Electronics

Changing the CID on an SD card – Working!

46 Comments

(tl;dr – skip to bottom for instructions, see also update post) The CID register on SD cards is supposed to be read-only, which means it can be used to lock devices to specific SD cards, preventing the user swapping them out, which is very annoying. This can result in you being stuck with a smaller card than you’d like in a device or not being able to use a backup in case of damage.

I’ve spent a while trying to work out how to change the ID on some cards. There is surprisingly little info out there about this, when it’s easy for other devices. For example, if you want to change the supposedly read-only ID on various kinds of RFID tag you can simply buy a special version from China that allows it (often referred to as gold or magic cards). There are rumours of cheap Chinese SD cards that don’t follow the official spec and allow you to change to them – I now have  large pile of cheap Chinese SD cards on my desk, but unfortunately none of them did allow it. The spec includes a command (CMD26) for writing the CID, but it’s only supposed to work once in the factory when the card is first assigned an ID. All the cards I got seemed to honour that restriction. However, there is probably some way to unlock them…

If you’ve found this page by looking for help on this topic you’ve probably already seen Bunnie Huang’s SD card hacking presentation, unfortunately I wasn’t able to track down any APPO AX211 based cards, which I thought would be my best bet.

In that presentation was mention of vendor commands for a Samsung eMMC used as the built-in storage on an Android phone. I’m not well enough versed on the technology to know quite what the difference between eMMC and SD cards are, aside from the way SD cards are packaged of course – although that might be all there is to it. Reading around they seem work in the same way and appear the same within Linux. Then I stumbled upon SamDunk, where Sean Beaupre had managed to unlock a Samsung phone (to developer mode) by reverse engineering some of the eMMC firmware on his device and finding commands that allowed the CID to be unlocked and rewritten.

So I started buying Samsung SD cards, hoping for one with the same moviNAND core as the eMMC in their phones. I now also have a stack of Samsung SD cards on my desk, but with the last different one I found I struck gold! (Collecting Samsung cards is more expensive than cheap Chinese ones and it takes some effort to avoid getting fakes.) The Samsung EVO Plus 32GB MicroSDHC card took the commands from SamDunk and let me change the CID.

I have taken the SamDunk code and reworked it a little to make it easier to use for SD cards, but all the credit really needs to go to the original author. To use you simply need a rooted Android device with an SD card slot. Copy the evoplus_cid binary to the device and put it somewhere with a proper Linux file system (not FAT), then apply execute permission to it. Run the tool and point it to the SD card device e.g. /dev/block/mmcblk1 (you almost certainly do not want to use mmcblk0, that is likely to be the built-in storage on your device). List the /dev/block folder and make sure the device you going to use appears and disappears as you insert and remove the SD card to be sure. Supply the new CID you want to set on the command line. If you only need to change the card serial number (part of the CID) you can supply the old CID and the new serial number and the new CID will be calculated for you. I suggest you make a note of the old CID first, in case you want to set it back later. This can be found in the file like /sys/class/mmc_host/mmc1/mmc1:0001/cid, but the path may vary, and again make sure you are looking at the right card by checking it disappears when you remove the card.

You can find the code here: https://github.com/raburton/evoplus_cid (compiled binary is in the lib folder). Use entirely at your own risk. Use only against genuine Samsung Evo Plus cards, anything else is unlikely to work and could be damaged. Even the right card could potentially be damaged!

To set a new completely new CID:

# Usage: ./evoplus_cid <device> <new cid>
./evoplus_cid /dev/block/mmcblk1 744a454e2f412020106c6d77470104c3

Or to just change the serial number part of the current CID:

# Usage: ./evoplus_cid <device> <currentcid> <new serial>
./evoplus_cid /dev/block/mmcblk1 1b534d30303030301098625deb0102a1 12345678

46 thoughts on “Changing the CID on an SD card – Working!”

  2. Thanks! Your script from your youtube video worked for me on one 32GB evo plus card. I also tried it on another 32GB evo plus card but there I got the message that it could not remove the lock. Anyway, I only needed one so I am happy. My ereader is working fine again!

