xMagic - Dual Microchip-Implantat

Simply magical - the xMagic

What's so great about the xMagic?

In general, RFID and NFC chips only have readable, unique IDs. These are used as a type of serial number that cannot be changed. The xMagic features two different chips designed to emulate many types of commonly used simple RFID chips found in access cards, key fobs, gym cards, etc. This means that you can copy or clone the ID (serial number) of many chip types onto the xMagic!

Part 1: 13.56MHz Magic Mifare 1k

One of the chips in the xMagic is the "Magic Mifare 1k" emulator chip. For many years, the Mifare MF1ICS50 1k chip has been used for all sorts of applications as a "secure chip," from access control to value cards, and for local payments in closed systems such as public transportation and laundromats. However, it uses a security mechanism called "crypto1," a simple, proprietary encryption mechanism that has nothing to do with modern cryptographic standards. Although crypto1 has been hacked for many years, the Mifare Classic 1k is still widely used in all kinds of access control systems. This means that you can hack the security of these cards and clone their content (including the ID "serial number") to your xMagic with devices like our Proxmark3!

Part 2: 125kHz T5577

In addition to the Magic Mifare 1k emulator chip in the xMagic, we also have the 125kHz T5577 chip, which is designed to emulate a wide range of chip types in the 125kHz range. Typically, key fobs and access cards used for things like gym memberships, gates, residential complexes, etc., that use a 125kHz chip are very cheap and have no encryption or security whatsoever, making it extremely easy to copy an ID from one of these devices onto the T5577 emulator chip!

What can this chip implant do?

• Copy certain HF 13.56MHz chip IDs onto this chip
• Copy certain LF 125kHz chip IDs onto this chip
• Some types of access control applications
• Scan this chip implant to log into your computer.

What can't this chip implant do?

• Exchange data with NFC-enabled smartphones
• Trigger events on NFC devices such as smartphones
• This chip implant cannot be used for payments
• Chip implants cannot be used for GPS or tracking

Important to know

Part 1: 13.56MHz Magic Mifare Classic 1k Emulator

• Emulates the Mifare MF1ICS50 1k (gen1) chip with "Chinese Magic Backdoor" (CMB)
• 4-byte ID and the entire sector 0 is writable with CMB commands
• Proxmark3 can clone Mifare Classic 1k cards, fobs, tags, etc. to xMagic
• 10 years of data retention with 100k write cycles per memory block
• Pre-tested and pre-loaded in sterile injection configuration
• No "anti-migration" coating makes it easy to remove/replace

Part 2: 125kHz T5577 LF Chip Emulator

• Emulates common EM41xx, EM4200, HID, and Indala chips (and more!)
• Proxmark3 can clone common 125kHz cards, fobs, tags, etc. to xMagic
• The T5577 chip is pre-programmed with a unique 40-bit ID in the EM41xx mode
• 10 years of data retention with 100k write cycles per memory block
• Pre-tested and pre-loaded in sterile injection configuration
• No "anti-migration" coating makes it easy to remove/replace

Implantation

Basically, any piercer should be able to set x-Series implants. If they have any questions, we will gladly answer them.
For this reason, we believe that no special partner piercers are required to implant a tag. However, if you are looking for recommendations, here is a map with piercers who can set x-Series implants. Simply take your kit, book an appointment there, and have the tag implanted briefly. Individually and without prepayment.

Difference between gen1a and gen2?

The xMagic Implant is a versatile RFID implant that combines two chips in a 3 mm x 15 mm biocompatible glass cylinder:

1. 13.56 MHz "Magic" Mifare 1k Emulator Chip: This chip emulates the Mifare Classic 1k (gen1a) and allows cloning of cards and tags using this technology. It features the "Chinese Magic Backdoor" (CMB), which allows the entire sector 0 to be writable.

2. 125 kHz T5577 Emulator Chip: This chip can emulate various 125 kHz RFID types commonly used in access control systems, gym cards, and similar applications.

The main difference between the 1a and 2 versions of the xMagic implant lies in the generation of the "Magic" Mifare 1k emulator chip:

• Version 1a: Contains the gen1a "Magic" Mifare 1k emulator chip. This chip allows cloning of Mifare Classic 1k cards, but writing to sector 0 requires specialized hardware like the Proxmark3.

