Change NFC tag ID with NFC Tools

Hello DT community! I just self-installed a NeXT chip in my hand today (Covid makes it hard to do anything other than self-install :/) and I’m wanting to clone the id in an NXP MIFARE DESFire tag so I can get into work without carrying anything extra. This is my first implant and I’m still pretty new to this, but I’m really excited about everything.

Have any of you guys had experience using NFC Tools or NFC Tools PRO to work with your implants? There’s a serial number listed whenever I scan an NFC tag. Is that the 7-bit ID?

1 Like

A bunch of stuff for you mate, firstly


images (78)

Is it MIFARE DESFire EV1 or EV2?

Yes, it is good, some people prefer it, I personally prefer Taginfo and TagWriter by NXP.

Tricky question… could be.

Sounds like you have a 7byte UID Mifare.
If that is the case I would have reccomended the Desfire Implants (links to follow)
You MAY luck in with your NExT, if your system is just using ISO14443A protocol and only looking for a UID, (not 100% on this)

you won’t be able to clone your card, (The NTAG chip in your NExT does not have a changable UID, nor do the DESFire implants) but you may be able to enroll your card…I’m just on my phone at the moment, I can give you some more info when I am at a PC.
In the meantime, if you can follow this with your work fob / card

And have the info ready…

Just to be clear from above, and to answer your Post Title

Change NFC tag ID with NFC Tools

Unfortunately, you can’t change the UID on your NExT ( HF - Chip )
So as I said above, there is still a chance your work system with work with the NExT ( HF - Chip )
It has some similarities, with the DESFire implants -13.56MHz ISO14443A also has a 7 byte UID.
But it will ultimately come down to what your security system is “looking” for.

This is what I would recommend as your next step

You will have to do some sleuthing, to find out some more info about your work security system and get chummy with the security admins.
What I would suggest is thusly:- ( 2 approaches )
Scan your NExT with TagInfo or NFC Tools and find out the UID, give this UID to the admin or
Go to the security office, Swipe your NExT on the enrollment system how they normally enroll a new card /fob, attach this info to your profile

Slightly more effort:
Scan your NExT with TagInfo or NFC Tools and find out the UID ( For your records )
At work, Scan your NExT on a reader ( You will be denied, but hopefully you get some feedback ( Lights, beeps, whistles, sirens )
then immediately following the shameful denial, swipe your actual work card.
Record the date and time along with the location of scan, This info will now be in the security logs.
Use this info to enroll your NExT on your profile

Links, as promised

1 Like

Thanks! :laughing:

It looks like it’s a EV2. TagInfo by NXP gives a lot more info :grin:

In retrospect it probably would have been better to get a Desfire implant, but I’ll see what I can figure out when I go into the office tomorrow. I know who to talk to get things setup if it’s possible to do so.

1 Like

Hindsight is 20-20, but it may still work !
Awesome, Goodluck.
Let us all know how it goes.

If you can get us some more info to your work system, we can add it to the Matrix

Ooh. I’ll see if I can’t figure that out. Based on the keyfob I was given, I think the reader is from Salto.

Interesting, SO after a cursory search

ID Technologies

  • MIFARE. (DESFire EV1, Plus, Ultralight C, Classic - ISO/IEC 14443).
  • Bluetooth SMART (BLE).
  • NFC.

If this is accurate, I Think because of the multiple options, the odds are more in your favour, The Classic is interesting but it will likely be the newer 7 byte, rather than the 4 byte which could have been some other options for you…UNLESS it only looks at the first 4 bytes…

I’ve had some great luck working with the staff. They’ve been very friendly and helpful and they support me being able to use my implant. Unfortunately, in testing things thus far at least, I haven’t been able to get the readers to detect it. I’m hoping that it’s only an issue with the range (especially since the swelling probably doesn’t help and it’s hard enough to get my phone to read it).

It’s definitely a Salto access system though. Here are some pictures of the access systems I’ve tried it on.

I’ll try a little more when the swelling’s gone done before assuming that it doesn’t work or that it’s impractical.

1 Like

I’ve never had any good interactions with Salto. Glad you got someone to treat you nicely.


Thanks for the update. I will put those images and the link to this thread for Salto in the spreadsheet.

So just throwing out some more stuff for you to try and consider.

Use your HF xFD that would have come with your NExT.
This will help you find the sweet spot(s) on the reader.
Try different orientations that you can then mimic with your hand. You are looking for when the LED is at its brightest, this will be the optimal location(s) and orientation(s)

Place your DT Diagnostic card on the reader (the HF LED should light up) try then placing your NExT ontop/over the Diagnostic Card
If the reader is in a low power mode until it is woken (the xSeries antenna may be struggling to couple with the reader). The DTDC should help to wake it up.
Obviously if you are having to use a card to use your NExt, that is not a workable solution, therefore

A FlexDF2,
a bit more expensive, but the FlexFormat will be your best bet to work with your locks, and the DF2 is a powerful implant in its own right.
In my opinion, Probably THE most powerful RFID implant in the market right now, until the Apex is released.

Waiting for Apex release. ApexFlex rather than the ApexMax (“xSeries”)
Why the Apex?
I believe the Apex will be capable of emulating a DESFireEV1, but not sure about the EV2, however, EV1 SHOULD be capable of operating your SALTO locks.

You could do some testing.
KSEC (@KaiCastledine) have a great RFID card test pack, for a good price, That would be good for your testing.


I’ve got some updates with the Salto locks. Unfortunately, I don’t think it’s going to work. I tested it pretty thoroughly and I haven’t been able to get the readers to react to NExT. If the ID isn’t in the system, it should light up red, but with almost 30 minutes of effort, I wasn’t able to get it to do anything.

At least with the small Salto lock, I definitely found that this was true. I tested it with the RFID Diagnostic Card and the 13.56MHz RFID Field Detector that came with my NExT. The field detector would only light up if I first brought the diagnostic card close to it.

I tried using the Diagnostic Card along with NExT to get it to trigger, but that didn’t work either.

I don’t think it’s an issue with swelling either, because I found that there was an HID reader on the outside of the building and I got that to react with very little effort.

I think I’ll need something different to get this to work for me. I think a Flex implant would be awesome, but now I’m really curious about Apex. Do you have any more information about that @Pilgrimsmaster?

EVERYBODY is eagerly awaiting the arrival.

Release date is still TBD
There is a bunch of info here in the forum, but you will have to filter out the chatter, But your best reference source is the VivoKey webpage , have a good look around, it should answer most of your questions…

Oh, can you try your DT DC on that HID reader!?

Thanks for the info! I’ll check it out.

Yeah, I tried it yesterday :grin: . I got a read for both HF and LF when using the Diagnostic Card. I got a better read for RFID on the left and a better read for NFC on the right. My NExT chip was able to trigger it on either side. It didn’t authenticate of course because my tags weren’t in the system, but it did flash red for both and I was able to get a read pretty easily.

1 Like

Awesome mate, you’re all over it!
just another little FYI.

1 Like

Oh, got it! Thanks for sharing! That’s super helpful.

1 Like