  3. Just bough used 32gb MB-MPBGC made in Korea. Tried few others cards with model mentioned above both from China and Europe and none of them worked. Changed using Galaxy S4 mini with Lineage OS. Suggest you search for used old cards, maybe ask your friends about those made in Korea. Thank you Richard for the script.

  4. Hi,
    I just want to ask you, if I will be able to use SD card again on other devices (like smartphone) after updating maps to car nav. Because of assingment SD card to the specific car.
    Thanx

    1. Just changing the cid won’t stop it working normally anywhere else. If you have to play with other card properties, like locks and passwords, to use it in the car then you might have more difficulties.

  5. I got a Samsung EVO+ 32GB from 2016 with type number MB-MC32DA/EU. But when i change CID i get
    Writing new CID
    ioctl invalid argument

    When i try another method in Ubuntu i get:
    Writing new CID: 094150414620534402104afb57011900
    Success! Remove and Reinsert SD card to check new CID.
    But when i check the CID i see 1b534d3030303030106c295770010a01 and not 094150414620534402104afb57011900
    –
    Would a Samsung EVO 16GB from 2015 work with type number MB-MP16D work?

  6. Hi, how can i execute the command in Android? I try in Ubuntu but i dont know how to run the command or where to put the files. Can you help step by step?

    1. Hi, i receive the message:”Failed to enter vendor mode. Genuine Samsung Evo Plus?
      The card is a Samsung evo 32gb. I think the card is a original one.
      Anyone knows how to solve?
      I run it on linux PC With embebed sdcard reader.

  7. Who wants to find a writebale cid sd cards, i found a company that selling those, but their are sellling them only with the device which can write cid. I dont want to advertize here, but if you need their contacts, contact me jeezywoods@gmail.com

  8. Hi Richard, I know this is an old post, just wanted to thank you, as I managed to change the CID on a 64gb Samsung Evo (no plus).

    Now, I am facing the next challenge…
    the purpose is to update the maps on an rns315, which requires the card to be password locked.

    As my only way of accessing the card via mmc is through an Android phone, I was wondering if you had taken this project another step ahead or if you know how to do it.

    I know what password to set, according to my custom cid, but i haven’t found a way of setting it via adb shell i order to lock the card.

    Thank you!

    1. Hello javlae,

      I have Samsung Evo 16GB card (not Plus).
      Can you describe me how did you change CID, please?
      Which program, what you type or use in order to change CID?

      Thank you in advance.

    1. it worked for me on a Samsung Evo 64GB.

      More details of the card:
      Model: MB-MP64D
      original cid was 1b534d303030303010f951144900ea00 so 1b=samsung, 534d = OEM id, 3030303030 = product name, 10 = version, rest does not matter.

    1. Sorry, no advertising on my blog. It doesn’t appear the device is actually available yet either, so presumably you are it’s maker.
      However, the device does look interesting. I did consider making something similar myself but when I found some cards you could change my motivation to go to that effort quickly disappeared. Since these cards are no longer readily available, a device like this looks like a good idea again. Perhaps once they are available I’ll get one and write a review.

      1. @modimo @Richard

        Actually that kind of tool already exists using something like a cheap “Blue Pill” STM32 and even it can independently check whether the card supports the back door or not.
        The fact is that indeed when you have the right cards, that kind of device is by no means indispensable, just as EVOPLUS_CID is not even (honestly speaking), simply send the right commands via SPI protocol is the easiest and cleanest way.
        Even if nowadays Linux can do it without the need for anything else, as Android, Windows nor other kind of OS, that isn’t the better way, IMHO: SPI it is.

        1. The device in question isn’t a standalone cid programmer for compatible cards. It’s an sd card sized device that takes a microsd card for storage and passes everything through, except cid requests which it responds to itself. A neat device and on topic. However the site is just a signup page where you can register your interest in something that isn’t actually available. As such I deemed the post above to be an advertising post to drive traffic to something the guy is planning to sell. Once it’s available and if it’s demonstrated to be good I might well choose to link to it.

