Flipper Zero Magic NFC Cards: Writing UID-Changeable Gen1a/Gen2 Chips

This site's Flipper Zero NFC coverage — cloning and emulating cards, the EMV payment card analysis deep-dive, general RFID/NFC hacking — has focused on reading, analyzing, and emulating cards directly from the Flipper's own memory. What's missing is the complementary technique: writing a cloned card's full data, including its UID, onto a real, physical, standalone NFC card using so-called "magic" chips. This matters because Flipper emulation only works while the Flipper itself is present and powered on — a magic card produces an independent, standalone physical clone that works in any reader the same way the original does, which is the actual goal for a lot of legitimate use cases: making a spare copy of your own building access fob without carrying a Flipper everywhere, or testing whether a reader properly validates UID authenticity as part of an access-control security review.

What Makes a Card "Magic"

Standard MIFARE Classic cards have a factory-locked UID (unique identifier) in block 0 of sector 0 — this block is manufacturer write-protected and cannot be changed on a genuine card, which is exactly the property that makes UID a (weak, but commonly relied upon) form of card identity in many access systems. Magic cards are specially manufactured MIFARE Classic-compatible chips where that protection is deliberately removed, allowing block 0 — and therefore the UID — to be rewritten like any other data block. They exist specifically to make direct 1:1 clones possible, and are sold openly for that purpose, most commonly in card and fob form factors.

Gen1a vs. Gen2 (CUID/FUID): What's the Difference

TypeHow UID is writtenBehaviorCompatibility Gen1aRequires a special "backdoor" command sequence to unlock block 0 for writing, different from normal MIFARE write commandsOnce written, functions like a real card during normal reads — but the backdoor unlock command itself is sometimes detectable by readers specifically checking for itWidest support across cheap card-clone tooling; most common and cheapest magic card type Gen2 (also sold as CUID or FUID)Block 0 is directly writable using standard MIFARE write commands, no special unlock sequence neededBehaves more like a genuine card during the write/read process itself since no backdoor command is used, though the underlying UID is still non-factory and can potentially be flagged by systems checking chip fingerprint characteristics beyond just the UID valueSlightly less universally supported by older tools, but works fine with the Flipper Zero's NFC app

For most Flipper Zero use, either works — the Flipper's NFC app supports writing to both Gen1a and Gen2 magic cards. Gen2/CUID is generally the better choice if you have to pick one, since it avoids the backdoor command that a small number of more security-conscious readers specifically check for and reject.

Step by Step: Cloning to a Magic Card

1. Read the source card fully first. Use the Flipper's NFC app to read the card you want to clone (see this site's RFID/NFC cloning guide for the read process). Confirm you got a complete read, not a partial one — for MIFARE Classic cards with unknown keys, the Flipper needs to successfully crack or already know the sector keys to get a full dump, not just the UID.
2. Save the dump. The Flipper stores the full card data (UID plus all readable sector contents) as a .nfc file on the SD card.
3. Insert a blank magic card (Gen1a or Gen2, matching what your Flipper firmware version and card type support — check your firmware's NFC app documentation, since magic card write support has evolved across firmware versions).
4. From the saved dump, select "Write to initial card" or the equivalent magic-card write option in the NFC app menu — this writes the full saved dump, including the UID, onto the magic card.
5. Verify the write by reading the magic card back and comparing its UID and sector data against the original dump, and by testing it against the actual reader the original card works with.

Why a Full Sector Dump Matters, Not Just the UID

A surprisingly common mistake is assuming UID alone is enough to clone a card. Many real-world access systems do rely on UID alone (which is exactly why magic cards are a meaningful security concern for those systems), but plenty of others store an access credential inside the card's data sectors, encrypted or not, and check that data in addition to or instead of the UID. A card cloned by UID only, without the underlying sector data, will fail against any reader that validates sector contents. Always capture and write the fullest dump the Flipper can obtain, not just the UID field, unless you've specifically confirmed the target system only checks UID.

Where This Fits Legally and Ethically

This site's approach to security-adjacent Flipper Zero content (the EMV analysis guide, the smart lock vulnerability testing guide) has consistently framed this kind of capability around testing systems you own or have explicit authorization to test, and the same applies here directly:

• Legitimate uses: making a backup copy of your own access card or fob, testing whether an access control system you own or administer properly validates more than just UID (a real and common security weakness worth knowing about if you're responsible for that system), and general electronics/RFID education.
• Not legitimate: cloning access credentials you don't own or don't have explicit authorization to duplicate, including workplace badges, apartment/condo fobs you don't have permission to copy under your building's policy, or any card belonging to someone else. Many jurisdictions treat unauthorized access-credential duplication as a real offense, separate from any general "hacking" law, and building/property management agreements frequently prohibit fob duplication explicitly regardless of the technical ease of doing it.

If you're testing an access control system as part of a legitimate security review, get that authorization in writing before testing, exactly as this site's EMV and smart lock guides recommend for their respective scenarios.

Limitations Worth Knowing

• MIFARE DESFire, iCLASS, and other higher-security card families are not cloneable this way — magic cards in the form covered here emulate MIFARE Classic's UID-writable block 0 specifically; cryptographically stronger card families use per-card keys and challenge-response authentication that a simple UID/sector clone doesn't replicate.
• Some newer or higher-end readers detect magic card characteristics beyond just the UID value — certain chip-level fingerprinting (ATQA/SAK response timing, for instance) can differ subtly between magic and genuine cards on scrutiny, though this isn't something most consumer-grade access readers check.
• Not every access system is MIFARE Classic at all — many modern commercial systems have moved to DESFire or other higher-security card types specifically because MIFARE Classic's cloning weakness (including via magic cards) is well known; confirm what card family you're actually dealing with before assuming this technique applies.

Magic card writing is the natural complement to the Flipper's NFC read/emulate capability covered elsewhere on this site — it turns a saved dump into a standalone physical card rather than something that only works while the Flipper is present, and it's also one of the clearest, most hands-on demonstrations of exactly why UID-only access control is a weak security model in the first place.