Salto card clone to dUG4T

chipman · March 16, 2026, 6:37pm

I would like to write this Salto card to my dUG4T, however, I cannot read it using the command: hf mf autopwn ?

Can anyone help?

[-] Searching for ISO14443-A tag…
[+] UID: 06 A6 D4 CA FF 52 80
[+] ATQA: 00 44

+\] SAK: 00 \[2

[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+] MIFARE Ultralight
[+] MIFARE Ultralight C
[+] MIFARE Ultralight EV1
[+] MIFARE Ultralight Nano
[+] MIFARE Ultralight AES
[+] MIFARE Hospitality
[+] NTAG 2xx
[=] proprietary non iso14443-4 card found, RATS not supported

[?] Hint: try hf mfu info

[+] Valid ISO 14443-A tag found

[=] — Tag Information --------------------------
[+] TYPE: MIFARE Ultralight C (MF0ULC)
[+] UID: 04 A5 D4 CA FF 52 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] BCC0: FD ( ok )
[+] BCC1: E7 ( ok )
[+] Internal: 48 ( default )
[+] Lock: 0F 00 - 0000111100000000
[+] OTP: 53 4C 54 4F - 01010011010011000101010001001111

=

[=] — Fingerprint
[+] SALTO Systems card

=

[+] — Known UL-C 3DES keys
[=] n/a

Aoxhwjfoavdlhsvfpzha · March 16, 2026, 7:01pm

hf mf autopwn is only for Mifare Classic

chipman · March 16, 2026, 7:11pm

How could I store these in a bin file to write to the dUG4T?

Equipter · March 16, 2026, 7:51pm

you would need the

hf mfu dump -k {key}

command.

but you don’t have the key, I can generate the key for you if you’d like, but you cannot put it on your dUG4t, you can upload the bin but the UMC cannot handle customised key authentication for Ultralight C so you will not be able to use it on the Salto system.

caj380 · March 18, 2026, 1:29pm

Is this the issue I was encountering? If so, it may be solved if the dUG4t uses a newer UMC version since you said it worked for you with the newer chip version.

chipman · March 19, 2026, 6:58am

The problem is that I don’t really know exactly how to clone this type of card on my dUG4t.

Can someone explain this to me?

hf mfu dump -k already works, and writing back works too, but suppose it doesn’t work on the dUG4t yet, what else needs to be done?

Equipter · March 19, 2026, 9:47am

nothing can be done, the password emulation simply does not work on the UMC.

Equipter · March 19, 2026, 9:48am

I think I got a fluke with that because I can’t recreate it on saflok readers. I have my ul USCUID that work fine but my UMC doesn’t.

chipman · April 14, 2026, 9:03am

Hello everyone,

I was indeed able to write the card to a Bin file using the “hf mfu dump” … and then wrote it back to the dUG4T using the “hf mfu restore -f hf-mfu-xxxx.bin -sr” command, but then I get the following:

Original Salto card:

[usb] pm3 → hf mfu info

[=] — Tag Information --------------------------
[+] TYPE: MIFARE Ultralight C (MF0ULC)
[+] UID: 04 43 D7 12 C1 7B 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] BCC0: 18 ( ok )
[+] BCC1: 28 ( ok )
[+] Internal: 48 ( default )
[+] Lock: 0F 00 - 0000111100000000
[+] OTP: 53 4C 54 4F - 01010011010011000101010001001111

=

[=] —Fingerprint
[+] SALTO Systems card

=

[+] — Known UL-C 3DES keys
[=] n/a

dUG4T:
[usb] pm3 → hf mfu info

[=] — Tag Information --------------------------
[+] TYPE: MIFARE Ultralight C (MF0ULC) (magic)
[+] UID: 04 43 D7 12 C1 7B 80
[+] UID[0]: 04, NXP Semiconductors Germany
[+] BCC0: 18 (ok )
[+] BCC1: 28 (ok)
[+] Internal: 48 (default)
[+] Lock: 0F 00 - 0000111100000000
[+] OTP: 53 4C 54 4F - 01010011010011000101010001001111

[=] —UL-C Configuration--------------------------
[=] Total memory… 188 bytes
[=] Available memory… 172 bytes
[=] 40 / 0x28 | 00 00 00 00 - 0000000000000000 Higher lock bits
[=] 41 / 0x29 | 00 00 00 FF - 0000000000000000 Counter
[=] 42 / 0x2A | 30 00 00 00 Auth0 unlocked
[=] 43 / 0x2B | 80 00 00 00 Auth1 R/W access restricted

=

[=] —Fingerprint
[+] SALTO Systems card
[#] Warning: HF field is off
[#] Warning: HF field is off
[!!] Error: tag didn’t answer to READ magic

The dUG4T is also configured completely correctly:
[usb] pm3 → script run hf_mf_ultimatecard -c

====================================================

Ultimate Magic Card Configuration

Raw Config 010100000000030A0A78008102DBA0C119402AB5BA4D321A44000002FB45
Card Protocol MIFARE Ultralight/NTAG
Ultralight Mode Ultralight-C
ULM Backdoor Key 00000000
GTU Fashion Disabled, high speed R/W mode for Ultralight
Card Type Ultralight-C
UID 0443D712C17B80
ATQA 00 44
SAK 00

==============================================================================

Magic UL/NTAG 21* Configuration

-ATS 0A78008102DBA0C119402AB5BA4D321A

Password [0xE5] FFFFFFFF [0xF0] FFFFFFFF
Pack [0xE6] 0000 [0xF1] 0000
Version 0000000000000000
-Signature 8B76052EE42F5567BEB53238B3E3F9950707C0DCC956B5C5EFCFDB709B2D82B3

[+] finished hf_mf_ultimatecard

The card should be fully displayed if I compare the original with the dUG4T, yet the salto lock does not respond at all when I hold the implant against the reader.

I feel like I am close to the solution.
Does anyone have an idea how I can solve this?

Pilgrimsmaster · April 14, 2026, 6:42pm

Can you use the DIFF Tool, on MCT

chipman · April 14, 2026, 7:01pm

Hi,

No, unfortunately, because for the moment I only have an iPhone to play around with.