A couple of newbie questions

(I’m gonna be addressing a lot of things out of order, sorry about that)
Okay so, there’s a lot to respond to here. First, I’ll go over some more general info, since you want to learn. One of the biggest things to clarify, is info on frequencies. In the world of implants, there are two that matter generally, LF, and HF. Low frequency, high frequency. Specifically, 125kHz for low frequency, and 13.56MHz for high frequency. There are others in use, for instance, 134.2 kHz is used for pet implants, and there are UHF RFID tags used mainly for parking passes and for inventory management in large warehouses. Modern phones use 13.56MHz high frequency. Now, another important distinction is RFID vs. NFC. RFID is the general term for the overarching technology, LF HF or UHF, doesn’t matter. NFC is a set of communication protocols used by some 13.56MHz devices, including phones.

The xNT is a HF implant, the xEM is an LF implant, and the NExT is literally just the two of them shoved into one implant. Both sides of the NExT are independant. The xSIID is also HF.

A term that you’ll hear thrown around a lot here is NDEF and NDEF records. NDEF stands for NFC Data Exchange Format. Basically, a high-frequency NFC implant (with some exceptions) is essentially just a big block of storage. Within that storage, there are parts that are read-only, and can’t be modified from the factory. This includes the serial number (also called the UID) of most NFC chips, like the xNT or the NExT. They are both actually based on the same physical chip, the NTAG216.

Other parts of that storage are writable by the user. In almost all cases, these parts are used to hold NDEF records. NDEF records are information that is readable by a phone or other NFC device. That’s a generic term, but it can be a lot of things. Generally, the most common types of NDEF records used are things like website URLs, contact info via a format called vCard, or even information to connect to a certain wifi network. This is how most of us use our implants with phones, is to share information with others.

On all NTAG based implants, only up to 888 bytes of storage space are able to be used for NDEF records, which is what 99% of people will use them for.

On the xSIID, it is based on the NTAG I2C series, which has 2 kilobytes of storage. However, as stated, only 888 bytes can be used for NDEF storage. The remaining space can be used for user data. What I meant earlier about using the space via your own programming, is that, you can use actual NFC shell commands (getting decently complex at that point) to put data into that space, and retrieve it. This is out of the realm for a lot of users, and for a lot of people, it doesn’t make a lot of sense to do so. However, it’s there if someone wants it. @DonFire did a good post a bit ago about achieving this, here is that thread. Don’t worry if that overwhelms you a bit, it’s the opposite of beginner stuff.

Because of this, from a user perspective, there is nothing different about using an xSIID compared to an xNT or the HF side of a NExT, but that extra space is there if needed.

Regarding opening up an implant, that’s 10000000% a no-no. They’re sealed soda-lime glass, filled with resin. Even if you could open it up, there’s nothing you could do with it. As I mentioned, NTAG chips are essentially just a big block of storage that can be accessed. They can’t run code really, they’re not microcontrollers. There are some minor exceptions to this, because of course there are, but they don’t really matter for the scope of this discussion. Basically, other than writing and reading data, consider most HF implants unmodifiable in that aspect. Picture them like a tiny internal flash drive to store useful info on to share with others.

Regarding the DT app, that is only ever required if you decide to get an xNT. Basically, you can set a password on an NTAG216 chip, which is needed to change configuration options. The reason why this is important, is without it, someone could make the ENTIRE chip read-only, making it forever unchangeable. On the NExT, the HF side is already password protected from the factory, but on the xNT, there’s no password. The DT app merely adds a specified password to the xNT, to protect it.

Another thing to clear up, is implant notation, because you see it a lot. There’s a great post here, that you can read to understand what I mean when I say locations.

My primary implant is an xSIID, in position R0. I also have a NExT in position L0 (and a Spark 2 in L2).

So, this is why I like the xSIID as my primary implant. Due to it having an LED built-in, I can use it to find good positioning on any reader. Just move my hand until it starts lighting up.

However, this is far from required. What a lot of people do, is have a seperate xLED implanted next to another implant. xLEDs come in both HF and LF versions, and that determines what field type makes them light up. So, if someone has an HF implant, like an xNT, they might put a HF xLED next to that. This gives you lights/blinkies (as we call them) next to any implant you want, and they act as a convenient field detector (like you said, makes sure you hit the right spot). Generally the guideline is 5mm spacing between implants.

This brings up another topic that’s important to know, given what I just said. Crosstalk is something that can happen, when you have two implants of the same frequency next to each other. For instance, you wouldn’t want a HF implant in L1 and an HF implant in L2. If they’re too close, they can interfere with each other. Same goes for LF implants. The major exception to this rule is xLEDs. Since they don’t “talk” as it were, they don’t cause cross-talk on their respective frequencies.

While it’s not relevant to NTAG based implants, in a lot of implant and access control work, the two most common programming languages you’ll see is C and Python. This is for doing microcontroller programming (such as the work I’m doing on my car project), simple desktop apps to read from implants, etc. C for low level stuff, Python for anything high-level that needs good libraries (like nfcpy).

Regarding software for a proxmark, the software and firmware is completely open-source, it’s a command-line utility. Linux would be by far the best platform to use, but windows is fine as well.

Now, LF stuff… this is where things get tricky. Basically, the chip used in the xEM and the NExT is the T5577. This chip is used to emulate several different card types. This is why you can clone various LF credentials to it. LF is generally only used to pull a UID, but that’s simplifying a bit. There’s no NDEF records, no user storage, nothing. It’s purely for access control.

Now, onto access control. There are essentially two types of access control, to put it simply. UID-based, and encrypted/key-based. For UID systems, it verifies based on the serial number of a chip, which is linked in the system to a particular person. Basically, “Okay, UID 80484382 just scanned, that links to Jim Johnson, who is indeed allowed in this area, unlock the door”. Or, for something like an RFID safe, it’s literally just a list of valid UIDs to accept.

With key-based systems, it’s a lot more complex, but for the most part, consider them non-viable for cloning or anything. The most popular chips in this area are the DESFire EV1 and DESFire EV2.

One more note about UID-based systems, is the xM1 implant. Basically, the xM1 is a HF implant, that allows you to change the UID/serial number on. This allows you to “clone”(for lack of a better term) an HF card on some systems. If the system checks literally nothing but serial number, you can use the xM1 and set the UID to that of the target card. Just thought I’d put that out there, in-case you weren’t aware of that as an option.

You can definitely fit 3 implants in one hand by the way, especially if one is an xLED. I’ve got 2 in my left hand, and an xLED doesn’t really “matter” in terms of implant space, since for most people it almost combines in utility with another implant. I also got all 3 of mine put in at once, and it was no biggie. Wouldn’t fear the number of implants, as long as it’s what’s useful to you. They’re much less consequential once they’re actually in.

You can also definitely add a coil to light up your implants. It’s again, a bit tricky, and there’s a few ways to approach it, but this massive thread I mentioned earlier has a lot of info in that regard.

Also, since this comment is VERY long at this point, I will say, the search function is really good on this forum, and if you search “learn” and “resources” it’ll bring up a ton more than what I mentioned. Don’t mean that in a bad way at all, it’s just that if I try to just restate everything here, I’ll just butcher it :wink:

3 Likes