Cloning a NFC Vcard to xSIID NFC using only Proxmark3

Hiyer · November 4, 2023, 4:50pm

Hi,

Can somebody help me the command inside porxmark 3 to

Cloning a NFC Vcard to xSIID NFC using only Proxmark3
Copy Vcard data manually into xSIID NFC using only Proxmark3

The issue is both my implants xSIID ( LED still blinks and works ) and NExt ( Both LF & HF ) have stopped responding to all android mobile apps ( TagInfo,Tagwriter,NFC Tools Pro or for that matter any NFC tools ) Have tried using multiple android mobile but they have stopped detecting HF.

The proxmark3 still does not detect my NEXT LF correctly and shows as Indala after all attempts. Its almost 2 weeks now and i never had any inflammation or swelling ever till date. I have been explained its a contact issue that it wrongly identifies as Indala,

What i have tired
In NEXT LF iam unable to progress further after trying all delay codes and contact placement orientations in Proxmark3.
In xSIID HF iam unable to progress further after trying all delay codes and contact placement orientations on multiple android Mobile Phone Samsung Z fold3,Fold 5 and Galaxy S22. This used to work earlier on the same phones as i used to write on both XSIID and NEXT HF successful using the same tools.

Any indicators or help would be great, seems iam still struck on basics

Regards
HI

amal · November 4, 2023, 5:09pm

This feels like the NDEF message envelopes on your chips mat have been corrupted. Can you read the memory with the proxmark3?

You might be able to set the user memory to all 00 bytes (null) and then format the chip with tagwriter on android to get it working again.

Hiyer · November 4, 2023, 5:32pm

Hi

Whats the command to read memory in proxmark3
and the command to set user memory to all null so that tagwriter can atelast detect it to format it

Pilgrimsmaster · November 4, 2023, 6:43pm

ALMOST

is the key word there.

Yeah you did; you just didn’t notice it, Your body responded to the trauma by healing itself and likely still is.

Give it the full 2 weeks and maybe more before you get too worried.

Chances are, in a few more days you’ll be reading, and writing like a champion.

Just basic healing,

An lesson from ᴚƎᗡNՈNMOᗡ

“she’ll be right mate”

Hiyer · November 8, 2023, 1:13pm

Its 2 weeks now and still struck on the same aspect, with no progress.Sure need some guidance in moving further

somebody help me the command inside porxmark 3 to

Cloning a NFC Vcard to xSIID NFC using only Proxmark3
Copy Vcard data manually into xSIID NFC using only Proxmark3

The issue is both my implants xSIID ( LED still blinks and works ) and NExt ( Both LF & HF ) have stopped responding to all android mobile apps ( TagInfo,Tagwriter,NFC Tools Pro or for that matter any NFC tools ) Have tried using multiple android mobile but they have stopped detecting HF.

The proxmark3 still does not detect my NEXT LF correctly and shows as Indala after all attempts. Its almost 2 weeks now and i never had any inflammation or swelling ever till date. I have been explained its a contact issue that it wrongly identifies as Indala,

What i have tired
In NEXT LF iam unable to progress further after trying all delay codes and contact placement orientations in Proxmark3.
In xSIID HF iam unable to progress further after trying all delay codes and contact placement orientations on multiple android Mobile Phone Samsung Z fold3,Fold 5 and Galaxy S22. This used to work earlier on the same phones as i used to write on both XSIID and NEXT HF successful using the same tools.

Any indicators or help would be great,so repeating the post after 2 weeks

tangerineaxle · November 8, 2023, 1:31pm

Mind sharing videos of your scan attempts. Perhaps some tips for method could be offered to increase likelihood of success.

I had troubles with my LF next after a couple weeks even though there was no VISIBLE inflammation or swelling. It did get better with time.

Hiyer · November 8, 2023, 3:38pm

thankful if commands in Proxmark3 are shared for HF, as using Proxmark3 it identifies on both xSIID & Next as “Valid ISO 14443-A tag found”, though nothing comes up on scanning using Android Phones. getting the HF fixed is my immediate priority now ( The Next LF is a case i will deal later as it wrongly identifies itself as Indala with a new id each time i scan it )

Command in proxmark3 to clone a ISO 14443-A tag as below

Cloning a NFC Vcard to [xSIID]NFC using only [Proxmark3]
Copy Vcard data manually into [xSIID]NFC using only [Proxmark3]

Hiyer · November 17, 2023, 8:05am

Anybody here can help me as its more than 3 weeks and iam struck with a XSIID not being read by any NFC mobile but can be read by Proxmark3 and a NEXT LF side being misidentified as Indala.The HF side of Next card works perfect and i have a Vcard [756 byte] data type file written perfectly using NFC Tools ( Custom Record Option )

Need immediate help /command Command in [proxmark3] for below

Cloning a NFC Vcard [756 byte] to xSIID NFC using only Proxmark3
Copy Vcard [756 byte] data manually into xSIID NFC using only Proxmark3
3, Fix a Next Tag being misidentified as Indala , have tried all contact zones and orientation.

