Mifare Access condition calculation - permissions

Question

I am aware of this post :- Locking mechanism of Mifare Classic 1K
However, it is really not clear - how a value like FF 07 80 FF is calculated in this string:
D3 F7 D3 F7 D3 F7 FF 07 80 FF 00 00 00 00 00 00
This means that the blocks can be read with key A and written with Key B but does not allow inc/dec.
How should the access bits look like if I have to support increment and decrement operations. I understand that C1, C2 and C3 must be 1,1,0 how does this reflect to the byte 6, 7 and 8.
Any help would be highly appreciate.

Answer 1

The access bits FF 07 80 translate to
C1 = 0x0 => C1_3 = 0, C1_2 = 0, C1_1 = 0, C1_0 = 0
C2 = 0x0 => C2_3 = 0, C2_2 = 0, C2_1 = 0, C2_0 = 0
C3 = 0x8 => C3_3 = 1, C3_2 = 0, C3_1 = 0, C3_0 = 0
So the sector trailer can be read and written using key A only (Cx_3 = 0 0 1). All operations (read, write, increment, decrement, etc) can be performed on the data blocks using key A only (Cx_{0,1,2} = 0 0 0, key B is disabled due to the access conditions of the trailer block).
If you want be able to read all blocks with key A, write with key B, perform value block increments with key B and perform value block decrement, etc. with keys A and B, you could use access conditions like this:
sector trailer write with key B only: Cx_3 = 0 1 1
data/value blocks: read/decrement with key A, write/increment with key B: Cx_{0,1,2} = 1 1 0
C1_3 = 0, C1_2 = 1, C1_1 = 1, C1_0 = 1 => C1 = 0x7
C2_3 = 1, C2_2 = 1, C2_1 = 1, C2_0 = 1 => C2 = 0xF
C3_3 = 1, C3_2 = 0, C3_1 = 0, C3_0 = 0 => C3 = 0x8
This leads to the access bits 08 77 8F. Hence, you sector trailer could look like this (with key A = D3F7D3F7D3F7 and key B = 000000000000):
D3F7D3F7D3F7 08778F FF 000000000000