Cloning HD iCLASS MIFARE Px DM18Y

Greetings Dangerous Thuings brothers and sisters. I love this website but am struggling to find cloning info on this card.

I have limited experience using the Proxmark3 Easy and copying HID 125 kHz cards to T5577 cards.

My card starts in pre-printed blue writing: HID iCLASS MIFARE Px DM18Y
Then the card info in black: 92465 +92465 11102597881-1 SR
Then at the very end pre-printed blue: XT

I thought I cloned this card by doing a “lf search” and 'lf clone" but it only works on some readers. I think this might be a dual frequencty card complete with HF.

Does anyone know how I clone this card with a Proxmark 3 Easy and what type of blank cards/keychain fobs I need to buy? I have some UID 13.56MHZ blank cards - will they work?

Any help would be much appreciated!

~Blackhawks

There’s a lot going on there.

I think you could be correct

Do you have a bright torch / flashlight :flashlight:
If you shine the light from the back, you should be able to see the antenna(s)
LF likely circle in the middle
HF likely Rectangular, following the perimiter of the card

Possibly, we just need a little more information

Can you scan the card you want to copy with TagInfo ? and repeat with your blank cards you currently have
this will tell us the HF chips they have

Thanks for the reply Pilgrim!

The NFC Tag Info for iPhone did nothing. Could not scan/find anything.

Torchlight test showed 2 circular antennas in the middle plus some type of chip off to the upper right rotated 45 degrees and another chip lower right in line with the card. See attached photo.

I tried running Proxmark last night but had difficulties with the Unix environment. I could not get the proxmark3.exe to run or any LF or HF commands. I’ll try again over the weekend.

-Blackhawks

There are 3 chips in there total. A prox 125khz chip, a mifare classic, and an hid iclass. From your description it seems like some readers are programmed to take one type or another.

Interesting, BUT thats one test passed and a step in the right direction.

Next we want to sort out your TagInfo (lower priority) and your Proxmark3 (higher priority)

Odd, it should have found either the Mifare or the HF HID.

Which flavour iPhone do you have?

Can you try scanning another HF card with it.

your blank cards?
or Credit card? (we dont need detail, just to know TagInfo is working)

Have you had your Proxmark running before?
Have you been able to ready ANY cards?

What OS are you running it on? Windows, iOS, Linux?

What have you done so far to set it up?
Have you followed any guides for installation?

Do you have a link?

Would you like one or two or three?
If you are happy with your setup and its working, you can ingnore the links below
HOWEVER
If yours is not working, i would suggest you delete your entire setup, including folders, then follow your chosen guide below.
Make sure you follow it to the letter.
IF you get an error, STOP the install, and reply to this post so we can more easily fault find for you.

Your choices below

INDEPTH WITH EXPLANATION

PAINT BY NUMBERS

https://forum.dangerousthings.com/t/handy-dandy-tips-and-tricks/13041/14?u=pilgrimsmaster

JUST GET THIS BITCH WORKING

https://forum.dangerousthings.com/t/handy-dandy-tips-and-tricks/13041/15?u=pilgrimsmaster

nada. iphones don’t scan mifare classics or iclass (iso15693) chips.

I tried MasterCards, Visas, bank cards, my HID Class card again - nothing.

Payment cards are a special situation with iPhone. They block access to those payment applications on the cards and only let Apple pay use those application identifiers. You got to find something that’s a standard NFC tag that complies with NFC forum type specifications.

Ahhh, I thought that they just didnt read NDEF on Mifare Classic, but otherwise worked :man_shrugging:

STOOPID iPhones

I’ll shut up now and just watch from the corner

popcorn-watching-tv

1 Like

Also to clarify, they can read ISO 15693 chips if they are formatted for NFC type 5.

absolutely i was rushing to make the distinction that the iclass mifare cards have two hf heh

1 Like

OK Gents, thanks for your patience with me! Please stay with me me as I try to figure this out. I’ve read a lot of posts but still can’t figure out what exactly I need to do and what commands.

I can’t get NFC TagInfo in my iPhone 14 to read anything. Tried credit cards, bank cards, and a UID 13.56MHZ that came with my Proxmark3 Easy I bought 4-5 years ago.

To date, all I did was copy the HID 125MHz info on to a blue pastiche tag but that does not work. Here are some screenshots I recently done:

image

But if I keep moving the card around a bit, the LF SEARCH finds an EM4X05 chip. Do I need to copy this info on another blue tag?

image

Not really sure what all this LF EM 4X05INFO and 4X05DUMP information means:

image

Oh yah, the HW VERSION info that likely tells you I’m running ancient software. Not sure how I update any of this.

image

So, where does this leave me? Who knows!

An HF SEARCH just crashes my Proxmark:

image

Any recommendations what I do next would me much appreciated. I’m using Windows 10. Please link any specific guides if available.

Thanks again for your patience! I will buy a new Proxmark some day but am hoping my Proxmark3 Easy can handle this task.

~Blackhawks

You look like you might need to do an update

Try this

Then you’ll at least be singing off the same song sheet, so fault finding should be easier

And these 7 commands above will magically find/get the new files somewhere?

Well done not just putting commands into your computer from a rando on the internet :exclamation:

But then asking the same person if the answer they originally gave was the truth…:interrobang:


Here’s a riddle for you:
Imagine you are a prisoner, you stand in a room and infront of you are 2 prison guards and 2 doors, one door leads to freedom, the other the electric chair, YOU dont know which one is which…

One of the guards always tells the truth and the other always lies YOU don’t know which one is which, HOWEVER both guards know each other.

