The Absolute Nuclear-Level ARQC / CDA / SDAD Generation Bible 2025

[Student]

(30 Nov 2025 – The exact byte-by-byte process used by the last 4 groups that are still pulling $8k–$22k per day from Chase / Wells Fargo / BofA / TD / Santander indoor ATMs)

This is the final, most detailed version ever written. If you follow every single byte below, your cloned card will pass full Combined DDA + Application Cryptogram Generation (CDA) on 91–97 % of indoor ATMs worldwide right now.

Part	Exact value / tool (30 Nov 2025)	Why it kills if wrong
Software	X2 2025 v9.3.8.1 build 30112025 cracked	Only build with working CDA + 2025 key pack
Key pack	“2025_Issuer_Master_Keys_v31” (1,847 banks cracked as of 30 Nov)	Missing key = 0 % CDA pass
Blank	JCOP184 v3.4 80K or NXP JCOP4 P71D336 with Athena IDProtect 2025	Cheap blanks have no proper RSA key support
Reader	Omnikey 3121 RDR + ACR122U for NFC fallback	Other readers drop bytes during write

Byte-by-Byte ARQC + CDA Generation Process That Still Works Today​

Phase 1 – Dump Validation (if any of these fail → stop)​

1. Tag 5A – PAN (exact match)
2. Tag 5F24 – Expiry (MMYY)
3. Tag 9F36 – ATC (e.g., 00A7) → you MUST use this exact counter
4. Tag 82 – AIP → byte 2 must be 10xx or 18xx (CDA supported)
5. Tag 8E – CVM List → must start with 42 03 1E 03 02 (Offline PIN first)
6. Tag 9F26 – Old ARQC (if present)
7. Tag 9F10 – Issuer Application Data (contains key index + ICC data)

Phase 2 – Session Key Derivation (the real 2025 method)​

1. Load dump → Tools → “2025 Key Pack” → select BIN (e.g., 414720 = Chase)
2. Software auto-loads:
   • Issuer Master Key (IMK) 16-byte 3DES or 32-byte AES
   • ICC Master Key (for SDA/SDAD)
3. Derive Session Key for AC: Method = 3DES-ECB (Visa/Chase) or AES-128-CMAC (Mastercard) Input = ATC (left-padded to 16 bytes) Example for ATC 00A7: 00 A7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Encrypt with IMK → SK_AC (16 bytes)

Phase 3 – Build the exact data block the terminal expects​

Terminal sends PDOL: 9F66 04 9B00 0000 9F02 06 000000010000 9F03 06 000000000000 95 05 0000000000 9A 03 251130 9C 01 00

You must reply with CDOL1 data exactly like a real card:

9F02 06 000000012345   ; Amount
9F03 06 000000000000   ; Other amount
9F1A 02 0840           ; Country code
95   05 0000000000     ; TVR
9F36 02 00A7           ; ATC (exact!)
9F36 02 251130         ; Transaction date
9C   01 00             ; Transaction type (cash)
9F10 15 010203040506070809101112131415   ; Issuer data from dump

Phase 4 – Generate the real ARQC (this is the 2025 part)​

1. X2 2025 → ARQC Tab → “Generate CDA Full”
2. Select:
   • AC Type = ARQC (80)
   • CDA Mode = Combined DDA + AC Generation
   • Cryptogram Version = 51 (Visa) or 71 (Mastercard)
3. Click Generate → you get:
   • 9F26 = 8-byte ARQC (e.g., 3F8A1C9D4E7B2F01)
   • 9F10 = updated Issuer Application Data (ATC incremented)
   • CID = 80 (ARQC with CDA)

Phase 5 – Generate Signed Dynamic Application Data (SDAD) – the final kill switch​

1. CDA Tab → “Generate SDAD”
2. Input:
   • ICC Private Key (recovered from dump or key pack)
   • Hash of all dynamic data (PDOL + CDOL1)
   • Padding = PKCS1 v1.5
3. Output = Tag 9F4B (SDAD) – 128 or 256 bytes RSA signature This is what the terminal verifies in 80–120 ms.

Phase 6 – Write everything back to blank​

Tag 9F26 → new ARQC
Tag 9F10 → updated Issuer data
Tag 9F36 → ATC + 1 (after first transaction)
Tag 8E   → CID = 80
Tag 9F4B → SDAD
Tag 9F47 → ICC Public Key Certificate (exact from dump)

Phase 7 – Final test on real terminal​

Verifone VX520 → insert → Balance Inquiry → enter PIN Terminal does full CDA:

• Verifies ICC signature
• Verifies SDAD
• Verifies ARQC If all pass → shows real balance = 100 % working cloned card.

Real Success Rates When Done 100 % Correctly (30 Nov 2025)​

Bank	CDA + SDAD pass rate	Avg cash per card (4–8 hits)
Chase	94–97 %	$5,800–$9,200
Wells Fargo	91–95 %	$5,200–$8,400
Bank of America	93–96 %	$6,100–$9,800
Capital One	89–93 %	$4,800–$7,600

Bottom Line – 30 Nov 2025​

If you follow every single byte above exactly with X2 2025 v9.3.8.1 + the 2025 key pack + real JCOP184 v3.4 blanks → your cloned card will pass full CDA verification on 91–97 % of indoor ATMs worldwide today.

One single mistake in ATC, session key, CVM list, or SDAD → instant “Chip malfunction” or silent decline.

This is the absolute last working EMV cloning method before the final death (March–June 2026). There is nothing more advanced left. Run it exactly as written while the window is still open.