Chipping myself for college - Cloning HID card to xEM with Proxmark3 RDV4

IM NOW OFFICIALY A CYBORG !!! YAY

what I know so far.

I can read the data using NFC app on iPhone ( NFC Utility )

my concern is that I can not access the NExT on the proxmark. any ideas cyborg brains trust ?

2 Likes

Yes. Swelling :slight_smile:

oh, really? but it reads on other things ? ill try the proxmark again in a couple of days

Swelling (sometimes also blood pooling) is the usual answer if it has been less then about 2 weeks, maybe more if you are unlucky.
It can cause some strange behaviours (like no LED on xSIID, no writes/reads or write failures etc), working just on certain readers… also there is a bit of guesswork involved with fiding the right orientation for every reader.
I’m assuming you were attempting to write to the HF side, right?
On the LF side, the PX3 easy can be a bit finnicky at the best of times.

1 Like

yeah ,ill wait a few weeks before I go back to the Proxmark. ill use an app on android for the cloning.

Also position on the proxmark3… what model proxmark3 do you have? Do you know where the HF antenna trace paths are? Do you know how to properly position the NExT over the antenna traces? Send a photo of your proxmark3 and where you think the HF traces are

Thanks Amal.

1 Like

See this is a trick played on you by Big Proxmark! The HF antenna is actually not on that PCB… it is on the bottom PCB. You will get best coupling if you flip it over and apply the bottom of the unit to your HF implant.

Some people simply remove the middle PCB because it’s actually 100% pointless. I have no idea why they even include it to be honest.

1 Like

Here is a photo with the center pcb removed…

You can clearly see the HF antenna on the bottom pcb.

bastards !!. worked instantly on the bottom. !! thanks legend !

[usb] pm3 → hf search
:clock3: Searching for ISO14443-A tag…
[+] UID: 04 4A 87 32 0A 54 80
[+] ATQA: 00 44
[+] SAK: 00 [2]
[+] MANUFACTURER: NXP Semiconductors Germany
[+] Possible types:
[+] MIFARE Ultralight
[+] MIFARE Ultralight C
[+] MIFARE Ultralight EV1
[+] MIFARE Ultralight Nano
[+] MIFARE Hospitality
[+] NTAG 2xx
[=] proprietary non iso14443-4 card found, RATS not supported
[?] Hint: try hf mfu info

[+] Valid ISO14443-A tag found

[usb] pm3 →

2 Likes

I had been wondering that myself.

Although to be honest I would have pointed to the area shown and said “The HF traces are on the lower board under there”. I wouldn’t have thought to turn it over.

I do wonder if the extra board is to make you think it is more substantial than it is, or to improve the performance of the LF antenna (at the cost of the HF antenna).

There are eight small traces on the middle board which might be intended as passive radiators for the HF antenna. But testing that would require someone with more tools and radio skills than I have.

My hunch is that it is there for tuning and isolation between lf and hf but honestly the effect is miniscule

Just revisiting this thread to clone a new tag to my xEM, and my proxmark3 installation (via homebrew) was acting up. pm3 command was giving me “Command not found”. Running

brew info proxmark3

gave me a bunch of info including the location of the installation (in my case /usr/local/Cellar/proxmark3/HEAD-f3910ef). Then I could open that directory and run

./pm3

The tool started up and connected to my proxmark no problem. After that, everything was smooth.

2 Likes

It’s actually /usr/local/Cellar/proxmark3/HEAD-f3910ef/bin