Is this Mifare Classic 1k (with Java) Cloneable?

Hi @amal, could you take a look at this for me, it looks cloneable but…

Proxmark log below and Tag info screens

[usb] pm3 --> hf search
[=] Checking for known tags…

UID : C5 9F 37 67
ATQA : 00 04
SAK : 28 [1]
TYPE : JCOP31 or JCOP41 v2.3.1
ATS : 13 78 80 72 02 80 31 80 66 B1 84 0C 01 6E 01 83 00 90 00 11 D8
- TL : length is 19 bytes
- T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 8 (FSC = 256)
- TA1 : different divisors are NOT supported, DR: [], DS: []
- TB1 : SFGI = 2 (SFGT = 16384/fc), FWI = 7 (FWT = 524288/fc)
- TC1 : NAD is NOT supported, CID is supported
[+] Prng detection: HARD

[+] Valid ISO14443-A tag found

[usb] pm3 --> hf 14a read
UID : C5 9F 37 67
ATQA : 00 04
SAK : 28 [1]
ATS : 13 78 80 72 02 80 31 80 66 B1 84 0C 01 6E 01 83 00 90 00 11 D8
[+] field dropped.

TagInfo scan: Infineon Technologies AG Unknown IC implementing ISO/IEC 14443-4 tag with Gemalto TOP C5:9F:37:67

I’m also trying to see if this one would be able to be cloned, perhaps to an xM1?

thanks a lot, unfortunately this is the only info I have been able to acquire about it. But I think assuming I can clone the uid and they aren’t doing anyhting else it should work?

@Pilgrimsmaster Nope. That is a Javacard, basically the Flex One. You can’t clone it without the source code of the applet.

@ChildApple Looks clonable to an xM1.

Thanks for the reply;
yeah, the


part of the dump was kinda the red flag :triangular_flag_on_post:

If only I had a Vivokey Flex One to compare it to :stuck_out_tongue_winking_eye:

While true you can’t clone the whole card, the question is, do you need the whole javacard part of it or just the mifare emulation part of it? I think you are seeing that just because TagInfo is asking for it and the javacard is simply choosing to send what TagInfo is asking for by emulating the mifare classic. I could see the possibility (No idea if its true) of being able to clone mifare classic data to an xM1. Could totally be off but worth a try.

Pretty sure I will need the Java card part also, but like you say worth a try…

UPDATE
Tried and followed through this Proxmark guide , the proxmark doesn’t see it as a NXP MIFARE CLASSIC 1k
unfortunately, it is seen as TYPE : JC0P31 or JC0P41 v2.3.1
Assuming the JC is Java Card

I could change the UID of my test card to match, but don’t think that will do anything.
Thanks for the info @turbo2ltr and @bepiswriter

A flex One to compare it to.

Is it a transit pass or a university ID?

Thanks for that, and yes the read info does look very much like a Flex One.

It’s actually a prepay credit card, I got it as test.
It’s a “sticker card” with no expiry, so I was hoping it could get cloned or converted into an implant

Just to clarify what others have said - the answer is yes and no. What you have there is a secure element (smart card chip) that is emulating a Mifare classic 1k. What this means is that the chip is responding to iso14443a selection and scan commands as a classic 1k but also at the same time all the AIDs (applets) on the chip are accessible via apdu commands. So, you could easily clone the Mifare Classic 1k emulated data to an xM1 for example, but chances are really really high that this emulation is not what’s being used by whatever application you use this card with. It’s probably accessing an applet on the card and ignoring the Mifare Classic 1k emulation all together.

So in this case it absolutely will do nothing for you to clone the mifare emulated card to another chip… payment applications are not tied to this functionality what so ever.

1 Like