jumpycalm/pn532-cloner

Use NXP PN532 board to read and write MIFARE Classic, MIFARE Ultralight, as well as NTAG tags on Windows and macOS

What is this project?

This project is based on the famous libnfc project as the backend to drive the NXP PN532 chip. Much of the higher-level application code is based on the mfoc-hardnested project.

This project aims to provide a cost-effective way to make duplicating MIFARE Classic, MIFARE Ultralight, as well as NTAG tags easy on Windows and macOS.

Supported hardware

Only NXP PN532 board via UART to USB interface is supported. The PN532 boards are widely available from all the major online retailers. If you buy one of the boards without a USB port, you will need to buy a UART to USB cable as well (also available via all major online retailers). I also have the PN532 boards with a CH340 UART to USB interface built-in for sale. The PN532 boards I carry have USB-C ports on them. Please note, that the widely available ACR122 reader is not supported due to ACR122 does not use UART to USB interface.

Supported operating system

Only Windows and macOS are supported. There's no plan to support Linux. For Linux applications, you can use libnfc directly.

Supported RFID tags

Read

MIFARE Classic, MIFARE Ultralight (under development), NTAG (under development).

Write

Gen 3 Magic MIFARE Classic, Gen 2 Magic MIFARE Classic, Magic MIFARE Ultralight (under development).

Usage

Reader driver installation (Windows)

If you purchased a driver from me, Windows should already have the driver for the reader. Just plug the reader into the PC, and wait for a minute or 2, the correct driver should get installed automatically. If the driver is not installed correctly, you can open the Device Manager and install the driver with the following instructions:

If the above method does not work (this is usually due to you are running an old version of Windows), the driver can be found in this repository or search "CH340 driver" on the internet.

Reader driver installation (macOS)

The reader is plug-n-play on macOS. No need to install any driver.

How to clone a tag

Plug the reader into the PC, run the application, and follow the instructions on the screen. Simply read the original tag, after the read is complete, write the data onto a Magic tag (a special changeable tag). Please note, that the MIFARE Classic tags are encrypted tags, it takes time to crack the keys and read the tag. The application will provide you with an ETA when you start to read a tag.

I have included the built binary files in the Releases section for your convenience. Below is the screenshot of the application

Fix macOS "cannot be opened" error for unofficial software ( for example the test software I sent you to test)

macOS has secure measurements to make a user run unsigned applications harder. If you are getting the following error message, you will have to go to the System Preferences -> Security & Privacy. Click on "Click the lock to make changes", enter your password, then click on OK on the error message. After that, you should be able to see the option to be able to run the application. I have included screenshots with step-by-step instructions below. If you have concerns the safety of running the application, you can inspect every line of source code and build the application from the source (instructions below).

Build instruction

Windows

MSYS2

Install MSYS2. Open the MSYS2 UCRT64 terminal, and clone this project first:

git clone https://github.com/jumpycalm/pn532-cloner.git

Navigate into the project folder, create a new folder called build, go to that folder, use the CMake to generate the Makefile, then build the project with mingw32-make

cd pn532-cloner
mkdir build
cd build
cmake -G "MinGW Makefiles" ../
mingw32-make

After the software is built, a PN532-Cloner-Win-x64.exe file should be generated. Just double-click on this application and run it.

CLion

Simply create a project from version control, and enter the GitHub link for this project.

macOS

Xcode

You can build the Xcode project file with CMake. Simply download and install CMake. The instruction can be found on CMake's official website: Installing CMake

After the CMake is installed, clone this project first:

git clone https://github.com/jumpycalm/pn532-cloner.git

Navigate into the project folder, create a new folder called build, go to that folder, and use the CMake to generate the Xcode project file.

cd pn532-cloner
mkdir build
cd build
cmake -G "Xcode" ../

If you are getting Xcode 1.5 not supported. error, you need to manually specify the Xcode location. sudo /usr/bin/xcode-select --switch /Users/admin/Downloads/Xcode.app, you may need to change the command to match your Xcode.app location.

