MAGIC ISO15693 tags

iceman · 2018-04-22 10:30:16

Found a producer which claims magic iso 15693 tags, the initial tags has all same UID which is a good indicator that the claims are true.

I let you all know more, I am quite busy with adapting iceman fork for RDV40...

Dot.Com · 2018-04-23 16:39:09

That's a quick post!

I will pump it the details this week. Let's see who is interested.

yaowang · 2018-07-15 08:53:57

1k，and use 13.8Mhz。。。I bought some。。。

iceman · 2018-07-15 12:11:08

The tags has a custom uid set, when ordered from supplier. So yeah, work, but not very useful in current version.
The supplier doesn't want to release how to change UID at will,.. This will limit their sales quite a lot.

dipolin · 2018-07-18 17:00:21

Hi Iceman

I'm new to this community and I have not contributed anything yet, although I have learned a lot ... before asking, searching and reading

I have a contact in China that makes me custom rfid UID tags, I am going to ask him if he can get MAGIC ISO15693

If you need special information, tell me and I'll ask him

iceman · 2018-07-18 19:47:14

Ask for uid changeable iso-15693 cards. aka magic.
Not custom UID... possibility to change uid by yourself.

dipolin · 2018-07-18 21:25:11

ok, as soon as I know something I inform you, that will take some days

dipolin · 2018-07-19 11:39:15

Good news iceman!

My contact can supply me ISO15693 tags with UID modifiable.

I have asked him to send me some samples, as soon as he receives them, I will contact you.

iceman · 2018-07-19 20:47:28

Who is your chinese supplier?

dipolin · 2018-07-23 11:55:40

Hi, Iceman.

I really do not know who is the Chinese manufacturer, I always do business with him as an intermediary.

I met him in a congress through a provider.

I do not know if he will be a reseller, I call him "the obtainer", because practically everything I have asked for and they are not usual things that you can find on aliexpress or GeZhi Electronic Co.Ltd. at the end, he has obtained them to me, and he makes me personalized works.

iceman · 2018-07-23 18:09:39

GeZhi.. aha, he is known on this forum...

dipolin · 2018-07-23 20:19:30

I think that either I misread your message or you misunderstood me ... GeZhi is not my contact, he is a Chinese who lives in Valencia (Spain).

I do not think it has anything to do with GeZhi.

iceman · 2018-07-23 21:36:10

you are right, I missunderstood.

iceman · 2018-12-04 14:33:26

Life finds a way

The ISO15693 uid-custom card found on RFXSecure https://www.rfxsecure.com/product/icode … tom-inlay/ has now been sorted out to become fully UID rewritable.

magic iso15693 uid

dipolin · 2018-12-11 11:00:35

Very good news!

Did the samples I sent you work?

iceman · 2018-12-11 14:47:14

Yes, it works on those samples aswell. I assume its from the same source

pruwait · 2019-02-02 18:40:57

iceman wrote:

Life finds a way
The ISO15693 uid-custom card found on RFXSecure https://www.rfxsecure.com/product/icode … tom-inlay/ has now been sorted out to become fully UID rewritable.
http://www.icedev.se/proxmark3/magicISO15693.png

This card works but...
proxmark can't send to card right command or card answers not right....

 bootrom: iceman/master/ice_v3.1.0-1072-gfbc42bd7 2019-02-02 20:05:11
 os: iceman/master/ice_v3.1.0-1072-gfbc42bd7 2019-02-02 20:05:20

Why card select failed (and write/read is OK)?

pm3 --> hf 15 restore f hf-15-2F386888500104E0-dump.bin
[=] Blocksize: 4
iso15693 writing to page 00 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 00 (0x&02X) | data
OK
iso15693 writing to page 01 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 01 (0x&02X) | data
OK
iso15693 writing to page 02 (0x&02X) | data
OK
iso15693 writing to page 03 (0x&02X) | data
OK
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
OK
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
OK
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
OK
iso15693 writing to page 07 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 07 (0x&02X) | data
OK
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed


