Okay, I took the plunge and purchased a Yale Doorman V2N today. If no hacking is happening, someone’s gotta pick up the slack I’m thinking, even if I can’t get my implant to work, it has a keypad, and entering a code beats goofing around with stupid Finnish-standard keys when it’s freezing cold outside any day. Getting in with my implant would be the best case scenario, but punching a keycode is also an improvement - albeit an expensive one at EUR 350.
The thing comes with 3 “authorized” Yale Mifare Classic tags. So my plan is this:
- Install the lock on my door. Duh…
- Clone tag #1 into a gen1a magic Chinese card. See if the lock picks it up. If it does, the original tag #1 will become unusable with my lock.
- If the cloned card works reliably, clone tag #2 into my gen1a magic Chinese implant (exact same chip as the card’s). If everything goes well, I should be able to get in with my implant. If not, well bummer… In any case, the original tag #2 will also become unusable with my lock.
- Send my original tags #1 and #2 to Iceman if he wants to use them to do some hacking of his own with his own Doorman lock.
- Keep using my implant, the magic Chinese card and tag #3 with the lock, but taking care to dump the keys and the data after each successful entry, to create a log of what changed on all 3 working tags. Over time, hopefully I’ll have enough data to do some reverse engineering on the crypto algorithm.
I’ve already created a clone of tag #1 in the magic Chinese card. It took a while, to make sure the entire card matches the original byte to byte - UID, manufacturer block on the second half of block zero, keys and all - but now the clone is indistinguisable from the original. The only way to tell them apart is to test if the magic Chinese command works - which, to my knowledge, the lock doesn’t do. But I’ll see soon enough.
So, stay tuned to see if I manage to make something out of the damned thing