Clone MF 1K Gen3

stalbertmama · June 3, 2025, 1:49am

I have been trying to clone a Gen3 Mifare (7B) fob with PM3 and whereas everything looks like it is working, the reader doesn’t recognize it.

I then used an I-CopyX and viola it worked. What could I be doing wrong?

LOG OF ORIGINAL FOB READ

[usb] pm3 → hf search
[-] Searching for ISO14443-A tag…
[+] UID: 04 C3 FB 22 82 64 80
[+] ATQA: 00 44
[+] SAK: 08 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+] MIFARE Classic 1K CL2
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities… Gen 3 / APDU ( possibly )
[+] Prng detection… weak

[?] Hint: use hf mf gen3* magic commands
[?] Hint: try hf mf commands

[+] Valid ISO 14443-A tag found

[usb] pm3 → hf mf autopwn
[=] MIFARE Classic EV1 card detected
[+] loaded 5 user keys
[+] loaded 61 keys from hardcoded default array
[=] running strategy 1
[+] target sector 0 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 0 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 5 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 6 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 6 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 7 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 7 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 8 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 8 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 9 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 9 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 10 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 10 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 11 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 11 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 12 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 12 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 13 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 13 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 14 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 14 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 15 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 15 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 16 key type A – found valid key [ 5C8FF9990DA2 ]
[+] target sector 16 key type B – found valid key [ D01AFEEB890A ]
[+] target sector 17 key type A – found valid key [ 75CCB59C9BED ]
[+] target sector 17 key type B – found valid key [ 4B791BEA7BCC ]

[+] found keys:

[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 001 | 007 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 002 | 011 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 003 | 015 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 004 | 019 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 005 | 023 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 006 | 027 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 007 | 031 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 008 | 035 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 009 | 039 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 010 | 043 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 011 | 047 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 012 | 051 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 013 | 055 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 014 | 059 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 015 | 063 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 016 | 067 | 5C8FF9990DA2 | D | D01AFEEB890A | D ( * )
[+] 017 | 071 | 75CCB59C9BED | D | 4B791BEA7BCC | D ( * )
[+] -----±----±-------------±–±-------------±—
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )
[=] ( * ) These sectors used for signature. Lays outside of user memory

[+] Generating binary key file
[+] Found keys have been dumped to C:\Users\rohit\Downloads\rrg_other-20240623-81fd620345979e5ab0701151f5c22bdf47f21f6a\client\/hf-mf-049F9D8A3A6080-key.bin
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[=] downloading card content from emulator memory
[+] Saved 1024 bytes to binary file C:\Users\rohit\Downloads\rrg_other-20240623-81fd620345979e5ab0701151f5c22bdf47f21f6a\client\/hf-mf-049F9D8A3A6080-dump.bin
[+] Saved to json file C:\Users\rohit\Downloads\rrg_other-20240623-81fd620345979e5ab0701151f5c22bdf47f21f6a\client\/hf-mf-049F9D8A3A6080-dump.json
[=] autopwn execution time: 5 seconds

[usb] pm3 → hf mf gen3uid -h

Set UID for magic Gen3 card without changes to manufacturer block 0

usage:
hf mf gen3uid [-h] [-u ]

options:
-h, --help This help
-u, --uid UID 4/7 hex bytes

examples/notes:
hf mf gen3uid --uid 01020304 → set 4 byte uid
hf mf gen3uid --uid 01020304050607 → set 7 byte uid

[usb] pm3 → hf mf gen3uid --uid 049F9D8A3A6080
[+] Old UID… 04 C3 FB 22 82 64 80
[+] New UID… 04 9F 9D 8A 3A 60 80
[usb] pm3 → hf mf restore -h

Restore MIFARE Classic dump file to tag.

