Cloning Zeekr / Geely NFC tag

Support
1

Hi all,

So, i now have NExT2 installed, and when i ordered, I also grabbed a J3R452 as from what i took from my previous thread Assistance in implant selection? and some general research and chatgpt, that this was the card i needed to work towards getting my Zeekr nfc card made into an implantable.

However, I have no clue what im doing from this point. I have tried to register the card i received to the car hoping it might just pair, but that was a bust. So from what i can tell, I will need to get a proxmark3, and then sit that between the car and the card when im programming it.

My understanding is that i can remove the existing paired card, and then re-add it. So I should be able to capture some packets in flight. But im not 100% sure on that either.

So, I come to the experts in the hopes that i can get some assistance in getting this to work. If i can, i will provide the working solution freely for all.

But, based on this, am i correct in assuming that I will need a proxmark? and will that be able to capture whatever packets are in transit that are needed?

Many thanks.

2

The first thing you want to do is confirm that it is NFC, and maybe just scan it with taginfo first.. do a full scan and post?

1 Like
3

this is what came from taginfo

** TagInfo Scan (version 6.2.0) 01-Sep-26 21:31:12 **
Report Type: -- IC INFO ------------------------------

# IC Manufacturer:
NXP Semiconductors

# IC Type:
Unknown IC implementing ISO/IEC 14443-4

# Card OS type:
Java Card

# Application information:
Global Platform card manager present
Visa card manager

-- NDEF ------------------------------

# No NDEF Data Storage Populated:

-- EXTRA ------------------------------

# ATS historical bytes details:
ISO/IEC 7816-4 coding
Category: [RFU]

# Global Platform information:
Java Card version 2.2
Global Platform version 2.1.1
GP Secure Channel Protocol: 02 option 15
Max. length APDU data field: 255 bytes
Visa card manager
* FCI: 0x6F108408A000000003000000A5049F6501FF |o..............e..|

# Card Production Life Cycle data (CPLC):
IC Fabricator: [not set]
IC Type: [unknown]
OS ID: [unknown]
OS release date: [not set]
OS release level: 0x0000
IC Fabrication Date: [not set]
IC Serial Number: 0x00000000
IC Batch Identifier: 0x0000
IC Module Fabricator: [not set]
IC Module Packaging Date: [not set]
ICC Manufacturer: [not set]
IC Embedding Date: [not set]
IC Pre-Personalizer: [not set]
IC Pre-Perso. Equipment Date: [not set]
IC Pre-Perso. Equipment ID: 0x00000000
IC Personalizer: [not set]
IC Personalization Date: [not set]
IC Perso. Equipment ID: 0x00000000
IC Personalizer: [unknown]
IC Personalization Date: [not set]
IC Perso. Equipment ID: 0x00000000

# File Control Information:
Default selected AID
0x6F108408A000000003000000A5049F6501FF |o..............e..|

# TagInfo Version:
Version :6.2.0

# Device Info:
Device Model :samsung ( SM-G965F )
Android OS Version :10

-- FULL SCAN ------------------------------

# Technologies Supported:
ISO/IEC 7816-4 compatible
ISO/IEC 14443-4 (Type A) compatible
ISO/IEC 14443-3 (Type A) compatible


# Android Technology Information:
Tag description:
* TAG: Tech [android.nfc.tech.IsoDep, android.nfc.tech.NfcA]
* Maximum transceive length: 65279 bytes
* Default maximum transceive time-out: 2000 ms
* Extended length APDUs supported
* Maximum transceive length: 253 bytes
* Default maximum transceive time-out: 618 ms


# Detailed Protocol Information:
ID: 6E:38:F4:AD
ATQA: 0x0800
SAK: 0x20
ATS: 0x6F00
* Max. accepted frame size: 16 bytes (FSCI: 0)
* Supported receive rates:
	- 106 kbit/s
* Supported send rates:
	- 106 kbit/s
* SFGT: 302.0 us
* FWT: 4.833 ms
* NAD not supported
* CID supported
* Historical bytes: [none]

--------------------------------------
4

Screenshot_20260918-184148
Screenshot_20260918-1841481080×343 13.5 KB

This is interesting. If they are using a Java card for this then there is zero chance of cloning.. unless they did something extremely stupid. I have no experience with zeekr / geely but since they are issuing Java cards I can only imagine they’re properly using the secure features of these chips which have been designed for government IDs and other extremely secure environments.

2 Likes
5

would there be a possibility of using the proxmark to get what ever info is needed and then building the applet? My minimal understanding is this is how the tesla one was done.

I can program new cards to the car in the car, so im hoping that i can capture some of the info needed to make progress on it.

But, like i said, i have basically no knowledge on this.

6

Screenshot_20260918-205108
Screenshot_20260918-205108591×112 6.04 KB

source

2 Likes
7

Ahh, well that’s sad. oh well. i guess i will give up on that idea then.

with the conversion services you offer, would it be possible to send a card and then have it converted into an implant? Happy to move that to DM if needed.

8

Very likely convertible but we won’t know until we basically destroy the card and attempt to mate the chip with an antenna we have in stock

9

@jbates5873 ,
What Amal is suggesting, without actually saying it, is you use the “DT Conversion Service”

HOW TO:-
Unless you have access to the system and the ability to enroll new cards, I would suggest you get a spare card if possible and send that and the actual card you want converted and clearly label them.

To do this, if you “lose” a card, this becomes the TEST CARD, and your new replacement card become the CONVERSION CARD

I have used the DT Conversion Service a couple of times and can highly reccomend it.

These were both a few years back and DT now have a few more antenna options so your odds of a succesful conversion have improved

3 Likes