Clone EM410X to Magic Ring, One Try and Not Working

[JTrick]

Got my Magic Ring the other day! I was able to clone the EM410X card from my office. Did an LF search, got the ID. Then did the EM clone to the magic ring using the ID. I then did another LF Seach and validated that the Magic Ring showed the cloned info successfully.

Got to the office this morning, touched the ring to the access reader and it beeped but denied access. I tried it again and now the reader doesn’t even recognize the ring is there at all. No beep or anything. I use the original EM badge and it works just fine.

Any ideas?

Its an HID branded em410x 125khz card. HID reader.

I don’t have the ability to bring the Proxmark3 into the office to write the ring since I don’t have a laptop and my work computer is administratively locked, so I have to wait until I get home to retry things.

[enginerd]

I’d suspect a cuppling issue but I don’t own a ring so I don’t know how signifficant is the range difference.

Maybe try sliding it on the reader to see if it helps?

@JTrick

Its an HID branded em410x 125khz card. HID reader

Are you sure that it’s an EM card instead of a Prox card? Both run at 125KHz.

[JTrick]

According to pm3, it identified as an EM card.

The reader interacted with the ring as soon as my finger got close to it then nothing after the initial access denial. I even took it off my finger and changed the orientation in several ways.

[jpfeif29]

In my experience with the older readers from HID like the one below

The read is best from the sides of the reader rather than the middle, I would guess that it is a Prox credential rather than a EM card especially if the reader is branded as HID. I looked at the HID Global site and could not find a mention of EM410X readers, I checked everything they had that contained “EM” and it yielded regulatory stuff and some stuff about their old (windows 2000 era) card printers. I would hazard a guess that your Proxmark firmware and software needs to be updated or their firmware versions and software versions dont match up and you’re getting misreads. To update your firmware do this

#From the proxmark3 directory if you are on Windows start the Proxspace environment first
#Pull updates from source
git pull
#Build the software
sudo make clean && make all
#Once the new software gets built
./pm3-flash-bootrom
#Then 
./pm3-flash-firmware

Let me know if you have any questions.

[Zwack]

I have one of those readers and the antenna is pretty much under the square line incised around the edge. The middle is about as far as you can get from the antenna while above the pad.

See.

[Pilgrimsmaster]

With a quick look back and forward on my phone screen looking at the important parts of your output, it looks like you made a good clone.

So it still sounds like a reading issue.
Try a swipe, rather than presenting to the reader.
Go slowly over the antenna that @zwak showed you

@enginerd

Maybe try sliding it on the reader to see if it helps?

Yeah this

---

also @Zwack

Noice

[Zwack]

I was wondering if anyone would notice that. Yes, that reader is not connected up to an access control system. But it does have a cheap alternative to an esp-key attached to it (along with a battery pack).

This is why you really should connect the anti-tamper switch that is provided up to an alarm.

[JTrick]

I was mistaken, the readers are all GE branded.

Also, I tried re-cloning the Magic Ring thinking maybe it was just a write issue after all and I tried swiping all around the reader with the ring on and off my finger and the reader acts like it doesn’t even exist.

Any more advice? It is really weird to me that my initial/first clone to the ring reacted to the reader with one denied red light and beep and that is it. It hasn’t reacted since even after the re-clone atempt.

[Pilgrimsmaster]

Just a quick brain dump…

Do you have a T5577 card you can clone to a d test on the readers?

If that works, it is likely a ring range limitation or presentation technique you need to find/refine.

if not, it may be a cloning issue, but it did look good, or those readers may be multiclass and actually using HF.

Have you done an HF scan of your card?
Have you tested the readers with a diagnostic card or xFD?

[JTrick]

I do not have a diagnostic card or another programmable T5577 card, however, I just order some T5577 cards on Amazon and should get here Saturday. That should help determine if its a magic ring issue or something else at play.

I did run hf search with various card positions on the antenna and got no results found. So this seems to be an lf only EM card that I am trying to clone.

[Pilgrimsmaster]

Cool, you are getting closer to an answer…

[Equipter]

ive got two hypotheses

1. ring antenna to small to couple with GE reader, if its using a low power mode, raise on wakeup type deal then the ring may not be able to couple enough to let the reader wakeup.

2. reader has t55xx detection. incredibly rare but definitely a possibility.

if you’ve got your proxmark to hand with this reader can you do lf sniff while holding the proxmark between the original card and reader as you approach and then do trace save -f lf_ge_reader and send the trace here plz.

a larger picc like a card will tell you if its a coupling issue or a hardcoded defense.

[JTrick]

@Equipter It turns out that #2 was right. I ordered t55xx cards from Amazon. Cloned one of those as well and the reader reacted the same exact way as with the Magic Ring. Must have t55xx detection. So, I am just settling with using the magic ring for the outer doors instead of the inner doors. Still reduces my need to care one additional card and works perfectly! Thanks for all the help!