iClass Card Identification and Possible Cloning

Can you try with the fc and cn flags instead of raw?

Hmm, doesn’t seem to like that either:

[usb] pm3 --> lf hid clone --fc 4530 --cn 85581
[!] Unknown format:
[usb] pm3 --> lf hid clone -w H10301 --fc 4530 --cn 85581
[!] The card data could not be encoded in the selected format.
[usb] pm3 -->        

wrong format. Yours is 48 bit corporate 1000, so -w C1k48s

hmm hangs again

[usb] pm3 --> lf hid clone -w C1k48s --fc 4530 --cn 85581
[=] Preparing to clone HID tag
[+] [C1k48s  ] HID Corporate 1000 48-bit std    FC: 4530  CN: 85581  parity ( ok )
[#] Tags can only have 84 bits
[=] You can cancel this operation by pressing the pm3 button

This is due to limited memory on the t5577 I believe. Seen discussion of it before on the Iceman discord. Unfortunately I don’t know how to solve it. There may be a good place to ask.

All good, I’ll check there. Thanks for your help!

1 Like

Although, if your work readers are indeed multiclass, writing the data from the prox card onto an iClass legacy card may work. Worth testing if you can get a blank iclass card off ebay or something.

As an addendum, since I’d be putting the info on the FlexMN and FlexMT, I’d be worry about the reader not prioritizing reading the LF T55XX over the HF cards. Is there any way to disable them, kind of like temporarily putting in a bad UID on a card to mess up the BCC?

Hey Appellus, I am trying to clone a HID iclass Px D9P. I was wondering if you had any success and if so, do you have any helpful info on how you were able to clone the card?

Hey @D8136, I did actually get lucky in that my job was not using the HF aspect of the cards, so the HID LF aspect was good enough. I basically threw on some bad UID’s to disable the HF on my implants so that the readers wouldn’t look at them. For the LF, all it really took was cloning the raw string you get from using lf search using the HID Prox commands.

lf hid clone -r RAWHEXSTRINGHERE