ANYTIME FITNESS Pyramid - Cloning Gym Fob to implant

Did you invert the binary like guy above to get to work?

i did not

Where did you guys get the data in block 0 from? (00105080) Is this different for everyone?

im still kinda a noob. I came up with the block 0 from reading the t5577 datasheet. and just did my best educated guess lol
i wrote the block 0 based on the modulation, rate , max block. there are a few more variables I dont understand(psk-cf) and just left as 0.

Block 0 on the T5577 is the configuration block. The data dictates how the analog front end of the chip will behave, if the password bit is set, etc. I believe 00105080 is what is used for setting the EM style analog front end… though it doesn’t feel familiar actually. Might edit this post later.

My bad for bumping an old post.

I have just started my journey in relation to all things RFID and this is possibly one of the many use cases I want to try during my tinkering and research time.

I’m assuming that the PM3 will be the best tool to accomplish this clone to a T5577 chip. I was wondering because my initial purchase was going to be a Flipper Zero as a multiple-use case RFID tool.

As a Flipper owner, I can say that it’s possible to dump raw LF data and emulate it by turning debug mode on (at least with Xtreme firmware), but I don’t know if there’s any way to attempt writing a raw dump to a T5577. (Maybe using the command-line interface? I’m honestly not sure.) So if you encounter a similar situation where it’s a LF tag but it’s not understood yet, then the Flipper might not be able to help you unless support gets added later.

2 Likes

Ah okay, thank you for the feedback.

If I ever come across something, I will try to add it here.