Another Help Cloning iCLASS / PicoPass Card

Blackhawks · July 16, 2023, 12:06am

Hi there everybody!

I’m enjoying this forum and hobby and learning a lot. Thanks for the patient patrons who have helped me over the last few weeks.

I’m stuck on what to do next. Here is my hf ic dump --ki 0 info:

[usb] pm3 → hf ic dump --ki 0
[+] Using AA1 (debit) key[0] AE A6 84 A6 DA B2 32 78
[=] Card has at least 2 application areas. AA1 limit 18 (0x12) AA2 limit 31 (0x1F)
.

[=] --------------------------- Tag memory ----------------------------

[=] block# | data | ascii |lck| info
[=] ---------±------------------------±---------±–±---------------
[=] 0/0x00 | 0D 40 FC 14 FE FF 12 E0 | .@… | | CSN
[=] 1/0x01 | 12 FF FF FF 7F 1F FF 3C | …< | | Config
[=] 2/0x02 | DE FF FF FF FF FF FF FF | … | | E-purse
[=] 3/0x03 | 64 62 F0 02 DF 53 D5 B9 | db…S… | | Debit
[=] 4/0x04 | FF FF FF FF FF FF FF FF | … | | Credit
[=] 5/0x05 | FF FF FF FF FF FF FF FF | … | | AIA
[=] 6/0x06 | A3 03 03 03 00 03 E0 17 | … | | User / Cred
[=] 7/0x07 | 80 E5 C9 42 B6 F4 33 86 | …B…3. | | User / Cred
[=] 8/0x08 | 2A D4 C8 21 1F 99 68 71 | *…!..hq | | User / Cred
[=] 9/0x09 | 2A D4 C8 21 1F 99 68 71 | *…!..hq | | User / Cred
[=] 10/0x0A | 30 34 81 06 01 88 FB 30 | 04…0 | | User / SIO / SR
[=] 11/0x0B | 8A 24 A5 02 05 00 A6 08 | .$… | | User / SIO / SR
[=] 12/0x0C | 81 01 01 04 03 03 00 08 | … | | User / SIO / SR
[=] 13/0x0D | A7 18 85 16 F8 2B 8A B5 | …+… | | User / SIO / SR
[=] 14/0x0E | 1F 53 54 CD AB 2F 83 31 | .ST…/.1 | | User / SIO / SR
[=] 15/0x0F | 9D 7B 99 C7 21 6D EF 02 | .{…!m… | | User / SIO / SR
[=] 16/0x10 | F8 09 A9 02 05 00 05 00 | … | | User / SIO / SR
[=] 17/0x11 | 00 00 00 00 00 00 00 00 | … | | User
[=] 18/0x12 | FF FF FF FF FF FF FF FF | … | | User
[=] ---------±------------------------±---------±–±---------------
[?] yellow = legacy credential
[?] cyan = SIO / SR credential

[+] saving dump file - 19 blocks read
[+] saved 152 bytes to binary file C:\ProxSpace\pm3/hf-iclass-0D40FC14FEFF12E0-dump-001.bin
[+] saved 19 blocks to text file C:\ProxSpace\pm3/hf-iclass-0D40FC14FEFF12E0-dump-001.eml
[+] saved to json file C:\ProxSpace\pm3/hf-iclass-0D40FC14FEFF12E0-dump-001.json
[?] Try hf iclass decrypt -f to decrypt dump file
[?] Try hf iclass view -f to view dump file

I have no clue what that info is telling me.

Any recommendations on what I try next?

Any ideas where I can buy quality blank iClass/PicoPass cards preferably in a key ring fob?

Any input, as always, is hugely appreciated!

~Blackhawks

Blackhawks · July 19, 2023, 7:35pm

I noticed Blocks 6-9 are labelled “User/Cred”. I believe I simply need to use these commands:

hf ic dump --ki 0
hf ic wrbl --ki 0 -b 6 -d 030303030003E017
hf ic wrbl --ki 0 -b 7 -d 10A145919ED16F50

What does not make sense is this process seems to ignore any information from my specific card, or really any specific card, from Step #1. It seems like Step 1 is just a quick check to see whats on Blocks 6-9 and 10-18 and the info from Steps 2 and 3 are “master keys” that are applicable to all iClass legacy cards. Can anyone explain the route/source of the info for these blocks besides this thread Cloning an HID iClass credential to your flexClass?

It looks like my Blocks 10-18 are “User / SIO / SR”. Its not the dreaded SE blocks I’ve read about, so is this good? Can my card be cloned?

~B