          1. Sorry Richard.
            I think I haven’t expressed myself quite clearly, my fault.
            The device I’ve written really exists and among other things is a standalone CID programmer/tester for compatible cards.
            Being based on an ARM microcontroller, wanting it can be setup in order to spoof CID too.
            It is need an optional adapter though, because otherwise there is no way to put it into the host reader where it is need the spoofed CID.
            Even though I don’t know the device and I haven’t seen it yet, what modimo wrote is in fact an sd card sized device that takes a microsd card for storage and passes everything through, except CID requests which it responds to itself, so that it can spoof the actual CID with a dummy one.
            Surely, as you wrote, an interesting device which deserve attention, but nothing has to do with the ability to alter or rewrite the CID of the cards, compatible or not because actually there aren’t only Samsung EVO+, also other kind and brands allows for that.

    2. Hi

      I’ve finally managed to get hold of an old Samsung 32GB card that lets me change the CID however I also need to set the CSD anyone any idea how to do that?

      Thanks

  11. Hello Richard,

    firstly thank you for such detailed description how to proceed with CID change. I am happy I’ve found this place!

    Now referring to the latest Samsung Evo+ cards, I need to inform potential users that new cards purchased in March 2017 do not allow modification of CID. I have tested 3pcs of 32GB (MB-MC32DA/EU) cards and 2pcs of 64GB (MB-MC64DA/EU). All of them were bought from the official distributors of Samsung in Poland. Currently I am waiting for delivery of another 32GB card purchased via Aliexpress. I do hope this one will finally work as expected.

    PS. Maybe some of you have such unnecessary card – I would like to buy it or exchange with ones I have. I am open to any suggestions 🙂

    Best regards,
    Leszek

    1. Small update. Even the card purchased on Aliexpress didn’t work. I was not able to change the CID. Maybe the problem is not only with the date of production but also with country of production. All the cards I have been testing were made in Philippines.
      Or maybe my laptop HP EliteBook, which I am using is not proper for such task, I don’t know.

      Now I am waiting for delivery of SD cards from manufacturer able to customise the CID. If this will be confirmed source, I will let you know.

      1. Hello
        Leszek long time ago you were writing about order of changeable CID sd cards from China. Were you able to make such order? Did it work? In my case they don’t agree to send a sample and accept order of minimum 100pcs. That is a rather expensive. Of course it would be no problem to sell all this SDs, but $5 for a piece without certainty that it will work is a little bit risky. Including s&h this would be $520.

      2. Hi
        And what with this cards to changable CID ? CID is add by seller or you can change this CID ?
        Can you give me link to this cards and how many you must buy ?

    2. Hi Leszek,

      did you get the card from aliexpress? Can you can the cid? Unfortunately I have few cards but the backdoor is closed and I can’t change the serial.

      I looking for seller who has the “old” card.

      Regards, Janos

    3. Hi
      Did you recived this card from aliexpress ? And you can change CID number ?
      If yes please give me full info about model card from barcode, and year production and Made In ?
      Give me also link to aliexpress.
      Thanks.

    4. Hi
      Did you recived card from aliexpress ?
      Did you can change CID on this card ?
      Please give me model number from barcode, Made in ? and year production.
      Also please give me link to this card from seller on aliexpress.
      Thanks

  12. Hi I actually tried to change cid but when i finish the end code ist 02 (744a454e2f412020106c6d77470104c2) not 03 (744a454e2f412020106c6d77470104c3) it’s that’s right?

  14. Pingback: XV Sat Nav Map updates - Page 160

  15. Hi, i try to change cid but i have little problem…
    1. it say ‘s to me> ioctl: Connection timed out
    Unlock command failed.
    2. If i repeat command then unlock command failed.
    3. repeat again then Failed to enter vendor mode. Genuine Samsung Evo Plus?

