Gen1A Magic Mifare 1K
Gen1A chips use a “backdoor” unlock sequence (40 / 43) rather than a writable block 0 with the factory key. If hf search shows broken anticollision but the chip still responds to RF, the Iceman fork’s cset commands handle the unlock automatically:
hf mf csetuid -u 11223344
Or for full block 0 control:
hf mf csetblk --blk 0 -d 11223344440804006263646566676869
If the chip won’t respond even to the magic wakeup, it may be a hardware failure rather than a soft brick.
Gen2 Magic Mifare 1K
hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip
hf mf wrbl --blk 0 --force -k FFFFFFFFFFFF -d 11223344440804006263646566676869
hf 14a config --std
Block 0 layout (the -d argument):
11 22 33 44 UID (4 bytes — pick anything)
44 BCC (XOR of the four UID bytes — MUST match)
08 SAK (08 = Mifare 1K)
04 00 ATQA (little-endian; 04 00 = Mifare 1K)
62 63 64 65 66 67 68 69 manufacturer bytes (any 8 bytes)
If you change the UID, recompute BCC: BCC = UID0 XOR UID1 XOR UID2 XOR UID3. For UID 11 22 33 44 that’s 0x11 ^ 0x22 ^ 0x33 ^ 0x44 = 0x44. A wrong BCC will fail anticollision and re-brick the card.