Magic ring and Yale tag

Hello guys,

I got a magic ring to use it with my Yale Doorman L3 lock.

The lock can use legacy tags which I bought recently, these can easily be paired with the lock and here is the scan for one of them:

  • Auto:

hf search
[-] Searching for ISO14443-A tag…
[+] UID: 20 BB 26 B9
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: weak
[#] Auth error
[?] Hint: try hf mf commands
[+] Valid ISO 14443-A tag found

  • hf mf autopwn:

[usb] pm3 → hf mf autopwn
[!] no known key was supplied, key recovery might fail
[+] loaded 56 keys from hardcoded default array
[=] running strategy 1
[=] Chunk 2.0s | found 25/32 keys (56)
[=] running strategy 2
[=] Chunk 2.0s | found 25/32 keys (56)
[+] target sector 0 key type B – found valid key [ FFFFFFFFFFFF ] (used for nested / hardnested attack)
[+] target sector 1 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type B – found valid key [ FFFFFFFFFFFF ]
[+] Target block 0 key type A
[-] Nested attack failed, trying again (1/10)
[+] Found 1 key candidates
[+] Target block 0 key type A – found valid key [ 198B0B0EEA98 ]
[+] target sector 0 key type A – found valid key [ 198B0B0EEA98 ]
[+] Target block 4 key type A
[-] Nested attack failed, trying again (1/10)
[+] Target block 4 key type A
[-] Nested attack failed, trying again (2/10)
[+] Found 1 key candidates
[+] Target block 4 key type A – found valid key [ 1AB6C727CF1D ]
[+] target sector 1 key type A – found valid key [ 1AB6C727CF1D ]
[+] Target block 8 key type A
[-] Nested attack failed, trying again (1/10)
[+] Target block 8 key type A
[-] Nested attack failed, trying again (2/10)
[+] Target block 8 key type A
[-] Nested attack failed, trying again (3/10)
[+] Found 1 key candidates
[+] Target block 8 key type A – found valid key [ 62963919316F ]
[+] target sector 2 key type A – found valid key [ 62963919316F ]
[+] Found 1 key candidates
[+] Target block 12 key type A – found valid key [ 05912E0E3678 ]
[+] target sector 3 key type A – found valid key [ 05912E0E3678 ]
[+] Found 1 key candidates
[+] Target block 16 key type A – found valid key [ 0BB72606DE10 ]
[+] target sector 4 key type A – found valid key [ 0BB72606DE10 ]
[+] Target block 20 key type A
[-] Nested attack failed, trying again (1/10)
[+] Target block 20 key type A
[-] Nested attack failed, trying again (2/10)
[+] Found 1 key candidates
[+] Target block 20 key type A – found valid key [ A43041A1499F ]
[+] target sector 5 key type A – found valid key [ A43041A1499F ]
[+] Target block 24 key type A
[-] Nested attack failed, trying again (1/10)
[+] Found 1 key candidates
[+] Target block 24 key type A – found valid key [ 678B3A1A3260 ]
[+] target sector 6 key type A – found valid key [ 678B3A1A3260 ]
[+] found keys:
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | 198B0B0EEA98 | N | FFFFFFFFFFFF | D
[+] 001 | 007 | 1AB6C727CF1D | N | FFFFFFFFFFFF | D
[+] 002 | 011 | 62963919316F | N | FFFFFFFFFFFF | D
[+] 003 | 015 | 05912E0E3678 | N | FFFFFFFFFFFF | D
[+] 004 | 019 | 0BB72606DE10 | N | FFFFFFFFFFFF | D
[+] 005 | 023 | A43041A1499F | N | FFFFFFFFFFFF | D
[+] 006 | 027 | 678B3A1A3260 | N | FFFFFFFFFFFF | D
[+] 007 | 031 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 008 | 035 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 009 | 039 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 010 | 043 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 011 | 047 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 012 | 051 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 013 | 055 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 014 | 059 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 015 | 063 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] -----±----±-------------±–±-------------±—
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )
[+] Generating binary key file
[+] Found keys have been dumped to C:\ProxSpace\ProxSpace\pm3/hf-mf-20BB26B9-key-010.bin
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[=] downloading card content from emulator memory
[+] saved 1024 bytes to binary file C:\ProxSpace\ProxSpace\pm3/hf-mf-20BB26B9-dump-011.bin
[+] saved to json file C:\ProxSpace\ProxSpace\pm3/hf-mf-20BB26B9-dump-011.json
[=] autopwn execution time: 17 seconds

I tried the following:

A. Using MCT android app from this video and it failed, the ring UID still different and it did not work

B. Run hf mf cload -f it also failed

C. Run hf mf csetuid -u -a -s it also failed

After these my ring scan looks like:

