Cloning a Kantech ioProx?

Support
8

Alright, my blank t5577 cards arrived (same chip as the xEM and NExT). I was able to clone a Kantech ioProx card to a t5577 card with minimal difficulty. I have not been able to write the same information to my NExT with my original proxmark3 using the stock antenna. If I am able to roll my own cylindrical antenna, I’ll come back and update this thread. Here is the rundown of how to perform the operation using the base repo found on this page:

  1. Install and configure proxmark3 software/drivers
    I set everything up on an up-to-date Ubuntu installation using this guide.

  2. Read ioProx card ID
    Place the ioProx card on your proxmark antenna and run
    lf search
    The output will look something like this
    Checking for known tags:

    00000000 0
    11110000 1
    01100110 1 facility
    00000001 1 version
    01100010 1 code1
    11111110 1 code2
    01001000 11 checksum
    IO Prox XSF(01)66:25342 (007859a0362ff523) [48 crc ok]

    Valid IO Prox ID Found!

    Save the information in parentheses (007859a0362ff523) for later

  3. Provision t5577 as an ioProx card
    You need to configure block 0 on the t5577 chip to make it act like an ioProx card. Here is the data you’re going to write to that block.
    00147040
    I retrieved that from the page linked in my earlier post. You can break it down if you want. I started to, but I’m lazy and we’re splitting bytes here.

    Place your t5577 card on your proxmark antenna and run
    lf t55xx write b 0 d 00147040

  4. Clone ioProx card ID to t5577
    Now you can clone the ID information. Copy that bit in the parentheses from earlier and run
    lf io clone 007859a0362ff523
    replace “007859a0362ff523” with your information

After that you’re done. I verified that it worked with the Kantech access control system at my work. The “security” on these things is atrocious. We pay like $8 for the damn ioProx cards, whereas I paid $1.25 for each of these blank t5577s.

6 Likes
9

Thanks for the write up @Satur9 !
I just picked up the Proxmark3 RDV4.01 at the post office (I already have Proxlf antenna by Dangerous Things) I did what you wrote and it seems to work, as my NeXT (125khz part) reads the same info as my work chip. Will be making another comment tomorrow to tell you if it actually works with the readers at my office.

4 Likes
10

I can confirm that it worked at my office, as I tested it today! Thank’s again for the write up @Satur9

2 Likes
11

No problem. I got it working at my office too. I’ve introduced a few people to the concept of biohacking as a result.

4 Likes
12

@Satur9 do you happen to also know how I can get the t5577 back to it’s original state? There shouldn’t be a password on the chip, as I used the pm3 as previously stated.

13

See this post from TomHarkness

1 Like
14

How do i go forward with this whitin the cmd?
Like commands

15

AFAIK you would follow the instructions from step 3, but instead of
lf t55xx write b 0 d 00147040
to provision the tag as ioProx you would use
lf t55xx write b 0 d 00148041
to provision it as an EM410x (the way it’s shipped from DT)

I haven’t tried those specific numbers yet, so test it out on a blank t5577 card first. After that run an
lf search
to verify it worked

1 Like
16

proxmark3> lf t55xx write b 0 d 00148041
Writing page 0 block: 00 data: 0x00148041
proxmark3> lf search
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

No Known Tags Found!

17

Got a chance to learn even more about this legacy technology (:tada: joy :confetti_ball:) turns out the ioProx system uses the wiegand protocol to communicate? The PIGPIO Python module has a nifty library for handling that. Here’s a mockup I made.

Access_Control
Access_Control.gif480×640 7.68 MB

5 Likes
18

I can confirm this does not work. I can read P40, the syntax is lf io clone --vn --fc --cn

Thus was just to give my daughter. I recently moved to this townhome community, and being very helpful. Network and card readers alone, I need stop.

I bricked another one, I have confess T5577’s and magical 2k. I need help, I was locked in. Now locked out. I have raw data XSF. Blocks 0-7. Binary math seems to be needed. Odd I can’t find this anywhere else. I must be doing old or wrong.

Whoever I’ll send guft to ksec or here or whatever is allowed.

Hi. I’m new here. I’m a dangerous thing, accidentally.

19

Hey buddy,

I am not certain of your exact question, but please feel free to use the translation feature, It works pretty well and you might find it easier to read and write posts.

What is your native language? we have a few members that are bilingual / polyglots that also may be able to help

20

English, the American kind.
I thought found a python script to convert RAW or xsf ioprox output from reading the key fob.

