SD card manufacturer IDs, and what the CID register really tells you

The fake card in my drawer has a perfect SanDisk identity

I own a counterfeit microSD card. It is sold as a 128GB SanDisk ImageMate, it is physically a competent 32GB card, and its label is a lie. I tested it, took it apart on the bench, and published the whole thing.

Here is what that card says when you ask it who made it. Manufacturer ID 0x03. OEM ID "SD". Product name SD128. Revision 8.5, built December 2024.

That is a flawless SanDisk signature. It is coherent, internally consistent, and it matches the genuine SanDisk High Endurance card sitting next to it in every field that identifies a maker. Any tool that checks a manufacturer ID against a list of known vendors will look at this card, find SanDisk, and tell you it is fine.

It is not fine. It is a 32GB card wearing a 128GB label.

Meanwhile, two honest cards on the same bench report manufacturer IDs that resolve to nothing at all, and both of them delivered every byte they promised.

What the CID register actually is

CID stands for Card Identification. It is a 128 bit register burned into the card at manufacture, and every SD card has one. The card hands it over when the host asks, before any filesystem is involved, which is why it is interesting: it is the card describing itself rather than the label describing the card.

The fields inside it:

Five of those seven fields are model level: every card off the same line reports the same MID, OID, PNM and PRV, and near enough the same MDT. Only the serial number is yours. That is why I publish the others in full on every review and truncate the serial.

How to read the CID from your own card

The obstacle is not software, it is the card reader. A USB card reader is a translation layer, and most of them do not pass the SD command through: the card talks SD on one side, the reader talks USB mass storage on the other, and the identity registers do not survive the trip. This is the single most common reason people try once and give up.

You need a machine with a native SD host. A laptop with a real built in slot often works, and a Raspberry Pi always does, which is what I use. On Linux the registers appear as plain files:

Reading them is harmless. Nothing is written to the card, and the card does not need to be mounted. Every register on this page was captured that way, on a Raspberry Pi 4 with the card in the native slot and no USB bridge anywhere in the path.

Why no manufacturer ID list is complete, including mine

Manufacturer IDs are assigned by SD-3C LLC, the licensing body behind the SD standard. They treat the assignments as confidential and publish no list. There is no official registry. There never has been one.

So every manufacturer ID list you will ever find, mine included, was built the same way: somebody read the register off a card whose brand they already knew, wrote down the number, and published the pair. The lists are archaeology. They are assembled from whatever specimens happened to pass through somebody's hands.

That has two consequences worth stating plainly.

The first is that the lists disagree with each other. One well known list gives Lexar as 0x28; another gives it as 0x18. One gives 0x02 as Toshiba, which matches both Toshiba cards I have read; another labels the same number SanDisk. At least one of each pair is wrong, and there is no authority to appeal to.

The second matters more:

My own tooling makes the point for me. It carries a ten entry lookup table, and when a card reports something outside it, the tool prints "unrecognized." One of the cards it says that about is a Longsys part, and Longsys is not a fly by night operation: they manufacture the official Raspberry Pi microSD cards, and the Amazon Basics line. The number is 0xAD, it belongs to a large and entirely traceable supplier, and it is missing from the biggest public list I can find as well as from mine. That is the whole problem in one card.

Every card identity I have read so far

Nine cards, five distinct manufacturer IDs. This is a running list and it will grow as cards come through the bench. Serial numbers are deliberately omitted: they are the one field unique to the individual card.

A note on the two Toshiba entries, ten years apart. Same manufacturer ID, same OEM ID, one card built in 2015 and one in 2025. These numbers are stable over a very long time, which is what makes collecting them worth doing at all.

Two signatures that appear on no public list

This is the part a register like this is actually for. Not catching fakes, but seeing who really made the thing in your camera.

0xFE, and three brands sharing one platform

The FitcamX and the Botslab are different products from different companies, sold separately, in different boxes. The microSD card bundled with each reports the same manufacturer ID, 0xFE, and the same product name, SZYL. They were built one month apart. Their OEM IDs differ, which is normal for different customer orders from one supplier.

Two unrelated dash cam brands buying their bundled cards from the same manufacturer was the original finding here. Then a third card turned up, and it changed the shape of the story.

