HID iCLASS Card Cloning to Implant Chip

Projects
1

Hi! I’d like to clone my work badge’s proximity access function to an implantable chip, but I’m running into some potential roadblocks.

I used a HID OMNIKEY 5321 CLi v2 to verify the card identifies as an iCLASS 32KS (8x2KS+16KS). The markings on the card are “HID iCLASS Px G8Y”. The standard is ISO15693 operating at 13.56 MHz.

Looks like the xIC would work, except I’m concerned about the 112 byte memory since the card holds 4KB. However, it’s broken into 3 sections, so it’s possible the access function uses only one. The card is also a smartcard and can hold data which makes this more plausible. Still, seems like a potential size mismatch in addition to the difficulty in determining specifically which data are being used for door access.

This card is operating in HID Secure Mode, but I’ve found research offering ways around that. Cloning shouldn’t be an issue, aside from the potential shortage of capacity.

Has anyone had any experience dealing with cards like this?

2

Does your software look like this? If so it might be possible to use our flexDF (or possibly the flexDF2 or xDF2 if your software support DESFire EV2 chips).

3

I’m not sure what the software looks like. I can try and see, but I’m not sure this lead will result in success. My card isn’t a DESFire. We did get a round of card upgrades but they’re iCLASS Px G9Y as opposed to iCLASS Px G8Y when I originally posted.

Our cards did see a split, they’re no longer proximity + smartcard, they’re only proximity cards now. That change may alter the size requirements. I’ll scan the G9Y into my reader in the near future to see if the xIC would be suitable now. I’ll report my findings back. Thanks for the bump on this, maybe now I can get a solution embedded!

4

Really? That feels like a downgrade. Can you send me one of these cards for testing? It might be clonable to a T5577 chip in our xEM or NExT.

1 Like