# Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.

"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

## #1 2018-04-22 10:30:16

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### MAGIC ISO15693 tags

Found a producer which claims magic iso 15693 tags,    the initial tags has all same UID  which is a good indicator that the claims are true.

I let you all know more,   I am quite busy with adapting iceman fork for RDV40...

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #2 2018-04-23 16:39:09

Dot.Com
Contributor
From: Hong Kong
Registered: 2016-10-05
Posts: 178
Website

### Re: MAGIC ISO15693 tags

That's a quick post!

I will pump it the details this week. Let's see who is interested.

You live, you learn.
You give, you take.
You win, you lose.

Offline

## #3 2018-07-15 08:53:57

yaowang
Contributor
Registered: 2017-01-11
Posts: 15

### Re: MAGIC ISO15693 tags

1k，and use 13.8Mhz。。。I bought some。。。

Offline

## #4 2018-07-15 12:11:08

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

The tags has a custom uid set,  when ordered from supplier.   So yeah,  work,  but not very useful in current version.
The supplier doesn't want to release how to change UID at will,..  This will limit their sales quite a lot.

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #5 2018-07-18 17:00:21

dipolin
Contributor
Registered: 2017-05-04
Posts: 12

### Re: MAGIC ISO15693 tags

Hi Iceman

I'm new to this community and I have not contributed anything yet, although I have learned a lot ... before asking, searching and reading

I have a contact in China that makes me custom rfid UID tags, I am going to ask him if he can get MAGIC ISO15693

If you need special information, tell me and I'll ask him

"The only certain thing, the insecurity of things"

Offline

## #6 2018-07-18 19:47:14

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

Ask for uid changeable iso-15693 cards.   aka magic.
Not custom UID...    possibility to change uid by yourself.

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #7 2018-07-18 21:25:11

dipolin
Contributor
Registered: 2017-05-04
Posts: 12

### Re: MAGIC ISO15693 tags

ok, as soon as I know something I inform you, that will take some days

"The only certain thing, the insecurity of things"

Offline

## #8 2018-07-19 11:39:15

dipolin
Contributor
Registered: 2017-05-04
Posts: 12

### Re: MAGIC ISO15693 tags

Good news iceman!

My contact can supply me ISO15693 tags with UID modifiable.

I have asked him to send me some samples, as soon as he receives them, I will contact you.

"The only certain thing, the insecurity of things"

Offline

## #9 2018-07-19 20:47:28

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #10 2018-07-23 11:55:40

dipolin
Contributor
Registered: 2017-05-04
Posts: 12

### Re: MAGIC ISO15693 tags

Hi, Iceman.

I really do not know who is the Chinese manufacturer, I always do business with him as an intermediary.

I met him in a congress through a provider.

I do not know if he will be a reseller, I call him "the obtainer", because practically everything I have asked for and they are not usual things that you can find on aliexpress or GeZhi Electronic Co.Ltd.  at the end, he has obtained them to me, and he makes me personalized works.

"The only certain thing, the insecurity of things"

Offline

## #11 2018-07-23 18:09:39

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

GeZhi..  aha,  he is known on this forum...

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #12 2018-07-23 20:19:30

dipolin
Contributor
Registered: 2017-05-04
Posts: 12

### Re: MAGIC ISO15693 tags

I think that either I misread your message or you misunderstood me ... GeZhi is not my contact, he is a Chinese who lives in Valencia (Spain).

I do not think it has anything to do with GeZhi.

"The only certain thing, the insecurity of things"

Offline

## #13 2018-07-23 21:36:10

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

you are right,  I missunderstood.

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #14 2018-12-04 14:33:26

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

Life finds a way

The ISO15693 uid-custom card found on RFXSecure   https://www.rfxsecure.com/product/icode … tom-inlay/ has now been sorted out to become fully UID rewritable.

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #15 2018-12-11 11:00:35

dipolin
Contributor
Registered: 2017-05-04
Posts: 12

### Re: MAGIC ISO15693 tags

Very good news!

