Magic Ring V2 cloning instructions

Could someone point me to instructions on cloning an HID Prox ID to the Magic ring v2. I have a Proxmark3 and its configured correctly. I can read my key fob. But when I write using the lf hid clone -r command when it’s done I do lf search and its not the same id. I cant find clear instructions to do this with this ring. Can only find videos using the implant. Any help would be great.

Have you tried using the --FC and --CN options instead of using the raw?

1 Like

I believe I have but can try again. I think the problem is the ring itself. I can do an lf search and it will show up then do another search and it will say no known 125/134 khz tags found! It takes multiple times searching to show up again. So I wonder if its possible that when I write to the ring its not there anymore.

Try moving the tag around on the PM3 until you’re getting consistent reads, also make sure the PM3 isn’t placed over a conductive surface

2 Likes

make sure you’re doing lf t55 detect on the ring before any write operations to confirm you have good coupling with it.

-r raw should be working but if for whatever reason it isn’t, give Aox’s advice about manually inputting the FC and CN a go as that should also be working.

you may need to lf t55 wipe the ring to get it back to a state of consistent reads beforehand

3 Likes

Here’s a video link to the Magic Ring V1, but the principle is the same for the V2.

Go to the ~4min mark for LF ring writing demo and will give you the placment orientation i.e. Vertical with the single dot over the antenna
( FYI The V2 doesn’t have the 2 dots, but for the V1 and V2, The LF antenna / chip is under the single dot)

The PM3 commands as the guys above said

2 Likes

I can’t get this ring v2 to consistently show up on lf search. It will read no problem on hf. When it shows up I try to make the clone to no avail. Here’s what I have.
First I do an lf search on the fob. Then I do lf search on the ring until it shows up. Then I do “lf hid copy -r 20071af26e” I’ve also tried with the lf hid clone -w H10301 --fc 141 --cn 31031 still nothing. This is my first time doing this so I could definitely be doing something wrong.

can you post the result from “lf search” on the ring?

I was going to but cant figure out how to add pictures. lol

as i said above, make sure you’re doing lf t55 detect on the ring before doing write operations.

the t5577 is the underlying chip and having confirmed good communication with the bidirectional chip will make writing much easier. lf t55 detect requires the chip to acknowledge the command and respond. lf search just activates a field and listens for any potential response, get tighter coupling.

I did what you said and it comes back with
could not detect modulation automatically. Try setting it manually with lf t55xx config

then you need to change the placement of the ring on the proxmark.

if you have a pm3 easy with the big red circular antenna don’t put the ring smack bang in the middle, have it stood on its edge, lf chip facing down resting on top of the red coil so it can communicate

keep using lf t55 detect until you get a result. if you do not get a result you won’t make a successful write because it means the chip isn’t hearing the proxmark.

if you want to upload pics of how you’re placing it & the output of lf search
IMG_2431
this is the button to do so.

what does your lf search output look like? if it’s coming up as indala it’s not a good read, indala is often attributed to arbitrary signal noise not genuine chip info.

1 Like

Like I said. It reads the HF no problem every time. It takes me 10 times for it to work on LF. I move it to find the best location but it doesn’t matter.

Its the V2 ring so there’s no marks showing the chip. I’ve tried every spot in that red circle. The most i get it to read is 2x in a row.



1 Like

is the top one your original card yeah?

those indalas are definitely signal noise.

ok let’s do this another way, do lf tune --mix this will give you a live readout of antenna voltage with a handy visual aide. rotate the ring around and change where it is on the LF antenna until you find the spot where the voltage is at its lowest, once it’s at its lowest keep it there, press enter to finish the tune and do the lf t55 detect

4 Likes

the lowest I could get was 34v out of 39. Then did lf tune --mix

1 Like

ok… one last thing to try.

lf em 410x reader -@

this will put the proxmark in a state of constant search for em410x chip IDs, your ring should have come preprogrammed as this chipset. do the same of rolling the ring around and trying different placements to see if you can get anything. hopefully a consistent output of the Same ID, if you do get that, you’ll know the perfect spot to hold your ring in to get it to write.

if that does not work honestly at this point i would suggest you may be very unlucky to have received a dud LF chip. without something like the flipper that continuously tries until it couples & succeeds (or fails) to say for certain, all of the possible measures we can do with the proxmark to look for this chip have been exhausted. it should certainly not be this hard to at least find the chip let alone write to it.

if you get no feedback from the reader command i would suggest reaching out to the team using the orange help button on the homepage of the store website, describe the situation & link this forum thread and they should get back to you

2 Likes

Thank you for all your help. I greatly appreciate it. Definitely shouldn’t be this hard. But that’s technology for ya. Thanks again.

2 Likes

Let’s try confirming the version of your client and firmware. Can you post a screenshot of the very first screen that shows when you start pm3?

Also can you post a photo of how you are placing the ring on the proxmark3?

2 Likes