Help Cloning iCLASS / PicoPass Card

Support
25

I’m not really good enough at iClass to tell you whether this card is easily cloneable, but yes, you would need a blank picopass card to write to

What sort of system does it go to?

26

work clock in system, i work at a hospital. Not sure the system hardware type if that is what you are referencing.

1 Like
27

I located some additional chips for making flexClass… they will be back on the store again soon.

3 Likes
28

@counteru It’s pretty simple to clone the iClass 2k once you’ve wrapped your head around what it’s actually authenticating. Just manually copy over blocks 6-9, one block at a time. DO NOT touch block 1 or 3! :slight_smile: Just trust me. The CSN doesn’t change, and almost surely isn’t used for authentication anyways.
hf ic wrbl --ki 0 -b 6 -d hexvaluehere
take the 16bit hex value for each data block, without spaces and paste it above.
repeat for 7-9
enjoy

1 Like
29

Hi there,
Absolute newbie here. I’m following this thread to accomplish the same thing.
I cannot seem to get the dump file saved… I’m not sure why. This is what I get:

[usb] pm3 → hf ic dump --ki 0
[+] Using AA1 (debit) key[0] AE A6 84 A6 DA B2 32 78
[=] Card has at least 2 application areas. AA1 limit 18 (0x12) AA2 limit 31 (0x1F)
.

[=] --------------------------- Tag memory ----------------------------

[=] block# | data | ascii |lck| info
[=] ---------±------------------------±---------±–±---------------
[=] 0/0x00 | 82 81 ED 15 FE FF 12 E0 | … | | CSN
[=] 1/0x01 | 12 FF FF FF 7F 1F FF 3C | …< | | Config
[=] 2/0x02 | FF FF FF FF 9F FF FF FF | … | | E-purse
[=] 3/0x03 | E8 70 19 0A 4F D7 A5 28 | .p…O…( | | Debit
[=] 4/0x04 | FF FF FF FF FF FF FF FF | … | | Credit
[=] 5/0x05 | FF FF FF FF FF FF FF FF | … | | AIA
[=] 6/0x06 | 03 03 03 03 00 03 E0 17 | … | | User / HID CFG
[=] 7/0x07 | DA F7 71 89 E6 B2 2E E4 | …q… | | User / Enc Cred
[=] 8/0x08 | 2A D4 C8 21 1F 99 68 71 | *…!..hq | | User / Enc Cred
[=] 9/0x09 | 2A D4 C8 21 1F 99 68 71 | *…!..hq | | User / Enc Cred
[=] 10/0x0A | FF FF FF FF FF FF FF FF | … | | User
[=] 11/0x0B | FF FF FF FF FF FF FF FF | … | | User
[=] 12/0x0C | FF FF FF FF FF FF FF FF | … | | User
[=] 13/0x0D | FF FF FF FF FF FF FF FF | … | | User
[=] 14/0x0E | FF FF FF FF FF FF FF FF | … | | User
[=] 15/0x0F | FF FF FF FF FF FF FF FF | … | | User
[=] 16/0x10 | FF FF FF FF FF FF FF FF | … | | User
[=] 17/0x11 | FF FF FF FF FF FF FF FF | … | | User
[=] 18/0x12 | FF FF FF FF FF FF FF FF | … | | User
[=] ---------±------------------------±---------±–±---------------
[?] yellow = legacy credential

[+] saving dump file - 19 blocks read
[!] file not found or locked E:\FOR_Proxmark_Easy_512K\PM3_2023\client\/hf-iclass-8281ED15FEFF12E0-dump.bin
[-] error: can’t save the file: E:\FOR_Proxmark_Easy_512K\PM3_2023\client/hf-iclass-8281ED15FEFF12E0-dump.json
[?] Try hf iclass decrypt -f to decrypt dump file
[?] Try hf iclass view -f to view dump file

I’m running pm3.bat off of a USB folder, as you can see. What can I do to save successfully?

Thanks in advance!

30

It seems to not like writing to that USB drive, have you tried moving the client to your main drive?

31

at first glance, the directories look a little suspicious?
[!] file not found or locked E:\FOR_Proxmark_Easy_512K\PM3_2023\client\/hf-iclass-8281ED15FEFF12E0-dump.bin
[-] error: can’t save the file: E:\FOR_Proxmark_Easy_512K\PM3_2023\client/hf-iclass-8281ED15FEFF12E0-dump.json

seems like the proxmark doesn’t like where it’s being pointed to save. Have you tried explicitly pointing to where you want it saved?

can you go to the E:\FOR_Proxmark_Easy_512K\PM3_2023\client\ … directory with windows explorer? if so, what’s there?

hf ic dump --ki 0 -f /path/to/save/file
try different directories for the save path. I’ve never come across that issue until just now when I tried to save a dump file to a specific directory (NOT the default) as I’ve never really needed to change where the dumps are saved.

see if it will make any difference.

If not, @Aoxhwjfoavdlhsvfpzha is saying the same as what I would try next.

edit:
to be clear, can you navigate to:
E:\FOR_Proxmark_Easy_512K\PM3_2023\client\ and open in file explorer?

I believe the default target for saving dump files in the where the Proxmark source lives.

In my case, that’s C:\Proxspace\pm3

so when I save dumps, by default it goes to C:\Proxspace\pm3\yourfilehere.bin

unless you made the \client folder or changed a config for a specific purpose, that doesn’t seem right to me

The client directory should be INSIDE the source directory. I think it’s saving one level “too low” in your file system. Keep the / vs \ in mind with windows liking one and your proxmark seeing / from the source directory down…if that makes sense?

Where do you run pm3 comX from? Which specific directory? Can you go to that directory and create a \test subdirectory with file explorer. Then try:

hf ic dump --ki 0 -f /test/dump

that SHOULD create the .bin .eml .json files for the dump

3 Likes
33

Change directory E:/ to C:/ and delete this file.
[…/cilent/.proxmark3/preferences.json]