Did the samples I sent you work?

"The only certain thing, the insecurity of things"

Offline

## #16 2018-12-11 14:47:14

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

Yes,  it works on those samples aswell.   I assume its from the same source

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #17 2019-02-02 18:40:57

pruwait
Contributor
Registered: 2018-01-07
Posts: 6

### Re: MAGIC ISO15693 tags

iceman wrote:

Life finds a way

The ISO15693 uid-custom card found on RFXSecure   https://www.rfxsecure.com/product/icode … tom-inlay/ has now been sorted out to become fully UID rewritable.

http://www.icedev.se/proxmark3/magicISO15693.png

This card works but...
proxmark can't send to card right command or card answers not right....

 bootrom: iceman/master/ice_v3.1.0-1072-gfbc42bd7 2019-02-02 20:05:11
os: iceman/master/ice_v3.1.0-1072-gfbc42bd7 2019-02-02 20:05:20

Why card select failed (and write/read is OK)?

pm3 --> hf 15 restore f hf-15-2F386888500104E0-dump.bin
[=] Blocksize: 4
iso15693 writing to page 00 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 00 (0x&02X) | data
OK
iso15693 writing to page 01 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 01 (0x&02X) | data
OK
iso15693 writing to page 02 (0x&02X) | data
OK
iso15693 writing to page 03 (0x&02X) | data
OK
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
OK
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
OK
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
OK
iso15693 writing to page 07 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 07 (0x&02X) | data
OK
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed

pm3 --> hf 15 dump
[=] Using UID as filename
Reading memory from tag UID E0 16 24 66 1A A5 85 8F
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
..[-] iso15693 card select failed
...[-] iso15693 card select failed
..[-] iso15693 card select failed
[-] iso15693 card select failed
.[-] iso15693 card select failed
[-] iso15693 card select failed
....[-] iso15693 card select failed
#db# [!] error, uneven octet! (extra bits!) mask 02
.[-] iso15693 card select failed
.[-] iso15693 card select failed
.....[-] iso15693 card select failed
...[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed

block#   | data         |lck| ascii
---------+--------------+---+----------
0/0x00 | 00 00 00 00  | 0 | ....
1/0x01 | 00 00 00 00  | 0 | ....
2/0x02 | 00 00 00 00  | 0 | ....
3/0x03 | 00 00 00 00  | 0 | ....
4/0x04 | 00 00 00 00  | 0 | ....
5/0x05 | 00 00 00 00  | 0 | ....
6/0x06 | 00 00 00 00  | 0 | ....
7/0x07 | 00 00 00 00  | 0 | ....
8/0x08 | 00 00 00 00  | 0 | ....
9/0x09 | 00 00 00 00  | 0 | ....
10/0x0A | 00 00 00 00  | 0 | ....
11/0x0B | 00 00 00 00  | 0 | ....
12/0x0C | 00 00 00 00  | 0 | ....
13/0x0D | 00 00 00 00  | 0 | ....
14/0x0E | 00 00 00 00  | 0 | ....
15/0x0F | 00 00 00 00  | 0 | ....
16/0x10 | 00 00 00 00  | 0 | ....
17/0x11 | 00 00 00 00  | 0 | ....
18/0x12 | 00 00 00 00  | 0 | ....
19/0x13 | 00 00 00 00  | 0 | ....
20/0x14 | 00 00 00 00  | 0 | ....
21/0x15 | 00 00 00 00  | 0 | ....