NB : The last development on the Next LF side is it still identifies as Indala with hopping ids on “LF Search”
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!] Specify one authentication mode
[=] Odd size, false positive?
[+] Indala (len 78) Raw: 800000000080038008080080afffffffefffffffdfffffffffff7fff

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!] Specify one authentication mode
[=] Odd size, false positive?
[+] Indala (len 74) Raw: 80000000000000024080affffffffeffbffee9fffffff6ffff7ff3df

[+] Valid Indala ID found!

And then gets detected when i run this “t5 detect”
[usb] pm3 → lf t5 detect
[=] Chip type… T55x7
[=] Modulation… DIRECT/NRZ
[=] Bit rate… 2 - RF/32
[=] Inverted… Yes
[=] Offset… 35
[=] Seq. terminator… No
[=] Block0… 00080000 (auto detect)
[=] Downlink mode… 1 of 4 coding reference
[=] Password set… No

Example tag code
[usb] pm3 → lf em 410x clone --id 19006F58DE
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 19006F58DE (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8e40033ca8efbe

ON the XSIID the HF tag is clear recognizable via Proxmark3as you can see though it cannot be read or identified by any NFC phone useng NFC taginfo,Writer or NFC Tools pro.

[usb] pm3 → hf search
[|] Searching for ISO14443-A tag…
[+] UID: 04 CC 8A D2 CD 52 80
[+] ATQA: 00 44
[+] SAK: 00 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+] MIFARE Ultralight
[+] MIFARE Ultralight C
[+] MIFARE Ultralight EV1
[+] MIFARE Ultralight Nano
[+] MIFARE Hospitality
[+] NTAG 2xx
[=] proprietary non iso14443-4 card found, RATS not supported
[?] Hint: try hf mfu info

[+] Valid ISO 14443-A tag found

[usb] pm3 → hf mfu info

[=] — Tag Information --------------------------
[+] TYPE: NTAG I2C plus 1912bytes (NT3H2211FHK)
[+] UID: 04 CC 8A D2 CD 52 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] Blocks 0-2: 04 CC 8A D2 CD 52 80 00 44 00 0F 00
[+] Lock: 0F 00 - 0000111100000000
[+] OneTimePad: E1 10 6D 00 - 11100001000100000110110100000000

[=] — NDEF Message
[+] Capability Container: E1 10 6D 00
[+] E1: NDEF Magic Number
[+] 10: version 0.1 supported by tag
[+] : Read access granted without any security / Write access granted without any security
[+] 6D: Physical Memory Size: 872 bytes
[+] 6D: NDEF Memory Size: 872 bytes
[+] 00: Additional feature information
[+] 00000000
[+] xxx… - 00: RFU ( ok )
[+] …x… - 00: don’t support special frame
[+] …x… - 00: don’t support lock block
[+] …xx. - 00: RFU ( ok )
[+] …x - 00: IC don’t support multiple block reads

[=] — Tag Signature
[=] IC signature public key name: NXP NTAG21x (2013)
[=] IC signature public key value: 04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61
[=] Elliptic curve parameters: NID_secp128r1
[=] TAG IC Signature: 9D588A72A4C62EDC91CDCE52DA60887A24489D28655F9D1F48A57895D599250C
[+] Signature verification ( successful )

[=] — Tag Silicon Information
[=] Wafer Counter: 17455546 ( 0x10A59BA )
[=] Wafer Coordinates: x 204, y 138 (0xCC, 0x8A)
[=] Test Site: 2

[=] — Tag Version
[=] Raw bytes: 00 04 04 05 02 02 15 03
[=] Vendor ID: 04, NXP Semiconductors Germany
[=] Product type: NTAG
[=] Product subtype: 05, 50pF
[=] Major version: 02
[=] Minor version: 02
[=] Size: 15, (2048 ↔ 1024 bytes)
[=] Protocol type: 03, ISO14443-3 Compliant