pm3 --> hf 15 dump
[=] Using UID as filename
Reading memory from tag UID E0 16 24 66 1A A5 85 8F
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
..[-] iso15693 card select failed
...[-] iso15693 card select failed
..[-] iso15693 card select failed
[-] iso15693 card select failed
.[-] iso15693 card select failed
[-] iso15693 card select failed
....[-] iso15693 card select failed
#db# [!] error, uneven octet! (extra bits!) mask 02
.[-] iso15693 card select failed
.[-] iso15693 card select failed
.....[-] iso15693 card select failed
...[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed


block#   | data         |lck| ascii
---------+--------------+---+----------
  0/0x00 | 00 00 00 00  | 0 | ....
  1/0x01 | 00 00 00 00  | 0 | ....
  2/0x02 | 00 00 00 00  | 0 | ....
  3/0x03 | 00 00 00 00  | 0 | ....
  4/0x04 | 00 00 00 00  | 0 | ....
  5/0x05 | 00 00 00 00  | 0 | ....
  6/0x06 | 00 00 00 00  | 0 | ....
  7/0x07 | 00 00 00 00  | 0 | ....
  8/0x08 | 00 00 00 00  | 0 | ....
  9/0x09 | 00 00 00 00  | 0 | ....
 10/0x0A | 00 00 00 00  | 0 | ....
 11/0x0B | 00 00 00 00  | 0 | ....
 12/0x0C | 00 00 00 00  | 0 | ....
 13/0x0D | 00 00 00 00  | 0 | ....
 14/0x0E | 00 00 00 00  | 0 | ....
 15/0x0F | 00 00 00 00  | 0 | ....
 16/0x10 | 00 00 00 00  | 0 | ....
 17/0x11 | 00 00 00 00  | 0 | ....
 18/0x12 | 00 00 00 00  | 0 | ....
 19/0x13 | 00 00 00 00  | 0 | ....
 20/0x14 | 00 00 00 00  | 0 | ....
 21/0x15 | 00 00 00 00  | 0 | ....


[+] saved 22 blocks to text file hf-15-8F85A51A662416E0-dump.eml
[+] saved 88 bytes to binary file hf-15-8F85A51A662416E0-dump.bin

iceman · 2019-02-02 19:27:52

that would be more of iso15 support in firmware than the magic tags fault.
Try the offical repo, it has gotten some major changes the last months when it come to iso15, to see if it works better for you.
iso15 has been picky about distance and positioning in the past, see if you find your sweetspot with your setup

steph · 2019-02-04 10:28:46

pruwait wrote:

Why card select failed (and write/read is OK)?

pm3 --> hf 15 restore f hf-15-2F386888500104E0-dump.bin
[=] Blocksize: 4
iso15693 writing to page 00 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 00 (0x&02X) | data
OK
iso15693 writing to page 01 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 01 (0x&02X) | data
OK
iso15693 writing to page 02 (0x&02X) | data
OK
iso15693 writing to page 03 (0x&02X) | data
OK
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
OK
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
OK
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
OK
iso15693 writing to page 07 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 07 (0x&02X) | data
OK
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed

I also experienced that, so i used the R option with 10 times and finaly got my dumped.

pruwait wrote:

pm3 --> hf 15 dump
[=] Using UID as filename
Reading memory from tag UID E0 16 24 66 1A A5 85 8F
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
..[-] iso15693 card select failed
...[-] iso15693 card select failed
..[-] iso15693 card select failed
[-] iso15693 card select failed
.[-] iso15693 card select failed
[-] iso15693 card select failed
....[-] iso15693 card select failed
#db# [!] error, uneven octet! (extra bits!) mask 02
.[-] iso15693 card select failed
.[-] iso15693 card select failed
.....[-] iso15693 card select failed
...[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed


