Another potential bricked xEM? - Fixed!

Not an original title or problem. About 2.5 years ago xEM installed in my hand. I was excited to reprogram it and in hindsight I should have moved a little slower.

When I first attempted to read it, “lf search” using my Proxmark3 Rdv4 (latest official PM3 fw at the time), I didn’t read anything. This is the first point I should have stopped and taken a look at what was going on. I then assumed that the tag was blank, though now I realize it should have had a EM4100 ID already programmed. I attempted a “lf t5 detect” and it seemed to be responding, so then I decided to try to program it to a HID key with “lf clone hid deadbeef”, then a “lf search”. It did not read at this point and I tried several other things including a “lf t5 wipe”.

The end results is the tag doesn’t respond at all. After the fact I attempted to read my buddies newly implanted tag and it read easily with a EM4100 tag. I since learned there are known issues in trying to effectively couple the the antenna to a RFID tag this small.

I have been ignoring this useless lump in my hand in the mean time. So I recently picked up the ProxLF antenna and hoped it would be the magic bullet. That does not appear to be the case. I have updated my Proxmark3 RDV4 to a recent version of the Iceman repository.

I also originally posted over in the Proxmark forum and didn’t get anywhere. I just updated my post over there and decided to post here too.

Here are the hardware / software details:

 [ Proxmark3 RFID instrument ]

 [ CLIENT ]
  client: RRG/Iceman/master/v4.9237-3004-g7034aa525 2021-02-04 14:38:20
  compiled with MinGW-w64 10.2.0 OS:Windows (64b) ARCH:x86_64

 [ PROXMARK3 ]
  firmware.................. PM3RDV4
  external flash............ present
  smartcard reader.......... present
  FPC USART for BT add-on... absent

 [ ARM ]
  bootrom: RRG/Iceman/master/v4.9237-3004-g7034aa525 2021-02-04 14:38:08
       os: RRG/Iceman/master/v4.9237-3004-g7034aa525 2021-02-04 14:38:15
  compiled with GCC 8.4.0

 [ FPGA ]
  LF image built for 2s30vq100 on 2020-07-08 at 23: 8: 7
  HF image built for 2s30vq100 on 2020-07-08 at 23: 8:19
  HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23: 8:30

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev B
  --= Embedded Processor: ARM7TDMI
  --= Nonvolatile Program Memory Size: 512K bytes, Used: 309545 bytes (59%) Free: 214743 bytes (41%)
  --= Second Nonvolatile Program Memory Size: None
  --= Internal SRAM Size: 64K bytes
  --= Architecture Identifier: AT91SAM7Sxx Series
  --= Nonvolatile Program Memory Type: Embedded Flash Memory

An “lf search” doesn’t produce anything particularly useful:

So I am hoping someone can help me determine if the tag is recoverable or completely toasted. I attempted to capture some data that I thought would be useful:

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] (em4x50) timeout while waiting for reply.
[+] Indala (len 232)  Raw: 80000000000000000000000000000000000000000000000000000000

[+] Valid Indala ID found!

[!] (em4x50) timeout while waiting for reply.

An “lf t5 wipe” followed by an “lf search” doesn’t do anything exciting:

[usb] pm3 --> lf t5 wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0

[=] Begin wiping...
[=] Writing page 0  block: 00  data: 0x000880E0
[=] Writing page 0  block: 01  data: 0x00000000
[=] Writing page 0  block: 02  data: 0x00000000
[=] Writing page 0  block: 03  data: 0x00000000
[=] Writing page 0  block: 04  data: 0x00000000
[=] Writing page 0  block: 05  data: 0x00000000
[=] Writing page 0  block: 06  data: 0x00000000
[=] Writing page 0  block: 07  data: 0x00000000
[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 232)  Raw: 80000000000000000000000000000000000000000000000000000000

[+] Valid Indala ID found!

Couldn't identify a chipset

Finally a “lf t5 detect” doesn’t work.

[usb] pm3 --> lf t5 det
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 -->

I have also tried many other things, but nothing that produces any useful results.

All suggestions are appreciated. Otherwise it may be time to remove this things.

