How to Read Bad Blocks on a Flipper Zero — NFC Deep Dive

How to Read Bad Blocks on a Flipper Zero — NFC Deep Dive Mifare Classic cards use 64 sectors. Some are protected or return read errors. This guide explains what bad blocks are, why you get them, and how to get the most complete read possible. What is a Bad Block? Each Mifare Classic 1K card has 16 sectors (0–15), each with 3 data blocks plus 1 trailer block. The trailer block contains the sector keys (Key A and Key B) and access bits that control what operations are allowed. A "bad block" means the Flipper couldn't read that sector — either because: 1. The sector key isn't in the Flipper's dictionary 2. The access bits restrict reads even with the correct key 3. The card is damaged or counterfeit What the Flipper Tries When you read an NFC card, the Flipper runs through its built-in key dictionary (~1,600 keys) plus any keys it found in already-read sectors. This covers the vast majority of cards using factory-default keys. Sectors with non-standard keys — typically corporate access control systems — will show as bad blocks. Read the Card 1. NFC → Read 2. Hold card to back of Flipper for 2-3 seconds 3. Flipper shows how many sectors it read successfully 4. Save the card Use Mfkey32 to Crack Missing Keys If the card uses a standard reader (like an Omnikey or ACR reader), you can capture the nonces the reader sends and crack the missing keys. 1. NFC → Detect Reader — hold the Flipper near the access card reader 2. Flipper captures authentication nonces 3. Transfer the .nonces file to a computer 4. Run Mfkey32: ./mfkey32v2 nonces.mfn 5. Add cracked keys to /ext/nfc/assets/mfclassicdictuser.nfc 6. Read the card again — more sectors should unlock Reading with User Dictionary To add custom keys before reading: 1. Copy your keys to /ext/nfc/assets/mfclassicdictuser.nfc 2. Each line is one key in hex: AABBCCDDEEFF 3. Read card again — the Flipper will try all keys including yours Card Cloning For cards with no bad blocks: 1. NFC → Saved → select your read → Write → Write to Magic Card 2. A Magic card (UID-writable blank) accepts the full clone Partial reads (bad blocks present) can still be written — bad sectors are written as zeros. Whether the clone works depends on which sectors the reader actually checks. Checking Read Quality In the saved card file (.nfc on the SD card), each sector line either has hex data or ?? ?? ?? ?? for unread blocks. A fully read card has no ?? in data blocks. What You Can't Crack DESFire, HID iClass, Seos — these use real encryption, not Mifare Classic's broken CRYPTO1 Cards with keys not derived from UID or factory defaults require physical key extraction or insider access Flipper can read and emulate the UID of any ISO14443A card, but full clone only works on Mifare Classic

Related Guides

Loading_