New Ring with Mifare Magic not working

I just purchased a new dual frequency ring with the mifare magic and I am trying to clone my hotel card and for some reason when I do a “hf mf cload” I get an error “.[#] wupC1 error”. I never got that with my other mifare magic cards. Also when I do a “hf search” I also noticed an “[#] Auth error”. I don’t know what is up with that.

[usb] pm3 --> hf search
 🕗  Searching for ISO14443-A tag...
[+]  UID: 01 48 4A C0
[+] ATQA: 00 04
[+]  SAK: 08 [2]
[+] Possible types:
[+]    MIFARE Classic 1K
[=] proprietary non iso14443-4 card found, RATS not supported
[#] Auth error
[?] Hint: try `hf mf` commands


[+] Valid ISO 14443-A tag found

[usb] pm3 --> hf mf cload -f hf-mf-1CD827C6-dump-1.eml
[+] loaded 1024 bytes from text file hf-mf-1CD827C6-dump-1.eml
[=] Copying to magic gen1a card
[=] .[#] wupC1 error
[!] ⚠️  Can't set magic card block: 0
[usb] pm3 -->

The following prompts or from the ring.

I’m pretty sure the rings are gen2, magic back door doesn’t need to be used to write to them

Indeed they are!

These should help

Clone with Proxmark

Clone with Phone

Clone Bone

clone-bone

1 Like

See this is what’s confusing. I saw the “clone with proxmark” video already unfortunately it doesn’t show you how to clone to a gen2 with proxmark. It uses the phone app in that video.

I have the same symptoms with the mifare part of the ring.
And when I try to recreate the steps shown, it reports “Write failed, this could be bad”.

I also tried dumping sector 0 and rewriting it (using a proxmark3) and that fails too.

[usb|script] pm3 --> hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 1122334408d400046362656467666968
[=] Writing block no 0, key A - FFFFFFFFFFFF
[=] data: 11 22 33 44 08 D4 00 04 63 62 65 64 67 66 69 68 
[#] Auth error
[-] ⛔ Write ( fail )
[?] Maybe access rights? Try specify keytype `hf mf wrbl -b ...` instead

So the issue is not in the tools in the video.

Update: I found the key of block 0 to be a0a1a2a3a4a5, now reading block 0 works. but writing still fails, but now with a cmd error 4.

usb|script] pm3 --> hf mf wrbl --blk 0 -k a0a1a2a3a4a5 -d 11223344D40804006263646566676869
[=] Writing block no 0, key A - A0A1A2A3A4A5
[=] data: 11 22 33 44 D4 08 04 00 62 63 64 65 66 67 68 69 
[#] Cmd Error: 04
[#] Write block error
[-] ⛔ Write ( fail )
[?] Maybe access rights? Try specify keytype `hf mf wrbl -b ...` instead

Success!

You have to use the second key ‘b’ to write. So the command is

pm3 --> hf mf wrbl --blk 0 -b -k ffffffffffff -d 11223344440804006263646566676869

Note that the BCC0 code is not automatically calculated and might cause a mismatch. If you put the reader in the ignore mode, it will tell you what code it expects and you can put it in the 5th byte. Then perform a rewrite of block 0.

11223344440804006263646566676869
^^^^^^^^   ID
        ^^ BCC0
1 Like