The key file and dump file will program the card sector trailers.
By default we authenticate to card with key 0xFFFFFFFFFFFF.
If access rights in dump file is all zeros, it will be replaced with default values

--uid param is used for filename templates hf-mf-<uid>-dump.bin and hf-mf-<uid>-key.bin. if not specified, it will read the card uid instead. –kaparam you can indicate that the key file should be used for authentication instead. if so we also try both B/A keys–force` param is used to override warnings and allow bad ACL block writes.
if not specified, it will skip blocks with bad ACL.

usage:
hf mf restore [-h] [–mini] [–1k] [–2k] [–4k] [-u ] [-f ] [-k ] [–ka] [–force]

options:
-h, --help This help
–mini MIFARE Classic Mini / S20
–1k MIFARE Classic 1k / S50 (def)
–2k MIFARE Classic/Plus 2k
–4k MIFARE Classic 4k / S70
-u, --uid uid, (4|7|10 hex bytes)
-f, --file specify a filename for dump file
-k, --kfn key filename
–ka use specified keyfile to authenticate
–force override warnings

examples/notes:
hf mf restore
hf mf restore --1k --uid 04010203
hf mf restore --1k --uid 04010203 -k hf-mf-AABBCCDD-key.bin
hf mf restore --4k

[usb] pm3 → hf mf restore --1k --uid 049F9D8A3A6080 -k hf-mf-049F9D8A3A6080-key.bin
[+] Loaded binary key file hf-mf-049F9D8A3A6080-key.bin
[=] Using key file hf-mf-049F9D8A3A6080-key.bin
[+] Loaded 1024 bytes from binary file hf-mf-049F9D8A3A6080-dump.bin

[?] try hf mf dump --ns to verify
[=] Done!

&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
THE CLONED FOB DID NOT WORK
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

I then resorted to cloning with I-CopyX and it worked. Below is the autopwn information

[+] Communicating with PM3 over USB-CDC
[usb] pm3 → hf mf autopwn
[!] no known key was supplied, key recovery might fail
[+] loaded 5 user keys
[+] loaded 61 keys from hardcoded default array
[=] running strategy 1
[+] target sector 0 key type A – found valid key [ FFFFFFFFFFFF ] (used for nested / hardnested attack)
[+] target sector 0 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 1 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 5 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 6 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 6 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 7 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 7 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 8 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 8 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 9 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 9 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 10 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 10 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 11 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 11 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 12 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 12 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 13 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 13 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 14 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 14 key type B – found valid key [ 7F33625BC129 ]
[+] target sector 15 key type A – found valid key [ 6A1987C40A21 ]
[+] target sector 15 key type B – found valid key [ 7F33625BC129 ]

[+] found keys:

[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 001 | 007 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 002 | 011 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 003 | 015 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 004 | 019 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 005 | 023 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 006 | 027 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 007 | 031 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 008 | 035 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 009 | 039 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 010 | 043 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 011 | 047 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 012 | 051 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 013 | 055 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 014 | 059 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] 015 | 063 | 6A1987C40A21 | D | 7F33625BC129 | D
[+] -----±----±-------------±–±-------------±—
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )

[+] Generating binary key file
[+] Found keys have been dumped to C:\Users\rohit\Downloads\rrg_other-20240623-81fd620345979e5ab0701151f5c22bdf47f21f6a\client\/hf-mf-049F9D8A3A6080-key-005.bin
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[=] downloading card content from emulator memory
[+] Saved 1024 bytes to binary file C:\Users\rohit\Downloads\rrg_other-20240623-81fd620345979e5ab0701151f5c22bdf47f21f6a\client\/hf-mf-049F9D8A3A6080-dump-004.bin
[+] Saved to json file C:\Users\rohit\Downloads\rrg_other-20240623-81fd620345979e5ab0701151f5c22bdf47f21f6a\client\/hf-mf-049F9D8A3A6080-dump-004.json
[=] autopwn execution time: 4 seconds

&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
Your feedback and comments are appreciated

hf-mf-049F9D8A3A6080-dump.zip (658 Bytes)