Mifare classic card timer help

I have 2 temp cards for my unit - One that was available for 2 days and 1 that was available for 7 days, both worked on the same door, but stop when the timer runs out. I want to make a card that indefinitely works, so I compared the data and keys on both cards to find the timer. Nothing has a 2 to 7 ratio or 2 minus 7 number, or a date that I can decipher in Hex or Dec.

Anyone have insight on where the timer is? This is for an Assa Abloy Essence lock
Any help would be appreciated.

The different lines are line 0, 7, 24, 25 & 27 (All other lines are the same)

Line 0 UID (1st line is 2 day card)
Line 7 Key
Line 24 Data
Line 25 Data
Line 27 Key

My next step is to change this data to the default values to see if the timer goes away, but I’m sure someone here has a better suggestion. Thanks

My first thoughts were it is likely managed at the lock end?

are these locks networked or standalone?

Yes, I should have shared, they are not networked and are battery operated.

don’t beat yourself up, it’s not an obvious thing to mention.

does it look like this?

I know that for my lock at home (also battery powered) I can buy an add on WiFi hub, with which I could add additional locks, and control access to all connected locks; this might be how your ones are “networked”

I’m not saying they are, just a possibility, and to me the more logical way to manage access rather than on the card itself :man_shrugging:

You might need to do some sleuthing :mag_right:

Yes, that is my system, but I am 99.9% sure they are not networked.
Mgmt needs to come to the unit to program it when the key fob is lost and needs to be changed (I assume the other line item keys that match between cards). Mgmt told us they are not networked as it required extensive infrastructure and cost, the common wifi does not reach to all units to be networked and they are not wired. Thanks for the interest and help.

Good Sleuthing


That is super inefficient…

That confirms it then.

So back to your original question…

Can you try using MCT!?

Scan both of your 2 day and 7 day tags
and use “Diff Tool” (Compare dumps)

and share the results.

I’m hoping it will see something you didn’t


Thats a good idea. I had to hand back in the 2 day card to get the 7 day one. I will try to keep the 7 day one and get another card (Not 7 days) soon and post the results in a few days. Tks again.

1 Like

OK well, I made copies of the cards and compared them. It did not find lines 7, 24, 25 & 27, they were all zeros, so they came up identical. The only differences it found were in the UID.

And this


Hmm, Interesting. I discounted that as its part of the cards manufacturers data, but if the lock is using that and its programmable, then that could be it. I will look at other cards I have copied and see what they are, modify it and get back to you. Thank you


You could be right, but off the top of my head, thats the 80400, but I would need to look at the data sheet to confirm


My hunch is that byte is part of a calculated check. Look through the spec to find out for sure though… I’m mobile so I’m leaving it up to you :slight_smile:

S50.pdf (140.3 KB)