Messerschmitt hotel card encoding for new card manufacturer

Hi to everybody. I am new to the forum and currently bought a Proxmark3 Easy with Iceman firmware. I work for a hotel that uses Messerschmitt (https://www.messerschmitt.com) access control system for the guest rooms. As cards we currently got from them directly following types: Icode Slix2 and Mifare Ultralight EV1. The drawback is that the cards supplied by them are quit expenses, and we would like to find a cheaper supplier from China that can provide us with the compatible cards. Unfortunately, no manufactoring company in China has knowledge of Messerschmitt and their encoding on the cards to replicate them. I tried to order empty Icode Slix2 and Mifare Ultralight EV1 cards to check if they work, but unfortunately the encoder is not detecting them on read/write.
That’s why I bought a Proxmark3 hoping to discover what encoding the cards have and if I am able to simply copy the encoding to new cards. But I have no previous knowledge on how to use it.

I would appreciate your help!

I’ll prefix this with, I am not familiar with Messerschmitt, but happy to help you get some answers.

Can you confirm a few things

Your PM3 is setup and working, or do you need a hand with that?
If so, which OS?

Can you share a screenshot of the software/firmware “welcome screen”
(I just want to confirm which version and there is no mismatch)

Can you share the output of one of your cards
‘hf search’

In reality, I think the easiest / most likely approach will be through the Messerschmitt software.
Trying to find a chip compatability option.

Do you have a screen shot of that software page?

That’s probably a good starter fo now, so I’ll (and others) wait for your reply

Thank you for your reply :grinning:

Yes PM3 is setup and working fine. I am using MacOS.

This is a ‘hf search’ on the Mifare Ultralight EV1 fobs we have:

And this on the Slix2 cards:

This is an older documentation of the Messerschmitt HOCAS software we are using to encode cards: UserDescription HOCASWin 10 - 8 | PDF | Double Click | Computer Keyboard

1 Like

My BEST GUESS is,
Chapter 6
Page 8


Try and figure out the 4 cards/systems it uses.

DT just released a 5 card test bundle

compatiable with a number of DT implants.

But that pack is a convenient way to test and see if they can be enrolled into your system.

also, maybe look into
11.5.4

1 Like

Yep, and share the dump file

The other way is to use TagInfo

What are the other 2.

Hopefully
Mifare Classic 1k
might be called S50

These are very cheap and it is easy to Write to

These are informations about the background software of the encoder:


How can i determine if the encoder is able to read/write a Mifare Classic 1k?

While this is a dump try on the Mifare Ultralight EV1 card:



dump.zip (822 Bytes)

And this a sniff try always on Mifare Ultralight EV1 card when reading the card through Hocas software and when enconding a room access on it:


While this is a sniff on a normal (non-Messerschmitt supplied) card trying to read it (1st screenshot) and then encode it (2nd screenshot) without success (no output from the Hocas software that is why the trace is so long because it is continuing to find a valid card to complete operation):


1 Like

There is a lot of information to go through there.
Im going to drop an @Iceman here incase he is familiar with messerschmitt.

Infact, here is an invite to @iceman’s RFID Discord.

There is even a specific RFID Hotel system category, that will probably be the best place to search before asking a question.

1 Like

Ok let me join iceman Discord and ask there :slight_smile:

1 Like

This is an interesting system…

The communication with a MIFARE Ultralight Ev1 is not what I expected.

We will need to have some more fun with it to figure out all its secrets.

2 Likes

Hi Nicola,

I assume both chips work interchangeably. I can help you with that. How to reach you?