 37 +++++++++++++++++++++++++++++++++++++ common/generator.h | 3 +++ 2 files changed, 40 insertions(+) diff --git a/common/generator.c b/common/generator.c index 62512c103..ce39a1824 100644 --- a/common/generator.c +++ b/common/generator.c @@ -620,6 +620,42 @@ int mfc_algo_snapmaker_all(uint8_t *uid, uint8_t *keys) { return PM3_SUCCESS; } +// Vanderbilt ACT pattern-based key generation +// Generates keys by appending block ID to "Acces" (0x4163636573) +// Pattern: 416363657300, 416363657301, ..., 4163636573FF +int mfc_algo_vanderbilt_one(uint8_t *uid, uint8_t sector, uint8_t keytype, uint64_t *key) { + if (key == NULL) return PM3_EINVARG; + if (sector > 39) return PM3_EINVARG; + + // Base pattern: "Acces" in ASCII = 0x4163636573 + // For each sector, we generate keys for all 4 blocks (or 16 for sector 32+) + // Key format: 41 63 63 65 73 XX where XX is the block number + + uint8_t first_block = (sector < 32) ? (sector * 4) : (128 + (sector - 32) * 16); + uint8_t block_id = first_block + 3; // Use sector trailer block ID + + // Both key A and B use the same pattern with block ID + uint8_t key_bytes[6] = {0x41, 0x63, 0x63, 0x65, 0x73, block_id}; + *key = bytes_to_num(key_bytes, 6); + + return PM3_SUCCESS; +} + +int mfc_algo_vanderbilt_all(uint8_t *uid, uint8_t *keys) { + if (keys == NULL) return PM3_EINVARG; + + // Generate keys for all sectors (40 sectors for 4K card) + for (int keytype = 0; keytype < 2; keytype++) { + for (int sector = 0; sector < 40; sector++) { + uint64_t key = 0; + mfc_algo_vanderbilt_one(uid, sector, keytype, &key); + num_to_bytes(key, 6, keys + (keytype * 40 * 6) + (sector * 6)); + } + } + + return PM3_SUCCESS; +} + static kdf_t KDFTable[] = { {"Saflok / Maid", 16, mfc_algo_saflok_all, 4}, {"MIZIP", 5, mfc_algo_mizip_all, 4}, @@ -627,6 +663,7 @@ static kdf_t KDFTable[] = { {"Skylanders", 16, mfc_algo_sky_all, 4}, {"Bambu Lab Filament Spool", 16, mfc_algo_bambu_all, 4}, {"Snapmaker Filament Spool", 16, mfc_algo_snapmaker_all, 4}, + {"Vanderbilt ACT", 40, mfc_algo_vanderbilt_all, 0}, // {"Vinglock", 16, mfc_algo_ving_all, 4}, // not implemented // {"Yale Doorman", 16, mfc_algo_yale_all, 4}, // not implemented }; diff --git a/common/generator.h b/common/generator.h index d0dc0a8e9..0cd10b8ce 100644 --- a/common/generator.h +++ b/common/generator.h @@ -79,6 +79,9 @@ int mfc_algo_bambu_all(uint8_t *uid, uint8_t *keys); int mfc_algo_snapmaker_one(uint8_t *uid, uint8_t sector, uint8_t keytype, uint64_t *key); int mfc_algo_snapmaker_all(uint8_t *uid, uint8_t *keys); +int mfc_algo_vanderbilt_one(uint8_t *uid, uint8_t sector, uint8_t keytype, uint64_t *key); +int mfc_algo_vanderbilt_all(uint8_t *uid, uint8_t *keys); + uint32_t lf_t55xx_white_pwdgen(uint32_t id); int mfdes_kdf_input_gallagher(uint8_t *uid, uint8_t uidLen, uint8_t keyNo, uint32_t aid, uint8_t *kdfInputOut, uint8_t *kdfInputLen); From d9aee50dc467de6f2554c30e0466e83da35b8cad Mon Sep 17 00:00:00 2001 From: jof Lassoff Date: Tue, 10 Mar 2026 15:51:17 +0000 Subject: [PATCH 3/3] Remove redundant Vanderbilt ACT pattern keys from dictionary - Removed 257 lines of 'Acces'+N pattern keys (416363657300-4163636573FF) - These keys can now be generated dynamically with: hf mf keygen -k 6 - Kept unique Vanderbilt keys (414354616374, 4D61071B7254, 34016FAC127D) - Reduces dictionary file size and maintenance burden --- client/dictionaries/mfc_default_keys.dic | 259 +---------------------- 1 file changed, 2 insertions(+), 257 deletions(-) diff --git a/client/dictionaries/mfc_default_keys.dic b/client/dictionaries/mfc_default_keys.dic index cf9010bac..37e57815e 100644 --- a/client/dictionaries/mfc_default_keys.dic +++ b/client/dictionaries/mfc_default_keys.dic @@ -3254,263 +3254,8 @@ E058DC0E2C34 # # Vanderbilt Industries, ACT Line # "ACTact" in ASCII -- appears to hold