Help changing UID on ISO-15693

Support
1

I am trying to change the UID on a Jura coffee filter. The tag have the following info:

[=] — Tag Information ---------------------------
[+] UID… E0 16 3C 06 07 21 31 95
[+] TYPE MATCH EM-Marin SA (Skidata); EM4237 [IC id = 15] 23,5pF
[+] SYSINFO… 00 0F 95 31 21 07 06 3C 16 E0 00 00 41 03 0F
[+] DSFID… 0x00
[+] AFI… 0x00
[+] IC ref… 0x0F
[+] Tag memory layout (vendor dependent)
[+] 4 ( or 3 ) bytes/blocks x 66 blocks
[+] 264 total bytes

I try the following command:
hf 15 csetuid -u <new 8 bit UID>

but get a failure:
[=] Get current tag

[+] UID… E0 16 3C 06 07 21 31 95
[+] TYPE MATCH EM-Marin SA (Skidata); EM4237 [IC id = 15] 23,5pF

[=] Writing…
[=] Verifying…

[+] UID… E0 16 3C 06 07 21 31 95
[+] TYPE MATCH EM-Marin SA (Skidata); EM4237 [IC id = 15] 23,5pF

[-] Setting new UID ( fail )

Is it even possible to overwrite the tag? If so, what should I do.
And if not, is there any recommendation for a replacement tag that I can write to?

Thank you very much!

1 Like
2

domestic tags such as the ones provisioned for use in coffee filters do not come with the ability to change their UID, it serves no purpose for a product to be able to change its serial number on a whim.

UID changeable chips exist to serve the niche purpose of duplicating existing credentials.

RE sourcing rewritable UID iso15693 chips, lab401 sell them “magic slix” and they’re also on aliexpress

3 Likes
3

To be clear, grey market Chinese factories make these because it basically breaks the whole premise around a “UID” … the U of course meaning Unique… so if you just change them at will, it breaks the whole system. That’s why legit transponder chip manufacturers do not make these. The UID is serialized by the manufacturer and not changable.

2 Likes
5

Finally received my card and set the UID.
But Jura still do not read it.

Jura filter:

[=] --- Tag Information ---------------------------
[+] UID....... E0 16 3C 06 07 21 31 95
[+] TYPE MATCH EM-Marin SA (Skidata); EM4237 [IC id = 15] 23,5pF
[+] SYSINFO... 00 0F 95 31 21 07 06 3C 16 E0 00 00 41 03 0F
[+] DSFID..... 0x00
[+] AFI....... 0x00
[+] IC ref.... 0x0F
[+] Tag memory layout (vendor dependent)
[+]     4 ( or 3 ) bytes/blocks x 66 blocks
[+]     264 total bytes

Magic Card:

[=] --- Tag Information ---------------------------
[+] UID....... E0 16 3C 06 07 21 31 95
[+] TYPE MATCH EM-Marin SA (Skidata); EM4237 [IC id = 15] 23,5pF
[+] SYSINFO... 00 0F 95 31 21 07 06 3C 16 E0 00 00 37 03 22
[+] DSFID..... 0x00
[+] AFI....... 0x00
[+] IC ref.... 0x22
[+] Tag memory layout (vendor dependent)
[+]     4 ( or 3 ) bytes/blocks x 56 blocks
[+]     224 total bytes
6

As you can see from the comparisons, they are not identical. Perhaps the system is probing some of these different aspects to protect against potential clones. The only way to really check to see what it’s doing would be to put the proxmark into sniff mode and insert it between the real reader and real card, then dump the sniff log to see if it’s sending specific commands to get all the system data. Likely it is.

1 Like