Rabbit-Labs – Multi Pass MagSpoof Flipper Board

Description

>> There Are Some Things Money Can’t Buy, For Everything Else There’s Multi Pass <<

EMV was supposed to kill the magnetic stripe. It didn’t. That brown band of oxide is still clinging to life at the grocery checkout, the hotel room door, the parking garage, the arcade token machine, and a thousand legacy readers nobody ever upgraded. If your research touches access control, it touches magstripe.

The Rabbit-Labs MultiPass is a Flipper Zero add-on board that emulates a card swipe by driving track data into a reader head as a shaped magnetic field. Based on the original MagSpoof research by Samy Kamkar, rebuilt into a board made to actually swipe. No stripe, no card stock, just the field a reader expects to see.

It saves your Flipper from itself. The Flipper’s MagSpoof app can drive the device’s internal coils and antenna to do this, but that path can irreversibly damage the internal radios. MultiPass moves the job to dedicated hardware, so you keep your Flipper’s radios intact and get a far stronger, more reliable field doing it.

Built like the thing it emulates. Each board is hand soldered, hand assembled, and tested in-house at Rabbit-Labs. The PCB is no thicker than a credit card, so it swipes cleanly through slot readers, even ones with shielding around the throat that choke thicker boards. Two oversized field capacitors dump maximum energy into each spoof for a clean read, and only genuine, top-tier driver ICs and components go into the build. No bargain-bin silicon.

Nothing lives on the board. MultiPass has no memory of its own. The track data comes from your Flipper at swipe time. The board is just the muscle.

Key Specs:

• Compatibility: Flipper Zero (GPIO add-on board)
• Function: Magnetic stripe emulation (MagSpoof technique), Tracks 1, 2, and 3
• Design Basis: Samy Kamkar’s MagSpoof
• PCB Thickness: credit-card thin for slot-reader swipes
• Field Drive: dual oversized capacitors
• Onboard Storage: none (track data supplied by host)
• Required App: MagSpoof Flipper app (HummusSec fork), or RogueMaster, Unleashed (S branch), or Momentum (dev branch)
• Assembly: Hand soldered, hand assembled, and tested by Rabbit-Labs

Applications that matter:

Access-Control Research. Test and audit magstripe-based entry systems you own or are authorized to assess: doors, gates, and legacy badge readers.

Security Education. A hands-on way to teach how magnetic stripe data is structured, read, and spoofed, and why the stripe is the weak link EMV was meant to retire.

Legacy Reader Testing. Bench-test point-of-sale and kiosk readers, arcade and transit stock, and other magstripe hardware with stripe data you control.

Field Research. Pocketable, Flipper-powered, and strong enough to read reliably without a physical card.

The card is optional. The swipe is not.

▌README.TXT – INSTRUCTIONS FOR USE

Compatibility: MultiPass is a Flipper Zero GPIO add-on and requires a MagSpoof Flipper application to drive it.

Step 1: Install a MagSpoof App Get the MagSpoof app running on your Flipper. Options:

• Build the HummusSec MagSpoof fork from GitHub yourself, for official firmware or the firmware of your choice.
• Run the latest RogueMaster, which includes it.
• Run the S branch of Unleashed.
• Install it on the dev branch of Momentum.

Note: the HummusSec app is a work in progress and currently buggy, so your mileage may vary.

Step 2: Seat the Board Power the Flipper off. Align MultiPass with the Flipper’s GPIO header and seat it fully.

Step 3: Load Track Data Open the MagSpoof app and load or enter the track data you are authorized to use. The board stores nothing; the data lives on your Flipper.

Step 4: Position For slot readers, line the card-thin edge of the board up with the reader throat the same way you would a card.

Step 5: Swipe Trigger the spoof in the app and draw the board through the reader at a steady, even speed, as you would a real card. The oversized capacitors drive the field through each pass.

Step 6: Adjust If the read fails, vary your swipe speed and the board’s alignment in the slot, and trigger again. Different readers like different speeds.

PRO TIP: Reader heads sit at a fixed depth in the slot. Keep the active edge of the board at the same height a real card’s stripe would ride, and swipe at a smooth, moderate pace. Too fast or too slow is the most common reason a spoof doesn’t take.

▌DEBUG LOG – TROUBLESHOOTING

ISSUE: Reader doesn’t respond to a swipe. FIX: Vary swipe speed first; most failures are timing. Confirm the track data is valid for that reader, and that you are swiping the correct track in the correct orientation.

ISSUE: App won’t drive the board, or crashes. FIX: The MagSpoof apps are works in progress. Try a different firmware or build (HummusSec fork, RogueMaster, Unleashed S branch, Momentum dev). Make sure you are on a build that actually includes the board support.

ISSUE: Intermittent reads. FIX: Keep the board’s active edge at stripe height in the slot and swipe at a consistent speed. Recharge your Flipper, since a low battery weakens the drive. Shielded reader throats need a steady, full-depth pass.

ISSUE: Board not detected on the GPIO. FIX: Power down, reseat the board, and check orientation against the pin 1 marking. Inspect the header pins for bends.

ISSUE: Works on one reader, not another. FIX: Expected. Readers vary widely in head depth, shielding, and timing tolerance. Some legacy readers are simply fussy. Adjust speed and alignment per reader.

▌SYS.WARN – WARNINGS, HAZARDS & DISCLAIMERS

AUTHORIZED USE ONLY. MultiPass is a magnetic stripe emulator for security research, access-control testing, and working with magnetic stripe data you own or are authorized to use. It drives a coil to reproduce a magstripe field at a reader head. Nothing is stored on the board; the data comes from your host device.

You Are Responsible. You are solely responsible for how you use this product. Emulating, replaying, or presenting magnetic stripe data you are not authorized to use may violate federal and state law, including the access device fraud statute (18 U.S.C. 1029) and the Computer Fraud and Abuse Act (18 U.S.C. 1030). Do not use MultiPass with payment card data, credentials, or access cards that are not yours or that you are not expressly authorized to test. Rabbit-Labs LLC disclaims all liability for misuse.

Educational and Research Purpose. Use of MultiPass is intended solely for educational, research, and personal purposes on systems and data you are permitted to work with. Rabbit-Labs LLC is not responsible for any unauthorized or illegal use of this product. Any misuse is at the user’s own risk.

Hold Harmless. By using this product you agree to these terms and agree to hold harmless Rabbit-Labs LLC and its associates from any and all loss, damage, expenses, claims, suits, proceedings, actions, and causes of action of any kind arising out of your use of this product.

ESD Sensitivity. This is a bare electronic board. Handle it on an ESD-safe surface and avoid touching the driver IC and header pins directly.

Not a Toy. Contains small parts and electronic components. Keep out of reach of children.

Compliance. CE marked. Contains no radio transmitter. The full EU Declaration of Conformity and the FCC Part 15 status statement are available at rabbit-labs.com/compliance.

Disclaimer. This product is sold “as-is” for use by qualified individuals. The required Flipper applications are third-party, in active development, and may be unstable. Rabbit-Labs LLC makes no warranty, express or implied, regarding fitness for a particular purpose. Maximum liability shall not exceed the purchase price of the product.

© Rabbit-Labs LLC. All rights reserved. The Rabbit-Labs name and logo are trademarks of Rabbit-Labs LLC. Flipper Zero is a trademark of Flipper Devices Inc. Rabbit-Labs is not affiliated with or endorsed by Flipper Devices Inc. MagSpoof is the work of Samy Kamkar.