Proxmark3 community

vivat

Contributor

Registered: 2010-10-26

Posts: 332

iClass change CSN

Is there any way to rewrite CSN of the iClass card?

carl55

Contributor

From: Arizona USA

Registered: 2010-07-04

Posts: 175

Re: iClass change CSN

The PicoPass datasheet talks very little about the Card Serial Number (CSN) which is stored in Block 0 of the chip. I would have expected the datasheet to explicitly state that the CSN is "Read Only" but the only thing said about it is the following:

"This area stores the unique 64-bit chip serial number which is set up during the production phase.
It is used in the anti-collision procedure."

I personally have tried to re-write the CSN but I have had no success. I have even tried to write it using an un-initialized card while it is still in personalization mode and before it has been placed in application mode. Unfortunately that did not work either. If there is a "backdoor" procedure that will allow its modification then I am sure that the manufacturer would tightly restrict its disclosure.

I would typically expect that a fuse is blown during the production phase after the CSN is programmed. That would keep the CSN from being modified in the field.

The bottom line is that the iClass CSN appears to be "Read Only" and not modifiable. If anyone knows something to the contrary then I would be very interested to learn more.

Chigurh

Member

Registered: 2015-09-16

Posts: 9

Re: iClass change CSN

Replying to an old thread but it seems from the Picopass datasheet that CSN is not readable, at least officially