[+] saved 22 blocks to text file hf-15-8F85A51A662416E0-dump.eml
[+] saved 88 bytes to binary file hf-15-8F85A51A662416E0-dump.bin

Offline

## #18 2019-02-02 19:27:52

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

that would be more of iso15 support in firmware than the magic tags fault.
Try the offical repo,  it has gotten some major changes the last months when it come to iso15,  to see if it works better for you.
iso15 has been picky about distance and positioning in the past,   see if you find your sweetspot with your setup

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #19 2019-02-04 10:28:46

steph
Contributor
Registered: 2019-01-31
Posts: 3

### Re: MAGIC ISO15693 tags

pruwait wrote:

Why card select failed (and write/read is OK)?

pm3 --> hf 15 restore f hf-15-2F386888500104E0-dump.bin
[=] Blocksize: 4
iso15693 writing to page 00 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 00 (0x&02X) | data
OK
iso15693 writing to page 01 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 01 (0x&02X) | data
OK
iso15693 writing to page 02 (0x&02X) | data
OK
iso15693 writing to page 03 (0x&02X) | data
OK
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 04 (0x&02X) | data
OK
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 05 (0x&02X) | data
OK
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 06 (0x&02X) | data
OK
iso15693 writing to page 07 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 07 (0x&02X) | data
OK
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed
iso15693 writing to page 08 (0x&02X) | data
[-] iso15693 card select failed

I also experienced that, so i used the R option with 10 times and finaly got my dumped.

pruwait wrote:
pm3 --> hf 15 dump
[=] Using UID as filename
Reading memory from tag UID E0 16 24 66 1A A5 85 8F
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
..[-] iso15693 card select failed
...[-] iso15693 card select failed
..[-] iso15693 card select failed
[-] iso15693 card select failed
.[-] iso15693 card select failed
[-] iso15693 card select failed
....[-] iso15693 card select failed
#db# [!] error, uneven octet! (extra bits!) mask 02
.[-] iso15693 card select failed
.[-] iso15693 card select failed
.....[-] iso15693 card select failed
...[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed
[-] iso15693 card select failed

block#   | data         |lck| ascii
---------+--------------+---+----------
0/0x00 | 00 00 00 00  | 0 | ....
1/0x01 | 00 00 00 00  | 0 | ....
2/0x02 | 00 00 00 00  | 0 | ....
3/0x03 | 00 00 00 00  | 0 | ....
4/0x04 | 00 00 00 00  | 0 | ....
5/0x05 | 00 00 00 00  | 0 | ....
6/0x06 | 00 00 00 00  | 0 | ....
7/0x07 | 00 00 00 00  | 0 | ....
8/0x08 | 00 00 00 00  | 0 | ....
9/0x09 | 00 00 00 00  | 0 | ....
10/0x0A | 00 00 00 00  | 0 | ....
11/0x0B | 00 00 00 00  | 0 | ....
12/0x0C | 00 00 00 00  | 0 | ....
13/0x0D | 00 00 00 00  | 0 | ....
14/0x0E | 00 00 00 00  | 0 | ....
15/0x0F | 00 00 00 00  | 0 | ....
16/0x10 | 00 00 00 00  | 0 | ....
17/0x11 | 00 00 00 00  | 0 | ....
18/0x12 | 00 00 00 00  | 0 | ....
19/0x13 | 00 00 00 00  | 0 | ....
20/0x14 | 00 00 00 00  | 0 | ....
21/0x15 | 00 00 00 00  | 0 | ....

[+] saved 22 blocks to text file hf-15-8F85A51A662416E0-dump.eml
[+] saved 88 bytes to binary file hf-15-8F85A51A662416E0-dump.bin

For this i played a little with the antenna and the card, to find the right position..

But yes, no problem with the original card, little noise with the magic one...

Offline

## #20 2019-02-11 22:00:29

flux
Contributor
Registered: 2019-02-09
Posts: 4

### Re: MAGIC ISO15693 tags

iceman wrote:

The ISO15693 uid-custom card found on RFXSecure has now been sorted out to become fully UID rewritable.

@iceman
I have searched for the iso15_magic script for a while now. Would it be possible to get it into my fingers?

BTW: Its absolutely true that the iso15 cards are picky regarding distance to the antenna. I am using a soldering claw to fix the distance between card and antenna which significantly improves the selec/read/write operations.

