UID Changeable ISO15693 Thin-film TAG – 64 Blocks

This is the UID changeable ISO15693 iCode SLI Thin Film.

What does the Official ISO15693 Reader can do with this ISO15693 iCode Tag

• Change the UID
• Lock the UID
• Read and write single block
• Write and lock Dsfid
• Write and lock Afi
• Read and write all blocks

The UID can be modified with the official device (ISO15693 Reader).

The UID cannot be changed with NFC hardware on Android or iOS devices.

Read Info or ISO15693 Card

[usb] pm3 --> hf 15 reader

[+] UID: E0 11 22 33 66 66 66 66
[+] TYPE: Emosyn-EM Microelectronics USA
[usb] pm3 --> hf 15 info

[+] UID: E0 11 22 33 66 66 66 66
[+] TYPE: Emosyn-EM Microelectronics USA
[+] Using UID... E0 11 22 33 66 66 66 66

[=] --- Tag Information ---------------------------
[=] -------------------------------------------------------------
[+] TYPE: Emosyn-EM Microelectronics USA
[+] UID: E0 11 22 33 66 66 66 66
[+] SYSINFO: 00 0F 66 66 66 66 33 22 11 E0 00 00 3F 03 8B
[+] - DSFID supported [0x00]
[+] - AFI supported [0x00]
[+] - IC reference supported [0x8B]
[+] - Tag provides info on memory layout (vendor dependent)
[+] 4 (or 3) bytes/blocks x 64 blocks

Does the Proxmark3 X or Proxmark3 Easy support changing the UID of this tag?

Yes, we’ve add the support on the lua script to change the tag UID by Proxmark3 X. The script is listed below.

local cmds = require('commands')
local lib15 = require('read15')
local getopt = require('getopt')
local utils =  require('utils')
local ansicolors  = require('ansicolors')

copyright = 'Copyright (c) 2018 IceSQL AB. All rights reserved.'
author = 'Wilson - MTools Tec'
version = 'v1.0.0'
desc = [[
This script tries to set UID on a IS15693 Thin Film on MTools Tec
Remember the UID  ->MUST<- start with 0xE0
 ]]
example = [[
        script run hf_15_mg -u E011223344556677
]]
usage = [[
script run hf_15_mg -h -u 
]]
arguments = [[
    -h             : this help
    -u        : UID (16 hexsymbols)
]]

local DEBUG = true

-- This is only meant to be used when errors occur
local function oops(err)
    print('ERROR:', err)
    core.clearCommandBuffer()
    return nil, err
end
---
-- Usage help
local function help()
    print(copyright)
    print(author)
    print(version)
    print(desc)
    print(ansicolors.cyan..'Usage'..ansicolors.reset)
    print(usage)
    print(ansicolors.cyan..'Arguments'..ansicolors.reset)
    print(arguments)
    print(ansicolors.cyan..'Example usage'..ansicolors.reset)
    print(example)
end
--
--- Set UID on magic command enabled,  OFFICAL REPO
local function magicUID_mtools(b0, b1)
    print('Using MTools backdoor Magic tag function OFFICAL REPO')
    core.console('hf 15 raw -kcr -d 03e009473f038b00')
    core.console('hf 15 raw -kcr -d 03e0095200000000')
    core.console('hf 15 raw -c -d 03e00940'..b1)
    core.console('hf 15 raw -c -d 03e00941'..b0)
    os.execute("sleep " .. tonumber(1))
    core.console('hf 15 reader')
end
--
---
-- The main entry point
function main(args)

    print( string.rep('--',20) )
    print( string.rep('--',20) )
    print()

    local uid = 'E011223344556677'
    local use_iceman = false

    -- Read the parameters
    for o, a in getopt.getopt(args, 'hu:a') do
        if o == 'h' then return help() end
        if o == 'u' then uid = a end
    end

    -- uid string checks
    if uid == nil then return oops('empty uid string') end
    if #uid == 0 then return oops('empty uid string') end
    if #uid ~= 16 then return oops('uid wrong length. Should be 8 hex bytes') end

    local bytes = utils.ConvertHexToBytes(uid)

    local block0 = string.format('%02X%02X%02X%02X', bytes[4], bytes[3], bytes[2], bytes[1])
    local block1 = string.format('%02X%02X%02X%02X', bytes[8], bytes[7], bytes[6], bytes[5])

    print('new UID | '..uid)
    print('')
    core.clearCommandBuffer()
    magicUID_mtools(block0, block1)
end

main(args)

We've featured how to use Proxmark3 Easy to change the UID of UID Changeable ISO15694 TAG under private protocol. This will save you around $220 for the ISO15693 Tag reader which is a much higher cost and only supports Windows. https://t.co/TGldRwMc7I pic.twitter.com/56Wuf9Bo8H

— Wilson (@mtoolstec) April 5, 2024