Magic NTAG216 – UID Changeable (Gen3)

Magic NTAG216 – UID Changeable (Gen3) by KSec

Example cards shows response as NTAG216, however the UID can be changed.

[usb] pm3 --> hf 14a info
[+]  UID: 00 15 91 00 02 3E B6 
[+] ATQA: 00 44
[+]  SAK: 00 [2]
[+] MANUFACTURER: NXP Semiconductors Germany

You can change the UID of the magic NTAG216 via the following command.

[usb] pm3 --> hf mfu setuid --uid 04159100023EB6

This command will verify it has changed

[usb] pm3 --> hf mfu info
[#] Card didn't answer to select
[=] --- Tag Information --------------------------
[=] -------------------------------------------------------------
[+]       TYPE: NTAG 216 888bytes (NT2H1611G0DU) 
[+]        UID: 04 15 91 00 02 3E B6 
[+]     UID[0]: 04, NXP Semiconductors Germany
[+]       BCC0: 08 ( ok )
[+]       BCC1: 8A ( ok )
[+]   Internal: 48 ( default )
[+]       Lock: 00 00  - 0000000000000000
[+] OneTimePad: E1 10 6D 00  - 11100001000100000110110100000000
[=] --- NDEF Message
[+] Capability Container: E1 10 6D 00 
[+]   E1: NDEF Magic Number
[+]   10: version 0.1 supported by tag
[+]        : Read access granted without any security / Write access granted without any security
[+]   6D: Physical Memory Size: 872 bytes
[+]   6D: NDEF Memory Size: 872 bytes
[+]   00: Additional feature information
[+]   00000000
[+]   xxx..... - 00: RFU ( ok )
[+]   ...x.... - 00: don't support special frame
[+]   ....x... - 00: don't support lock block
[+]   .....xx. - 00: RFU ( ok )
[+]   .......x - 00: IC don't support multiple block reads
[=] --- Tag Counter
[=]        [02]: 00 00 00 
[+]             - 00 tearing ( fail )
[=] --- Tag Signature
[=]     Elliptic curve parameters: NID_secp128r1
[=]              TAG IC Signature: F682771EEF5AD100334FD1C4BD54B52C0442BCD0B979FDDEF80A58F26F55F716
[+]        Signature verification ( fail )
[=] --- Tag Silicon Information
[=]        Wafer Counter: 23576640 ( 0x167C040 )
[=]    Wafer Coordinates: x 533, y 401 (0x215, 0x191)
[=]            Test Site: 0
[=] --- Tag Version
[=]        Raw bytes: 00 04 04 02 01 00 13 03 
[=]        Vendor ID: 04, NXP Semiconductors Germany
[=]     Product type: NTAG
[=]  Product subtype: 02, 50pF
[=]    Major version: 01
[=]    Minor version: 00
[=]             Size: 13, (1024 <-> 512 bytes)
[=]    Protocol type: 03, ISO14443-3 Compliant
[=] --- Tag Configuratio
[=]   cfg0 [227/0xE3]: 04 00 00 FF 
[=]                    - strong modulation mode disabled
[=]                     - pages don't need authentication
[=]   cfg1 [228/0xE4]: 00 00 00 00 
[=]                     - Unlimited password attempts
[=]                     - NFC counter disabled
[=]                     - NFC counter not protected
[=]                     - user configuration writeable
[=]                     - write access is protected with password
[=]                     - 00, Virtual Card Type Identifier is not default
[=]   PWD  [229/0xE5]: 00 00 00 00 - (cannot be read)
[=]   PACK [230/0xE6]: 00 00       - (cannot be read)
[=]   RFU  [230/0xE6]:       00 00 - (cannot be read)
[+] --- Known EV1/NTAG passwords
[+] Found default password FF FF FF FF  pack 00 00
----------------------------------------------------

IMPORTANT The UID of NTAG 216 Tags is comprised of two parts: the UID itself, and the BCC. The BCC is a checksum value calculated from the UID. If the BCC is incorrect, tag will be rejected by the reader.

Most RFID tools, such as the Proxmark, LibNFC, MCT etc automatically calculate the BCC when the UID is modified. If you are modifying the UID by hand, it is vital that the BCC is correctly calculated.

NOTE: No support or refunds under any circumstances will be provided for cards that were ‘bricked’ due to incorrect UID/BCC configuration.