• Version 2: Contains the gen2 "Magic" Mifare 1k emulator chip. This chip offers the ability to write to sector 0 using common NFC tools like the MIFARE Classic Tool (MCT) app on compatible smartphones, making handling easier.

The choice between the versions depends on your specific needs and the hardware available. If you prefer to write the chip with a smartphone, Version 2 with the gen2 chip is more advantageous. If you already have specialized hardware like the Proxmark3 and want to use it, Version 1a may be sufficient.

Both versions offer the flexibility to emulate various RFID types and are ideal for applications in access control systems where both 13.56 MHz and 125 kHz technologies are used. There is no "better" or "worse" option.

What’s the difference between the "Single" and the "Value Kit"?

The "Single" includes the xMagic implant, pre-installed in a sterile syringe.

The "xMagic-Value Kit" contains the following products and materials:

• 1 sterile injector unit, pre-installed with the xMagic chip implant
• 1 sterile compress for wound care after installation
• 1 sterile adhesive bandage with an adhesive edge all around
• 1 pair of non-sterile surgical gloves
• 1 sterile pad
• 1x RFID diagnostic card
• 1x 13.56 MHz X-field detector

The diagnostic card and the field detector are tools for field detection, allowing you to determine the type of readers and the best position and alignment (rotation) to pair your xMagic chip implant with a reader. Our RFID diagnostic card informs you about the frequency range, frequency, and duty cycle of the readers.

<iframe width="560" height="315" src="https://www.youtube.com/embed/DSGcwCc4CjY" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Testing Process

Our x-Series chips are pre-installed in injector systems with steel needles and generally cannot be read while in the needle. For this reason, we perform a full test for each x-series tag before it is loaded into the injector assembly and sterilized. We have also performed multiple tests on our x-series chips and cataloged these tests here.

Cloning Cards, Fobs, etc. onto the xMagic

Proxmark3
The most powerful tool you can use for working with RFID chips is the Proxmark3. It is an open-source tool for RFID diagnostics and security research, available in many variants, shapes, and sizes. Thanks to its flexibility and the ability to update the firmware to support the latest security tactics and tools, it is an excellent investment for anyone interested in experimenting with RFID. Here are some example videos showing how the Proxmark3 is used to clone Mifare 1k and T5577 cards and fobs.

Mifare S50 Classic 1k Cloning
The original 4-byte "Classic" 1k Mifare card has only 4 bytes for an ID and uses the vulnerable version of the Crypto1 protocol. NXP (the company that manufactures Mifare chips) has released several updated versions of Mifare chips, including the Mifare Plus 1k and a Mifare "Classic" 1k EV1 (Evolution One) chip. The memory structures of these new chips are identical to those of the original vulnerable "Classic" 1k chips, but they have been updated with improved cryptographic algorithms and 7-byte IDs instead of 4-byte IDs. Although there are new attacks on these updated chip types, success is limited, and you won't be able to copy the full 7-byte ID number to the xMagic, as the embedded Mifare emulator chip only supports 4-byte IDs.

You can check the chip type in your 13.56 MHz cards and fobs using the Proxmark3 or, in some cases, by scanning with an NFC-enabled smartphone using the TagInfo app.

<iframe width="560" height="315" src="https://www.youtube.com/embed/72LwCcDqqss" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>

125kHz Chip Cloning
Today, there are many types of 125kHz chips that can be emulated by the T5577 chip in the xMagic. These have no security features, only different communication protocols. The T5577 chip is highly configurable, allowing it to emulate many types of communication protocols, making it an extremely versatile chip! You can use the Proxmark3 to clone the following types of 125kHz LF (low frequency) chips to the xMagic. This list currently includes: AWID, COTAG, EM, FDX-B, Gallagher, Guarall Prox II, HID Prox, Idteck, ioProx, Jablotron, Keri, Motorola, Nedap, NexWatch, Noralsy, PAC/Stanley, Paradox, Presco, Farpointe/Pyramid, Securakey, and Viking.

<iframe width="560" height="315" src="https://www.youtube.com/embed/F-KPVlyIxrA" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>