There Is an NFC Tag in My Vitamix Jar, and I Had to Bypass It

Submitted by petrify on Mon, 08/17/2026 - 06:42

This is for someone who has a Vitamix blender with the stupidly named "SmartDetect" NFC tags and is comfortable with hacking.

The base checks an NFC tag embedded in an official container before it runs a program. The tag is read in plaintext and does not use challenge-response authentication, so a UID-writable ("magic") NTAG and a Proxmark3 are enough to make a compatible copy.

One of the jars that came with the blender stopped being detected by the base. The official jars are expensive, and I wanted to see if I could bypass the NFC check and make that jar work with the base again. This is a record of the steps I took to make a third-party container pass that check.

If you want to use a coding agent to help copy this tag, I wrote an agent skill for the Proxmark3 workflow.

What I used

Reader	Proxmark3 Easy running the RRG/Iceman Proxmark3 fork; firmware `v4.21611`. For the hardware, search for "Proxmark3 512M RFID Card Reader IC" on aliexpress.us.
Client	`pm3` CLI via Homebrew (`brew install proxmark3`)
Firmware check	After connecting the reader, run `hw version` and compare the reported firmware with `v4.21611`. Use the matching RRG/Iceman client and device firmware before running the scripts below.
Device node	`/dev/cu.usbmodem11101`. When I attached the Proxmark3 to my Mac, it appeared as this device node.
Clone tag	UID-changeable "magic" NTAG216 (identified as a USCUID-UL class tag) On aliexpress.us, search for `25MM NFC 13.56Mhz NTAG216 UID Changeable Writable 25mm Inlay Tag Stickers` Note: Require NFC tags that have the UID changeable and writable: Look for a tag whose UID can be changed and whose memory can be written. The changeable UID lets it match the original tag, while writable memory allows the tag data to be copied during setup.

Check the reader and firmware

Connect the Proxmark3 to your computer. Install the client first with brew install proxmark3. On my Mac, the reader appeared as /dev/cu.usbmodem11101.

$ pm3 -p /dev/cu.usbmodem11101 -c "hw version"

Check the output before continuing. It should show firmware v4.21611, the version used for this write-up. The client and the device firmware should come from the RRG/Iceman fork and match each other. If the version is different, stop here and install the matching build rather than continuing with the tag-writing steps.

Read the original tag

Luckily, I had a working original container that the base recognized. I put it on the antenna and identified the tag before making a dump:

$ pm3 -p /dev/cu.usbmodem11101 -c "hw tune; hf search; hf 14a info"

hf search identified an ISO14443-A tag from NXP Semiconductors Germany and suggested an NTAG 2xx. The info command narrowed that down to an NTAG216 and verified the NXP originality signature:

TYPE: NTAG 216 888bytes (NT2H1611G0DU)
UID:  XX XX XX XX XX XX XX
Lock: FF FF
Signature verification: successful

I then made a full memory dump before writing anything:

$ pm3 -p /dev/cu.usbmodem11101 -c "hf mfu dump -f vitamix_original"

That produced vitamix_original.bin and vitamix_original.json. The dump covers all 231 pages, including the NDEF record. The tag contains a plain NDEF URI pointing to vitamix.com/nfc?tag=XXXXX, with the tag's UID in the URL. There were also about 140 bytes of binary configuration data in pages 0x20–0x57. That is the part the blender uses to identify the container type and size.

Check the blank magic tag

Place the NTAG216 sticker you bought flat on the Proxmark3 antenna, roughly over the center of the coil. Keep it still while you run:

$ pm3 -p /dev/cu.usbmodem11101 -c "hf 14a info"

Check the response. The ATS should begin with 85 00 00 A0 ..., a pattern associated with the hidden vendor configuration on USCUID-class tags. The output should identify the tag as an NTAG216 with the USCUID-UL class:

TYPE: NTAG 216 888bytes (NT2H1611G0DU) ( USCUID-UL )
UID:  YY YY YY YY YY YY YY
Lock: 00 00

If the Proxmark3 does not find the tag, move the sticker slowly across the antenna and run the command again.

Set the tag's identity fields

Before restoring the memory dump, configure the blank USCUID tag with the identity values from the working tag. USCUID tags keep the UID, tag type, version bytes, OTP, and stored IC signature in a separate hidden configuration area.

The RRG/Iceman Proxmark3 fork listed in the workstation table includes the hf_mfu_magicwrite script for writing those fields. Use jq to pull the values from the JSON dump. In this dump, page 3 contains the OTP value:

$ DUMP=vitamix_original.json
$ TAG_UID=$(jq -r '.Card.UID' "$DUMP")
$ TAG_OTP=$(jq -r '.blocks["3"]' "$DUMP")
$ TAG_VERSION=$(jq -r '.Card.Version' "$DUMP")
$ TAG_SIGNATURE=$(jq -r '.Card.Signature' "$DUMP")

Put the blank tag back on the Proxmark3 antenna, then run the command with those values:

$ pm3 -p /dev/cu.usbmodem11101 -c "script run hf_mfu_magicwrite \
    -u $TAG_UID -t 7 -o $TAG_OTP -v $TAG_VERSION \
    -s $TAG_SIGNATURE"

The -t 7 option identifies the tag as an NTAG216. The -s value is the TAG IC Signature from the original dump, not the NXP public key shown by hf mfu info. They are different 32-byte values. The Card.TBO_0 and Card.TBO_1 fields are separate dump metadata; do not use them for -o.

Leave the clone writable

Zero the clone's two page-2 lock bytes before restoring the dump; otherwise copying FFFF from the original would lock the clone. This command reads the original file and writes the patched data to a new file, leaving vitamix_original.json unchanged:

$ jq '.blocks["2"] = (.blocks["2"][:4] + "0000")' vitamix_original.json > vitamix_clone.json

Write the full dump

$ pm3 -p /dev/cu.usbmodem11101 -c "hf mfu restore -f vitamix_clone.json -s -e"

Test whether it worked

Bring the cloned tag close to the base. The base should recognize it as a valid container, and the display should show "0:00".

Result

I stuck the cloned tag under the rubber cover on the blender. The display on the base showed "0:00", and pressing the start toggle made the blender spin, even without a jar on it. I was able to use the blender with the jar that had not been recognized before.

Caveats

This bypasses tag detection, not physical fit or blade safety. Use appropriate settings with third-party jars.