block#   | data         |lck| ascii
---------+--------------+---+----------
  0/0x00 | 00 00 00 00  | 0 | ....
  1/0x01 | 00 00 00 00  | 0 | ....
  2/0x02 | 00 00 00 00  | 0 | ....
  3/0x03 | 00 00 00 00  | 0 | ....
  4/0x04 | 00 00 00 00  | 0 | ....
  5/0x05 | 00 00 00 00  | 0 | ....
  6/0x06 | 00 00 00 00  | 0 | ....
  7/0x07 | 00 00 00 00  | 0 | ....
  8/0x08 | 00 00 00 00  | 0 | ....
  9/0x09 | 00 00 00 00  | 0 | ....
 10/0x0A | 00 00 00 00  | 0 | ....
 11/0x0B | 00 00 00 00  | 0 | ....
 12/0x0C | 00 00 00 00  | 0 | ....
 13/0x0D | 00 00 00 00  | 0 | ....
 14/0x0E | 00 00 00 00  | 0 | ....
 15/0x0F | 00 00 00 00  | 0 | ....
 16/0x10 | 00 00 00 00  | 0 | ....
 17/0x11 | 00 00 00 00  | 0 | ....
 18/0x12 | 00 00 00 00  | 0 | ....
 19/0x13 | 00 00 00 00  | 0 | ....
 20/0x14 | 00 00 00 00  | 0 | ....
 21/0x15 | 00 00 00 00  | 0 | ....


[+] saved 22 blocks to text file hf-15-8F85A51A662416E0-dump.eml
[+] saved 88 bytes to binary file hf-15-8F85A51A662416E0-dump.bin

For this i played a little with the antenna and the card, to find the right position..

But yes, no problem with the original card, little noise with the magic one...

flux · 2019-02-11 22:00:29

iceman wrote:

The ISO15693 uid-custom card found on RFXSecure has now been sorted out to become fully UID rewritable.

@iceman
I have searched for the iso15_magic script for a while now. Would it be possible to get it into my fingers?

BTW: Its absolutely true that the iso15 cards are picky regarding distance to the antenna. I am using a soldering claw to fix the distance between card and antenna which significantly improves the selec/read/write operations.

Last edited by flux (2019-02-11 22:01:05)

iceman · 2019-02-13 13:58:24

Depends where you bought your cards. If you bought from rfxsecure.com https://www.rfxsecure.com/product/icode … tom-inlay/ you should have gotten it from them.

shefajs · 2019-03-01 12:42:08

Hello,

I bought recently a lot of ISO 15693 magic stickers from this manufacturer.
https://makarfid.com/products/uid-changeable-card/

They may or may not be made by same manufacturer as cards mentioned above (does anyone know the OEM of the cards?)
Since no-one else was mentioning the stickers it may be something completely different...

But anyway I would love to interface those by proxmark.

Especially since the manufacturer want quite outrageous sum for the software to write UID ($1000 for every type of the card and HWID locked for 1 PC only).

In case it's something different I actually bought the software for the client (only for I-Code SLI-X.....they want another $1000 for the icode SLI-S) so I could record/sniff the command for the UID rewrite.

But since I'm unskilled with Proxmark, can You help me with that?

1) I need the Icemans lua script to try the same UID operations as mentioned above (But 50/50 since they use a different commands for SLI-X and SLI-S).
2) I need the re-commanded commands and setup for proxmark to sniff the UID write from OEM software.

Thank You.

Last edited by shefajs (2019-03-01 12:44:24)

piwi · 2019-03-01 21:35:11

Re 2) iso15693 allows a variety of modulations and codings. Proxmark knows only some of them. But give it a try: 'hf 15 snoop', stop with PM3 button, then 'hf list 15’.

t0m4 · 2019-06-24 08:41:26

Hi @iceman,

I just received my ISO15693 UID changeable from RfxSecure and I requested the iso15_magic.lua script via their chat.
I got the version 1.02 of the script.

First of all, I had to modify it to change the commands from "hf 15 raw" to "hf 15 cmd raw", that is quite surprising.

Then, when I use it I can't manage to change the UID.

Here is the result :

proxmark3> script run iso15_magic -u E004013344556677
--- Executing: iso15_magic.lua, args '-u E004013344556677'
----------------------------------------
----------------------------------------

new UID | E004013344556677
Using backdoor Magic tag function
received 0 octets

received 0 octets

received 0 octets

received 0 octets


-----Finished

proxmark3> hf 15 reader
#db# 12 octets read from IDENTIFY request:
#db# NoErr CrcOK
#db# ........ 00 00 00 00 00 00 00 00
#db# ..xc     00 00 78 63
#db# UID = 0000000000000000

So, basically, it "reseted" the UID but couldn't write the new one.