You have to choose a door, and you may only ask one question of only one guard.

What question do you ask to gain your freedom?

Yes
this bit
git pull

Ha ha! What I meant was I see tonnes of forums using “git pull” commands followed by a specific website. I am not sure how this “git pull” can get all the update info I likley require.

git pull

means github pull.

pulling the information from the respository, to bring down any changes that were made in between the original time you git cloned (repo link) or made your last git pull.

this is a common way of downloading updates.

if this worries you for some reason, you can git checkout -v (release version) to set your branch to the release and compile from there

OK, that makes sense now. Thanks a million Equipter!

Before I update my software and firmware (and possibly brick my old Proxmark3 Easy), I am going to try something different.

I am going to try to clone the HID component of the card to a T5577 (already done) and also clone the EM4x05 chip component to another T5577. I just started a new thread for that. If I can do that, I’ll try and see what happens when I bring both cloned T5577 chips (HID and EM4x05) to the original reader.

OK, I updated everything (software, firmware, bootloader, full image) as per the Getting started with the proxmark3 easy instructions.

I followed the README.MD instructions for Proxmark3 Easy with 256kb.

Strangely, I can no longer do any LF SEARCH commands - this is what happens:

[usb] pm3 → hw version

[ Proxmark3 RFID instrument ]

[ CLIENT ]
Iceman/master/v4.16717-103-g5f8cd5cac 2023-07-14 22:36:05 cdf68ab2f
compiled with… MinGW-w64 10.3.0
platform… Windows (64b) / x86_64
Readline support… present
QT GUI support… present
native BT support… absent
Python script support… present
Lua SWIG support… present
Python SWIG support… present

[ PROXMARK3 ]
firmware… PM3 GENERIC

[ ARM ]
bootrom: Iceman/master/v4.16717-103-g5f8cd5cac 2023-07-14 22:34:59 cdf68ab2f
os: Iceman/master/v4.16717-103-g5f8cd5cac 2023-07-14 22:35:14 cdf68ab2f
compiled with GCC 10.1.0

[ FPGA ]
fpga_pm3_lf.ncd image 2s30vq100 2023-07-12 16:12:04
fpga_pm3_hf.ncd image 2s30vq100 2023-07-12 16:12:14
fpga_pm3_felica.ncd image 2s30vq100 2023-07-12 16:12:34
fpga_pm3_hf_15.ncd image 2s30vq100 2023-07-12 16:12:24

[ Hardware ]
–= uC: AT91SAM7S256 Rev D
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 256K bytes ( 97% used )

[usb] pm3 → lf search
[#] unknown command:: 0x0205
[!] (lf_read) command execution time out
[-] Data in Graphbuffer was too small.
[usb] pm3 →

Does anyone know whats going on with my build or Proxmarkw Easy hardware?

~Blackhawks

HOWEVER … it looks like my HF SEARCH commands do work - this is what I get:

[usb] pm3 → hf iclass info

[=] --------------------- Tag Information ----------------------
[+] CSN: 0D 40 FC 14 FE FF 12 E0 uid
[+] Config: 12 FF FF FF 7F 1F FF 3C card configuration
[+] E-purse: DE FF FF FF FF FF FF FF Card challenge, CC
[+] Kd: 00 00 00 00 00 00 00 00 debit key ( hidden )
[+] Kc: 00 00 00 00 00 00 00 00 credit key ( hidden )
[+] AIA: FF FF FF FF FF FF FF FF application issuer area
[=] -------------------- card configuration --------------------
[=] Raw: 12 FF FF FF 7F 1F FF 3C
[=] 12… app limit
[=] FFFF ( 65535 )… OTP
[=] FF… block write lock
[=] 7F… chip
[=] 1F… mem
[=] FF… EAS
[=] 3C fuses
[=] Fuses:
[+] mode… Application (locked)
[+] coding… ISO 14443-2 B / 15693
[+] crypt… Secured page, keys not locked
[=] RA… Read access not enabled
[=] PROD0/1… Default production fuses
[=] -------------------------- Memory --------------------------
[=] 2 KBits/2 App Areas ( 256 bytes )
[=] 1 books / 1 pages
[=] First book / first page configuration
[=] Config | 0 - 5 ( 0x00 - 0x05 ) - 6 blocks
[=] AA1 | 6 - 18 ( 0x06 - 0x12 ) - 13 blocks
[=] AA2 | 19 - 31 ( 0x13 - 0x1F ) - 18 blocks
[=] ------------------------- KeyAccess ------------------------
[=] * Kd, Debit key, AA1 Kc, Credit key, AA2 *
[=] Read AA1… debit
[=] Write AA1… debit
[=] Read AA2… credit
[=] Write AA2… credit
[=] Debit… debit or credit
[=] Credit… credit
[=] ------------------------ Fingerprint -----------------------
[+] CSN… HID range
[+] Credential… iCLASS legacy
[+] Card type… PicoPass 2K
[usb] pm3 →

Does anyone know how I clone the HF part/chip within this card? I already copied the HID Prox to T5577 (although my LF SEARCH no longer works) but how do I decipher all this stuff from my HF SEARCH? What type of blank card/fob do I need to clone into?

Any info would be much appreciated!!!

Thanks,
~Blackhawks