Cloning MiFare Ultralight EV1

Hey everyone,

I recently purchased a NExT, ACR122U, and this copier. I was wondering if it’s possible to clone the Ultralight to my NExT on my own or would I have to go to the system admin and have them do it. I’ve included the NFC info in a Google Photos folder below, as well as a picture of the card. Thank you guys for your help!

It is not possible to copy any Ultralight or even another NTAG216 to the NTAG216 chip inside the NExT because the NTAG216 chip does not allow for UID changes. Your only option will be to go to the system admin and ask them to add your NTAG216 chip to the roster.

I know this an old post, and it was also the answer I was looking for. With only 6-8 months really researching RFID/NFC technology, I still consider myself very much a beginner at this- so I’m hoping this isn’t a dumb question; but if it cannot be cloned (speaking specifically of the EV1 V2), can it be emulated? Say with something like the emutag?

There are magic NTAG chips available now. You can clone NTAG and Ultralight to flexMN for example.

Thanks for the reply! When you say these can “clone” an ultralight or NTAG by what method exactly? It says that it does this, with a Prox3…

I am using an icopyXS with latest firmware (running Lua scripts). My card will scan, but when it goes to read (in auto-copy mode), that’s when it fails. I’m pasting the card info below.

Thank you!

** TagInfo scan (version 4.25.5) 2023-03-09 22:57:04 **
Report Type: – IC INFO ------------------------------

IC manufacturer:

NXP Semiconductors

IC type:

MIFARE Ultralight EV1 (MF0UL11)

– NDEF ------------------------------

No NDEF data storage populated:

– EXTRA ------------------------------

Memory size:

48 bytes user memory

  • 12 pages, with 4 bytes per page

IC information:

Full product name: MF0UL1101DUx

Version information:

Vendor ID: NXP
Type: MIFARE Ultralight
Subtype: 17 pF
Major version: 1
Minor version: V0
Storage size: 48 bytes
Protocol: ISO/IEC 14443-3

Configuration information:

AFC counter values:

  • Counter #0: 0
  • Counter #1: 0
  • Counter #2: 0

Originality Check (asymmetric):

Signature verified with NXP public key

TagInfo Version:

Version :4.25.5

Device Info:

Device Model :samsung ( SM-S918U )
Android OS Version :13

– FULL SCAN ------------------------------

Technologies supported:

ISO/IEC 14443-3 (Type A) compatible
ISO/IEC 14443-2 (Type A) compatible

Android technology information:

Tag description:

  • TAG: Tech [android.nfc.tech.NfcA, android.nfc.tech.MifareUltralight, android.nfc.tech.NdefFormatable]
  • Maximum transceive length: 253 bytes
  • Default maximum transceive time-out: 618 ms

Detailed protocol information:

ID: 04:93:C0:6A:87:10:91
ATQA: 0x4400
SAK: 0x00

Memory content:

[00] * 04:93:C0 DF (UID0-UID2, BCC0)
[01] * 6A:87:10:91 (UID3-UID6)
[02] x 6C 48 08 00 (BCC1, INT, LOCK0-LOCK1)
[03] x 90:04:83:1C (OTP0-OTP3)
[04] . D4 AB 1C FA |…|
[05] . 1A 5B B9 E0 |.[…|
[06] . 38 5D 88 BB |8]…|
[07] . 0C B0 F0 0D |…|
[08] . B5 B9 4C CD |…L.|
[09] . 29 4B B4 4F |)K.O|
[0A] . 00 00 00 00 |…|
[0B] . 00 00 00 00 |…|
[0C] . 00 00 00 00 |…|
[0D] . 00 00 00 00 |…|
[0E] . 00 00 00 00 |…|
[0F] . 00 00 00 00 |…|
[0F] ?p XX XX XX XX (LOCK2-LOCK4, CHK)
[10] ?p XX – – – (AUTH0)
[11] ?p XX XX – – (ACCESS, VCTID)
[12] +P XX XX XX XX (PWD0-PWD3)
[13] +P XX XX – – (PACK0-PACK1)

*:locked & blocked, x:locked,
+:blocked, .:un(b)locked, ?:unknown
r:readable (write-protected),
p:password protected, -:write-only
P:password protected write-only


In reading further… from what I gather is that my icopy for example is missing some things in which the Prox 3 (specifically the one I can purchase through this site) has the necessary resources to do this that my icopy does not? Hence…

“ The hardware is standard Chinese issue, but the [Iceman firmware] we have pre-loaded onto it is considered to be the pinnacle of features and functionality, enabling a huge range of extremely useful and convenient commands and LUA scripts to automate chip identification, penetration testing, and programming.”

Am I correct in assuming that?

And is it possible to substitute a wearable band/ring in place of the Flex for this tag? If so, what would be one of the best suited packages for me that’s sold on the product page?