  • hf search:

[usb] pm3 → hf search
[/] Searching for ISO14443-A tag…
[+] UID: 9A 6B 28 1A
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Magic capabilities : Gen 4 GDM
[+] Prng detection: weak
[#] Auth error
[?] Hint: try hf mf commands
[+] Valid ISO 14443-A tag found

  • hf mf autopwn:

[usb] pm3 → hf mf autopwn
[!] no known key was supplied, key recovery might fail
[+] loaded 56 keys from hardcoded default array
[=] running strategy 1
[=] .
[=] Chunk 2.3s | found 25/32 keys (56)
[=] running strategy 2
[=] .
[=] Chunk 2.3s | found 25/32 keys (56)
[+] target sector 0 key type B – found valid key [ FFFFFFFFFFFF ] (used for nested / hardnested attack)
[+] target sector 1 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 2 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 3 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 4 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 5 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 6 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 7 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 8 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 9 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 10 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 11 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 12 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 13 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 14 key type B – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type A – found valid key [ FFFFFFFFFFFF ]
[+] target sector 15 key type B – found valid key [ FFFFFFFFFFFF ]
[+] Found 1 key candidates
[+] Target block 0 key type A – found valid key [ 198B0B0EEA98 ]
[+] target sector 0 key type A – found valid key [ 198B0B0EEA98 ]
[+] Found 1 key candidates
[+] Target block 4 key type A – found valid key [ 1AB6C727CF1D ]
[+] target sector 1 key type A – found valid key [ 1AB6C727CF1D ]
[+] Found 1 key candidates
[+] Target block 8 key type A – found valid key [ 62963919316F ]
[+] target sector 2 key type A – found valid key [ 62963919316F ]
[+] Found 1 key candidates
[+] Target block 12 key type A – found valid key [ 05912E0E3678 ]
[+] target sector 3 key type A – found valid key [ 05912E0E3678 ]
[+] Found 2 key candidates
0/2 keys | 12.7 keys/sec | worst case 0.2 seconds remaining
[+] Target block 16 key type A
[-] Nested attack failed, trying again (1/10)
[+] Found 1 key candidates
[+] Target block 16 key type A – found valid key [ 0BB72606DE10 ]
[+] target sector 4 key type A – found valid key [ 0BB72606DE10 ]
[+] Found 1 key candidates
[+] Target block 20 key type A – found valid key [ A43041A1499F ]
[+] target sector 5 key type A – found valid key [ A43041A1499F ]
[+] Found 1 key candidates
[+] Target block 24 key type A – found valid key [ 678B3A1A3260 ]
[+] target sector 6 key type A – found valid key [ 678B3A1A3260 ]
[+] found keys:
[+] -----±----±-------------±–±-------------±—
[+] Sec | Blk | key A |res| key B |res
[+] -----±----±-------------±–±-------------±—
[+] 000 | 003 | 198B0B0EEA98 | N | FFFFFFFFFFFF | D
[+] 001 | 007 | 1AB6C727CF1D | N | FFFFFFFFFFFF | D
[+] 002 | 011 | 62963919316F | N | FFFFFFFFFFFF | D
[+] 003 | 015 | 05912E0E3678 | N | FFFFFFFFFFFF | D
[+] 004 | 019 | 0BB72606DE10 | N | FFFFFFFFFFFF | D
[+] 005 | 023 | A43041A1499F | N | FFFFFFFFFFFF | D
[+] 006 | 027 | 678B3A1A3260 | N | FFFFFFFFFFFF | D
[+] 007 | 031 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 008 | 035 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 009 | 039 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 010 | 043 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 011 | 047 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 012 | 051 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 013 | 055 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 014 | 059 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] 015 | 063 | FFFFFFFFFFFF | D | FFFFFFFFFFFF | D
[+] -----±----±-------------±–±-------------±—
[=] ( D:Dictionary / S:darkSide / U:User / R:Reused / N:Nested / H:Hardnested / C:statiCnested / A:keyA )
[+] Generating binary key file
[+] Found keys have been dumped to C:\ProxSpace\ProxSpace\pm3/hf-mf-9A6B281A-key-003.bin
[=] --[ FFFFFFFFFFFF ]-- has been inserted for unknown keys where res is 0
[=] transferring keys to simulator memory ( ok )
[=] dumping card content to emulator memory (Cmd Error: 04 can occur)
[=] downloading card content from emulator memory
[+] saved 1024 bytes to binary file C:\ProxSpace\ProxSpace\pm3/hf-mf-9A6B281A-dump-004.bin
[+] saved to json file C:\ProxSpace\ProxSpace\pm3/hf-mf-9A6B281A-dump-004.json
[=] autopwn execution time: 14 seconds

I would appreciate any help:

1- Is the ring compatible with this tag from first place? when I bring it closer to lock it don’t react at all!