Last edited by flux (2019-02-11 22:01:05)

Offline

## #21 2019-02-13 13:58:24

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

Depends where you bought your cards.  If you bought from rfxsecure.com https://www.rfxsecure.com/product/icode … tom-inlay/ you should have gotten it from them.

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #22 2019-03-01 12:42:08

shefajs
Contributor
Registered: 2019-02-27
Posts: 3

### Re: MAGIC ISO15693 tags

Hello,

I bought recently a lot of ISO 15693 magic stickers from this manufacturer.
https://makarfid.com/products/uid-changeable-card/

They may or may not be made by same manufacturer as cards mentioned above (does anyone know the OEM of the cards?)
Since no-one else was mentioning the stickers it may be something completely different...

But anyway I would love to interface those by proxmark.

Especially since the manufacturer want quite outrageous sum for the software to write UID ($1000 for every type of the card and HWID locked for 1 PC only). In case it's something different I actually bought the software for the client (only for I-Code SLI-X.....they want another$1000 for the icode SLI-S) so I could record/sniff the command for the UID rewrite.

But since I'm unskilled with Proxmark, can You help me with that?

1) I need the Icemans lua script to try the same UID operations as mentioned above (But 50/50 since they use a different commands for SLI-X and SLI-S).
2) I need the re-commanded commands and setup for proxmark to sniff the UID write from OEM software.

Thank You.

Last edited by shefajs (2019-03-01 12:44:24)

Offline

## #23 2019-03-01 21:35:11

piwi
Contributor
Registered: 2013-06-04
Posts: 704

### Re: MAGIC ISO15693 tags

Re 2) iso15693 allows a variety of modulations and codings. Proxmark knows only some of them. But give it a try: 'hf 15 snoop', stop with PM3 button, then 'hf list 15’.

Offline

## #24 2019-06-24 08:41:26

t0m4
Contributor
Registered: 2012-07-07
Posts: 9

### Re: MAGIC ISO15693 tags

Hi @iceman,

I just received my ISO15693 UID changeable from RfxSecure and I requested the iso15_magic.lua script via their chat.
I got the version 1.02 of the script.

First of all, I had to modify it to change the commands from "hf 15 raw" to "hf 15 cmd raw", that is quite surprising.

Then, when I use it I can't manage to change the UID.

Here is the result :

proxmark3> script run iso15_magic -u E004013344556677
--- Executing: iso15_magic.lua, args '-u E004013344556677'
----------------------------------------
----------------------------------------

new UID | E004013344556677
Using backdoor Magic tag function

-----Finished

#db# 12 octets read from IDENTIFY request:
#db# NoErr CrcOK
#db# ........ 00 00 00 00 00 00 00 00
#db# ..xc     00 00 78 63
#db# UID = 0000000000000000

So, basically, it "reseted" the UID but couldn't write the new one.

I tried with 2 different antennas and several distances antenna-card with no success.

I also tried to type the following raw commands (used in the script) directly, with the same result :

proxmark3> hf 15 cmd raw -2 -c 02213E00000000

hf 15 cmd raw -2 -c 02213F69960000

hf 15 cmd raw -2 -c 02213877665544

hf 15 cmd raw -2 -c 022139330104E0
received 0 octets

My guess the third & fourth commands aren't correct since they don't return the expected result (00 78 F0).

Could you please tell me if these commands are those that should be used ?

For information, I'm using the official repo of proxmark3 (latest version), not your fork but I believe the script doesn't rely on it. Tell me if I'm wrong.

Best regards.

Offline

## #25 2019-06-24 20:54:50

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

The correct output from a successful script run doesn't look like that.  Then on the other hand you are using it on official repo.
You most likely need to edit the script to run just the offical repo commands.  (it should be a oneline change)

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #26 2019-06-24 23:23:49

t0m4
Contributor
Registered: 2012-07-07
Posts: 9

### Re: MAGIC ISO15693 tags

But I still can't get it work on the official repo, even with the "-a" parameter.

So I switched to your repo (and firmware) and I finally managed to set the new UID !

Great work !