creds in Sector 1, Block 4 +# Note: "Acces"+N pattern keys (416363657300-4163636573FF) can be generated +# dynamically using: hf mf keygen -k 6 414354616374 4D61071B7254 34016FAC127D -# "Acces"+N Keys, Blocks 0x00-0xFF -416363657300 -416363657301 -416363657302 -416363657303 -416363657304 -416363657305 -416363657306 -416363657307 -416363657308 -416363657309 -41636365730A -41636365730B -41636365730C -41636365730D -41636365730E -41636365730F -416363657310 -416363657311 -416363657312 -416363657313 -416363657314 -416363657315 -416363657316 -416363657317 -416363657318 -416363657319 -41636365731A -41636365731B -41636365731C -41636365731D -41636365731E -41636365731F -416363657320 -416363657321 -416363657322 -416363657323 -416363657324 -416363657325 -416363657326 -416363657327 -416363657328 -416363657329 -41636365732A -41636365732B -41636365732C -41636365732D -41636365732E -41636365732F -416363657330 -416363657331 -416363657332 -416363657333 -416363657334 -416363657335 -416363657336 -416363657337 -416363657338 -416363657339 -41636365733A -41636365733B -41636365733C -41636365733D -41636365733E -41636365733F -416363657340 -416363657341 -416363657342 -416363657343 -416363657344 -416363657345 -416363657346 -416363657347 -416363657348 -416363657349 -41636365734A -41636365734B -41636365734C -41636365734D -41636365734E -41636365734F -416363657350 -416363657351 -416363657352 -416363657353 -416363657354 -416363657355 -416363657356 -416363657357 -416363657358 -416363657359 -41636365735A -41636365735B -41636365735C -41636365735D -41636365735E -41636365735F -416363657360 -416363657361 -416363657362 -416363657363 -416363657364 -416363657365 -416363657366 -416363657367 -416363657368 -416363657369 -41636365736A -41636365736B -41636365736C -41636365736D -41636365736E -41636365736F -416363657370 -416363657371 -416363657372 -416363657373 -416363657374 -416363657375 -416363657376 -416363657377 -416363657378 -416363657379 -41636365737A -41636365737B -41636365737C -41636365737D -41636365737E -41636365737F -416363657380 -416363657381 -416363657382 -416363657383 -416363657384 -416363657385 -416363657386 -416363657387 -416363657388 -416363657389 -41636365738A -41636365738B -41636365738C -41636365738D -41636365738E -41636365738F -416363657390 -416363657391 -416363657392 -416363657393 -416363657394 -416363657395 -416363657396 -416363657397 -416363657398 -416363657399 -41636365739A -41636365739B -41636365739C -41636365739D -41636365739E -41636365739F -4163636573A0 -4163636573A1 -4163636573A2 -4163636573A3 -4163636573A4 -4163636573A5 -4163636573A6 -4163636573A7 -4163636573A8 -4163636573A9 -4163636573AA -4163636573AB -4163636573AC -4163636573AD -4163636573AE -4163636573AF -4163636573B0 -4163636573B1 -4163636573B2 -4163636573B3 -4163636573B4 -4163636573B5 -4163636573B6 -4163636573B7 -4163636573B8 -4163636573B9 -4163636573BA -4163636573BB -4163636573BC -4163636573BD -4163636573BE -4163636573BF -4163636573C0 -4163636573C1 -4163636573C2 -4163636573C3 -4163636573C4 -4163636573C5 -4163636573C6 -4163636573C7 -4163636573C8 -4163636573C9 -4163636573CA -4163636573CB -4163636573CC -4163636573CD -4163636573CE -4163636573CF -4163636573D0 -4163636573D1 -4163636573D2 -4163636573D3 -4163636573D4 -4163636573D5 -4163636573D6 -4163636573D7 -4163636573D8 -4163636573D9 -4163636573DA -4163636573DB -4163636573DC -4163636573DD -4163636573DE -4163636573DF -4163636573E0 -4163636573E1 -4163636573E2 -4163636573E3 -4163636573E4 -4163636573E5 -4163636573E6 -4163636573E7 -4163636573E8 -4163636573E9 -4163636573EA -4163636573EB -4163636573EC -4163636573ED -4163636573EE -4163636573EF -4163636573F0 -4163636573F1 -4163636573F2 -4163636573F3 -4163636573F4 -4163636573F5 -4163636573F6 -4163636573F7 -4163636573F8 -4163636573F9 -4163636573FA -4163636573FB -4163636573FC -4163636573FD -4163636573FE -4163636573FF