Compatible RFID tags. (Post your tested tags here)

[tfurci]

Sourcing right rfid tags can be hard so to make it easier for everyone please share your working/non working tags here.

Add following information:

LINK: https://lab401.com/products/mifare-compatible-1k-uid-modifiable-pack-of-5
STATUS: Not working

(Optional):
GENERATION: Gen 1
INFORMATION: Tag can be unlocked with command 0x40, therefore doesnt work with AMS

[tfurci]

LINK: https://www.ebay.com/itm/154522184516
STATUS: Works
GENERATION: Gen 2
INFORMATION: Have to modify ACL bits into tricking ams that it cant write into block 0

[ModMike]

LINK: https://www.ebay.com/itm/154522184516
STATUS: Works
GENERATION: Gen 2
INFORMATION: Have to modify ACL bits into tricking ams that it cant write into block 0

Do you have a source for the adhesive ones?

[Schokobecher]

Do you have a source for the adhesive ones?

These for example
https://www.aliexpress.com/item/1005003317461663.html

Ordered today

Edit:
To be precise I ordered these:

[Greger312]

LINK: https://www.ebay.com/itm/154522184516 STATUS: Works GENERATION: Gen 2 INFORMATION: Have to modify ACL bits into tricking ams that it cant write into block 0

How do you modify the ACL bits, could you update the readme with how to clone a tag?

[tomvandeneede]

Have some Gen 1a
STATUS: Does not work Generation Gen1a Information : N/A

AliExpress Gen 2

STATUS: Does not work Generation Gen2 Information : Did not change ACL bits

Can anyone share the ACL bits to change so I can further test with the altered ACL settings

[hurzhurz]

Do you have a source for the adhesive ones?

These for example https://www.aliexpress.com/item/1005003317461663.html

I can confirm that they work.
Didn't need to modify anything, just restored the dumped data, keys and UID with:
hf mf restore --1k --uid XXXXXXXX -f hf-mf-XXXXXXXX-dump.bin -k hf-mf-XXXXXXXX-key.bin

[ModMike]

So is this working perfectly? Are all issues sorted?

If so, are the settings tied to a database or can you make your own settings?

[hurzhurz]

Well, I just started playing with it today. So I can't say much yet.
I used the instructions from the readme page to get the keys and dump the data from both tags on the one genuine spool that I have.
Then I cloned one of them and it looks good to me. No error or anything in Bambu Studio, it seems to recognize it. And it doesn't even care to see the genuine one and the cloned one on two spools next to each other.

[michalss]

Well, I just started playing with it today. So I can't say much yet. I used the instructions from the readme page to get the keys and dump the data from both tags on the one genuine spool that I have. Then I cloned one of them and it looks good to me. No error or anything in Bambu Studio, it seems to recognize it. And it doesn't even care to see the genuine one and the cloned one on two spools next to each other.

What is it mean exactly pls ? Im trying to make my own stickers, where i need only change color and material type.. Is this possible or i can just clone it ? Can you also add link what tag did you use please ? Best would be aliexpres...

regards

[hurzhurz]

What is it mean exactly pls ? Im trying to make my own stickers, where i need only change color and material type.. Is this possible or i can just clone it ? Can you also add link what tag did you use please ? Best would be aliexpres...

regards

It just means that:
a) above mentioned tags (https://www.aliexpress.com/item/1005003317461663.html) are suitable
b) you can create 1:1 copies of genuine tags with them
c) it looks like it isn't an issue if you have multiple spools in the AMS with the same UID, so you can reuse the UID+keys multiple times and don't need a way to generate new ones

but it does NOT mean that is already possible to customize the tags.
there is some kind of checksum or signature that prevents this. maybe someone else knows more about this.

[avwuff]

Hey, just wanted to post that I bought those same aliexpress tags and was able to duplicate one of my spools tags. The AMS reads it just fine.

However, if I change any of the data (such as the color), the AMS no longer reads the tag. So yeah, there's some kind of checksum for sure.

Annoyingly, the tags seem to only support being written once (at least, with the restore command) so it will get quite expensive to try different things to find the checksum.
Update: Tried fiddling with the access control bits to allow writing to the tags more than once, but I have no idea what I am doing.