After the Xcode project file is generated, you can open Xcode and open the project and build the project inside the Xcode.

Clion

Install CLion. Create a project from version control, enter the GitHub link for this project. Build the project from CLion.

License

Because source code from mfoc-hardnested project is used. mfoc-hardnested project under GPL-2.0 License. This project must be under GPL license to comply with the mfoc-hardnested project.

Support this project:

Contribute code change, report bugs, and provide suggestions for improvements to this project to make this project better. Buy RFID tags and RFID research tools from my online store.

Proprietary Notes

MIFARE is a trademark of NXP Semiconductors. All other trademarks are the property of their respective owners.

pn532-cloner's Issues

Add retry for hardnested attack

There might be some read failure for low-quality tags for some magic tags. Allow retry for hardnested attack to prevent the program fail in the middle of the attack.

Save recovered keys into a temporary file

Save recovered keys into a temporary file so that if the user aborts in the middle of the reading process, the next time the user tries to read, we don't need to start everything from scratch.

Support NTAG and MIFARE Ultralight

Improve hardnested performance

Improve hardnested performance with 2 approaches:

1. Non-stop encrypted nonce collection until we no longer need to collect nonces for all the non-broken keys.
2. Research the possibility to use a faster data rate.

Evaluate if we need to support Gen 2 Magic MIFARE Classic

Gen 2 Magic MIFARE Classic tags do not have a backdoor, so factory resetting it is challenging especially if it is bricked by other applications. Evaluate the possibility to support it.

Unsupported Tag Error

Getting Unsupported tag when writing to gen2 tags.
Purchased these from aliexpress, are these not the right ones?

https://www.aliexpress.com/item/1005005864017347.html

Fully encrypted Mirefire classic tag not supported

read tag fail

Maybe add some process logs, I do not know it is stuck or not

Thanks, author, it is a good project.
When it showed me ETA is 25 minutes, using 16 threads, I am so happy.
But almost 40 minutes passed, it still does not print anything, make me confused.And it seems only use 2 threads?

Add support for static nonce MFC tags

1. Add support for static nonce detection.
2. Add support for static nonce tags key recovery.

Mifare Classic 4K 7-Byte Fob/Card - Able to read but not write to

Hello! Thank you again for the incredible tool!

I have been able to read my keyfob but have not been able to duplicate it because the program states "Cloning this tag is not supported at his moment". Would you be able to add support for Mifare Classic 4K 7-Byte fobs and cards?

Thank you!

Unable to write to MIFARE tag

Hi there,

I'm unable to write to a mifare blank tag purchased from aliexpress.
My flipper is able to write to these tags.

Here is the read info from the tag:
Detected MIFARE Classic 1K 4-Byte tag
ISO/IEC 14443A (106 kbps) target:
ATQA (SENS_RES): 00 04
UID (NFCID1): 49 2e 54 3d
SAK (SEL_RES): 08

Checking encryption keys, please wait up to 8s
Unencrypted MIFARE Classic tag
All keys found! Reading the tag.
Read Block 0/63 with key A success!

Total time elapsed reading this tag: 1 s.

Read tag success!

When attempting to write to these tags, it errors saying unsupported tag:

w
Unsupported tag!
Reader is ready for the command.

I can provide dumps or whatever else is required.

Thank you so much, this tool is great. Currently I use it to dump the keys and add them to the flipper dictionary manually, but being able to skip that step would speed things up.

If there's a donation link, please let me know. Cheers.

Support macOS

Cant write to tag

I can read and bruteforce card but im unable to both clean/restore and write to tag, it says "Unsupported tag!" ive got two mifare 2nd gen magic cards and got the same error

Add support to "Fully Encrypted Mirare"

Hi, unfortunately when I try to read my tag with the Pn532 the program says "fully encrypted mifare Classic" not supported, could you add support for these cards!
Many thanks!