I tried with 2 different antennas and several distances antenna-card with no success.

I also tried to type the following raw commands (used in the script) directly, with the same result :

proxmark3> hf 15 cmd raw -2 -c 02213E00000000
received 0 octets

hf 15 cmd raw -2 -c 02213F69960000
received 0 octets

hf 15 cmd raw -2 -c 02213877665544
received 0 octets

hf 15 cmd raw -2 -c 022139330104E0
received 0 octets

My guess the third & fourth commands aren't correct since they don't return the expected result (00 78 F0).

Could you please tell me if these commands are those that should be used ?

For information, I'm using the official repo of proxmark3 (latest version), not your fork but I believe the script doesn't rely on it. Tell me if I'm wrong.

Best regards.

iceman · 2019-06-24 20:54:50

The correct output from a successful script run doesn't look like that. Then on the other hand you are using it on official repo.
You most likely need to edit the script to run just the offical repo commands. (it should be a oneline change)

t0m4 · 2019-06-24 23:23:49

Thanks for your reply.

I downloaded the version 1.05 of the script here : https://github.com/RfidResearchGroup/proxmark3/blob/master/client/scripts/iso15_magic.lua
But I still can't get it work on the official repo, even with the "-a" parameter.

So I switched to your repo (and firmware) and I finally managed to set the new UID !

Great work !

piwi · 2019-06-25 07:40:45

The "hf 15 cmd raw" command on official repo has been changed to switch of the HF field after each command. This was a quick fix in order to protect RDV4 from overheating until a better protection strategy can be found. Sequences of raw commands which require the card to remain powered on between the commands (like in the mentioned script) therefore fail.

t0m4 · 2019-06-25 20:36:49

Thank you @piwi for this explanation.
I was wondering why there was a difference between official and iceman’s repo while executing 4 simple raw commands, especially with an option to use this script on the official repo...

tzxiang · 2019-06-26 16:38:05

Hi

I am new to proxmark and trying to clone a 15693. I encountered this error using the iso15_magic script. I tried on both official and iceman builds. Would appreciate some help

script run iso15_magic -u E00401502A4A0C22 -a
--- Executing: iso15_magic.lua, args '-u E00401502A4A0C22 -a'
...rk3\Proxmark\Proxmark\pm3\client\scripts/iso15_magic.lua:2: module 'read15' not found:
no field package.preload['read15']
no file 'C:\Users\tzxiang\Downloads\Proxmark3\Proxmark\Proxmark\pm3\client\lua\read15.lua'
no file 'C:\Users\tzxiang\Downloads\Proxmark3\Proxmark\Proxmark\pm3\client\lua\read15\init.lua'
no file 'C:\Users\tzxiang\Downloads\Proxmark3\Proxmark\Proxmark\pm3\client\read15.lua'
no file 'C:\Users\tzxiang\Downloads\Proxmark3\Proxmark\Proxmark\pm3\client\read15\init.lua'
no file '.\read15.lua'
no file 'C:\Users\tzxiang\Downloads\Proxmark3\Proxmark\Proxmark\pm3\client\lualibs/read15.lua'
no file 'C:\Users\tzxiang\Downloads\Proxmark3\Proxmark\Proxmark\pm3\client\read15.dll'
no file 'C:\Users\tzxiang\Downloads\Proxmark3\Proxmark\Proxmark\pm3\client\loadall.dll'
no file '.\read15.dll'

-----Finished

Last edited by tzxiang (2019-06-26 16:38:49)

t0m4 · 2019-06-26 18:58:01

Hi @tzxiang,

Got the same issue.

You just have to comment out the second line of the script :

-- local lib15 = require('read15')

I have obsolutely no idea what it should append but, for me, it worked without it.

Hope this helps.

t0m4 · 2019-07-06 18:35:20

Hi @iceman,

I just submitted a pull request on the official repo to add the command hf 15 csetuid <UID>, since your script no longer works on this repo because of the RDV4 over-heating protection in DirectTag15693Command(), as explained by @piwi.

