MagicRing v2 anti-clone issue

Hi There

I purchased a Magic Ring v1 a few weeks back which I was able to successfully clone my apartment’s mifare 1k card onto. It works on the elevators and the door lock without issue.

I hadn’t noticed the v2 Ring so when my partner also wanted one, I decided to buy a matching pair of V2s which I was hoping would improve the reading position for the door lock (the elevators are fine without making sure I have the ring aligned)

The issue I’ve run into is that I can clone my card onto the ring no problem. It works on the elevator readers no problem, but as soon as I try the door lock, it gives me a deny and the lock corrupts the ring so it no longer works anywhere. From what I can tell, this might be anti-clone tech.

At the time of purchase I didn’t notice that the newer V2 Ring uses the older gen1a magic chip. The much lower cost and older V1 ring uses the later gen2 which doesn’t trigger the anti-clone.

Does anyone know a way that I can write the card config to the ring and then lock it so it no longer responds to the backdoor instructions to prevent the lock from corrupting it?

Thanks
Woz

1 Like

As far as I know there is no way to lock-out the gen1a chips from the backdoor command, but hopefully someone else will have an idea to share with you soon

In the meantime, would you mind sharing what type of lock it is? You’re the first person I’ve come across that has actually run into magic chip detection in person, and I’d be fascinated to look into the lock

2 Likes

It’s a KAS smart lock. Possibly a Neo. Installed as part of the building infrastructure.

A genuine card displays a green “7” on the keypad when accepted. The cloned one displays a red “8” after which the clone no longer works on any readers. Running hf mf info returns a corrupt data response

1 Like

an anti-magic gen1a defense is overwriting the block 0 to nonsense values, if the bcc of the card is not correct nothing will be able to communicate with it.

…besides a proxmark running commands with a BCC ignore enforcing commands regardless of incorrect comms.

@Woz
hf 14a config —bcc ignore (that’s two - -s if the formatting gets messed up
hf mf cwipe

this should bring your rings back to life but there is nothing that can be done for the magic detection. unfortunately magic card tech is an arms race against detection capabilities. the way to circumvent gen1a detection is to use a gen2, so on and so fourth.

3 Likes

i’ve ran into lots of magic detection, Vigik, ICT, Onity, NSP & i categorised a new type of magic & emulator detection that isn’t version specific, just any card/emulator that mirrors its wup SAK from block 0 content. retailers are having chips manufactured with a modified block 0 sak of 88 and the sak on wake up of 08.

2 Likes