Is it possible to 'un-format' xM1+?


#1

I have my xM1+ formatted for NDEF so it’s readable with most cellphones, but I am wondering if it’s possible to undo that process?

I originally formatted it for NDEF with either NFC Tools Pro or NXP TagWriter (I forget which, I use both) and it does work fine, readable by various NFC apps and even readable on the iPhone.

But now I’m considering a different usage that would work better if it wasn’t NDEF formatted, so I am trying to undo that process so it’s just a blank Mifare tag again.

I’ve tried with a few Android apps that have options to ‘Factory Format’ but they don’t seem to work. Or maybe they’re just re-formatting as NDEF again rather than going back to being a blank Mifare format…

Thanks!


#2

So you have a few options, your best being a proxmark3 and using the included lua script “remagic.lua” it sets magic gen1 chips back to factory programming.

The other option is to use the proxmark cli commands for gen1 chips to reset it, can’t recall how of the top of my head but will check when I can.


#3

Thanks @TomHarkness!

I haven’t played with the proxmark scripting stuff yet but I’ll check it out.

Edited to add:
There’s a script in there, “formatMifare.lua” which does exactly what I want, except it doesn’t work lol.

However – it prints out the actual proxmark commands and if I enter all the commands manually, one at a time, it does work! :smile:

Testing all this on a spare Mifare tag of course, not an implant of course lol.

Edited again to add:
Figured out why the script didn’t work lol. The line that did the actual command was commented out so it was just displaying but not doing. :smile:


#4

Sweet! So that script will format a blank mifare card. Not your xM1+.

Remagic.lua has the correct Hf14a raw apdu commands to set the gen1 chip back to the original state.

Edit: testing on a blank mifare card is not really compatible to a gen1 uid changeable chip. If you don’t have any you can buy some from hacker-warehouse or rfxsecure.

2nd edit - unless DT sell them, In which case by from them!! :slight_smile:


#5

Thanks Tom. The remagic script looks like it’s meant to ‘reset’ block 1 of the Gen1 chip? It doesn’t seem to do anything to the rest of the memory? I haven’t tried it on my xM1+ but just looking at the script it seems to just write block 1 to a sort of ‘default’ state.

What I wanted was to remove the NDEF formatting from the rest of the memory. Eg. remove the NDEF directory info from blocks 2 and 3, set keys A and B from all 16 sectors back to the factory default, set the contents of sectors 2-16 to 00, which is what the formatMifare script does.

I will see about getting some Gen1 cards to experiment with just in case tho, but I’m 99% sure that the formatMifare script does what I want. I don’t think the remagic script would break anything, but it doesn’t look like it’d actually remove the NDEF formatting.

Cheers!

Edited to add: I realized my PM3Easy came with a Gen1a card, so I just tested with that. Used the Proxmark to set the UID, then used the NFC Tools Pro app to format to NDEF and write a couple records to it. Verified with iPhone that it was readable, like my xM1+ is. Then I used the formatMifare script on proxmark, and it wiped everything to ‘factory’ again, so the card is no longer NDEF formatted.

Success, this is exactly what I wanted to do with my xM1+ if I do switch to the other use case. :smile:


#6

Amazing! I definitely misunderstood but glad you managed to test it on a card. Well done :slight_smile:

Just be careful with the coupling with your implant. Really don’t want to have any write issues with those commands - if something goes wrong you can potentially brick the xm1+.