Cloning a Kantech ioProx?

Support
21

Step back, slow down and remember we don’t have any context…

So, what I can gather is that you have just moved into a townhome community and you are trying to clone a Kantech IoProx key fob so that you can give one to your daughter.

You have the correct command
lf io clone --vn --fc --cn but you need to know the values for vn, fc and cn.

You should be able to put your working IoProx on the LF antenna of a proxmox and run the command lf io read and it should spit out all of the data you need.

1 Like
22

Thanks, I do the lf io read, it returns
XSF(01)c2:64030, Raw: 007870a03fa8f4d3

I don’t know what goes to what. I apologize, I am exhausted.

These are the options

clone a ioProx card with specified facility-code and card number
to a T55x7, Q5/T5555 or EM4305/4469 tag.
Tag must be on the antenna when issuing this command.

usage:
lf io clone [-h] --vn --fc --cn [–q5] [–em]

options:
-h, --help This help
–vn 8bit version
–fc 8bit facility code
–cn 16bit card number
–q5 optional - specify writing to Q5/T5555 tag
–em optional - specify writing to EM4305/4469 tag

23

XSF Version 01 facility code c2 card number 64030

All the information you needed.

24

Seriously? lol.

This is day 7 of 8, haha. Thank you kind sir. Good thing I have extra cards

25

c2 is not going over well.

Python script must be doing something

id_str = “XSF(01)c2:64030”

version = id_str.split(‘(’)[1].split(‘)’)[0]
facility = id_str.split(‘(’)[1].split(‘)’)[1].split(‘:’)[0]
code = id_str.split(‘:’)[1]

version = int(version, 16) #is this hex? Have only seen 1 or 2 here
facility = int(facility, 16) #this is always hex
code = int(code, 10) #this is always decimal

checksum = 0xF0 + facility + version + (code >> 8) + (code & 0xff)
checksum = 0xFF ^ (checksum & 0xff)

id_strbin = format(0, ‘08b’) + “0” +
… format(0xF0, ‘08b’) + “1” +
… format(facility, ‘08b’) + “1” +
… format(version, ‘08b’) + “1” +
… format(code >> 8, ‘08b’) + “1” +
… format(code & 0xff, ‘08b’) + “1” +
… format(checksum, ‘08b’) + “11”

print(id_strbin)
0000000001111000011100001010000000111111101010001111010011010011

id_int = int(id_strbin, 2)
id_strhex = format(id_int, ‘016x’)

print(id_strhex)
007870a03fa8f4d3

26

I took the 8bits literal, closest yet. that c2 hex value to decimal

usb] pm3 → lf io clone --vn 01 --fc 194 --cn 64030
[+] IO raw bits:
[+] 0000000001111000011100001010000000111111101010001111010011010011

[=] Preparing to clone ioProx to T55x7 with Version: 1 FC: 194 (0xc2) CN: 64030
[+] Blk | Data
[+] ----±-----------
[+] 00 | 00147040
[+] 01 | 007870A0
[+] 02 | 3FA8F4D3
[+] Data written and verified
[+] Done
[?] Hint: try lf io reader to verify
[usb] pm3 →
[usb] pm3 →
[usb] pm3 →
[usb] pm3 → lf io reader
[+] IO Prox - XSF(01)c2:64030, Raw: 007870a03fa8f4d3 (ok)

27

C2 in decimal would be 194 not 08. Why are you putting them through some python code?

Here is what I get when I write that to a t5577 and read it afterwards.

[usb] pm3 --> lf io clone 01 c2 64030
[+] IO raw bits:
[+]  0000000001111000011100001010000000111111101010001111010011010011

[=] Preparing to clone IOProx to T55x7 with Version: 1 FC: 194, CN: 64030
[+] Blk | Data
[+] ----+------------
[+]  00 | 00147040
[+]  01 | 007870A0
[+]  02 | 3FA8F4D3
[+] Success writing to tag
[+] Done
[usb] pm3 --> lf io read
[+] IO Prox - XSF(01)c2:64030, Raw: 007870a03fa8f4d3 (ok)
[usb] pm3 -->

T5577 are not single write cards, so you should only need one to make one copy.

In this case I wrote this to a dual frequency ring. But any t5577 should work the same.

28

Help I’m stumped I have a io card when I read gives
XSF(01)ab:06240

When try to clone I get a error the facility code is ‘ab’

What do I do ?

29

ABh = 171d
Hex to Decimal conversion

2 Likes
30

Anyway I can get that list for emulation modes for t5577?
I tried to follow link and the link does not work…
thxs in advance.

31

I followed the link, it leads to the Proxmark3 forum login page.

I haven’t been on there in a while so I am not sure how active it is.
There is a Discord for RFID Hacking ( Same peeps ) which is quite active with a large helpful community ( Just make sure you do your research / search before asking questions )

Here’s an invite link

good luck

32

Hey thxs. I know it goes to the forum but the post is missing.
I’m looking for the table of emulation codes.

1 Like
33

My bad.

Do you have a proxmark?

lf help

Pretty sure It will popupate a list of T5577 modes

Is that what you are after?

34

I think I saved the webpage before it went down, I’ll see if I can find it.

35

thank you…all this information is very valuable. Perhaps someone should archive it somewhere? I will help if you want to.

36

if its saved as a .pdf we could save it in the repository

1 Like
37

thank you…I’d like to help if you want?
did you find table for t5577 emulation?

38

I looked around but I can’t find it.

39

confused-john-travolta

40

I am trying to the same thing discussed here. Why didn’t you use --vn 02 --fc ## --cn #####. I have tried it the same way without vn… fc… cn and with it; I have had no luck. It simply pulls up the lf io help. I have tried with the fc in hex 88 and as dec 136. If you have any advice you could offer I would be grateful.