Cloning a Kantech ioProx?

Step back, slow down and remember we don’t have any context…

So, what I can gather is that you have just moved into a townhome community and you are trying to clone a Kantech IoProx key fob so that you can give one to your daughter.

You have the correct command
lf io clone --vn --fc --cn but you need to know the values for vn, fc and cn.

You should be able to put your working IoProx on the LF antenna of a proxmox and run the command lf io read and it should spit out all of the data you need.

1 Like

Thanks, I do the lf io read, it returns
XSF(01)c2:64030, Raw: 007870a03fa8f4d3

I don’t know what goes to what. I apologize, I am exhausted.

These are the options

clone a ioProx card with specified facility-code and card number
to a T55x7, Q5/T5555 or EM4305/4469 tag.
Tag must be on the antenna when issuing this command.

usage:
lf io clone [-h] --vn --fc --cn [–q5] [–em]

options:
-h, --help This help
–vn 8bit version
–fc 8bit facility code
–cn 16bit card number
–q5 optional - specify writing to Q5/T5555 tag
–em optional - specify writing to EM4305/4469 tag

XSF Version 01 facility code c2 card number 64030

All the information you needed.

Seriously? lol.

This is day 7 of 8, haha. Thank you kind sir. Good thing I have extra cards

c2 is not going over well.

Python script must be doing something

id_str = “XSF(01)c2:64030”

version = id_str.split(’(’)[1].split(’)’)[0]
facility = id_str.split(’(’)[1].split(’)’)[1].split(’:’)[0]
code = id_str.split(’:’)[1]

version = int(version, 16) #is this hex? Have only seen 1 or 2 here
facility = int(facility, 16) #this is always hex
code = int(code, 10) #this is always decimal

checksum = 0xF0 + facility + version + (code >> 8) + (code & 0xff)
checksum = 0xFF ^ (checksum & 0xff)

id_strbin = format(0, ‘08b’) + “0” +
… format(0xF0, ‘08b’) + “1” +
… format(facility, ‘08b’) + “1” +
… format(version, ‘08b’) + “1” +
… format(code >> 8, ‘08b’) + “1” +
… format(code & 0xff, ‘08b’) + “1” +
… format(checksum, ‘08b’) + “11”

print(id_strbin)
0000000001111000011100001010000000111111101010001111010011010011

id_int = int(id_strbin, 2)
id_strhex = format(id_int, ‘016x’)

print(id_strhex)
007870a03fa8f4d3

I took the 8bits literal, closest yet. that c2 hex value to decimal

usb] pm3 → lf io clone --vn 01 --fc 194 --cn 64030
[+] IO raw bits:
[+] 0000000001111000011100001010000000111111101010001111010011010011

[=] Preparing to clone ioProx to T55x7 with Version: 1 FC: 194 (0xc2) CN: 64030
[+] Blk | Data
[+] ----±-----------
[+] 00 | 00147040
[+] 01 | 007870A0
[+] 02 | 3FA8F4D3
[+] Data written and verified
[+] Done
[?] Hint: try lf io reader to verify
[usb] pm3 →
[usb] pm3 →
[usb] pm3 →
[usb] pm3 → lf io reader
[+] IO Prox - XSF(01)c2:64030, Raw: 007870a03fa8f4d3 (ok)

C2 in decimal would be 194 not 08. Why are you putting them through some python code?

Here is what I get when I write that to a t5577 and read it afterwards.

[usb] pm3 --> lf io clone 01 c2 64030
[+] IO raw bits:
[+]  0000000001111000011100001010000000111111101010001111010011010011

[=] Preparing to clone IOProx to T55x7 with Version: 1 FC: 194, CN: 64030
[+] Blk | Data
[+] ----+------------
[+]  00 | 00147040
[+]  01 | 007870A0
[+]  02 | 3FA8F4D3
[+] Success writing to tag
[+] Done
[usb] pm3 --> lf io read
[+] IO Prox - XSF(01)c2:64030, Raw: 007870a03fa8f4d3 (ok)
[usb] pm3 -->

T5577 are not single write cards, so you should only need one to make one copy.

In this case I wrote this to a dual frequency ring. But any t5577 should work the same.