Potentially bricked flexUG4?

I’m with family for the holidays and thus haven’t been able to try with a proxmark, but using my flipper zero (the NFC Magic app > check magic tag > write) I tried to rewrite my flexUG4 from my apartment key to a website link to show off to my family. That write failed, but not before removing my original apartment key, and now I can’t seem to write anything to it, or even wipe it

Trying to write, wipe, or read the chip takes a long time as the flipper shows a loading bar for unlocking sectors 1-5, but only ever reports 2/10 keys found, and 1/5 sectors read, and afterwards, reads just say it’s “ISO14443-3A (unknown) UID: 11 22 33 44”

Is it bricked? Is there something I’m missing? Will a proxmark be able to save me where my flipper is failing (when I get home)?

1 Like

What transponder is it you tried to write to it? I would be very surprised if it were bricked. Probably just failed to write the proper config. Do you have a proxmark?

1 Like

The apartment key, which was on there for weeks beforehand, is a Mifare classic 1k. This problem began when I tried to switch it to an NTAG216. I do own a proxmark, but don’t have access to it until I get back from vacation on Sunday. I’ve tried the write, as well as reading and wiping, several times and they all fail

1 Like

I have had some messed up UG4s that I have been able to reset with a proxmark. I haven’t used the flipper for this much. The proxmark script is pretty great.

1 Like

I don’t think I’ve ever used the proxmark script on the UG4, so far I’ve been fine on the Flipper alone. What should I run when I get back?

1 Like
script run hf_mf_ultimatecard

Check the product page video.

3 Likes

Are you using the main NFC app for all this?

Have you tried using the NFC Magic app?

2 Likes

I’ve basically only been using the NFC Magic app. I used NFC (basic) for the reads, but the writes and wipes are all through NFC Magic

It is the version that came with the Momentum firmware though, so I’m unsure if it’s version or if it’s entirely working right, there’s a few apps that have bugs with that firmware, but I did use it to write the apartment key weeks ago with no issues

1 Like

Don’t quote me on this,

but I think the UG4 chip is “unbrickable” at least highly resilient.
I think it can be soft bricked, but it has a recovery mode.

If you set a password, and forget it, THAT “bricks” it

3 Likes

I had read that too, which was part of deciding on this chip. So far though, the Proxmark hasn’t fared much better. Using

script run hf_mf_ultimatecard -u [my uid] -t 1 
// this is correct as far  as I know, I am trying to write a 4 byte uid Mifare Classic 1K

I get:

[+] executing lua C:\ProxSpace\pm3\proxmark3\client\luascripts/hf_mf_ultimatecard.lua
[+] args '-u [uid here] -t 1 -q 000408'

ERROR:  iso14443a card select failed
ERROR:  iso14443a card select failed
Setting: Ultimate Magic card to Mifare mini S20 4-byte
ERROR:  iso14443a card select failed
[#] Warning: HF field is off
[#] Warning: HF field is off
ERROR:  iso14443a card select failed
ERROR:  iso14443a card select failed
Set max R/W block       13
ERROR:  iso14443a card select failed
ERROR:  iso14443a card select failed
ERROR:  iso14443a card select failed

[+] finished hf_mf_ultimatecard

Which, safe to say, is not a resounding success.

I’ve tried with and without a proxmark booster, with varying hf tune values. With the booster, it hovers around 3400 mV before my UG4 is nearby, dropping to the low 2900mV area when its in position. Without the booster, it hovers nearer 15000, dropping down to 8000mV or so with the chip nearby

1 Like

Oh, also just remembered and confirmed, running hw tune claims my HF antenna is only “marginal”. This is something I’m certainly not qualified to read or interpret, but here’s the full HF readout:

[=] -------- HF Antenna ----------
[+] 13.56 MHz… 3.50 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage… 1.0
[+] HF antenna ( marginal )

Could this be related?

1 Like

hw tune won’t read accurately with a booster installed.

2 Likes

Have you tried hf_mf_ultimatecard -c ?

The only reason to just use the -u flag is that you are going to manually configure the rest of the necessary parameters. Doing just that will almost certainly give you a useless config.

1 Like

I get:

[usb] pm3 --> script run hf_mf_ultimatecard -c
[+] executing lua C:\ProxSpace\pm3\proxmark3\client\luascripts/hf_mf_ultimatecard.lua
[+] args '-c'

ERROR:  iso14443a card select failed
1 Like

Running over and over, I sometimes get “Multiple tags detected. Collision after Bit 13”, “BCC0 incorrect, got 0x00, expected 0x20” or so on

1 Like

script run hf_mf_ultimatecard -w 1 ?

1 Like

Same output at -c 1

1 Like

Hmmmm @Equipter Any ideas?

1 Like

Just for funsies, can we see the startup output for the PM3 client?

2 Likes
C:\ProxSpace>runme64.bat
[=] Session log C:\ProxSpace\pm3/.proxmark3/logs/log_20251202022526.txt
[+] loaded `C:\ProxSpace\pm3/.proxmark3/preferences.json`
[+] Using UART port COM6
[+] Communicating with PM3 over USB-CDC


  8888888b.  888b     d888  .d8888b.
  888   Y88b 8888b   d8888 d88P  Y88b
  888    888 88888b.d88888      .d88P
  888   d88P 888Y88888P888     8888"
  8888888P"  888 Y888P 888      "Y8b.
  888        888  Y8P  888 888    888
  888        888   "   888 Y88b  d88P
  888        888       888  "Y8888P"


  [ This is rather distressing!  ]

  [ Proxmark3 ]

    MCU....... AT91SAM7S512 Rev A
    Memory.... 512 KB ( 69% used )
    Target.... PM3 GENERIC

    Client.... Iceman/master/v4.20469-40-g5de4dd68e 2025-06-26 20:47:00
    Bootrom... Iceman/master/v4.20469-40-g5de4dd68e-suspect 2025-06-26 20:46:32 81d668089
    OS........ Iceman/master/v4.20469-40-g5de4dd68e-suspect 2025-06-26 20:46:42 81d668089
1 Like