[=] — Tag Configuration
[=] cfg0 [230/0xE6]: 00 00 00 00
[=] - strong modulation mode disabled
[=] - page 0 and above need authentication
[=] cfg1 [231/0xE7]: 00 00 00 00
[=] - Unlimited password attempts
[=] - NFC counter disabled
[=] - NFC counter not protected
[=] - user configuration writeable
[=] - write access is protected with password
[=] - 00, Virtual Card Type Identifier is not default
[=] PWD [232/0xE8]: 01 00 F8 48 - (cannot be read)
[=] PACK [233/0xE9]: 08 01 - (cannot be read)
[=] RFU [233/0xE9]: 00 00 - (cannot be read)

[+] — Known EV1/NTAG passwords
[!] password not known
[?] Hint: try hf mfu pwdgen -r to get see known pwd gen algo suggestions
[=] ------------------------ Fingerprint -----------------------
[=] Reading tag memory…
[=] ------------------------------------------------------------

So i need to write a Vcard on the xSiid NFC HF and clone a tag or copy ID on the Next LF side by fixing the Indala recognition issue.

So need help commands in Proxmark3 to do it.

Regards

Hiyer · November 25, 2023, 4:17pm

It’s more than a month now and still struck with same issue, can anybody help me out.

Amal i have also emailed you multiple times seeking help as it’s struck at same stage with 0 progress…

Thanks

Pilgrimsmaster · November 25, 2023, 7:55pm

I don’t think many people would have done it your way, I certainly haven’t.

If I recall correctly, your NDEF will fit on the 1k easily written by a phone so Can you remind me why you dont want to use a phone to write your VCard?

I’m guessing its a security thing.

I have a feeling you may need to do it line by line. (block by block)

but I would need to sit a a PC with a ProxMark3, which I really dont want to do…

I’ll wait to see your reply

amal · November 25, 2023, 8:51pm

Do this please chances are very high it is operator error and diagnosing operator error without being there in person is extremely difficult. Videos and photos are the next best thing.

Hiyer · November 26, 2023, 1:42am

Hi

As i said multiple times these Next and xsiid are not getting detected over any of my android or Apple phone else would be a no brainer to do it via phone.

Both the implants next (HF side) and xsiid get detected on my with Proxmark3, thats why I have provided a dump over Proxmark3.

I need to get it fixed via proxmark3 so that they can somehow be detected over phone

Hope iam amply clear this time.

amal · November 26, 2023, 2:30am

Do you have the xfd tools? If you purchased from us directly you will have received them with your kit.

Hiyer · November 26, 2023, 4:43am

Yes I did purchase from you directly both the xsiid and next. I brought both as full kits along with Proxmark3 Kbr1 reader and a access kit, but don’t know what the xfd tool looks like, if it’s the HF/LF detector card then I have 4 of them along with a few nfc and rf detection resin encapsulation Keychain

Hiyer · November 26, 2023, 5:10am

This is using Samsung galaxy android phone where the led blinks on am off with no detection

Hiyer · November 26, 2023, 5:11am

The led blinks on the. Xsiid but cannot be detected under any orientation or pressure on android phone… It seems the header is corrupted and it needs to be fixed via proxmark3 as it has no issue detecting it

Hiyer · November 26, 2023, 5:26am

Another using my Samsung fold where the led is consistent on but still no detection of any kind

Hiyer · November 26, 2023, 5:37am

Amal of these are the xfd tools then I have 3 and phones are oriented along it aligned to the implants

amal · November 26, 2023, 7:33am

I have a really shitty time getting coupling of my proxmark3 to my xNT implant but basically try writing 00 00 00 00 to blocks 04 to 0A.

hf mfu wrbl -b 04 -d 00000000
hf mfu wrbl -b 05 -d 00000000
hf mfu wrbl -b 06 -d 00000000
hf mfu wrbl -b 07 -d 00000000
hf mfu wrbl -b 08 -d 00000000
hf mfu wrbl -b 09 -d 00000000
hf mfu wrbl -b 0A -d 00000000

If you don’t see any response it means the chip was not coupled and it was not written successfully. You can see me trying…

Try resetting those blocks to all null bytes and then try an erase after that.

amal · November 26, 2023, 7:41am

Blinking on the xSIID means your Samsung is not getting a good coupling. It’s close enough to light the LED when the Samsung pulses the field to look for tags, but it’s not good enough to engage the chip and have your Samsung phone “lock on” and turn the field power on to maintain the session with the chip.

Use the xfd keychain to find the best possible orientation and location on that phone. You may also need to remove any case that might be on it, but I think the xfd will show you all the best possible spots you can try and one should work.