Offline

## #27 2019-06-25 07:40:45

piwi
Contributor
Registered: 2013-06-04
Posts: 704

### Re: MAGIC ISO15693 tags

The "hf 15 cmd raw" command on official repo has been changed to switch of the HF field after each command. This was a quick fix in order to protect RDV4 from overheating until a better protection strategy can be found. Sequences of raw commands which require the card to remain powered on between the commands (like in the mentioned script) therefore fail.

Offline

## #28 2019-06-25 20:36:49

t0m4
Contributor
Registered: 2012-07-07
Posts: 9

### Re: MAGIC ISO15693 tags

Thank you @piwi for this explanation.
I was wondering why there was a difference between official and iceman’s repo while executing 4 simple raw commands, especially with an option to use this script on the official repo...

Offline

## #29 2019-06-26 16:38:05

tzxiang
Contributor
Registered: 2019-02-06
Posts: 2

### Re: MAGIC ISO15693 tags

Hi

I am new to proxmark and trying to clone a 15693. I encountered this error using the iso15_magic script. I tried on both official and iceman builds. Would appreciate some help

script run iso15_magic -u E00401502A4A0C22 -a
--- Executing: iso15_magic.lua, args '-u E00401502A4A0C22 -a'

-----Finished

Last edited by tzxiang (2019-06-26 16:38:49)

Offline

## #30 2019-06-26 18:58:01

t0m4
Contributor
Registered: 2012-07-07
Posts: 9

### Re: MAGIC ISO15693 tags

Hi @tzxiang,

Got the same issue.

You just have to comment out the second line of the script :

-- local lib15 = require('read15')

I have obsolutely no idea what it should append but, for me, it worked without it.

Hope this helps.

Offline

## #31 2019-07-06 18:35:20

t0m4
Contributor
Registered: 2012-07-07
Posts: 9

### Re: MAGIC ISO15693 tags

Hi @iceman,

I just submitted a pull request on the official repo to add the command hf 15 csetuid <UID>, since your script no longer works on this repo because of the RDV4 over-heating protection in DirectTag15693Command(), as explained by @piwi.

Hope this is OK with you.

Here is the result :

Best regards.

Offline

## #32 2019-07-06 20:31:26

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

Well since you are at it,  you could to a PR to the RRG repo aswell

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #33 2019-07-06 21:04:53

t0m4
Contributor
Registered: 2012-07-07
Posts: 9

### Re: MAGIC ISO15693 tags

Ok. I'll give a try on tomorrow then...

Thanks.

Offline

## #34 2019-07-07 10:07:39

t0m4
Contributor
Registered: 2012-07-07
Posts: 9

### Re: MAGIC ISO15693 tags

Hi @iceman,

So, as requested, I just made a pull request on the RRG repo to add the hf 15 csetuid command.

I implemented it in a much simplier way, by reproducing your script, with 4 raw commands in a row (using SendCommandOLD()).

Seems to be working fine :

Best regards.

Offline

## #35 2019-07-07 11:52:23

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

Look at that!  Well done,   I will adapt it to use NG

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #36 2019-10-21 09:38:52

sashat720
Contributor
Registered: 2019-09-16
Posts: 6

### Re: MAGIC ISO15693 tags

I ordered these cards and yes, they to work, the UID is changeable.

However, these cards have only 28 blocks of 4 bytes each, whereas I need 52 blocks to clone a EM4233 card..

Offline

## #37 2019-10-21 16:30:23

fazer
Contributor
Registered: 2019-03-02
Posts: 62

### Re: MAGIC ISO15693 tags

Re: MAGIC ISO15693 tags

Hello, I bought two cards .I just have a question I made a dump of my card which has 80 blocks I wrote 27 blocks in this card the rest of the blocks of 00000000, my question & do you think can the reader read this card? . Thank you good day.