I would try just writing an EM ID to it, don’t bother to wipe it.

I have definitely tried this. I have tried clone HID and EM tags, and also writing the t55xx header such as
“lf t5 write b 0 d 00148040”. The “lf search” results are always the same.

If you have something specific you would like me to try though, I am willing.

lf em 410x_write 0F0368568B 1

Check the syntax though, I am running older firmware

Indeed, your syntax is what I am used to, but with the latest Iceman firmware the syntax is:
lf em 410x clone --id 0F0368568B

Note that I followed up with a, “lf em 410x reader” as suggested by the clone command. Then did a “lf search”.

[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4

[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x reader
[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 232)  Raw: 80000000000000000000000000000000000000000000000000000000

[+] Valid Indala ID found!

Couldn't identify a chipset

Also note that the xEM is causing something to happen. If I have the reader in free space here is the results of an “lf search”.

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[|]Searching for COTAG tag......

[-] No data found!
[=] Signal looks like noise. Maybe not an LF tag?

Are you using your DT LF Antenna?

Signal looks like noise. Maybe not an LF tag?

To me that looks like poor coupling, But I am far from a PM3 expert…

Did you re-tune after you changed the antenna
hw tune

Yes and yes.

1 Like

Sorry for sucking eggs stuff.

Just suggesting what I would be going through to fault find

What result do you get with your

lf indala read

in your syntax of course

First of all Pilgrimsmaster and Amal thank you for providing feedback and suggestions. I was burned out on this whole ordeal. I needed someone to keep me motivated. I didn’t expect to solve my problems quick. So I just ran a command (to be indentifed later), and just after that command I ran the following.

[usb] pm3 -->  lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4

[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID 0F0368568B
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID      : F0C0166AD1
[=] HoneyWell IdentKey
[+]     DEZ 8          : 06837899
[+]     DEZ 10         : 0057169547
[+]     DEZ 5.5        : 00872.22155
[+]     DEZ 3.5A       : 015.22155
[+]     DEZ 3.5B       : 003.22155
[+]     DEZ 3.5C       : 104.22155
[+]     DEZ 14/IK2     : 00064481678987
[+]     DEZ 15/IK3     : 001034014845649
[+]     DEZ 20/ZK      : 15001200010606101301
[=]
[+] Other              : 22155_104_06837899
[+] Pattern Paxton     : 259822731 [0xF7C948B]
[+] Pattern 1          : 9750181 [0x94C6A5]
[+] Pattern Sebury     : 22155 104 6837899  [0x568B 0x68 0x68568B]
[=] ------------------------------------------------

[+] Valid EM410x ID found!

Couldn't identify a chipset

I think I am back in business!

3 Likes

yuss1

1 Like

The magic command for today is:

lf t5 write b 0 d 00088040 t

With emphasis on the final “t”. This does it in “test” mode. I remember reading about this when I first was trying to deal with the problem. I likely tried something like this, but I am sure that the DT ProxLF was the key ingredient along with the “t”.

2 Likes

Nice,

I have seen @fraggersparks recommend that before

AND

I used it just 2 days ago to remove the Bluecloner password but found I didn’t need it to do that so I omitted it.

Sorry I didn’t think to suggest it.

Good learnings though.

Thanks for sharing :+1:

Errrrmagrrrddd THANK YOU SOOOOOOOOO MUCH! I was in the same situation was getting the same readings (glad i got the rdv 4 with Dt antenna) the saw your magic command gave it a shot and booya my implant is back online and functional you have no idea how happy I am thnx a mill cheers guys

2 Likes

Glad to hear it!

  • Slack
1 Like

hi so im having the same issue, and i just tried that command, but yet it still doesnt even see it. is mine permanently bricked?

yes!!! including lots of search terms here to help people in my situation — i had used a blue cloner and clearly got a poor coupling and i thought i had bricked my tm55 tm55xx tm5577 chip, but the test mode switch (no password) is what got it back to working! i figured it was recoverable because HID readers would always beep when i placed my hand near them, so something was still working related to my bad clone. thank you @Slack for your note there, you’ve given me a lot of energy back after i thought I’d bricked this thing for years :bowing_man:

1 Like