Hope this is OK with you.

Here is the result :

Best regards.

iceman · 2019-07-06 20:31:26

Well since you are at it, you could to a PR to the RRG repo aswell

t0m4 · 2019-07-06 21:04:53

Ok. I'll give a try on tomorrow then...

Thanks.

t0m4 · 2019-07-07 10:07:39

Hi @iceman,

So, as requested, I just made a pull request on the RRG repo to add the hf 15 csetuid command.

I implemented it in a much simplier way, by reproducing your script, with 4 raw commands in a row (using SendCommandOLD()).

Seems to be working fine :

Best regards.

iceman · 2019-07-07 11:52:23

Look at that! Well done, I will adapt it to use NG

sashat720 · 2019-10-21 09:38:52

I ordered these cards and yes, they to work, the UID is changeable.

However, these cards have only 28 blocks of 4 bytes each, whereas I need 52 blocks to clone a EM4233 card..

fazer · 2019-10-21 16:30:23

Re: MAGIC ISO15693 tags

Hello, I bought two cards .I just have a question I made a dump of my card which has 80 blocks I wrote 27 blocks in this card the rest of the blocks of 00000000, my question & do you think can the reader read this card? . Thank you good day.

block# | data |lck| ascii
---------+--------------+---+----------
0/0x00 | 8E 08 F7 4D | 0 | ...M
1/0x01 | C2 1D 02 00 | 0 | ....
2/0x02 | 31 28 E7 D9 | 0 | 1(..
3/0x03 | 4C 30 50 49 | 0 | L0PI
4/0x04 | 42 20 53 42 | 0 | B SB
5/0x05 | 38 30 53 42 | 0 | 80SB
6/0x06 | 2E 40 53 42 | 0 | .@SB
7/0x07 | 24 50 53 42 | 0 | $PSB
8/0x08 | 1A 60 53 42 | 0 | .`SB
9/0x09 | 4E 00 00 00 | 0 | N...
10/0x0A | 12 34 AB CD | 0 | .4..
11/0x0B | 12 34 AB CD | 0 | .4..
12/0x0C | 02 12 82 02 | 0 | ....
13/0x0D | 77 66 55 44 | 0 | wfUD
14/0x0E | 33 01 04 E0 | 0 | 3...
15/0x0F | 69 96 00 00 | 0 | i...
16/0x10 | 02 10 3C 05 | 0 | ..<.
17/0x11 | 00 00 00 6A | 0 | ...j
18/0x12 | C7 39 F3 C4 | 0 | .9..
19/0x13 | E9 8A BE 99 | 0 | ....
20/0x14 | 4B CC F6 8D | 0 | K...
21/0x15 | 71 D0 88 84 | 0 | q...
22/0x16 | 02 14 9F 1A | 0 | ....
23/0x17 | 38 8C 40 7C | 0 | 8.@|
24/0x18 | 00 00 00 00 | 0 | ....
25/0x19 | 00 00 00 00 | 0 | ....
26/0x1A | 00 00 00 00 | 0 | ....
27/0x1B | 00 00 00 00 | 0 | ....

Card info original.
Detected UID E0 04 01 08 07 73 3B DA
UID : E0 04 01 08 07 73 3B DA
TYPE : NXP(Philips); IC SL2 ICS20/ICS21(SLI) ICS2002/ICS2102(SLIX)
SYSINFO : 00 0F DA 3B 73 07 08 01 04 E0 02 00 4F 03 01
- DSFID supported [0x02]
- AFI supported [0x00]
- IC reference supported [0x01]
- Tag provides info on memory layout (vendor dependent)
4 (or 3) bytes/blocks x 80 blocks
8E08F74D
C21D0200
3128E7D9
4C305049
42205342
38305342
2E405342
24505342
1A605342
4E000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
1234ABCD
1234ABCD
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
02128202
F0000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
02128202
F0000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
02103C05
0000006A
C739F3C4
E98ABE99
4BCCF68D
71D08884
02149F1A
388C407C
00000000
00000000
00000000
00000000
00000000
00000000

