Cloning NTAG216

[pomology]

Hi! I’m new at this and trying to clone an NTAG216 to a UID changeable tag.

I did: hf mfu dump -f test

then

hf mfu restore -f test.bin -s

That appears to have worked in all expects except that it appears I made a mistake in not calculating and setting the correct BCC value per this site (https://lab401.com/blogs/academy/pentestips-dont-brick-it-introduction-to-magic-cards-uids-and-bccs).

So now I’m getting “BCC1 incorrect. Expected 0x18, Got 0x16”.

My question is what exactly are the commands to set BCC1 correctly? The article above states it needs to be done but doesn’t show commands to actually do it!

If you can point me to a resource I’m glad to learn on my own. I’ve done a lot of googling but having trouble finding resources. Maybe I don’t know the correct terminology for what I should be searching for.

Thank you!

[amal]

Let’s fill in some blanks…

What’s the magic card product you’re trying or write to?

What’s the firmware of the proxmark3 you’re using? If you’re using something else like an xcopy, please specify.

[pomology]

Thank you! I’m using firmware v4.18341, and a Proxmark 3 Easy.

Edit: sorry I overlooked your question about the card. The card I’m trying to write to is this one: https://shop.mtoolstec.com/product/uid-changeable-ntag-n213-n215-n216?attribute_pa_card-type=n216

Much appreciate your insight!

[Equipter]

hf 14a config —bcc ignore

then do your restore command with the correct BCC.

[Aoxhwjfoavdlhsvfpzha]

Have you tried using the app they recommend?

The UID can be modified with MTools App.

[pomology]

Thank you so much. So this is a screenshot of the dump from the card I want to clone. This is what I tried to write to the magic card:

This is a screenshot of the UID and BCC written to the new card from the dump above. As you can see, it all took, except for BCC1:

What I can’t seem to find details on is: exactly what command should I use to write the BCC info in the dump, to the card?

I know how to do: hf mfu setuid --uid 044A2A2AD6680
But that wouldn’t affect the BCC would it?

Thank you for any help you can give!

[amal]

Based on the screen shot of the dump you’re showing, BCC1 is 18… is your dump data faulty?

[pomology]

Thanks! I have tried this, but unfortunately, it appears that app is not available for iPhone which is the only phone I have.

[pomology]

Thank you! The original card I want to clone from has a BCC1 of 18, that’s the card whose dump I shared above in the 1st screenshot. I have read it several times and get identical values each time.

However my magic card I want to clone to has a BCC1 value of 62. Not 18. That is shown in the 2nd screenshot. It’s just not clear to me how to change that value from 62 to 18 on my magic card.

Thank you so much for your help.

[pomology]

This is the dump of the non functional attempted clone:

compared to the dump of the original working card:

Any indications what is wrong? Is the clone card bricked or can it be salvaged?

If not, I do have a second magic card I can try the clone on, but I want to make sure I have the piece of code right to change its UID lest I ruin it too…

Thank you so much for any pointers you can give!