Cloning Hitag2 PCF7936

Thats all I did too. I wrapped my coil around a plastic tube that the tag just fit inside. I moved the tag around in the coil until I got it to write successfully I’ve written a few paxton tags now so it is working consistently once you get the right place in the coil. I cannot however write a hitag2 disk tag despite wrapping a coil to work with it.

Have you also tried running lf tune and then playing with the tag placement around the coil?


This is the tag I cannot get to write page 7 to.

Do you have an LC meter? I’ve been using that to get my coil to exactly 500uH.

Yes - I was using both the multimember to measure the inductance and then hw tune on the proxmark3.

I have made a little progress - after reading your comment about the power output being higher on the RDV4 I wondered, if the USB port power from the laptop might be limiting it. I connected the side USB port to a USB charger as well as the data/power USB to the PC and that made a significant difference. I have now successfully written page 6 and I have had data in page 7 that is not FFFF’s but it is still not correct.

As power supply clearly made a difference I tried adding a 100uF capacitor just inside the USB port to see if that would help further to stabilise the power rails. The capacitor on the 5V rail has not made any further difference, so I was going to add one to the 3.3V rail as well, as I presume the data transmission bursts on the coil give the power rails a hard time.

I have also started a larger coil in the hope that changing the position of the fob more might yield better results.

Here is the capacitor on the 5V and the larger coil. I have wound it higher, and then unwind to 500uH.


I have still only managed to write page 6 on one tag. I can’t get repeatable performance. Improving the USB power was the biggest performance difference, so it leads me to think is an RDV4 with it’s more powerful antenna the answer?
I tried a neater antenna on a 3D printed former, but no change to writes - all FFFFF’s and it measures 501uH.


Maybe I just need to buy and RDV4?

I’m really not sure about the RDV4 but good find on the laptop power supply. I may try that too. Currently I’m investigating some PCF7937 chips which are in crypto mode. I can read them but I’m not sure how successful I’m going to be changing them to password mode. I’ll report back.

I just found out you can normally use a EM41X token instead of a hitag2 token with most paxton readers. You can also take the number off the hitag2 tag convert it to a valid EM41X code and then use that to open the door. More info here How to copy, read and write Paxton fobs and cards with an RFIDler · GitHub

2 Likes