[hurzhurz]

Annoyingly, the tags seem to only support being written once (at least, with the restore command) so it will get quite expensive to try different things to find the checksum. Update: Tried fiddling with the access control bits to allow writing to the tags more than once, but I have no idea what I am doing.

you can wipe the tag with "hf mf wipe" and then rewrite it.
or you can edit the access bits in block 3/7/11/... from "87 87 87" to "F0 F7 80" to enable write access for key B and then add option --ka to the hf mf restore command.

[michalss]

Annoyingly, the tags seem to only support being written once (at least, with the restore command) so it will get quite expensive to try different things to find the checksum. Update: Tried fiddling with the access control bits to allow writing to the tags more than once, but I have no idea what I am doing.

you can wipe the tag with "hf mf wipe" and then rewrite it. or you can edit the access bits in block 3/7/11/... from "87 87 87" to "F0 F7 80" to enable write access for key B and then add option --ka to the hf mf restore command.

But still can we make our own tags or not? I just want to change color and material.... Not sure if this is possible, i know @avwuff did try that but can more ppl confirm it pls?

[embed-3d]

The only thing you can currently do is cloning the tag and place it to an other spool with the same color and material.
I think they added a signature to the tag (last blocks) to secure the data.
Breaking that signature is nearly impossible.

[SetsuaD]

If we compile a list together of each spools data, we basically have achieved the ability to use 3rd party spools and filaments and have them autodetect so long as we write the proper tag data. We found tags that work that are third party, so we do not need to use BL originals salvaged and carefully labeled/organized for future reuse, thats good!

Where are we compiling the list of tag dumps to find out if they are anonymous enough that BL won't be able to come after those who submitted them by tracing them to an order somehow? This solution is breaking their grip on forcing customers to buy BL spools/filament to have the convenience of auto-ams-detection/settings.

I own one of every BL spool they sell right now, organized on a excel spreadsheet. Lets take this to the next level - reach out to me to colab.

[michalss]

If we compile a list together of each spools data, we basically have achieved the ability to use 3rd party spools and filaments and have them autodetect so long as we write the proper tag data. We found tags that work that are third party, so we do not need to use BL originals salvaged and carefully labeled/organized for future reuse, thats good!

Where are we compiling the list of tag dumps to find out if they are anonymous enough that BL won't be able to come after those who submitted them by tracing them to an order somehow? This solution is breaking their grip on forcing customers to buy BL spools/filament to have the convenience of auto-ams-detection/settings.

I own one of every BL spool they sell right now, organized on a excel spreadsheet. Lets take this to the next level - reach out to me to colab.

this is good count me in :) Im still waiting for my PX3 but i would be very glad to participate on this... Im pretty sure there is not a problem to established the annonym vps and make simple app to share this data between each other... :) How can i contact you?

[SetsuaD]

I have proxmark3-ez.I have another more robust one with different addons somehwere... but it seems just basic kit is enough.I wonder what kind of brute force horsepower is needed? I have a rack of 4090s? I have a server farm with a few hundred cores? Rainbowtable?Then that leaves record keeping. The serial number is associated with the tag. Ideally before we could go public we would need to crack the crc to validate our own tags as authentic. Until then though, an underground private dump list is being made somewhere already.I am hoping I can validate myself to get access to the existing project. Right? Someone has to have a pile of dumps already and can write the tags...Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: michalss ***@***.***> Date: 9/7/23 2:34 AM (GMT-06:00) To: Bambu-Research-Group/RFID-Tag-Guide ***@***.***> Cc: warbarz ***@***.***>, Comment ***@***.***> Subject: Re: [Bambu-Research-Group/RFID-Tag-Guide] Compatible RFID tags. (Post your tested tags here) (Issue #1) If we compile a list together of each spools data, we basically have achieved the ability to use 3rd party spools and filaments and have them autodetect so long as we write the proper tag data. We found tags that work that are third party, so we do not need to use BL originals salvaged and carefully labeled/organized for future reuse, thats good! Where are we compiling the list of tag dumps to find out if they are anonymous enough that BL won't be able to come after those who submitted them by tracing them to an order somehow? This solution is breaking their grip on forcing customers to buy BL spools/filament to have the convenience of auto-ams-detection/settings. I own one of every BL spool they sell right now, organized on a excel spreadsheet. Lets take this to the next level - reach out to me to colab. this is good count me in :) Im still waiting for my PX3 but i would be very glad to participate on this... —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: ***@***.***>

[nmr94]

@warbarz I've got a Proxmark3 on the way and I've got quite a few Bambu filaments that I'm planning to scan.

