Hi, i was able to clone most of HID iClass Legacy 2k, but i’m having trouble to clone 1 HID iClass on my friend’s apartment.
I wrote all 6 - 18 block, including the key on blk 3, did the hf iclass chk everything is matched, but when i try to tap it to the reader, it just doesn’t interact.
What could be the problem? am i missing something on this particular reader?
note : i have successfully clone another HID iClass Legacy 2k with the same reader (HID iClass SE R10) in another apartment.
any help or information would appreciate.
can you post the dump? sounds like sio tbh
1 Like
Can you not copy SIO legacy credentials?
I thought it just prevented you from making new ones with different FC’s and such
1 Like
sio is tied to the CSN, it physically can be transferred but it won’t be accepted if the CSN isn’t the same
1 Like
hi, thanks for the reply, i will post the dump once i’m home
1 Like
So this is the dump file that I want to copy
[=] --------------------------- Tag memory ----------------------------
[=] block# | data | ascii |lck| info
[=] ---------+-------------------------+----------+---+----------------
[=] 0/0x00 | 78 DF CA 10 FE FF 12 E0 | x....... | | CSN
[=] 1/0x01 | 12 FF FF FF 7F 1F FF 3C | .......< | | Config
[=] 2/0x02 | FF FF FF FF 2B F0 FF FF | ....+... | | E-purse
[=] 3/0x03 | 59 D9 E3 74 E6 A8 2C B1 | Y..t..,. | | Debit
[=] 4/0x04 | FF FF FF FF FF FF FF FF | ........ | | Credit
[=] 5/0x05 | FF FF FF FF FF FF FF FF | ........ | | AIA
[=] 6/0x06 | A3 03 03 03 00 03 E0 14 | ........ | | User / HID CFG
[=] 7/0x07 | 00 00 00 00 06 58 04 35 | .....X.5 | | User / Cred
[=] 8/0x08 | 00 00 00 00 00 00 00 00 | ........ | | User / Cred
[=] 9/0x09 | FF FF FF FF FF FF 00 00 | ........ | | User / Cred
[=] 10/0x0A | 30 32 81 01 00 83 02 04 | 02...... | | User / SIO / SR
[=] 11/0x0B | 10 A5 02 05 00 A6 08 81 | ........ | | User / SIO / SR
[=] 12/0x0C | 01 01 04 03 03 00 08 A7 | ........ | | User / SIO / SR
[=] 13/0x0D | 17 85 15 0B 55 BE 03 BB | ....U... | | User / SIO / SR
[=] 14/0x0E | 81 2B 49 34 32 BE 14 10 | .+I42... | | User / SIO / SR
[=] 15/0x0F | EE 3E 0F 8D 85 E8 64 3E | .>....d> | | User / SIO / SR
[=] 16/0x10 | A9 02 05 00 05 00 00 00 | ........ | | User / SIO / SR
[=] 17/0x11 | FF FF FF FF FF FF FF FF | ........ | | User
[=] 18/0x12 | FF FF FF FF FF FF FF FF | ........ | | User
[=] ---------+-------------------------+----------+---+----------------
[?] yellow = legacy credential
[?] cyan = SIO / SR credential
[=] Block 7 decoder
[+] Binary..................... 110010110000000010000110101
[=] Wiegand decode
[+] [H10301 ] HID H10301 26-bit FC: 44 CN: 538 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 704 CN: 538 parity ( ok )
[=] found 2 matching formats
And this is dump file that I copy to.
