Hi, I’d like to ask for help. I have an implant with 7 byte UID, which is present in the Access Control database. Now, I’m trying to figure out how to make more ways of authenticating, since the implant is not always a rock solid solution, especially when the readers suck. The important thing to mention is that the HF readers in our scenario only authenticate based on the UID of the chip.
Figured out I still have those MF Classic 1K (CUID) cards you get with the PM3E order, which should do the job. So I tried changing the UID on both of these cards via PM3E, and I always end up with this error:
[usb] pm3 → hf mf csetuid -u SAMPLENUMBER
[#] wupC1 error
[=] couldn’t get old data. Will write over the last bytes of block 0
[+] new block 0… SAMPLENUMBERD20000000000000000
[#] wupC1 error
[!!] Can’t set UID. error -1
So I tried to do this instead, hoping it would help. No luck either.
Hmm so this is a strange thing with china and magic chips… CUID is meaningless as to whether it means gen1a or gen2… those terms aren’t even anything manufacturera are typically aware of… they are terms I believe were developed by the proxmark community actually.
So, this may be a gen2 card. You will have to use the standard block write commands to know for sure, or the MCT app for Android, to see if you can change the UID
Sure, I thought so as well, but if you choose to change the UID in ProxSpace hf mf menu, it offers you to change it to something from 4-7 bytes. Can’t send a screen right now though, I’m not home at the moment.
And the MCT Clone UID menu also offering the option to change from range of 4-10 bytes made me believe it is probably possible.
There are 7-byte UID-changeable cards, but they’re not nearly as common. This is why software would support it. It’s sadly not something that can be changed by software, it’s baked into the chip itself.
These are some of my observations from whats been posted so far:
Card type: MFC
Magic Capabilities: None or Gen2
UID size: 4B (C4556F4E)
PRNG: weak
Since it has been confirmed that its not a gen1a, it’ll be useful to know what the keys are on sector 0 (where the UID is stored). On a blank card we can normally assume that the keys are default (FFFs) but to confirm this with a proxmark using the command hf mf chk --1k which should give you a table of found keys per sector.
Observed is that all sectors, keys A and B are using Fs which is the default.
Once you have keys you can attempt to write to block 0 which will determine if it is magic or not. The command to do this on a proxmark would be hf mf wrbl --blk 1 -f <key> -d <data>. If it writes successfully then it is a gen2, else its not magic.
If you dont want the more manual approach, gen1a tags are much easier to use and forgiving. Gen1a will allow you to use the hf mf c* subset of commands which take advantage of the backdoor commands unique to gen1a cards.
Gen1a cards are available from a variety of retailers, some more reliable than others. The general things to look out for are that S0 B0 is re-writable, look at reviews for unhappy people mentioning that it doesnt work with MCT and that ‘special’ is needed to write to block 0.
Looks like its using default keys which makes things easier.
From your output of hf search this card has a 4 byte UID. Why are you looking for a card with a re-writable 7 byte UID?
It would be worthwhile putting your source card (the one you want to copy) on the proxmark and sharing the ouput of hf 14a info. Feel free to blur the UID but ensure that it doesnt make it difficult to interpret how long it is.
Thanks for that info, makes more sense now, my bad for missing it originally.
Since it is UID only auth you can really use anything that is 7B UID changeable. The one thing I would question is if it checks ATQA and SAK and UID which would be a limiting factor.
This is most likely the more reliable retailer for 7B Gen1a MFC. Of course, you’ll be able to find some available elsewhere but it may be more trial and error with less descriptive product details. From my experience, you are more likely to find a 7B Gen1a with 4k memory rather than 1k (not that it matters in your use case).
If the implant you’re using for access control is your NExT, then a magic ntag might suit you better than a mifare classic. You can get them from the same place Jirvin linked to.
Thanks!
I’m not trying to improve the security standards of the mentioned facility.
