iCopy-X v1.1.4 Released

Firmware v1.1.4 is out for the open-source iCopy-X. It is the third release since v1.1.1. Together the three add Hitag2 cloning and support for the ICS Decoder, and rebuild MIFARE Classic key recovery. Most of the work is from amec0e, whose Paxton, Hitag2 and MIFARE Classic changes span all three releases. Dysonian-Lab has added ICS Decoder support. Grab it from the v1.1.4 release page.

Notable changes

LF (Low Frequency)

  • Added Hitag2 read and write, so Hitag2 tags can be cloned to Hitag2 blanks (scan was already supported).
  • Added Paxton-to-Hitag2 writing: it uses the default Hitag2 password, writes block 1 last and reads back with the Paxton password to confirm.
  • Changed Paxton dumps to store blocks 1 to 7 rather than 4 to 7, so a dump can also be written to a generic Hitag2. Older dumps still work for Paxton-to-Paxton. Tags to be written to a generic Hitag2 need a new dump.
  • Changed the Paxton dump filename scheme to Paxton-ID_<UID>_<Block5>_N.txt, with a fallback for older dumps.

HF (High Frequency)

  • Added a full nested attack pass, run when less than half of a card’s keys are found.
  • Changed key recovery to seed the nested attack with the user dictionary, the built-in defaults and 61 hard-coded keys instead of the full Iceman dictionary.
  • Changed key recovery to run fchk again after the nested attack finds a key.
  • Added saveLearnedKeys: any recovered key not already in the dictionaries is appended to /keys/mf1/mfc_users_keys.dic.
  • Changed erase to use the same key-recovery pipeline as the read flow.
  • Changed Darkside recovery to run only when fchk finds no keys.
  • Fixed UID verification failures when writing Gen1a and Gen2 cards.
  • Fixed Gen1a SAK and ATQA normalisation when a dump reports a SAK of 0x88.
  • Fixed ACL decoding for JSON dumps.
  • Fixed sector-trailer key B not being written.
  • Fixed 4K nested recovery selecting the wrong sectors.
  • Added the missing Salto and NSP global keys and the University of Portsmouth library-card keys.

ICS Decoder

  • Added support for the ICS Decoder, a USB dongle that reads SEOS SIO credentials and returns the decrypted PACS payload over serial.
  • Added SEOS downgrade writes: the iCopy-X parses the SIO, extracts the Wiegand frame and writes 48-bit payloads to iCLASS Legacy or 26-bit payloads to T5577 blanks. It detects the blank on the coil and verifies the write by reading it back.
  • Moved decoder detection to a background thread.
  • Fixed a grey-screen hang on exit.

Quality of Life

  • Fixed firmware updates failing with error 0x05 when the IPK was copied from a Mac. The updater picked up AppleDouble ._ sidecar files first.
  • Fixed the companion client zips so that resources/, dictionaries/, lualibs/ and luascripts/ sit next to each platform binary. Without them, hardnested and autopwn on macOS had no bitflip tables. A sector that took about an hour and a half now takes about a minute.
  • Updated the bundled Proxmark 3 firmware to Iceman v4.21611 with the iCopy-X patches.
  • Restored the factory client in the no-flash IPK.
  • Fixed the ChkDic timer showing mm'ss'' instead of mm:ss.

Localisation

  • Added a switchable UI language, with French as the first translation. Strings load from data/lang/<code>.json and any missing string falls back to English. A new language is a drop-in JSON file.
  • Added Settings > Language. The choice persists across reboots, and switching updates the main menu immediately.
  • Added translations for the known Proxmark client status phrases, applied after normalisation. Hex and structured output are untouched.

Plugins

Two new plugins ship with these releases, and two existing plugins have been updated:

  • manage_dictionaries: copies the Iceman T55xx and MIFARE Classic default dictionaries onto the SD card, adds keys to either, backs them up to backup_dictionaries/N/, and clears the user keys.
  • mfc_recovery: MIFARE Classic key recovery at three levels of thoroughness. The fullest uses Iceman’s mfc_default_keys.dic.
  • Added block cycling and progress tracking to T55xx_block_reader.
  • Reworked the T55xx_block_writer write flow.

← All Proxmark News