[=] --------------------------- Tag memory ----------------------------
[=] block# | data | ascii |lck| info
[=] ---------+-------------------------+----------+---+----------------
[=] 0/0x00 | 44 38 83 14 FE FF 12 E0 | D8...... | | CSN
[=] 1/0x01 | 12 FF FF FF 7F 1F FF 3C | .......< | | Config
[=] 2/0x02 | FE FF FF FF FF FF FF FF | ........ | | E-purse
[=] 3/0x03 | 69 1A 04 56 BD A8 81 AF | i..V.... | | Debit
[=] 4/0x04 | FF FF FF FF FF FF FF FF | ........ | | Credit
[=] 5/0x05 | FF FF FF FF FF FF FF FF | ........ | | AIA
[=] 6/0x06 | A3 03 03 03 00 03 E0 14 | ........ | | User / HID CFG
[=] 7/0x07 | 00 00 00 00 06 58 04 35 | .....X.5 | | User / Cred
[=] 8/0x08 | 00 00 00 00 00 00 00 00 | ........ | | User / Cred
[=] 9/0x09 | FF FF FF FF FF FF 00 00 | ........ | | User / Cred
[=] 10/0x0A | 30 32 81 01 00 83 02 04 | 02...... | | User / SIO / SR
[=] 11/0x0B | 10 A5 02 05 00 A6 08 81 | ........ | | User / SIO / SR
[=] 12/0x0C | 01 01 04 03 03 00 08 A7 | ........ | | User / SIO / SR
[=] 13/0x0D | 17 85 15 0B 55 BE 03 BB | ....U... | | User / SIO / SR
[=] 14/0x0E | 81 2B 49 34 32 BE 14 10 | .+I42... | | User / SIO / SR
[=] 15/0x0F | EE 3E 0F 8D 85 E8 64 3E | .>....d> | | User / SIO / SR
[=] 16/0x10 | A9 02 05 00 05 00 00 00 | ........ | | User / SIO / SR
[=] 17/0x11 | FF FF FF FF FF FF FF FF | ........ | | User
[=] 18/0x12 | FF FF FF FF FF FF FF FF | ........ | | User
[=] ---------+-------------------------+----------+---+----------------
[?] yellow = legacy credential
[?] cyan = SIO / SR credential
[=] Block 7 decoder
[+] Binary..................... 110010110000000010000110101
[=] Wiegand decode
[+] [H10301 ] HID H10301 26-bit FC: 44 CN: 538 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 704 CN: 538 parity ( ok )
[=] found 2 matching formats
ok cool, this is an iclass SR.
you can try changing block 6 0xA3 to 0x03 changing the card classification to legacy and giving that a try, if the readers are configured to accept legacy creds it may work
2 Likes
okay i will give it a try and update the outcome.
but what is the difference between HID iClass Legacy and the SR?
1 Like
they’re fundamentally the same chip. iclass SR is iclass legacy + SIO blob with standard keying
TLDR: has CSN unique fingerprinting, can be sidestepped if legacy is enabled on the reader (bear in mind HID has recently been making a big push for clients to disable legacy when not needed so YMMV)
Fluffing out the above: when your reader identifies your card and sees it is configured as SR, it will attempt to match its SIO & CSN & PACs to what it knows, your SIO on the cloned card does not match the CSN it belongs to since you can’t change CSNs on standard iclass.
when it sees your SR fail the SIO, it rejects. making the credential legacy & relying on the reader having legacy enabled means the reader only looks at the PACs (facility code & card number) and doesn’t bother to check for the SIO.
1 Like
ahh okay i understand.
when it sees your SR fail the SIO, it rejects. making the credential legacy & relying on the reader having legacy enabled means the reader only looks at the PACs (facility code & card number) and doesn’t bother to check for the SIO.
what if my card’s facility code is different to them?
1 Like
why would it be? you’re copying it from the original card, the valid card.
1 Like
which block contains the facility code? when we order a blank card, we have to provide a facility code, and that is changeable?
1 Like
block 7 contains the PACs(card number and facility code) in their raw wiegand format. if you look at your output it tells you as much
[=] Block 7 decoder
[+] Binary..................... 110010110000000010000110101
[=] Wiegand decode
[+] [H10301 ] HID H10301 26-bit FC: 44 CN: 538
and yeah. you can change those but why would you? unless you’re looking to buy iclass cards externally and manually reprogram them to be system compatible for you, that’s totally something you can do if your system allows Legacy
1 Like
ohh ! thankyou for the explanation, i just realise that you mention it on my output 
i will try again the card as soon as i got the chance, and i will post the update.
Thank you !
2 Likes
happy to help! keep us in the loop of how it goes! fingers crossed the readers are legacy enabled!
2 Likes
Hello again, so i tried the method that you suggest me, and it still doesn’t work.
Looks like it is true about this that you mentioned earlier. Any solution to this?
are the readers multiclass (HF & LF) if so you can attempt to downgrade to low frequency. if not then you are out of luck barring a CSN changeable picopass
1 Like
nope, its not multiclass reader, it only read HF.
is this exist?