Bricked t55 chip when trying to clone

Support
1

I had a working Kantech ioProx fob which appears to be bricked when I tried cloning it to an HID. Current lf t55 info shows below, your assistance is appreciated.

[usb] pm3 → lf t5 info

[=] — T55x7 Configuration & Information ---------
[=] Safer key : 8
[=] reserved : 0
[=] Data bit rate : 0 - RF/8
[=] eXtended mode : No
[=] Modulation : 0 - DIRECT (ASK/NRZ)
[=] PSK clock frequency : 0 - RF/2
[=] AOR - Answer on Request : No
[=] OTP - One Time Pad : No
[=] Max block : 0
[=] Password mode : No
[=] Sequence Terminator : No
[=] Fast Write : No
[=] Inverse data : No
[=] POR-Delay : No
[=] -------------------------------------------------------------
[=] Raw Data - Page 0, block 0
[=] 80000000 - 10000000000000000000000000000000
[=] — Fingerprint ------------

2

The construction of your message makes it difficult to understand what you actually did. Can you break it down into points like this;

  • I have a Kantech ioProx fob
  • I performed xxxx to read the fob and here is the result
    … results …
  • I attempted to write the data to an HID prox card using this command; xxxxx

I’m only guessing, but I think what happened is the ioProx fob you have is a t5577 chip which is a rewritable chip. You tried getting the data off it somehow… now sure what the command you used was… but basically at some point you wiped or performed a bad write to the ioProx fob, destroying the data on it.

I’m not sure why you are attempting to write this data to an HID prox card since those are not writable… or did you attempt to write the HID prox card ID to the ioProx fob?

Need more clarification.

2 Likes
3

Hi Amal, thank you for the prompt response. My clarification below.

This is what I was doing.

  1. I have a Kantech iOProx fob
  2. I had wiped it (lf t55 wipe) and written to it as an HID prox card using lf hid clone -w H10301 --fc 118 --cn 1603. The write was successful
  3. I then tried writing to it to convert it to an ioProx fob using my proxmark 3 easy. Command was lf io clone --vn 2 --fc 101 --cn 56544. It did not work with the proxmark 3 easy
  4. I then tried writing to it with my icopy XS. It did not work, it was a fail. When I then run lf t5 info, I get the data in my original post.

Sounds like HID cannot convert to iOprox reading your response, perhaps this is the part I messed up. Since the fob is still responsive to lf t5 info, should it not be recoverable?

Thank you

4

Ok good job laying out your process :+1:

How do you know this? Did you perform a read after?

I would simply perform a wipe again, then try cloning your ioProx data to it.

If that doesn’t work try these recovery steps…

1 Like
5

Hey Amal,
The information you provided worked like a charm on my bricked Kantech ioProx fobs however, the Chinese FOBS I have did not respond to any of the commands and still show Block 0 configuration as 8000000. My i-Copy XS reads these tags as Indala but the chipset on the Proxmark3 Easy still shows it being a T55xx.

Is this a known issue with the Chinese FOBS or is there a step I am missing?

Thank you

6

They probably aren’t t5577 chips… or if they came with the icopy they might be locked somehow

7

@stalbertmama

Or if they DIDN’T come with the iCopy, earlier versions / regional versions of the iCopy had proprietary restrictions.

There is however a fix / solution

Read on

1 Like