Last edited by fazer (2019-10-21 16:35:28)

fazer · 2019-10-22 09:45:46

Hello, I'll tell you if it's ok for me in January. Thanks, have a good day.

fazer · 2019-10-22 18:45:28

Re, I managed to write 56 block but there are errors but much better. Thank you good night.
..[-] iso15693 card select failed
...[-] Tag returned Error 16: The specified block is not available (doesn't exist).

block# | data |lck| ascii
---------+--------------+---+----------
0/0x00 | FF 08 FF 4D | 0 | ...M
1/0x01 | FF 1D 02 00 | 0 | ....
2/0x02 | 31 28 FF FF | 0 | 1(..
3/0x03 | 4C 30 50 49 | 0 | L0PI
4/0x04 | 18 04 19 58 | 0 | ...X
5/0x05 | 38 30 53 42 | 0 | 80SB
6/0x06 | 2E 40 53 42 | 0 | .@SB
7/0x07 | 24 50 53 42 | 0 | $PSB
8/0x08 | 1A 60 53 42 | 0 | .`SB
9/0x09 | 4E 00 00 00 | 0 | N...
10/0x0A | 00 00 00 00 | 0 | ....
11/0x0B | 00 00 00 00 | 0 | ....
12/0x0C | 00 00 00 00 | 0 | ....
13/0x0D | 00 00 00 00 | 0 | ....
14/0x0E | 00 00 00 00 | 0 | ....
15/0x0F | 00 00 00 00 | 0 | ....
16/0x10 | 00 00 00 00 | 0 | ....
17/0x11 | 00 00 00 00 | 0 | ....
18/0x12 | 00 00 00 00 | 0 | ....
19/0x13 | 00 00 00 00 | 0 | ....
20/0x14 | 12 34 FF FF | 0 | .4..
21/0x15 | 12 34 FF FF | 0 | .4..
22/0x16 | 00 00 00 00 | 0 | ....
23/0x17 | 00 00 00 00 | 0 | ....
24/0x18 | 00 00 00 00 | 0 | ....
25/0x19 | 00 00 00 00 | 0 | ....
26/0x1A | 00 00 00 00 | 0 | ....
27/0x1B | 00 00 00 00 | 0 | ....
28/0x1C | 00 00 00 00 | 0 | ....
29/0x1D | 00 00 00 00 | 0 | ....
30/0x1E | 00 00 00 00 | 0 | ....
31/0x1F | 00 00 00 00 | 0 | ....
32/0x20 | 00 00 00 00 | 0 | ....
33/0x21 | 00 00 00 00 | 0 | ....
34/0x22 | 00 00 00 00 | 0 | ....
35/0x23 | 00 00 00 00 | 0 | ....
36/0x24 | 00 00 00 00 | 0 | ....
37/0x25 | 00 00 00 00 | 0 | ....
38/0x26 | 00 00 00 00 | 0 | ....
39/0x27 | 00 00 00 00 | 0 | ....
40/0x28 | 00 00 00 00 | 0 | ....
41/0x29 | 00 00 00 00 | 0 | ....
42/0x2A | 00 00 00 00 | 0 | ....
43/0x2B | 00 00 00 00 | 0 | ....
44/0x2C | 00 00 00 00 | 0 | ....
45/0x2D | 00 00 00 00 | 0 | ....
46/0x2E | 02 12 FF 02 | 0 | ....
47/0x2F | FF 00 00 00 | 0 | ....
48/0x30 | 00 00 00 00 | 0 | ....
49/0x31 | 00 00 00 00 | 0 | ....
50/0x32 | 00 00 00 00 | 0 | ....
51/0x33 | 00 00 00 00 | 0 | ....
52/0x34 | 00 00 00 00 | 0 | ....
53/0x35 | 00 00 00 00 | 0 | ....
54/0x36 | 00 00 00 00 | 0 | ....
55/0x37 | 00 00 00 00 | 0 | ....

iceman · 2019-10-22 18:48:43

Lets hope the access system is not reading all blocks. Do report back your findings, however in a seperate thread please.

sashat720 · 2019-10-23 07:36:46

fazer wrote:

Re, I managed to write 56 block but there are errors but much better. Thank you good night.