2- Am I doing it wrong? if yes what is right way? please be detailed since I am new to these and very noob

Thank you very much!!!

Did you get the Magic Ring from DT?

It looks like it should work, they’re both mifare classic 1k

Both of these we would expect to fail on the DT magic ring, these commands are for Gen1A chips, and the magic ring is a Gen2 magic chip.

MCT is the usual way to program the Gen2 chips, but if that’s not working I believe we can attempt it with the PM3.

If you’re willing, would you post a dump (hf mf eview after autopwn) of the ring?

1 Like

Thank you for the useful info!! here is the results:
[usb] pm3 → hf mf eview
[=] downloading emulator memory

[=] -----±----±------------------------------------------------±----------------
[=] sec | blk | data | ascii
[=] -----±----±------------------------------------------------±----------------
[=] 0 | 0 | 9A 6B 28 1A C3 08 04 00 62 63 64 65 66 67 68 69 | .k(…bcdefghi
[=] | 1 | A8 F9 9C 14 83 77 99 A3 7B B7 F8 2B F2 AD 6D DC | …w…{…+…m.
[=] | 2 | 02 02 07 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 3 | 19 8B 0B 0E EA 98 FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 1 | 4 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 6 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 7 | 1A B6 C7 27 CF 1D FF 07 80 69 FF FF FF FF FF FF | …'…i…
[=] 2 | 8 | 42 60 CA 3E DD 00 00 00 00 00 00 00 00 00 00 00 | B.>............ [=] | 9 | 60 23 0D 17 60 00 00 00 00 00 00 00 00 00 00 00 | #…........... [=] | 10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 11 | 62 96 39 19 31 6F FF 07 80 69 FF FF FF FF FF FF | b.9.1o...i...... [=] 3 | 12 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 13 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 14 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 15 | 05 91 2E 0E 36 78 FF 07 80 69 FF FF FF FF FF FF | ....6x...i...... [=] 4 | 16 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 19 | 0B B7 26 06 DE 10 FF 07 80 69 FF FF FF FF FF FF | ..&......i...... [=] 5 | 20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 21 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 22 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 23 | A4 30 41 A1 49 9F FF 07 80 69 FF FF FF FF FF FF | .0A.I....i...... [=] 6 | 24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ [=] | 27 | 67 8B 3A 1A 32 60 FF 07 80 69 FF FF FF FF FF FF | g.:.2…i…
[=] 7 | 28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 31 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 8 | 32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 35 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 9 | 36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 39 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 10 | 40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 42 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 43 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 11 | 44 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 45 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 46 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 47 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 12 | 48 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 49 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 51 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 13 | 52 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 53 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 54 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 55 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 14 | 56 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 57 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 58 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 59 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] 15 | 60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 61 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 62 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | …
[=] | 63 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | …i…
[=] -----±----±------------------------------------------------±----------------
[?] cyan = value block with decoded value

1 Like

Give these a try on the PM3:

hf mf wrbl --blk 0 -d ffffffff000804006263646566676869 --force
to try to change the UID manually, and then
hf search
to check that the UID really did change to FFFFFFFF

You can use
hf mf wrbl --blk 0 -d 9A6B281AC30804006263646566676869 --force
to return the ring to its previous setup

1 Like

I tried and here how it went:

[usb] pm3 → hf mf wrbl --blk 0 -d ffffffff000804006263646566676869 --force
[=] Writing block no 0, key A - FFFFFFFFFFFF
[=] data: FF FF FF FF 00 08 04 00 62 63 64 65 66 67 68 69
[#] Auth error
[-] Write ( fail )
[?] Maybe access rights? Try specify keytype hf mf wrbl -b ... instead

:frowning:

One more thing to try before I’m out of ideas:

The magic ring really shouldn’t be a Gen4, but just in case the PM3 is right, give this one a try:

hf mf gdmsetblk --blk 0 -d ffffffff000804006263646566676869

1 Like

Thank you for your time and help!

It didn’t work again:

[usb] pm3 → hf mf gdmsetblk --blk 0 -d ffffffff000804006263646566676869
[=] Writing block no 0, key 000000000000
[=] data: FF FF FF FF 00 08 04 00 62 63 64 65 66 67 68 69
[-] Write ( fail )

What do you think I should do?

Ah, poop

Just to confirm, this is a magic ring from DT?

At this point to me it sounds like it’s busted, and I’d try waiting just a little longer for some advice from other forum members who might have other ideas, and if that fails reaching out to DT customer support from the main site

Yeah I got it from DT with the ProxMark3.