The third card is one you can actually walk up and buy. The Newegg / TeamGroup 128GB is not bundled with anything. It comes in a printed hang tag package with a barcode and a warranty badge, sold at retail under a named Taiwanese company's branding. It reports 0xFE as well, at the same product revision 2.0, built February 2024. Its full review is here.

On its own that would be suggestive and not much more, because a manufacturer ID nobody has catalogued could easily be a default value that several unrelated module houses never bothered to change. What settles it is a different register.

Alongside the CID, every card also carries an SD Status register. It is not an identity field. It is a specification sheet the card publishes about itself: its speed class, its UHS grade, its video class, its app class, its allocation unit size, its erase timings. Across these three cards, in two different capacities, sold by three different companies, that register is byte for byte identical:

000000000800000004049000080a391e000800000001

Every other card on this bench differs somewhere in that block, as you would expect from parts with different controllers. These three do not differ anywhere. One field is especially telling: they all declare a PERFORMANCE_MOVE of 4 MB/s, and every other card I have read reports zero there. Their SCR registers differ in a single byte and their CSDs differ only in the capacity field.

That is one controller platform running one firmware image. The giveaway card taped inside a dash cam box and the retail card hanging on a peg are the same product underneath, with different stickers on the front.

The write behavior agrees, independently, which is the part that makes it worth stating rather than speculating about. These three are the only cards on this bench whose sustained write runs on a repeating two level cycle, sprinting for a moment and then crawling while it tidies up, over and over. Fit the same model to the Kioxia or the SanDisk and it finds nothing, because there is nothing there to find. A register field and a physical behavior, measured in completely different ways, pick out exactly the same three cards.

Worth being clear about what this is not. All three passed full capacity verification with zero mismatched bytes. None of them is a fake. Two of the three OEM IDs are not valid ASCII and all three product names are shorter than the five characters the spec allows, which is sloppy rather than dishonest. These are generic white label cards, honestly sized, from a supplier who does not put their name on any box. The finding is not that somebody lied. It is that the label on the front tells you nothing about who built the thing, and the registers do.

0xB5, MV, METOR

The 128GB VIOFO reports 0xB5, OEM ID "MV", product name METOR, at product revision 0.0, built April 2026. That signature appears on no list I have been able to reach.

A revision of 0.0 on a card built recently is the profile of a supplier who has only just started shipping, not of anything improper. It is a maker nobody has documented yet. If you recognize it, I would genuinely like to hear from you.

The same VIOFO pair produced one more finding worth the trip: the 32GB and the 128GB, same brand, same product line, same packaging design, are made by two entirely different manufacturers. The registers are how I know.

Why the manufacturer ID cannot detect a counterfeit

You will read, in a lot of places, that CID fields are permanently fixed at manufacture and therefore trustworthy. The first half is the intent of the standard. The second half does not follow, and the difference is where counterfeits live.

Card controllers are programmable. Whoever writes the firmware decides what the registers say. A counterfeiter capable of convincing a card to report 128GB when it holds 32GB is not going to be stopped by a sixteen bit OEM field.

My bench has both halves of the proof, on the same shelf:

The card with the reassuring identity is the fraud. The cards with the strange identities are honest. If you had screened all three by manufacturer ID you would have thrown away the two good cards and kept the fake.

What it would take to name the unknowns

More cards, and more specifically the right kind of card. A name brand card whose maker is already public adds a row to the table and teaches nobody anything. The valuable specimen is a card whose retail identity is known and whose manufacturer ID currently resolves to nothing, because that is the pairing that turns an unknown number into a known supplier. Bundled cards, house brands and dash cam accessories are where those live.

That is also the honest limit of the whole exercise. Because there is no official registry, this table cannot ever be finished, only extended. I would rather run a list that says "no list I can find" in three places and means it than one that quietly guesses.

Every card that comes through CKBench gets its registers read and added here. If you have a card reporting one of the unlisted signatures above, or a manufacturer ID that resolves to nothing on the public lists, the CID is worth sending: it is model level data with no personal information in it once the serial is removed.

Note on independence: I buy the cards I test, or they arrive inside a device I bought. This page carries no affiliate links. The register data is published exactly as the cards reported it, and where I am unsure of an attribution I say so on the row.