INTRODUCTION
Need to make perfect, undetectable of MIFARE Classic® 1K Cards ?
Many access control systems / RFID readers are now able to detect "Chinese Magic" tags by sending the "Unlock Command" (0x40 / 0x43). If the badge replies, it is flagged as an imposter / clone and rejected.
These "Gen2a" badges allow the UID to be set one time only - and after that - the tag never responds to magic commands. This allows you to make undetectable, perfect clones.
Once the UID has been set, the tag acts as a normal card. You can change the data of the card as many times as required - we've tested up to 10,000 read/write cycles.
Remember: This badge's UID can only be set one time.
These tags are red and in key ring form for convenience.
Technical Specifications
| Feature |
Information |
Notes |
| Chipset |
MIFARE Classic® Compatible |
|
| Memory Size |
1K |
|
| UID Size |
4 Byte |
|
| UID Modifiable |
✔️ |
One time only
|
| Chip Generation |
Gen 2 OTW (Gen2a) |
Chipset Generation Guide
|
Write Capabilities
| UID Modifiable |
Unlock Required |
DirectWrite / Block 0 |
One Time Write |
Notes |
| ✔️ |
|
✔️ |
✔️ |
UID can only be modified once!
|
Device Compatibility
| Compatibility |
UID |
R/W |
Config |
Notes |
| Flipper Zero |
✔️ |
✔️ |
✔️ |
|
| Proxmark / iCopy-X |
✔️ |
✔️ |
✔️ |
|
| Android & iOS |
✔️ |
✔️ |
✔️ |
MTools recommended |
| LibNFC |
✔️ |
✔️ |
✔️ |
|
| ChameleonUltra |
✔️ |
|
✔️ |
Requires MTools |
Hands on: See the card in action
The MIFARE Classic® Compatible 1K UID One-Time-Write can be used with several tools:
LibNFC - change UID
To update the UID of the badge, simply write the dump contents to the badge.
nfc-mfclassic w a u /tmp/1K.dmp
Proxmark - change UID
To update the UID of the badge, simply write the dump contents to the badge. When using wrbl - you are directly modifying the card's configuration. Ensure that all data is correct including BCC - otherwise you will brick your card.
hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 11223344440804006263646566676869 # Where 11223344 is the UID, 08 is the BCC
Live Demonstration : LibNFC & Proxmark
Unbricking
"Soft-bricking" refers to when a magic card has been configured in a way that prevents it from being detected. Ways of soft-bricking tags include:
- Incorrect BCC
- Incorrect SAK
- Incorrect ATQA
- Incorrect ATS
- Incorrect ACL (Access Control) Values
Some "soft-brick" situations can be resolved with special commands. If your MIFARE Classic® Compatible 1K UID Modifiable is "soft-bricked", you can try recovering it with the following methods:
With Proxmark / iCopy-X
hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip
# for 1k
hf mf wrbl --blk 0 -k FFFFFFFFFFFF -d 11223344440804006263646566676869 --force
hf 14a config --std
hf 14a reader
Via external reader/writer and MTOOLS
Select the "UID Changer" function in MTools, select "bricked" and run the task
IMPORTANT:
Lab401 cannot provide refunds under any circumstances for cards that were 'bricked' due to incorrect configurations.