block#   | data         |lck| ascii
---------+--------------+---+----------
0/0x00 | 8E 08 F7 4D  | 0 | ...M
1/0x01 | C2 1D 02 00  | 0 | ....
2/0x02 | 31 28 E7 D9  | 0 | 1(..
3/0x03 | 4C 30 50 49  | 0 | L0PI
4/0x04 | 42 20 53 42  | 0 | B SB
5/0x05 | 38 30 53 42  | 0 | 80SB
6/0x06 | 2E 40 53 42  | 0 | .@SB
7/0x07 | 24 50 53 42  | 0 | $PSB 8/0x08 | 1A 60 53 42 | 0 | .SB 9/0x09 | 4E 00 00 00 | 0 | N... 10/0x0A | 12 34 AB CD | 0 | .4.. 11/0x0B | 12 34 AB CD | 0 | .4.. 12/0x0C | 02 12 82 02 | 0 | .... 13/0x0D | 77 66 55 44 | 0 | wfUD 14/0x0E | 33 01 04 E0 | 0 | 3... 15/0x0F | 69 96 00 00 | 0 | i... 16/0x10 | 02 10 3C 05 | 0 | ..<. 17/0x11 | 00 00 00 6A | 0 | ...j 18/0x12 | C7 39 F3 C4 | 0 | .9.. 19/0x13 | E9 8A BE 99 | 0 | .... 20/0x14 | 4B CC F6 8D | 0 | K... 21/0x15 | 71 D0 88 84 | 0 | q... 22/0x16 | 02 14 9F 1A | 0 | .... 23/0x17 | 38 8C 40 7C | 0 | 8.@| 24/0x18 | 00 00 00 00 | 0 | .... 25/0x19 | 00 00 00 00 | 0 | .... 26/0x1A | 00 00 00 00 | 0 | .... 27/0x1B | 00 00 00 00 | 0 | .... Card info original. Detected UID E0 04 01 08 07 73 3B DA UID : E0 04 01 08 07 73 3B DA TYPE : NXP(Philips); IC SL2 ICS20/ICS21(SLI) ICS2002/ICS2102(SLIX) SYSINFO : 00 0F DA 3B 73 07 08 01 04 E0 02 00 4F 03 01 - DSFID supported [0x02] - AFI supported [0x00] - IC reference supported [0x01] - Tag provides info on memory layout (vendor dependent) 4 (or 3) bytes/blocks x 80 blocks 8E08F74D C21D0200 3128E7D9 4C305049 42205342 38305342 2E405342 24505342 1A605342 4E000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1234ABCD 1234ABCD 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 02128202 F0000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 02128202 F0000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 02103C05 0000006A C739F3C4 E98ABE99 4BCCF68D 71D08884 02149F1A 388C407C 00000000 00000000 00000000 00000000 00000000 00000000 Last edited by fazer (2019-10-21 16:35:28) Offline ## #38 2019-10-22 09:45:46 fazer Contributor Registered: 2019-03-02 Posts: 62 ### Re: MAGIC ISO15693 tags Hello, I'll tell you if it's ok for me in January. Thanks, have a good day. Offline ## #39 2019-10-22 18:45:28 fazer Contributor Registered: 2019-03-02 Posts: 62 ### Re: MAGIC ISO15693 tags Re, I managed to write 56 block but there are errors but much better. Thank you good night. ..