Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
I've been playing with the PM3 and various china bought RFID cloners.
My efforts are all in an attempt to help my girlfriend's dad transition from a traditional locksmith replicating physical door keys to provide modern RFID cloning service for digital door locks.
I've had great success with duplication most cards utilizing PM3 and some china cloners on low frequency cards.
However, I've hit a major bump, and has been stuck for several months trying to figure out HID ICLASS and how I may utilize my HID Omnikeys 5321 CLi v2 to help replicate HID Iclass cards.
iclass card duplication has been actively sought after as home owners are at the mercy of ridiculous charges of US$50-US$100/card with their manager to issue additional / replace loss cards.
I've also spent a fair amount financially trying to locate local university enginerring students to assist me with this project, but money has been spent but there's been no progress.
I'm posting to request for a one on one help, maybe via skype, etc, to provide me a absolute dummy's guide to cloning iclass cards, like a step by step process utilizing PM3, and or Softwares which I can use with HID Omnikeys 5321 CLi v2.
This will be a paid tuition, please let me know if you're able to help me.
PS. I've read the Heart of Darkness, downloaded iclassifieds, copyclass and all sorts of other PDFs, and VMWares to run Win XP, but I can't find the instructions to duplicate iclass cards with my existing softwares and hardware. I believe I've most if not all of the pieces, but I don't know how to use them.
I've been stuck for about 6-8 weeks on this now. I'm sincere in my request and I hope some kind soul may offer some assistance.
Offline
Like Snorlax, I too am stuck on how to proceed.
Have been reading many papers and posts in this forum but still couldn't figure out where to start. Obviously, I won't be able to get older iClass readers like RW400 for key extraction as these readers are next to extinction.
I was hinted that it is possible to extract the master key from PM3 but still don't know how.
Could you please offer assistance on how to proceed with obtaining the master key? Currently, I have Omnikey 5321 V2 and PM3.
Thanks.
Offline
Hi Capecode,
I too have a Omnikey & PM3, but I don't think the master key's on PM3?
Rather I believe it's encrypted in 3DES on iclassifieds as it can read block 6 on the iclass cards.
Offline
Hi Snorlax,
Are you able to run iclassified? I have problem running this program as every time I run it, it give me "Cannot find reader" error. I'm using Windows 10 64 bit version.
Offline
You've to run it on a Windows XP machine running 32bit, just go get a VMWare and slap a XP image on it, you'll be set.
Offline
I'll give it a try.
Offline
Hi Snorlax,
I just did what you suggested. Installed Win XP SP2 on VMWare, then installed HID PCSC Driver 1.1.1.4 and Synchronous API 1.1.1.4.
After that tried to run "main.exe" from iclassified directory. Still the same error :
Connecting to reader : Omnikey Cardman 5x21-CL 0... Failed
Error : Could not find Omnikey Reader.
What happened? What did I do wrong?
Offline
Windows 10 64 bit version
Windows XP machine running 32bit
Offline
Capecode,
Did Windows XP VMware detected your usb device(Onnikeys)?
You can try running contactlessdemovc.exe to see if the device is detected properly. you look like you've the correct drivers except your machine is having difficulty detecting the reader.
If it's detected in Windows 10 OS, it will not be detectable in your Windows XP VMWare, because the device is "being used" in Win 10.
Shoutout: I'm still looking for someone to help me with this! =] Ideally if you've already extracted the keys, because it's been a MASSIVE pain to locate the older versions of RW400 to extract the keys.
Offline
I read your thread with interest, but I can not help you.
some Proxmark user from Australian seemed to use PM3 to clone HID iclass
https://www.securusglobal.com/community/2014/05/21/building-an-iclass-cloner/
interesting is what you can make of the artikel in OpenCD
http://www.openbeacon.org/Talk:HID_iClass_demystified
"Q: That nice, but in fact actually it's impossible to buy a machine able to make a copy ?
A: You only need the standard Desktop USB Omnikey Readers 5321/6321 to make a copy manually. You don't even need a special software, but only the extracted authentication key. A copy can be made using the free ContactlessDemoVC.exe (see Fig. 10 and Table III on page 6). This process can be fully automated in software."
