Clone HID Prox II ID Card to EM410x? EM4305? Sticker chip Using Proxmark3 Easy

Support
#1

Hello everyone…I would like to clone my HID Prox ID Card to EM4305 Sticker

This is my ID card info ;

[usb] pm3 → auto
[=] lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!] Specify one authentication mode
[+] [HCP32 ] HID Check Point 32-bit FC: 0 CN: 11272618
[+] [HPP32 ] HID Hewlett-Packard 32-bit FC: 2752 CN: 55927808
[+] [Kastle ] Kastle 32-bit FC: 0 CN: 27308 Issue: 11 parity ( ok )
[+] [Kantech ] Indala/Kantech KFS 32-bit FC: 0 CN: 27308
[+] [WIE32 ] Wiegand 32-bit FC: 1536 CN: 54617
[=] found 5 matching formats
[+] DemodBuffer:
[+] 1D555655A6695555A6666696

[=] raw: 0000000000000010d600d559

[+] Valid HID Prox ID found!

[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try lf em 4x05 commands

[usb] pm3 → lf em 4x05 info
[=] — Tag Information ---------------------------
[+] Block0: 00040072
[+] Chip Type: 9 | EM4305
[+] Cap Type: 3 | 330pF
[+] Cust Code: 0x200 | Default
[+] Serial #: 24445086

And this is my EM4305 Stickers info;

Sticker 1 >

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!] Specify one authentication mode
[+] EM 410x ID 0000000C12
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 0000003048
[=] HoneyWell IdentKey
[+] DEZ 8 : 00003090
[+] DEZ 10 : 0000003090
[+] DEZ 5.5 : 00000.03090
[+] DEZ 3.5A : 000.03090
[+] DEZ 3.5B : 000.03090
[+] DEZ 3.5C : 000.03090
[+] DEZ 14/IK2 : 00000000003090
[+] DEZ 15/IK3 : 000000000012360
[+] DEZ 20/ZK : 00000000000003000408
[=]
[+] Other : 03090_000_00003090
[+] Pattern Paxton : 1329682 [0x144A12]
[+] Pattern 1 : 108 [0x6C]
[+] Pattern Sebury : 3090 0 3090 [0xC12 0x0 0xC12]
[+] VD / ID : 000 / 0000003090
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try lf em 4x05 commands

[usb] pm3 → lf em 4x05 info
[=] — Tag Information ---------------------------
[+] Block0: 00040072
[+] Chip Type: 9 | EM4305
[+] Cap Type: 3 | 330pF
[+] Cust Code: 0x200 | Default

Sticker 2 >

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try lf em 4x05 commands

[usb] pm3 → lf em 4x05 info
[=] — Tag Information ---------------------------
[+] Block0: 00040072
[+] Chip Type: 9 | EM4305
[+] Cap Type: 3 | 330pF
[+] Cust Code: 0x200 | Default
[+] Serial #: 7AA9CEE5

[=] — Config Information ------------------------
[=] ConfigWord: 0001805F ( EM UNIQUE / PAXTON )
[=] Data Rate: 31 | RF/64
[=] Encoder: 1 | Manchester
[=] Delay: 0 | no delay
[=] LastWordR: 06 | Address of last word for default read - meaning 2 blocks are output
[=] ReadLogin: 0 | Read login is not required
[=] WriteLogin: 0 | Write login is not required
[=] Disable: 0 | Disable command is not accepted
[=] R.T.F.: 0 | Reader talk first is disabled
[=] Pigeon: 0 | Pigeon mode is disabled

[=] — Protection --------------------------------
[=] ProtectionWord: 00008002 (Word 14)
[=] Word: 00 | unlocked
[=] Word: 01 | write Locked
[=] Word: 02 | unlocked
[=] Word: 03 | unlocked
[=] Word: 04 | unlocked
[=] Word: 05 | unlocked
[=] Word: 06 | unlocked
[=] Word: 07 | unlocked
[=] Word: 08 | unlocked
[=] Word: 09 | unlocked
[=] Word: 10 | unlocked
[=] Word: 11 | unlocked
[=] Word: 12 | unlocked
[=] Word: 13 | unlocked
[=] Word: 14 | unlocked
[=] Word: 15 | unlocked

I do ‘lf hid clone -r 10d600d559’ command to stickers,

[usb] pm3 → lf hid clone -r 10d600d559
[=] Preparing to clone HID tag using raw 10d600d559
[=] Done
[?] Hint: try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 →

and `lf hid clone -w HCP32 --fc 0 --cn 11272618’, ‘lf hid clone -w HPP32 --fc 2752 --cn 55927808’, …rest…

Then I tried ‘lf hid reader’ or ‘lf search’ command on my stickers again and nothing happened.
so I tried using the ‘lf em 4x05 write’ command to change data one by one, but that didn’t work either.

I’m trying to find a way, so done the dump of my card info by ‘lf em 4x05 dump’ command, but How can i restore the dump file to my stickers?

#2

you need to affix the —em parameter in your command to tell the proxmark you are writing to an em4305 and not a t5577.

1 Like