    So what is wrong? All information about card is here>
    Samsung evoplus 32gb
    oot@ubuntu:~/Desktop/evoplus_cid/jni# ./evoplus_cid /dev/mmcblk0 744a454e2f412020106c6d77470104c3
    Unlock command failed.
    root@ubuntu:~/Desktop/evoplus_cid/jni# ./evoplus_cid /dev/mmcblk0 744a454e2f412020106c6d77470104c3
    Failed to enter vendor mode. Genuine Samsung Evo Plus?

    root@ubuntu:~/Desktop/evoplus_cid/jni# ./evoplus_cid
    /dev/mmcblk0 744a454e2f412020106c6d77470104c3
    Failed to enter vendor mode. Genuine Samsung Evo Plus?
    root@ubuntu:~/Desktop/evoplus_cid/jni# cat /sys/block/mmcblk0/device/cid
    1b534d303030303010829b5d02010b01

    root@ubuntu:~/Desktop/evoplus_cid/jni# ls -l /sys/block |grep mmc
    lrwxrwxrwx 1 root root 0 Dec 17 20:43 mmcblk0 -> ../devices/pci0000:00/0000:00:1c.3/0000:04:00.0/rtsx_pci_sdmmc.0/mmc_host/mmc0/mmc0:0001/block/mmcblk0
    root@ubuntu:~/Desktop/evoplus_cid/jni#

  16. Pingback: EU maps: download with CID - Page 50 - 2004 to 2016 Mazda 3 Forum and Mazdaspeed 3 Forums

      1. Hello,
        Thanks for the answer. I was compiling on raspberry pi and got:
        evoplus_cid.c: In function ‘program_cid’:
        evoplus_cid.c:58:19: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
        idata.data_ptr = (__u64)cid;
        ^
        evoplus_cid.c: In function ‘parse_serial’:
        evoplus_cid.c:107:7: warning: incompatible implicit declaration of built-in function ‘strlen’
        if ((strlen(str) > 2) && (str[0] == ‘0’) &&
        ^
        evoplus_cid.c: In function ‘main’:
        evoplus_cid.c:135:8: warning: incompatible implicit declaration of built-in function ‘strlen’
        len = strlen(argv[2]);
        ^

        is that okay should i ignore it?

        2. Hello, can help me someone I tried to change the CID, but when I entered comand : gcc evoplus_cid.c -o evoplus_cid
          I got this:
          evoplus_cid.c: In function ‘parse_serial’:
          evoplus_cid.c:107:7: warning: implicit declaration of function ‘strlen’ [-Wimplicit-function-declaration]
          if ((strlen(str) > 2) && (str[0] == ‘0’) &&
          ^
          evoplus_cid.c:107:7: warning: incompatible implicit declaration of built-in function ‘strlen’
          evoplus_cid.c:107:7: note: include ‘’ or provide a declaration of ‘strlen’
          evoplus_cid.c:109:9: warning: implicit declaration of function ‘strtol’ [-Wimplicit-function-declaration]
          val = strtol(str, NULL, 16);
          ^
          evoplus_cid.c: In function ‘main’:
          evoplus_cid.c:135:8: warning: incompatible implicit declaration of built-in function ‘strlen’
          len = strlen(argv[2]);
          ^
          evoplus_cid.c:135:8: note: include ‘’ or provide a declaration of ‘strlen’
          evoplus_cid.c:179:2: warning: implicit declaration of function ‘close’ [-Wimplicit-function-declaration]
          close(fd);
          ^
          Thanks in advance for help

    1. You can copy the compiled evoplus_cid to /data on you phone or tablet and run it form there. Path to current cid of an sd card depends on your kernel, but can usually be found with in /sys/bus/mmc/devices/mmc0:0001/cid (note mmc0:0001 will vary, do a listing of /sys/bus/mmc/devices/ before and after inserting the card and see to see which device id gets added for your card).

  19. Interesting Read!

    I would like to try this. What android device did you use for this ?

    Unfortunately my phone doesn’t have a memory card slot

    1. I tested with a Samsung Galaxy Tab 2 (p5110) running either CyanogenMod 12 or 13 (not got it hand at this moment). It should work on pretty much any Android phone/tablet though. You might also get it to work on a PC running Linux, but you’ll need to have a proper SD reader, not a USB one (probably only find a real one on a laptop). I read in a forum where someone had compiled this code on Ubuntu and it sounded like it worked. I haven’t tried it because I don’t have a PC with a real SD slot.

      1. I actually tried my laptop with windows and PC with linux to read an CID one day but wasn’t successful.
        I’m going to order a tab and let’s see how this goes! I’ll let you know …
        Thank You for the reply

Leave a Reply