How to change the UID of Gen1A Magic Card with ChameleonUltra

Requirement

1. The ChameleonUltra device must be running firmware version 2.0.0 or later. Please note that the ChameleonLite device does not support reader mode.
2. You will need a Gen1A Magic Card, which is a Mifare Classic Card or Key fob with a 4-byte UID. This type of card is also referred to as a UID Card or UFUID Card.

Software

1. Official clients
   Windows / Linux / macOS
2. MTools Lite App
   Android / iOS / Website

Steps on Official Clients

1. Connect the ChameleonUltra device to the client using a USB connection.
2. Connect to the device using the command hw connect.
3. Enter the reader mode by executing the command hw mode -r.
4. Run the Magic WUPC1 command: hf 14a raw -k -b 7 -d 40. Check for a success response of 0A.
5. Run the Magic WUPC2 command: hf 14a raw -k -d 43. Check for a success response of 0A.
6. Run the Write Block 0 command: hf 14a raw -c -k -cc -d A000.
7. Run the Write Block 0 Data command: hf 14a raw -c -cc -d 11223344440804001122334455667788.
8. Run the HF Scan command: hf 14a scan to view the changed UID information.
9. Exit the reader mode and enter emulation mode using the command: hw mode -e.

Steps on MTools Lite App

Before proceeding with the following actions, please ensure that you have connected the ChameleonUltra device using MTools Lite’s Bluetooth connection feature.

With Chameleon CLI

1. Enter the reader mode by clicking the toggle switch.
2. Scan the old UID by clicking the hf scan button.
3. Execute the command hf 14a raw -k -b 7 -d 40 for Magic WUPC1.
4. Execute the command hf 14a raw -k -d 43 for Magic WUPC2.
5. Execute the command hf 14a raw -ckl -d A000 for writing block purposes.
6. Execute the command hf 14a raw -cl -d 11223344440804001122334455667788 to write data to block 0.
7. Scan the new UID by clicking the hf scan button.
8. Exit the reader mode.

With UID Changer

This premium feature enables you to effortlessly change the UID of your Gen1A Magic Card with just one click.

1. Simply click on the Reader icon to scan the original UID information.
2. Input the desired new UID and, if needed, modify the SAK, ATQA, or Manufacturer Information.
3. Finally, click the Execute button to initiate the UID change process.

BCC Notice

Make sure the BCC byte (The byte after UID) is valid. The value of BCC byte is the XOR value of 4 UID bytes. If invalid BCC byte is writen to the Gen1A card, it will be soft-bricked.

Solve Soft-bricked issues

Check Brick Checkbox and Click Execute button will fixed the soft-bricked of Gen1A Magic Card.