Unable to rewrite xSIID

I recently got an xSIID implanted in my hand. I was able to write to it, but now I cannot rewrite to it nor does my phone open the URL programmed in it when I scan it. I did attempt to password protect it, but when I try to remove the password, NFC Tool PRO says the NFC tag is not supported. Then how was I able to set one? Either way, I am unable to write or format the chip now but it does still light up. :frowning:

I accept if I broke it, but I thought I would ask if there is a way to force a format with special commands?
04-42-7D-32-94-51-80_08-Jul-25 11-20-16_taginfo_scan.txt (15.7 KB)

What exactly did you use for this and what exact buttons did you boop? When it comes to the word “protect” … it could mean different things. We program the NFC chip to disable the lock bits because people were “protecting” their tag, not realizing it means lock it forever in an unrecoverable read-only state… so that’s not what happened… but there are other forms of “protection” including soft-lock based on TLVs you can write to the user memory pages, but that’s not what happened here. I can tell by your taginfo dump the lock bytes are ok;

[002] * 44 00 0F 00 (CFG0-CFG1, LOCK0-LOCK1)
[0E2] . 00 00 FF 00 (LOCK2-LOCK4, CHK)

We also set a default password and AUTH0 byte that protects only lower config pages (including password) so unless you authenticated using the default password first, you could not have changed the default password.

[0E3] . 00 00 00 E2 (RFU-RFU, AUTH0)

Just to be clear, you cannot remove the password from the chip because “the password” is whatever is stored in memory page E5… and since you can’t physically remove the memory page, you cannot remove the password. All you can do is set the password to a well known “factory default”, or you can make the password irrelevant by settings AUTH0 to point to a memory page lower than any existing page, like FF.

What I do see however is a broken NDEF container, starting with a zeroed out page 4

[004] + 00 00 00 00 |…|

Try using TagWriter to “format” your tag. If this fails, you might need to use RawNFC to overwrite your user memory with a blank NDEF record…

RawNFC command library - Projects - Dangerous Things Forum

Scroll down to the second post “Tag Fixes”

5 Likes

Referring to the password, I saw a feature in NFC Tools to set a password that would be required each time you want to write to the NFC tag. I thought that was the issue, but the “TagWriter” app you linked to was able to write to this NFC tag with no password and no problem. So it may have just been the NFC Tools app does not like this type of tag? Not sure but I am able to write to it no problem with this other app.

However, when I write a new URL on to the tag and then use taginfo, it says no ndef data storage populated and the link still does not open on my phone as expected.

04-42-7D-32-94-51-80_08-Jul-25 14-37-39_taginfo_scan.txt (15.7 KB)
I am able to write to it. This is with the new URL written, but the link does not open and taginfo says no NDEF data storage populated, “sector 0, page 0x00 error invalid last NDEF message page address”

Did you try the raw NFC suggestion?

That’s from your tag info dump… user memory starts at page 04 and there appears to be a blank ndef record followed by another entirely different ndef record for the dangerousthings.com URL.

Let me know if you have RawNFC loaded and I’ll write a custom link here for it that will entirely clear your tag and set a single ndef record.

1 Like

I do have RawNFC loaded, yes.

1 Like

this should just blank your whole tag with 00s then you can format again;

dnfc://NfcA/A20400000000/A20500000000/A20600000000/A20700000000/A20800000000/A20900000000/A20A00000000/A20B00000000/A20C00000000/A20D00000000/A20E00000000/A20F00000000/A21000000000/A21100000000/A21200000000/A21300000000/A21400000000/A21500000000/A21600000000/A21700000000/A21800000000/A21900000000/A21A00000000/A21B00000000/A21C00000000/A21D00000000/A21E00000000/A21F00000000/A22000000000/A22100000000/A22200000000/A22300000000/A22400000000/A22500000000/A22600000000/A22700000000/A22800000000/A22900000000/A22A00000000/A22B00000000/A22C00000000/A22D00000000/A22E00000000/A22F00000000/A23000000000/A23100000000/A23200000000/A23300000000/A23400000000/A23500000000/A23600000000/A23700000000/A23800000000/A23900000000/A23A00000000/A23B00000000/A23C00000000/A23D00000000/A23E00000000/A23F00000000/A24000000000/A24100000000/A24200000000/A24300000000/A24400000000/A24500000000/A24600000000/A24700000000/A24800000000/A24900000000/A24A00000000/A24B00000000/A24C00000000/A24D00000000/A24E00000000/A24F00000000/A25000000000/A25100000000/A25200000000/A25300000000/A25400000000/A25500000000/A25600000000/A25700000000/A25800000000/A25900000000/A25A00000000/A25B00000000/A25C00000000/A25D00000000/A25E00000000/A25F00000000/A26000000000/A26100000000/A26200000000/A26300000000/A26400000000/A26500000000/A26600000000/A26700000000/A26800000000/A26900000000/A26A00000000/A26B00000000/A26C00000000/A26D00000000/A26E00000000/A26F00000000/A27000000000/A27100000000/A27200000000/A27300000000/A27400000000/A27500000000/A27600000000/A27700000000/A27800000000/A27900000000/A27A00000000/A27B00000000/A27C00000000/A27D00000000/A27E00000000/A27F00000000/A28000000000/A28100000000/A28200000000/A28300000000/A28400000000/A28500000000/A28600000000/A28700000000/A28800000000/A28900000000/A28A00000000/A28B00000000/A28C00000000/A28D00000000/A28E00000000/A28F00000000/A29000000000/A29100000000/A29200000000/A29300000000/A29400000000/A29500000000/A29600000000/A29700000000/A29800000000/A29900000000/A29A00000000/A29B00000000/A29C00000000/A29D00000000/A29E00000000/A29F00000000/A2A000000000/A2A100000000/A2A200000000/A2A300000000/A2A400000000/A2A500000000/A2A600000000/A2A700000000/A2A800000000/A2A900000000/A2AA00000000/A2AB00000000/A2AC00000000/A2AD00000000/A2AE00000000/A2AF00000000/A2B000000000/A2B100000000/A2B200000000/A2B300000000/A2B400000000/A2B500000000/A2B600000000/A2B700000000/A2B800000000/A2B900000000/A2BA00000000/A2BB00000000/A2BC00000000/A2BD00000000/A2BE00000000/A2BF00000000/A2C000000000/A2C100000000/A2C200000000/A2C300000000/A2C400000000/A2C500000000/A2C600000000/A2C700000000/A2C800000000/A2C900000000/A2CA00000000/A2CB00000000/A2CC00000000/A2CD00000000/A2CE00000000/A2CF00000000/A2D000000000/A2D100000000/A2D200000000/A2D300000000/A2D400000000/A2D500000000/A2D600000000/A2D700000000/A2D800000000/A2D900000000/A2DA00000000/A2DB00000000/A2DC00000000/A2DD00000000/A2DE00000000/A2DF00000000/A2E000000000/A2E100000000

You should be able to just click this link and RawNFC will open.

After executing, try using TagInto and just write an ndef to your chip… don’t format just write a link or something.

2 Likes

There were a few rows that I had to delete a 0, but that worked and my implant is working as expected now. Thank you!

3 Likes

hah omg yeah … fixed :slight_smile:

2 Likes