ANYTIME FITNESS Pyramid - Cloning Gym Fob to implant

[whizkid98]

Did you invert the binary like guy above to get to work?

[clonewars]

i did not

[bubuchenko]

Where did you guys get the data in block 0 from? (00105080) Is this different for everyone?

[clonewars]

im still kinda a noob. I came up with the block 0 from reading the t5577 datasheet. and just did my best educated guess lol
i wrote the block 0 based on the modulation, rate , max block. there are a few more variables I dont understand(psk-cf) and just left as 0.

[amal]

@bubuchenko

Where did you guys get the data in block 0 from? (00105080) Is this different for everyone?

Block 0 on the T5577 is the configuration block. The data dictates how the analog front end of the chip will behave, if the password bit is set, etc. I believe 00105080 is what is used for setting the EM style analog front end… though it doesn’t feel familiar actually. Might edit this post later.

[caysun]

My bad for bumping an old post.

I have just started my journey in relation to all things RFID and this is possibly one of the many use cases I want to try during my tinkering and research time.

I’m assuming that the PM3 will be the best tool to accomplish this clone to a T5577 chip. I was wondering because my initial purchase was going to be a Flipper Zero as a multiple-use case RFID tool.

[RedWingx86]

As a Flipper owner, I can say that it’s possible to dump raw LF data and emulate it by turning debug mode on (at least with Xtreme firmware), but I don’t know if there’s any way to attempt writing a raw dump to a T5577. (Maybe using the command-line interface? I’m honestly not sure.) So if you encounter a similar situation where it’s a LF tag but it’s not understood yet, then the Flipper might not be able to help you unless support gets added later.

[caysun]

Ah okay, thank you for the feedback.

If I ever come across something, I will try to add it here.

[Zeno]

@clonewars

for those who might come across this later. in summary
lf read
data rawdemod --fs
take the first 4 lines to convert to hex to write to block 1-4 later
put new card on
lf t5 det
lf t5 wipe
lf t5 det
lf t5 write -b 0 -d 00105080
lf t5 det
lf t5 write -b 1 -d “first line of converted hex from rawdemod”
lf t5 write -b 2 -d “second line of converted hex from rawdemod”
lf t5 write -b 3 -d “third line of converted hex from rawdemod”
lf t5 write -b 4 -d “fourth line of converted hex from rawdemod”
done
you can check by
lf t5 dump
and should look something like this
[+] ----±---------±---------------------------------±------
[+] 00 | 00105080 | 00000000000100000101000010000000 | …P.
[+] 01 | “hex 1” | “line 1 from rawdemod” |
[+] 02 | “hex 2” | “line 2 from rawdemod”|
[+] 03 | “hex 3”| “line 3 from rawdemod”|
[+] 04 | “hex 4”| “line 4 from rawdemod”|

I copied my gym tag last night and this works.

The reader is hf tho so I’m kinda confused.

[Aoxhwjfoavdlhsvfpzha]

Dual frequency maybe? Is your wallet RFID blocking?

[Equipter]

looks like youve got other cards in your wallet, if any of those are HF they could be hitting the reader (and while not being read) still telling the reader there’s a HF card in the field and to keep the HF field on until it gets the desired read.

[Zeno]

@Aoxhwjfoavdlhsvfpzha

Dual frequency maybe?

Probably

@Aoxhwjfoavdlhsvfpzha

Is your wallet RFID blocking?

No

[Zeno]

@Equipter

looks like youve got other cards in your wallet

It does this with the diagnostic card by itself as well, but I assume you’re right tho, I’ll have to play with it.

[amal]

@Zeno

@Aoxhwjfoavdlhsvfpzha

Dual frequency maybe?

Probably

It is because they also allow you to use your phone as a “fob” which means NFC which means HF.

[amal]

@Zeno

@clonewars

for those who might come across this later. in summary
lf read
data rawdemod --fs
take the first 4 lines to convert to hex to write to block 1-4 later
put new card on
lf t5 det
lf t5 wipe
lf t5 det
lf t5 write -b 0 -d 00105080
lf t5 det
lf t5 write -b 1 -d “first line of converted hex from rawdemod”
lf t5 write -b 2 -d “second line of converted hex from rawdemod”
lf t5 write -b 3 -d “third line of converted hex from rawdemod”
lf t5 write -b 4 -d “fourth line of converted hex from rawdemod”
done
you can check by
lf t5 dump
and should look something like this
[+] ----±---------±---------------------------------±------
[+] 00 | 00105080 | 00000000000100000101000010000000 | …P.
[+] 01 | “hex 1” | “line 1 from rawdemod” |
[+] 02 | “hex 2” | “line 2 from rawdemod”|
[+] 03 | “hex 3”| “line 3 from rawdemod”|
[+] 04 | “hex 4”| “line 4 from rawdemod”|

I copied my gym tag last night and this works.

FYI, my anytime fitness fob was a T5577 so I found the lf t5 dump and lf t5 restore process much easier

[Zeno]

@amal

I found the lf t5 dump and lf t5 restore process much easier

I knew there had to be an easier way