It converts id_string

Let me get on the computer.

I need to lf io clone --vn --fc --cn

This version doesn’t allow lf clone raw data

21

Step back, slow down and remember we don’t have any context…

So, what I can gather is that you have just moved into a townhome community and you are trying to clone a Kantech IoProx key fob so that you can give one to your daughter.

You have the correct command
lf io clone --vn --fc --cn but you need to know the values for vn, fc and cn.

You should be able to put your working IoProx on the LF antenna of a proxmox and run the command lf io read and it should spit out all of the data you need.

1 Like
22

Thanks, I do the lf io read, it returns
XSF(01)c2:64030, Raw: 007870a03fa8f4d3

I don’t know what goes to what. I apologize, I am exhausted.

These are the options

clone a ioProx card with specified facility-code and card number
to a T55x7, Q5/T5555 or EM4305/4469 tag.
Tag must be on the antenna when issuing this command.

usage:
lf io clone [-h] --vn --fc --cn [–q5] [–em]

options:
-h, --help This help
–vn 8bit version
–fc 8bit facility code
–cn 16bit card number
–q5 optional - specify writing to Q5/T5555 tag
–em optional - specify writing to EM4305/4469 tag

23

XSF Version 01 facility code c2 card number 64030

All the information you needed.

24

Seriously? lol.

This is day 7 of 8, haha. Thank you kind sir. Good thing I have extra cards

25

c2 is not going over well.

Python script must be doing something

id_str = “XSF(01)c2:64030”

version = id_str.split(’(’)[1].split(’)’)[0]
facility = id_str.split(’(’)[1].split(’)’)[1].split(’:’)[0]
code = id_str.split(’:’)[1]

version = int(version, 16) #is this hex? Have only seen 1 or 2 here
facility = int(facility, 16) #this is always hex
code = int(code, 10) #this is always decimal

checksum = 0xF0 + facility + version + (code >> 8) + (code & 0xff)
checksum = 0xFF ^ (checksum & 0xff)

id_strbin = format(0, ‘08b’) + “0” +
… format(0xF0, ‘08b’) + “1” +
… format(facility, ‘08b’) + “1” +
… format(version, ‘08b’) + “1” +
… format(code >> 8, ‘08b’) + “1” +
… format(code & 0xff, ‘08b’) + “1” +
… format(checksum, ‘08b’) + “11”

print(id_strbin)
0000000001111000011100001010000000111111101010001111010011010011

id_int = int(id_strbin, 2)
id_strhex = format(id_int, ‘016x’)

print(id_strhex)
007870a03fa8f4d3

26

I took the 8bits literal, closest yet. that c2 hex value to decimal

usb] pm3 → lf io clone --vn 01 --fc 194 --cn 64030
[+] IO raw bits:
[+] 0000000001111000011100001010000000111111101010001111010011010011

[=] Preparing to clone ioProx to T55x7 with Version: 1 FC: 194 (0xc2) CN: 64030
[+] Blk | Data
[+] ----±-----------
[+] 00 | 00147040
[+] 01 | 007870A0
[+] 02 | 3FA8F4D3
[+] Data written and verified
[+] Done
[?] Hint: try lf io reader to verify
[usb] pm3 →
[usb] pm3 →
[usb] pm3 →
[usb] pm3 → lf io reader
[+] IO Prox - XSF(01)c2:64030, Raw: 007870a03fa8f4d3 (ok)

27

C2 in decimal would be 194 not 08. Why are you putting them through some python code?

Here is what I get when I write that to a t5577 and read it afterwards.

[usb] pm3 --> lf io clone 01 c2 64030
[+] IO raw bits:
[+]  0000000001111000011100001010000000111111101010001111010011010011

[=] Preparing to clone IOProx to T55x7 with Version: 1 FC: 194, CN: 64030
[+] Blk | Data
[+] ----+------------
[+]  00 | 00147040
[+]  01 | 007870A0
[+]  02 | 3FA8F4D3
[+] Success writing to tag
[+] Done
[usb] pm3 --> lf io read
[+] IO Prox - XSF(01)c2:64030, Raw: 007870a03fa8f4d3 (ok)
[usb] pm3 -->

T5577 are not single write cards, so you should only need one to make one copy.

In this case I wrote this to a dual frequency ring. But any t5577 should work the same.