Possibilities with the Magic Ring

Hmmm…still not super clear.

Photos of a reader or readers if there are different types might be more useful.

I have ordered a proxmark3 from the uk retailer and will get back to you in a few days! Thanks everyone :slight_smile:

2 Likes

Be prepared and warned, the proxmark can be fickle to get started

I would have been lost if not for some of the proxmark gurus on here,

Works decently well when the setup, and implants take a fair about is trial and error to find the exact right spot on the proxmark,

This isn’t a discouragement, just don’t expect to be running in 5 minutes

Correct, we have the three versions available currently.

Proxmark Easy (same as DT) https://cyborg.ksecsolutions.com/product/proxmark3-easy-iceman-rrg/

Proxmark RDv4: Proxmark 3 RDv4 Kit - Access Control, Gadgets & Tools, ProxGrind, Proxmark & Addons, Redteam Tools, RFID Access Cards, RFID Cloners & Emulators, RFID NFC Tools - KSEC Solutions

Proxmark RDv4 complete kit: https://cyborg.ksecsolutions.com/product/proxmark-3-rdv4-complete-kit/

You can browse all of the Proxmark products and addons here
https://cyborg.ksecsolutions.com/product-category/rfid-tools/proxmark-kit-addons/

1 Like

Thanks for replying Kai. It has just arrived!

I have tried using the ‘auto’ command in pm3 and it said both tags are “MIFARE Classic 1K” under possible types. Does this mean I would only be able to assign one at a time to the magic ring?

1 Like

Yes, however, if you can enroll your ring into your entrance system for example, then you could change the NUID of your Ring to your Uni card NUID number so it will work on that, then you enroll your Ring into your entrance system and Viola you have “One ring to rule them all…Well, to rule Both at least”.

  • You may need to do a full dump rather than just NUID changing, but the principle is the same

Hmm I don’t think I can do that for either, both the keycard and uni card are assigned to us when we join :(. I think I will still get the ring just for the entrance system :).

I am unsure how to use the proxmark to clone the room key to the test 1k magic gen1a card as a test though. I watched the proxmark setting up tutorials but I am a bit lost with the commands to create a dump file and then clone to the new card. If you have any links / advice it would be greatly appreciated.

Thanks!

I used the hf search command to find the card and then used hf mf csetuid -u XXXXXXXX -a XXXX -s XX. And now when i do an hf search on both cards they produce the same output apart from a ‘tag signature’ on my keycard. The test card doesn’t open the door either.

It seems strange the would use the same tech and issue you 2 cards for it. Any access control should be handled in the access system…anyway

This should help

Maybe I misunderstood what you were trying to say… sorry! I thought you meant if I change the UID of my uni card / keyring to the other so they are identical and then assign it to my door?

Also thanks!

If you have the ability to add a card to one of the systems you can clone one card onto the ring, and then enroll that ring into the other system.

Assuming that your door card and student card are both issued by your university then it seems odd that they issue two cards rather than just one student card and then add that into the access system with the access that you need.

If you can’t enroll a card in either system the you will need two replacements, either two rings or two implants or an implant and a ring…

If you copy the UID just the uid then you might be missing some other data that is needed for your access system. That would be why you use the dump and clone commands.

1 Like

Yeah they are seperatley issued. The accomodation company is technically seperate just to make it extra awkward :slight_smile:. I managed to get it working with the help from those videos. I used the autopwn and cload commands and they worked a treat.

I only ordered one ring for now and will probably stay like that for a while because of the hefty shipping cost (rip living in the uk :/). But I’m excited to get it setup. If everything goes smoothly ill give a final report in just over a week probably.

Thanks for everyone.

Currently we don’t stock them but we can order them in for customers. E.G pre order for when we get next our stock from DT. Means no shipping cost and a set price but only possible once every 1-3 months. Not always the most suited but might be helpful for future stuff :slight_smile:

2 Likes

Oh cool… Unfortunately I already ordered it :cry: but if I get any more / implants I’ll come to you!

1 Like

Don’t forget to sign up here and become a KSEC Cyborg member. You’ll get 10% off Dangerous Things products KSEC Cyborg Membership - KSEC Solutions

Hi all,

I’ve been testing with a gen1a mifare card whilst im in the process of getting the ring, and have a few queries about how the gen2 chip in the ring works. I have seen it is easy to lock yourself from sectors on the chip in the useful info from Amal. However I do not understand how I can prevent such a thing from happening whilst cloning a card.

In the videos I have watched only the UID is cloned in sector 0. However my room keycard seems to have other sections full of data which are used to unlock the kitchen and shared spaces. (as I couldnt access these, only my room door with the sector 0 clone). The question now is, how do I do a complete clone of the tag without locking myself from any sectors. For the gen1a card I use autopwn and cload, but cload is not avaliable for gen2 so I assume I have to wrbl --blk <num> -d data. I am unsure whether the keys and access conditions that are stored in the trailing sector (I think its called this?) get copied over with the data stored in my keycard sector.

Say for example I had a keycard with the following:
sector 0:
6F19ECA9E1880400C833002000000017
sector 1:
8D303448000000000000000000000000
sector 3:
A0B1A2A3A4A5787788C1B0B1B2B3B4B5

How would I copy these to my card whilst ensuring I dont make the chip read only.

Thanks so much for the help in advance!

(Also not sure if I should have made a new topic for this or not… I can copy it into a new one if this is a problem.)

Missed this. Check the magic ring product page and scroll down to the proxmark3 section to see how to clone cards with the proxmark and MCT app for Android. In short you basically use the data generated by autopwn, import that data file with MCT and write it.

Hey !
Where I can get the software out oft this video:

Cloning a Mifare S50 1k to the xM1

All links are broken.
Can you help me please?

Thanks!

klaas

Worth reading the whole thread, it’s a short one.

1 Like

THANKS!!

1 Like