[-] iso15693 card select failed ...[-] Tag returned Error 16: The specified block is not available (doesn't exist). block# | data |lck| ascii ---------+--------------+---+---------- 0/0x00 | FF 08 FF 4D | 0 | ...M 1/0x01 | FF 1D 02 00 | 0 | .... 2/0x02 | 31 28 FF FF | 0 | 1(.. 3/0x03 | 4C 30 50 49 | 0 | L0PI 4/0x04 | 18 04 19 58 | 0 | ...X 5/0x05 | 38 30 53 42 | 0 | 80SB 6/0x06 | 2E 40 53 42 | 0 | .@SB 7/0x07 | 24 50 53 42 | 0 |$PSB
8/0x08 | 1A 60 53 42  | 0 | .SB
9/0x09 | 4E 00 00 00  | 0 | N...
10/0x0A | 00 00 00 00  | 0 | ....
11/0x0B | 00 00 00 00  | 0 | ....
12/0x0C | 00 00 00 00  | 0 | ....
13/0x0D | 00 00 00 00  | 0 | ....
14/0x0E | 00 00 00 00  | 0 | ....
15/0x0F | 00 00 00 00  | 0 | ....
16/0x10 | 00 00 00 00  | 0 | ....
17/0x11 | 00 00 00 00  | 0 | ....
18/0x12 | 00 00 00 00  | 0 | ....
19/0x13 | 00 00 00 00  | 0 | ....
20/0x14 | 12 34 FF FF  | 0 | .4..
21/0x15 | 12 34 FF FF  | 0 | .4..
22/0x16 | 00 00 00 00  | 0 | ....
23/0x17 | 00 00 00 00  | 0 | ....
24/0x18 | 00 00 00 00  | 0 | ....
25/0x19 | 00 00 00 00  | 0 | ....
26/0x1A | 00 00 00 00  | 0 | ....
27/0x1B | 00 00 00 00  | 0 | ....
28/0x1C | 00 00 00 00  | 0 | ....
29/0x1D | 00 00 00 00  | 0 | ....
30/0x1E | 00 00 00 00  | 0 | ....
31/0x1F | 00 00 00 00  | 0 | ....
32/0x20 | 00 00 00 00  | 0 | ....
33/0x21 | 00 00 00 00  | 0 | ....
34/0x22 | 00 00 00 00  | 0 | ....
35/0x23 | 00 00 00 00  | 0 | ....
36/0x24 | 00 00 00 00  | 0 | ....
37/0x25 | 00 00 00 00  | 0 | ....
38/0x26 | 00 00 00 00  | 0 | ....
39/0x27 | 00 00 00 00  | 0 | ....
40/0x28 | 00 00 00 00  | 0 | ....
41/0x29 | 00 00 00 00  | 0 | ....
42/0x2A | 00 00 00 00  | 0 | ....
43/0x2B | 00 00 00 00  | 0 | ....
44/0x2C | 00 00 00 00  | 0 | ....
45/0x2D | 00 00 00 00  | 0 | ....
46/0x2E | 02 12 FF 02  | 0 | ....
47/0x2F | FF 00 00 00  | 0 | ....
48/0x30 | 00 00 00 00  | 0 | ....
49/0x31 | 00 00 00 00  | 0 | ....
50/0x32 | 00 00 00 00  | 0 | ....
51/0x33 | 00 00 00 00  | 0 | ....
52/0x34 | 00 00 00 00  | 0 | ....
53/0x35 | 00 00 00 00  | 0 | ....
54/0x36 | 00 00 00 00  | 0 | ....
55/0x37 | 00 00 00 00  | 0 | ....

