Hello, I’m looking for a way to unlock Vigik access systems using my Flipper Zero. I’ve already tried MFKey32. I won’t have access to the original card database, only to the badge reader. I’d like to know what the best attack method would be to unlock the Vigik system and gain access through the door it controls. I’m still new to this and would like to learn more.

Hello, I am looking to verify if this protocol I found with Gemini is correct and actually allows NFC access to unlock VIGIK systems, thus allowing doors of buildings to be opened without the original card linked to the NFC reader. Is this protocol accurate for this use case? I have a Flipper 0 running Unleashed

Here is the complete, ultra-detailed, A to Z guide to duplicating a MIFARE Classic key fob using the MFKey32 attack, using only your Flipper Zero, the door reader, and your Android smartphone.

This guide takes into account your rewriteable CUID Gen 2 (13.56 MHz) blank key fob, which is fully rewritable.

Phase 1: Capture at the door reader (Nonce detection)

Since you do not have the original card on hand, you are going to query the door reader so that it sends you encrypted information (the nonces).

1. On your Flipper Zero, go to the NFC menu.
2. Choose Detect Reader.
3. Place the back of the Flipper Zero directly against the door reader (where you usually scan your badge).
4. The Flipper will simulate a card and interact with the reader.
5. Look at the screen: a nonce counter will display (e.g., 1/5, 2/5... up to 5/5).
6. Wait until you have 5/5 nonces collected (this takes a few seconds).
7. Press the Back button on the Flipper to exit the tool. The nonces are now saved in the Flipper's temporary memory.

Phase 2: Key calculation on the Smartphone (MFKey32)

The recorded nonces are not directly usable: their encryption must be cracked to find the access keys to the memory sectors. Your smartphone will perform this calculation.

1. Enable Bluetooth and Location on your Android smartphone.
2. Enable Bluetooth on your Flipper Zero (Settings $\rightarrow$ Bluetooth $\rightarrow$ ON).
3. Open the Flipper app on your smartphone and make sure it is properly connected to your Flipper Zero.
4. On the app home screen, a MFKey32 banner or notification will automatically appear indicating that nonces have been detected.
5. Click on MFKey32 (or Calculate Keys).
6. The smartphone's processor will run the decryption algorithm for a few seconds.
7. Once completed, the app displays the discovered keys and automatically injects them into your Flipper Zero's user dictionary (user.nfc).

Phase 3: Reconstructing and saving the full dump

Now that your Flipper has the encryption keys in its dictionary, it needs to decrypt all the sectors of the key fob it saved during the initial interaction.

1. On the Flipper Zero, go back to the NFC menu.
2. Choose Saved.
3. Select the partial file that was created during your passage at the reader (it usually bears the date or an automatically generated name).
4. In the file options, select Read Extra Sector Keys (or Nested Attack / Read Sector Keys depending on your firmware version).
5. The Flipper will compare the save file with its dictionary updated during Phase 2.
6. It will gradually decrypt all remaining missing sectors (e.g., 32/32 keys found or 16/16 sectors read).
7. Once the reading process is finished, click on Save to store the definitive and full backup of your key fob.

Phase 4: Writing to the CUID (Gen 2) blank key fob

Your rewriteable CUID T4U® key fob will now receive the entire dump (UID + data).

1. On the Flipper Zero, stay in the NFC $\rightarrow$ Saved menu.
2. Open the complete key fob file saved in Phase 3.
3. Simply select the Write option.
4. Place your blank CUID key fob against the back of the Flipper Zero.
5. Hold the key fob still for 2 to 3 seconds.
6. The Flipper displays a success message (or emits a beep): the data from the old key fob and its UID have overwritten the contents of the CUID key fob.

Phase 5: Testing on the reader

1. Go to the door reader.
2. Present your newly flashed CUID key fob.
3. The reader checks the UID and the sector data: access is granted.

(Note: If you wish to reuse this same CUID key fob later for another door, you will simply need to repeat Phase 4 only with a new file: the new data will overwrite the old ones).