Offline
Hi Snorlax,
Got very weird response from iClassified today. First, under Windows 10 (and XP under VMWare), iClassified now found Omnikey reader but were unable to establish secure mode.
After a while, running XP under VMWare, I was able to get iclassified to run correctly but don't know whether it will run again next time or not. Anyway, now I got a readout of csn, conf, App1, App2, iss, and block 6.
If iclassified is able to read block 6, then I would expect it to be able to read block 7-9 if you modify the code in main.c as suggested by member rparker in http://www.proxmark.org/forum/viewtopic.php?id=2755
After you have block 6-9 read, possibly, you can modify iClassified to write it. Don't know whether it will work or not as I am not even on step 1 yet.
However, I am unable to get mingw to run yet.
Offline
Dear ntk,
The very problem is how to get that AUTHENTICATION KEY without dissecting the old iclass readers. Also, it is obviously not possible to go to public readers and attach our "bottle of wine" to the back of readers. The only resources I currently have is Omnikey 5321 reader and PM3.
Offline
Made a mistake above. CANNOT read App1 & App2 above. App1 : block [06-12] App2 : block [13-1f]
That's it.
Offline
Another update :
I now installed mingw under WinXP and everything seems to work fine. I modified main.c to read block 7-9 and run it. It seems to read block 6-9 now. But the data on block 8 and 9 are the same. Is this right?
Offline
Hi Cape,
Do you have a skype username I can reach you at?
Offline
@capecode win7 and later use usually signed driver, to come around that problem there are ways to apply. like start up in "allowed to use unsigned driver" mode; call program to force window stay in test mode etc... I don't know about win10, particularly 64bit system, you are sure those signed/unsigned driver issue won't affect your work with thid device and program?
Also if you have PM3 and 6321 can you not snoop? Sorry my ignorance I don't have such hardware, but I would like to know what you can sniff or snoop from the 6321, if it is possible at all? what comes out of the snoop? what to do next? if failed to extract key from there why it fails? etc...
Again if I make mistake or say something wrongly pls correct me, so I can learn. I follow with interest to learn. Not that I want to advise/educate you, pls don't see me that way.
Offline
@Snorlax,
I have skype account but don't usually turn on. Do you use Whatsapp / Line / WeChat apps? I'm on a GMT+7 Timezone.
@ntk,
I believe PM3 can snoop but I haven't gone that far yet.
Have any of you use PM3 command "hf iclass loclass"? I can't seem to get it work with my standard iClass card.
Offline
I have not seen any HF iclass IOclass card. where you can get a used but valid HF iclass IOclass card, or HF standard iclass? For what are they used?
Offline
Hello,
I use MinGW to compile main.c and I have problem with error message "undefined reference to 'SendApdu'" Will you please suggest how can I pass this unresolved issue?
Thank you.
Offline
anyone got a copy of main.c which was modified to read block 7-9?
Offline
Newbie here - I've been able to run iclassified on an XP machine with the Omnikey 5321 CLi and I also get the ""Cannot find reader" error.
However, when I remove the card and put the card back on and run the Read command again iclassified does find the reader, but then it says that it "can't go into Secure Mode".
Can anyone give me some advice on where to go from there?
I've got the diagnostic tools from HID and it definitely shows that the drivers and everything is installed correctly.
Offline
Take a read through this blog post:
https://blog.kchung.co/reverse-engineering-hid-iclass-master-keys/
Secondly, the iClass master key for standard security has been leaked online through popular channels. It is arguably easier to find the key and use the PM3 to pull data.
Offline
Thanks for replying KChung.
I actually read your post and many other iclass-related posts quite a few times before I went ahead and bought the OK5321 reader. Your post is one of the most detailed and practical that I've found and had it bookmarked.
I downloaded iclassified and MinGW and was able to compile the source files by following your instructions.
The drivers have been downloaded and installed (although I couldn't get the older version of CardMan to install on WinXP because the newer driver automatically installs).
Trying to run the "iclass.exe" read is where I get stuck with the Secure Mode problem.