Hi fazer, how did you manage to write 56 blocks?
I only managed to write 28 blocks by using "hf 15 restore" with the current iceman build..

I assume you are using this card:
https://www.rfxsecure.com/product/icode-sli-icode-slix-uid-custom-inlay/
Correct?

Pls help

fazer · 2019-10-23 09:08:51

Hello Sashat720, the first time I wrote block by block with the command (write). Then I injected the file bin with the command (restore) the end bin of my original card which contains 80 blocks. I had errors but much better than 26 blocks.So yes my cards come from the same seller as you.This original card contains 320 bytes since it had 15 days pay last year, it is rechargeable for this year, I think that I will use a daily card less write block. So I continue my search on this map & map to clone, there is a lot of reading to do & to understand the operation of this map.
Have a nice day, oh yes you have to insert a clone card.
Here is my configurtion .
Support iceman on patreon - https://www.patreon.com/iceman1001/
on paypal - https://www.paypal.me/iceman1001

[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC

[ Proxmark3 RFID instrument ]

[ CLIENT ]
client: RRG/Iceman
compiled with GCC 8.3.0 OS:Linux ARCH:x86_64

[ PROXMARK3 RDV4 ]
external flash: present
smartcard reader: present

[ PROXMARK3 RDV4 Extras ]
FPC USART for BT add-on support: absent

[ ARM ]
bootrom: RRG/Iceman/master/3586cad1 2019-10-08 18:03:05
os: RRG/Iceman/master/3586cad1 2019-10-08 18:04:17
compiled with GCC 5.4.1 20160919

[ FPGA ]
LF image built for 2s30vq100 on 2019-07-31 at 15:57:16
HF image built for 2s30vq100 on 2018-09-03 at 21:40:23

[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 276415 bytes (53%) Free: 247873 bytes (47%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory

Last edited by fazer (2019-10-23 09:39:03)

sashat720 · 2019-10-25 22:30:19

fazer wrote:

Hello Sashat720, the first time I wrote block by block with the command (write)

Hi fazer,

the first 28 blocks (number 0 to 27) work fine, can be written with the "hf 15 write" command.

Block 29 (number 28) and ff. are, however, not writeable:

[usb] pm3 --> hf 15 write u 28 00000000
iso15693 writing to page 28 (0x1C) | data

How did you manage to write more than 28 (0-27) blocks on these cards?

Last edited by sashat720 (2019-10-25 22:42:55)

fazer · 2019-10-26 18:05:57

Good evening Sashat720, I wrote the 28 blocks with the same cmd as you & then I write the bin file of my official card which contains 80 blocks, do not ask me for I could write as much block I can not you explain because I'm surprised myself. There is a lot of error why?, Here is my explanation that is not much help you, you must know that a dump gives us that the datas not use the rest that protect by a passwd, how to extract this passwd? I think it is necessary to be able to sniff between the reader & the card, it will be possible at the station this winter, but write the impeccable user blocks and the dump. Here is a good weekend @ soon on the fofo.

bob12x · 2019-11-07 18:47:20

Hello,

what are the factory default Privacy and Destroy passwords for this cards?

Is it even possible to set a Privacy password for these magic cards?

iceman · 2019-11-07 19:08:12

Dunno. I never tested it on them.

bob12x · 2019-11-10 23:43:15

Iceman, could you please ask the producer or manufacturer?

iceman · 2019-11-11 07:18:51

I'll try.

fazer · 2019-11-15 17:43:55

Hello iceman, the manufacturer of card magic15 provides a card with more memory ex: 80 block soon because I have several map of last year is it all 80 block in France.If not I will try to write the blocks one by one & tried on the spot this winter, I hope he does not read all the blocks.I will tell you what in January. Thanks, Have a nice week end

Last edited by fazer (2019-11-15 17:46:08)

Gambrius · 2019-11-19 18:30:22

Are there any news regarding the factory default passwords for privacy mode of the magic cards?
I bought mine at RFxSecure, but did not get any response yet.

Proxmark3 community

Announcement

#1 2018-04-22 10:30:16