The Ultimate Guide to USCUID-UL Magic Cards: Configure, Disable, and Re-Enable DirectWrite

Before we begin, special thanks to GuruSteve from Iceman’s Discord community for the inspiration. His professionalism and deep research on USCUID-UL have been extremely valuable to the RFID community.

If you work in RFID testing, red teaming, or access-control research, USCUID-UL magic cards are among the most flexible tags you can carry. A single card can emulate multiple identities in the MIFARE Ultralight and NTAG families, including NTAG213, NTAG215, NTAG216, UL11, UL21, and UL-C, by changing a hidden 16-byte configuration block.

What You Will Learn

• How to configure USCUID-UL tags to emulate different chip identities
• How to disable DirectWrite (CUID) for stealthier behavior on strict readers
• How to re-enable DirectWrite using Proxmark3 magic wakeup commands

Important Capacity Limitation

You can change the tag identity, but you cannot expand the physical memory of the card. For example, if the card physically has NTAG213-level memory (144 bytes) and you configure it as NTAG216 (888 bytes), many readers will identify it as NTAG216, but read/write operations beyond the actual physical capacity will fail.

How the Configuration Block Works

USCUID-UL behavior is controlled through the hidden configuration area accessed with the E2 backdoor command.

The DirectWrite (CUID) behavior is controlled by one byte in Block 1:

• 0A = DirectWrite enabled (CUID mode)
• 00 = DirectWrite disabled (normal or stealth mode)

Setting this byte to 00 does not permanently lock or brick the card. It only disables standard UID rewriting through normal write commands. You can re-enable it through Proxmark3 magic wakeup flow.

Part 1: Configure Card Identity (DirectWrite Enabled)

Use these command groups when preparing a card or changing identity while keeping DirectWrite active.

Config as NTAG216

hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000AAA; hf 14a raw -ck E20200040402; hf 14a raw -c E20301001303

Config as NTAG215

hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000A5A; hf 14a raw -ck E20200040402; hf 14a raw -c E20301001103

Config as NTAG213

hf 14a raw -sck E200850085A0; hf 14a raw -ck E20100000AA5; hf 14a raw -ck E20200040402; hf 14a raw -c E20301000F03

Config as MIFARE Ultralight EV1 (UL11)

hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000AC3; hf 14a raw -ck E20200040301; hf 14a raw -c E20301000B03

Config as MIFARE Ultralight EV1 (UL21)

hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000A3C; hf 14a raw -ck E20200040301; hf 14a raw -c E20301000E03

Config as MIFARE Ultralight C (UL-C)

hf 14a raw -sck E200850000A0; hf 14a raw -ck E2010A000A00; hf 14a raw -ck E20200000000; hf 14a raw -c E20300000000

Part 2: Disable DirectWrite (Stealth Mode)

After setting your UID, you may want to disable DirectWrite to reduce detection by anti-cloning filters. These command sets switch the control byte to 00.

Disable DirectWrite on NTAG216

hf 14a raw -sck E200850000A0; hf 14a raw -ck E201000000AA; hf 14a raw -ck E20200040402; hf 14a raw -c E20301001303

Disable DirectWrite on NTAG215

hf 14a raw -sck E200850000A0; hf 14a raw -ck E2010000005A; hf 14a raw -ck E20200040402; hf 14a raw -c E20301001103

Disable DirectWrite on NTAG213

hf 14a raw -sck E200850085A0; hf 14a raw -ck E201000000A5; hf 14a raw -ck E20200040402; hf 14a raw -c E20301000F03

Disable DirectWrite on UL11

hf 14a raw -sck E200850000A0; hf 14a raw -ck E201000000C3; hf 14a raw -ck E20200040301; hf 14a raw -c E20301000B03

Disable DirectWrite on UL21

hf 14a raw -sck E200850000A0; hf 14a raw -ck E2010000003C; hf 14a raw -ck E20200040301; hf 14a raw -c E20301000E03

Disable DirectWrite on UL-C

hf 14a raw -sck E200850000A0; hf 14a raw -ck E2010A000000; hf 14a raw -ck E20200000000; hf 14a raw -c E20300000000

Part 3: Re-Enable DirectWrite (Restore CUID)

If DirectWrite is disabled, normal write commands cannot change UID data. Use Proxmark3 magic wakeup commands first, then apply the matching configuration sequence.

Enable DirectWrite on NTAG216

hf 14a raw -a -k -b 7 40; hf 14a raw -k 43; hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000AAA; hf 14a raw -ck E20200040402; hf 14a raw -c E20301001303

Enable DirectWrite on NTAG215

hf 14a raw -a -k -b 7 40; hf 14a raw -k 43; hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000A5A; hf 14a raw -ck E20200040402; hf 14a raw -c E20301001103

Enable DirectWrite on NTAG213

hf 14a raw -a -k -b 7 40; hf 14a raw -k 43; hf 14a raw -sck E200850085A0; hf 14a raw -ck E20100000AA5; hf 14a raw -ck E20200040402; hf 14a raw -c E20301000F03

Enable DirectWrite on UL11

hf 14a raw -a -k -b 7 40; hf 14a raw -k 43; hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000AC3; hf 14a raw -ck E20200040301; hf 14a raw -c E20301000B03

Enable DirectWrite on UL21

hf 14a raw -a -k -b 7 40; hf 14a raw -k 43; hf 14a raw -sck E200850000A0; hf 14a raw -ck E20100000A3C; hf 14a raw -ck E20200040301; hf 14a raw -c E20301000E03

Enable DirectWrite on UL-C

hf 14a raw -a -k -b 7 40; hf 14a raw -k 43; hf 14a raw -sck E200850000A0; hf 14a raw -ck E2010A000A00; hf 14a raw -ck E20200000000; hf 14a raw -c E20300000000

Best Practices Before Deployment

• Always verify physical memory limits before delivering configured cards.
• Test read and write behavior on at least two reader models.
• Keep a known-good backup profile for each tag family you use.
• Document whether DirectWrite is enabled or disabled before handoff.

Final Thoughts

With correct configuration control, USCUID-UL cards provide strong flexibility for professional RFID workflows. If you need reliable tags, tools, and testing hardware, browse the full collection at MTools Tec.