I spent the whole weekend trying to install and reinstall everything but still can't get any further. I do have a feeling it might be the newer version of the OmniKey driver that's causing me issues.
Re the iClass Master Key, I was able to get a hold of that - but key permutations are definitely not my specialty. I'll admit that reading the related documents leaves me quite confused and I honestly don't think it'll be something I'd be able to understand by myself any time soon.
I'll keep going at it in the meantime, but I'll wait until I go back to my home city and ask my programming friends to explain it to me.
On a separate topic, happy to report that I've been able to use the Proxmark3 to do some random HID, Indala and Pyramid tag cloning so far. I was able to test the copied tags to confirm that they actually work.
Last edited by bobbified (2017-03-06 11:52:49)
Offline
I spent the whole weekend trying to install and reinstall everything but still can't get any further. I do have a feeling it might be the newer version of the OmniKey driver that's causing me issues.
I'm not sure if that is your problem.
I have used scardsyn.dll v2.0.0.0 and v1.1.1.4 for reading various iCLASS cards.
I have not installed drivers on a Windows 10 system. Can't remember if I needed to install drivers on Windows 7.
ColdHeat/iclass appears to work fine.
I didn't have an easily accessible compiled version on hand so I used one of my own apps...
;Auth
Command: 80 82 00 F0 08 xx xx xx xx xx xx xx xx
Response: 90 00
Command: 80 88 00 F0
Response: 90 00
;UID
Command: 80 B0 00 00 08
Response: 54 B2 1A 02 F9 FF 12 E0 90 00
UID: E012FFF9021AB254
;PACS Block 7
Command: 80 B0 00 07 08
Response: 13 91 B7 3A C3 39 6E C8 90 00
Decoded: 0000000006020007
PACS: 10000000100000000000000111
Name - Standard 26bit - (H10301).
Site code - 1 (0x1)
Card number - 3 (0x3)This might help...
GitHub akw0088/HID-Card-Copy
Offline
I've been trying to install iclassified onto a win7 machine with the following driver problem before installing it to an old xp machine (Mingw was a PIA on this one). I'm now looking at a error that I cannot find described anywhere: "FAIL: Could not establish smartcard memory context". Anyone that has knowledge of this? OK Diagnostic tool cannot find the reader as well...
Offline
Sorry if I'm barking up the wrong tree here.. After a couple of restarts Omnikey Diagnostic tool suddenly works like a charm, but I'm now stuck with the same problem as bobbified regarding the "Secure Mode problem" whenever presenting a card and trigger the "iclass.exe read" command. Same command without a card present gives me "Could not find OMNIKEY reader". Is this normal behaviour? I can't seem to get my head around this.
Offline
Sorry if I'm barking up the wrong tree here.. After a couple of restarts Omnikey Diagnostic tool suddenly works like a charm, but I'm now stuck with the same problem as bobbified regarding the "Secure Mode problem" whenever presenting a card and trigger the "iclass.exe read" command. Same command without a card present gives me "Could not find OMNIKEY reader". Is this normal behaviour? I can't seem to get my head around this.
May be it's helps somebody. I solved this problem by installing VM Windows XP SP1 x86, installing drivers for Omnikey 6321/5321 from kchung github, installing net framework 4.0, installing microsoft visual c++ 2008. After all this actions omnikey starts read and write iclass cards but not correclty. When i put the card on omnikey and type "iclass read" in first time you will see "failed" after this omnikey will read the card, writing working only by one block "iclass write 0 4141414141414141", if i am try to write full dump of card, program will close. But it's nevermind i just write one block after another.
P/S Sorry fo my english.
Offline
hey sorry to bring the subject back up again i got everything to work the 5321 all good i done everything it telling me but now when i want to read the card it tells me authentication failed very confused here. dignostic tool reads and copycard reads it on this
Offline
Did anyone get this to work successfullly?
1. What type of re-writable card do you use to transfer the found blocks of information?
2. How did anyone solve the issue of getting this error " ERROR Authorization failed"
3. How did anyone solve the issue of the "Could not find OMNIKEY reader"?
Last edited by diamondrail (2019-09-23 15:46:50)
Offline
Pages: 1