Unable to write to xMagic Mifare Classic Gen2 (Auth Error)

I’ve been trying to clone my work badge to my xMagic chip, but I think I might’ve messed things up by “experimenting” a bit too much before actually finding the correct instructions for restoring a dump file to a Mifare Classic Gen2 chip.

This is what I get when I do a “hf search” on my implant:

[usb] pm3 --> hf search
 🕔  Searching for ISO14443-A tag...          
[=] ---------- ISO14443-A Information ----------
[+]  UID: 71 52 23 1F   ( ONUID, re-used )
[+] ATQA: 00 01
[+]  SAK: 08 [2]
[+] Possible types:
[+]    MIFARE Classic 1K
[=] 
[=] Proprietary non iso14443-4 card found
[=] RATS not supported
[+] Prng detection..... weak

[?] Hint: Try `hf mf info`


[+] Valid ISO 14443-A tag found

I did a hf mf autopwn on my implant and renamed the output to wristdump.bin and wristkey.bin.
Then I did the same to my work badge and renamed the output to workdump.bin and workkey.bin.

But then when I try to clone the dump to my implant by using hf mf restore -k wristkey.bin -f workdump.bin –force, I receive several Auth errors. Using the same command on a blank Mifare Classic Gen2 card works just fine. See below:

[usb] pm3 --> hf mf restore -k wristkey.bin -f workdump.bin --force
[+] Loaded binary key file `wristkey.bin`
[+] Loaded 1024 bytes from binary file `workdump.bin`

[=]  blk | data                                            | status
[=] -----+-------------------------------------------------+----------------
[#] Auth error
[=]    0 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    0 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]    1 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    1 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]    2 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    2 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]    3 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    3 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]    4 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    4 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]    5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key B
[#] Auth error
[=]    5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key A
[#] Auth error
[=]    6 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key B
[#] Auth error
[=]    6 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key A
[#] Auth error
[=]    7 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    7 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]    8 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    8 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]    9 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]    9 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key B
[#] Auth error
[=]   10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key A
[#] Auth error
[=]   11 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   11 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   12 | FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF | ( fail ) key B
[#] Auth error
[=]   12 | FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF | ( fail ) key A
[#] Auth error
[=]   13 | FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF | ( fail ) key B
[#] Auth error
[=]   13 | FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF | ( fail ) key A
[#] Auth error
[=]   14 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key B
[#] Auth error
[=]   14 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key A
[#] Auth error
[=]   15 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   15 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   16 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   16 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   17 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   17 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   18 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   18 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   19 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   19 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   20 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   20 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   21 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   21 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   22 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   22 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   23 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   23 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   24 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   24 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   25 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   25 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key B
[#] Auth error
[=]   26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( fail ) key A
[#] Auth error
[=]   27 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   27 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   28 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   28 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   29 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   29 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   30 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   30 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[#] Auth error
[=]   31 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key B
[#] Auth error
[=]   31 | CE NS OR ED CE NS OR ED CE NS OR ED CE NS OR ED | ( fail ) key A
[=]   32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   35 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=]   36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   39 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=]   40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   42 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   43 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=]   44 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   45 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   46 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   47 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=]   48 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   49 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   51 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=]   52 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   53 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   54 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   55 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=]   56 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   57 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   58 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   59 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=]   60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   61 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   62 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ( ok )
[=]   63 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | ( ok )
[=] -----+-------------------------------------------------+----------------

Anyone who can nudge me into the right direction?

1 Like

You need to use the --ka flag, this tells it to use the supplied keyfile to authenticate

3 Likes

Thank you so much for your help. That did it!

2 Likes