Offline

## #40 2019-10-22 18:48:43

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #41 2019-10-23 07:36:46

sashat720
Contributor
Registered: 2019-09-16
Posts: 6

### Re: MAGIC ISO15693 tags

fazer wrote:

Re, I managed to write 56 block but there are errors but much better. Thank you good night.

Hi fazer, how did you manage to write 56 blocks?
I only managed to write 28 blocks by using "hf 15 restore" with the current iceman build..

I assume you are using this card:
https://www.rfxsecure.com/product/icode-sli-icode-slix-uid-custom-inlay/
Correct?

Pls help

Offline

## #42 2019-10-23 09:08:51

fazer
Contributor
Registered: 2019-03-02
Posts: 62

### Re: MAGIC ISO15693 tags

Hello Sashat720, the first time I wrote block by block with the command (write). Then I injected the file bin with the command (restore) the end bin of my original card which contains 80 blocks. I had errors but much better than 26 blocks.So yes my cards come from the same seller as you.This original card contains 320 bytes since it had 15 days pay last year, it is rechargeable for this year, I think that I will use a daily card less write block. So I continue my search on this map & map to clone, there is a lot of reading to do & to understand the operation of this map.
Have a nice day, oh yes you have to insert a clone card.
Here is my configurtion .
Support iceman on patreon - https://www.patreon.com/iceman1001/
on paypal - https://www.paypal.me/iceman1001

[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC

[ Proxmark3 RFID instrument ]

[ CLIENT ]
client: RRG/Iceman
compiled with GCC 8.3.0 OS:Linux ARCH:x86_64

[ PROXMARK3 RDV4 ]
external flash:                  present

[ PROXMARK3 RDV4 Extras ]
FPC USART for BT add-on support: absent

[ ARM ]
compiled with GCC 5.4.1 20160919

[ FPGA ]
LF image built for 2s30vq100 on 2019-07-31 at 15:57:16
HF image built for 2s30vq100 on 2018-09-03 at 21:40:23

[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 276415 bytes (53%) Free: 247873 bytes (47%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory

Last edited by fazer (2019-10-23 09:39:03)

Offline

## #43 2019-10-25 22:30:19

sashat720
Contributor
Registered: 2019-09-16
Posts: 6

### Re: MAGIC ISO15693 tags

fazer wrote:

Hello Sashat720, the first time I wrote block by block with the command (write)

Hi fazer,

the first 28 blocks (number 0 to 27) work fine, can be written with the "hf 15 write" command.

Block 29 (number 28) and ff. are, however, not writeable:

[usb] pm3 --> hf 15 write u 28 00000000
iso15693 writing to page 28 (0x1C) | data

How did you manage to write more than 28 (0-27) blocks on these cards?

Last edited by sashat720 (2019-10-25 22:42:55)

Offline

## #44 2019-10-26 18:05:57

fazer
Contributor
Registered: 2019-03-02
Posts: 62

### Re: MAGIC ISO15693 tags

Good evening Sashat720, I wrote the 28 blocks with the same cmd as you & then I write the bin file of my official card which contains 80 blocks, do not ask me for I could write as much block I can not you explain because I'm surprised myself. There is a lot of error why?, Here is my explanation that is not much help you, you must know that a dump gives us that the datas not use the rest that protect by a passwd, how to extract this passwd? I think it is necessary to be able to sniff between the reader & the card, it will be possible at the station this winter, but write the impeccable user blocks and the dump. Here is a good weekend @ soon on the fofo.

Offline

## #45 2019-11-07 18:47:20

bob12x
Contributor
Registered: 2019-10-27
Posts: 4

### Re: MAGIC ISO15693 tags

Hello,

what are the factory default Privacy and Destroy passwords for this cards?

Is it even possible to set a Privacy password for these magic cards?

Offline

## #46 2019-11-07 19:08:12

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

Dunno.  I never tested it on them.

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #47 2019-11-10 23:43:15

bob12x
Contributor
Registered: 2019-10-27
Posts: 4

Offline

## #48 2019-11-11 07:18:51

iceman
Registered: 2013-04-25
Posts: 6,473
Website

### Re: MAGIC ISO15693 tags

I'll try.

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

## #49 2019-11-15 17:43:55

fazer
Contributor
Registered: 2019-03-02
Posts: 62

### Re: MAGIC ISO15693 tags

Hello iceman, the manufacturer of card magic15 provides a card with more memory ex: 80 block soon because I have several map of last year is it all 80 block in France.If not I will try to write the blocks one by one & tried on the spot this winter, I hope he does not read all the blocks.I will tell you what in January. Thanks, Have a nice week end

Last edited by fazer (2019-11-15 17:46:08)

Offline

## #50 2019-11-19 18:30:22

Gambrius
Contributor
From: germany
Registered: 2019-10-28
Posts: 25
Website

### Re: MAGIC ISO15693 tags

Are there any news regarding the factory default passwords for privacy mode of the magic cards?
I bought mine at RFxSecure, but did not get any response yet.

I do a lot with tonies. If you like to read more:

My Blog (Gambrius Tech-Blog): http://www.gt-blog.de

Offline