Modding a Door Lock

I guess it comes down to what you have access to/ what you are familiar with/ what you prefer.
Some more info on the Mifare implants :arrow_down_small:

gen1a vs gen2

Basically, gen1a chips are “safer” because you can always recover mistakes, but require special hardware or software to change sector 0 (where the serial number lives) or recover from locked sectors. With gen2 chips, you can easily use an NFC smartphone to write to sector 0 using an app, but if you accidentally lock a sector you cannot recover it (just like a real Mifare “classic” 1k chip). For more info about this exact difference, check out this post .

gen1a
The gen1a magic Mifare chip requires a special back door command that opens up all sectors to writing, including sector 0. The advantage of this is that even if you have lost the crypto1 keys for a particular sector that is marked as protected by the access bits for that sector, you can still overwrite it after issuing the back door command. The down side is, the back door command is issued to the chip after it supposedly enters the halt state, which means only certain devices can issue the back door command. Smartphones generally cannot do this because the chips and firmware in the phone do not allow further communications after the halt state has been entered. Furthermore, certain readers, especially in Asia, look for magic chips by issuing the back door command and if the chip answers, it shuts down to avoid allowing a possibly cloned chip to access whatever door or service the reader is attached to.

gen2
The gen2 magic Mifare chip has no back door command. All sectors are simply open for writing. The advantage of the gen2 magic chip is that even NFC capable smartphones can simply issue write commands for any sector, including sector 0. This means a smartphone app could be used change the ID of the chip along with all the data in the manufacturing block. In addition to this, readers looking for magic chips ultimately have no good way to really tell if the chip is a magic chip or not. The down side is that the real Mifare S50 1k chip’s operation is emulated completely and accurately. There is no back door, so if one or more sectors on the chip become protected by access bit changes, you need valid keys in order to make further changes. In addition to this, if you set access bits such that the sector becomes locked, there is no way to recover that sector… it will be locked forever.

Here is the Thread link if you need more info

3 Likes