Thank you for the help!!! really appreciate it

2 Likes

:emoji_surprised:
Your language is appaling :wink:

Try MCT again, but maybe do the UID first separately from the dump.

MCT
TOOLS - Clone UID

  1. Then scan your original Fob to get your (N)UID
  2. then Scan your ring to write
  3. then scan again to check it wrote correctly.
  4. Then write your data dump
1 Like

Oh, Also after you do the (N)UID and Dump

use the compare tool, also in MCT

Share the results here if there is a difference.


If it works for you, consider getting the Paid version of MCT, its only a few bucks.

No difference in the App, except you get to support the developer with an open source project AND you get a Yellow logo

1 Like

Thank you! It did not work

I tried the paid version:

I scanned the tag UID and tried to clone it to the ring:

Scanned the ring and still got the same UID:

Tried from the dump again:

Still nothing changed:

Did dump comparison:

:disappointed::disappointed::frowning:

so the only difference is the (N)UID!?

That doesnt sound too bad.

But I’m not sure why you cant change it.

The Magic Ring has a gen2 chip, and MCT can write to gen2
:thinking:

do you habe a gen2 card/fob?
Can you get one and try it with that?

1 Like

Ok this is insane, I found this card in my proxmark3

[usb] pm3 → hf search
[-] Searching for ISO14443-A tag…
[+] UID: 69 CC CD 30
[+] ATQA: 00 04
[+] SAK: 08 [2]
[+] Possible types:
[+] MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[+] Prng detection: weak
[#] Auth error
[?] Hint: try hf mf commands

I tried the MCT app and same everything happened, tried to clone UID still got the same error

Then I went back to ProxMark3 and did:

[usb] pm3 → hf mf cload -f hf-mf-20BB26B9-dump-009.bin
[+] loaded 1024 bytes from binary file hf-mf-20BB26B9-dump-009.bin
[=] Copying to magic gen1a card
[=] .[#] wupC1 error
[!] Can’t set magic card block: 0

[usb] pm3 → hf mf csetuid -u 20BB26B9
[#] wupC1 error
[=] couldn’t get old data. Will write over the last bytes of block 0
[+] new block 0… 20BB26B9040000000000000000000000
[#] wupC1 error
[!!] Can’t set UID. error -1

To make things more weird I tried to generate random UID in MCT and still go the same error :open_mouth:

I ran a test on a second card (not touched yet) and I could clone random UID, it looks like once you use the export of the tag you can’t write the UID again!!

What do you think?

I’m pretty sure that’s a gen1a card, and MCT can’t write to it

Where did THIS card come from? is it gen2?
Can you copy your access card UID to it?

1 Like

It came with my RC522 sensor, it just says CUID but the Proxmark could find it.

I have 2 cards of it. (still un-touched)

card 1: I used MCT app with the imported tag.bin and key.bin then after that I couldn’t clone UID (same error show)

card 2: I didn’t import anything I just went to MCT and cloned tag’s UID and it worked!

It looks like once you use the tag’s imported files you can’t write anymore!!! is this possible? what do you think?

Can you download this

20BB26B9.mct.pdf (2.2 KB)

delete the .pdf on the end (needed to add it to share on the forum.)

Write that to one of your cards you are having trouble with

Can you also share your dump file of your acces card?
Youll need to add the .pdf to the end also.

Can you confirm the UID you want is 20BB26B9

I will create a dump for you, which SHOULD work.

1 Like

Thank you!

It did not work! but I think I found the right diagnoses (it’s super weird).

“The ring and the other cards I used” don’t write any new UID even if I use random UIDs in MCT, I get the same error we got before.

However I tried a new lock tag (untouched “30F9E446”) and a new MF card (untouched).

I paired the lock tag as I did with the old one then I did the same autopwn and sent the dump to MCT.

But this time I did not clone the dump immediatly! I first did UID clone then I did write the dump and now this card work!!!

So it looks like if you do the write clone you can’t chage the UID anymore!!!

The questions:

  1. Why once I do the clone I can’t change the UIDs anymore?
  2. How can I now transfer this to my ring?

Thank you for the help and I uploaded the dump of the working card that was cloned from the tag (the one I wish to move to the ring)

hf-mf-30F9E446-dump.bin.pdf (1 KB)
hf-mf-30F9E446-dump.json.pdf (11.3 KB)
hf-mf-30F9E446-key.bin.pdf (192 Bytes)

1 Like

Sorry to disturb but forgot to reply to you in my previous comment!

Any ideas?

Hahaha, This is what I was trying to get you to do.

Write UID then Write dump

The successful files above were they done with PM3 or MCT?

Give me a sec to put something together for you

1 Like