Help how to clone iclass/picopass

Blocks 0-3 are config. If you tried to change them, there’s a good chance the whole thing is bricked.

I want to buy a new card as this card is no longer valid. :cry:

[=] crypt… No auth possible. Read only if RA is enabled
This card don’t work
[+] crypt… Secured page, keys not locked
This card is work

Can I disable RA?

Read the picopass datasheet

Where did you get these numbers from “030303030003E017” and “10A145919ED16F50”

I purchased an HID IClass tag, same as the one I’m trying to clone. It’s so difficult to clone though. Is there a way we can change the CSN on the new tag as the same as the original tag?

Changing the CSN is unnecessary. Don’t touch blocks 0-5 or you’ll damage the tag.

1 Like

Not only is changing the CSN unnecessary, it cannot be changed. Locked by the manufacturer from the factory.

So what needs to be “changed” in order to duplicate the original tag so that the clone tag will work???


I keep getting this when I try to dump all the information from the original tag “failed to communicate with card.” I can’t read all the block information. Any help?

It looks like that stored key isn’t the right one for that card. Try --ki 1 or --ki 2


I tried those as well and still nothing…any other methods?


This is the tag information for the tag I am trying to clone. I cannot read the block information for some reason…maybe because its an SE tag?

So I used the command “hf iclass sim -t 4” for a reader attack and it actually did something. This is what I got when I placed the proxmark3 next to the reader while the oriignal fob communicated with the reader. Any ideas what I can do with this information?

It said to do this to recover the “elite key” from the bin file, as you can see from the pic below. It says it used CSN 01 0A 0F FF F7 FF 12 E0 for the attack? but the CSN of the original fob is actually something different. I have no idea what I’m looking at though, just trying out different methods. Any ideas what I could do with this info?
@NinjuhhNutz @philidelphiaChickens

iClass SE can’t be cloned in this manner

I have no clue about SE. I’ve had so much going on lately, I’ve been MIA on the forum in general. Sorry, wish I could help.

1 Like

pm3 → hf iclass dump -k 34573C1798D0269B --elite

elite key - 34573C1798D0269B

So, fill me in on this. How is the elite key calculated? Is it UID dependent? Is it data block 6-9 dependent? Did the iClass gods shake their angered fists and hex bits fall out? :stuck_out_tongue:

The key for Elite cards is set by the manufacturer. You won’t be able to copy the Elite card without knowing the key. I entered my Elite card manufacturer key.

1 Like