I'm really interested in this project (although it seems to have stalled somewhat). My plan at this stage is to collect as many unmodified Bambu tag data as I possibly can and make this available on a public website for download.

The vision here is you'd be able to select your colour, filament type and if we have it stored somewhere provide it as a download to the user - if we don't have it then we provide instructions to easily dump the tag on the filament.

Even setting up a postage address where people could send their tags, along with the data of the filament it came from could help for less technically minded people.

Anybody who's interested in helping, please do reach out!

[cherryduck]

Am I missing something? I've made a dump of my tag and written it to a CUID gen2 sticker. I then dumped it and compared it to the dump from the original tag and they match, however my AMS doesn't recognise it.

We don't get the B keys do we? I've only got A keys. Would this matter?

[thekakester]

Not all Magic Tags are created equal. Some Gen2 tags have a write-once UID, and others have an infinite-write UID.
The infinite-write UID tags don't work because the AMS attempts to write the UID and brick the tag intentionally.

The tags with a write-once UID (also known as FUID for fused-UID) work fine.

The gen2 tags that I got do not work, but the gen2 tags that someone else got on the discord channel seem to work.
Regardless, once they are written, they can never be re-written unless the RSA signature issue is solved.

[cherryduck]

Do you have a source for the adhesive ones?

These for example https://www.aliexpress.com/item/1005003317461663.html

I can confirm that they work. Didn't need to modify anything, just restored the dumped data, keys and UID with: hf mf restore --1k --uid XXXXXXXX -f hf-mf-XXXXXXXX-dump.bin -k hf-mf-XXXXXXXX-key.bin

I bought these ones exactly, I ran the command given - doesn't work, and after the AMS has tried to read it, pm3 shows no tag found if I try and read it.

[Nabahe]

Do we need a physical initial tag or is the information to clone a tag here? What tags are currently working for this? Very interested in this!

[jaredshearer]

It seems like there was a big push for this, but it feels like it's gone somewhere else. Is there a better place for this conversation that someone can point us to?

[capull0]

LINK: https://www.ebay.com/itm/154522184516 STATUS: Works GENERATION: Gen 2 INFORMATION: Have to modify ACL bits into tricking ams that it cant write into block 0

and how you modified the ACL?

[jgoggan]

Just wanted to mention that it appears that Bambu's tags ARE SUSCEPTIBLE to the recently discovered Mifare 1k Classic backdoor key (A396EFA4E24F)! This means that they can now be fairly easily dumped WITHOUT having to do any sniffing. This should make it much easier for anyone with a PM3 device to dump data. You simply use the "fm11rf08s_recovery.py" script and in under 15 minutes, you'll have the full set of keys (A & B) for a Bambu tag.

[jaredshearer]

Just wanted to mention that it appears that Bambu's tags ARE SUSCEPTIBLE to the recently discovered Mifare 1k Classic backdoor key (A396EFA4E24F)! This means that they can now be fairly easily dumped WITHOUT having to do any sniffing. This should make it much easier for anyone with a PM3 device to dump data. You simply use the "fm11rf08s_recovery.py" script and in under 15 minutes, you'll have the full set of keys (A & B) for a Bambu tag.

That's awesome! I'm pretty new to using scripts. Is there a guide you can point me to? Also, do you know if there are a bunch of tag dumps somewhere so I can write tags for filaments I haven't bought from Bambu?

[jgoggan]

That's awesome! I'm pretty new to using scripts. Is there a guide you can point me to? Also, do you know if there are a bunch of tag dumps somewhere so I can write tags for filaments I haven't bought from Bambu?

As for scripts -- make sure you are using the latest version of Iceman's stuff (i.e. do a new git clone/download and update the firmware on your PM3 device too). And then you run the script by just doing "script run fm11rf08s_recovery.py".

As for the tag dumps -- I don't know of any, but that is what would be very useful. Then we could just all write our own bunch of tags for various filament types and colors and be all set. Someone above basically said that he had every color from Bambu. So we just need a way to put them all together for download for those that want to write out some RFID clones.

[jaredshearer]

Oh, it's built into Iceman's firmware? I'm have to break out the PM3 this weekend. Thanks. If I can figure it out, maybe I'll reach out to dude above.

…

On Wed, Sep 25, 2024, 16:10 John ***@***.***> wrote: That's awesome! I'm pretty new to using scripts. Is there a guide you can point me to? Also, do you know if there are a bunch of tag dumps somewhere so I can write tags for filaments I haven't bought from Bambu? As for scripts -- make sure you are using the latest version of Iceman's stuff (i.e. do a new git clone/download and update the firmware on your PM3 device too). And then you run the script by just doing "script run fm11rf08s_recovery.py". As for the tag dumps -- I don't know of any, but that is what would be very useful. Then we could just all write our own bunch of tags for various filament types and colors and be all set. Someone above basically said that he had every color from Bambu. So we just need a way to put them all together for download for those that want to write out some RFID clones. — Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFAQB5OQDWTNSMROOMDGRSDZYMRD3AVCNFSM6AAAAABJCVXQTKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNZVGI3DKMBWGY> . You are receiving this because you commented.Message ID: ***@***.***>

[jgoggan]

Yup -- latest release has it. The paper came out recently and they had it built in even before the paper was presented. :)

[jaredshearer]

Thanks for your help, @jgoggan. I scanned a couple tonight and wrote one to a magic tag I had sitting around. I will have to try scanning it in the AMS tomorrow when a long print I have running ends.

[capull0]

very nice to know, that we can dump all our Bambu RFID tags, but how i can use this dumps?

I ordered CUID Gen 2 tags and i'm able to write an existing dump to this tag with the MCT.
When i compare the tag with the dump, everything is matching.
But my Bambulab P1S doesn't accept this tags and is overwriting block0, so the rfid tag is not readable anymore.
Is there a way to lock block0, so i can use this magic cards, or are this tags just unusable?

[Aptimex]

LINK: https://www.ebay.com/itm/154522184516 STATUS: Works GENERATION: Gen 2 INFORMATION: Have to modify ACL bits into tricking ams that it cant write into block 0

The ACL bits for the Bambu tags are 0x878787 by default. According to this decoder (https://slebe.dev/mifarecalc/), that means that neither key (A or B) has write permission to block 0 when you create a clone. So unless you managed to find a Gen 2 tag that actually enforces the ACL on block 0 (no idea if they exist or not), changing the ACL bits won't make a difference because they're already as write-restrictive as they can be, but the AMS is still overwriting it. Key A can write to the UID (block 0) regardless of the ACLs in my testing.

Caveat: I've only tested this on the AMS Lite on the latest firmware. It's possible there was a way to use the common infinitely-rewritable Gen 2 tags in the past, or with the normal AMS unit. But currently it doesn't seem like that's an option now.

[token47]

If we compile a list together of each spools data, we basically have achieved the ability to use 3rd party spools and filaments and have them autodetect so long as we write the proper tag data. We found tags that work that are third party, so we do not need to use BL originals salvaged and carefully labeled/organized for future reuse, thats good!

Where are we compiling the list of tag dumps to find out if they are anonymous enough that BL won't be able to come after those who submitted them by tracing them to an order somehow? This solution is breaking their grip on forcing customers to buy BL spools/filament to have the convenience of auto-ams-detection/settings.

I own one of every BL spool they sell right now, organized on a excel spreadsheet. Lets take this to the next level - reach out to me to colab.

I started a new issue [1] to specifically track/document cloning instructions. One of the things I listed there is to create a directory of existing tags. I'm ordering the equipment and tags to be able to help more.

[1] - #54