Cloning Indala Key with Some Type of Code

Support
1

I have an Indala fob from my building but it won’t work just cloning it. It looks like it has a default password.

How would I clone this to a 5577 chip?

Below are some command and outputs that might be helpful:

[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
[!] ⚠️  Specify one authentication mode
[+] Indala (len 224)  Raw: a0000000ec948c1b6e4a70c0e13bea64c60be459cd4ade7db4fd5b5a

[+] Valid Indala ID found!

[+] Chipset detection: EM4x05 / EM4x69


[+] found valid password [ 00000000 ]

[usb] pm3 --> lf em 4x05 info
[=] --- Tag Information ---------------------------
[+]     Block0: 00040072
[+]  Chip Type:     9 | EM4305
[+]   Cap Type:     3 | 330pF
[+]  Cust Code: 0x200 | Default
[+]   Serial #: 787079F0

[=] --- Config Information ------------------------
[=] ConfigWord: 0002C10F  (  )
[=]  Data Rate:  15 | RF/32
[=]    Encoder:   4 | PSK1
[=]      Delay:   0 | no delay
[=]  LastWordR:  11 | Address of last word for default read - meaning 7 blocks are output
[=]  ReadLogin:   0 | Read login is not required
[=] WriteLogin:   0 | Write login is not required
[=]    Disable:   0 | Disable command is not accepted
[=]     R.T.F.:   0 | Reader talk first is disabled
[=]     Pigeon:   0 | Pigeon mode is disabled

[=] --- Protection --------------------------------
[=] ProtectionWord: 00008002 (Word 14)
[=]       Word:  00 | unlocked
[=]       Word:  01 | write Locked
[=]       Word:  02 | unlocked
[=]       Word:  03 | unlocked
[=]       Word:  04 | unlocked
[=]       Word:  05 | unlocked
[=]       Word:  06 | unlocked
[=]       Word:  07 | unlocked
[=]       Word:  08 | unlocked
[=]       Word:  09 | unlocked
[=]       Word:  10 | unlocked
[=]       Word:  11 | unlocked
[=]       Word:  12 | unlocked
[=]       Word:  13 | unlocked
[=]       Word:  14 | unlocked
[=]       Word:  15 | unlocked

[usb] pm3 --> lf em 4x05 dump
[=] Found a EM4305 tag

[=] Addr | data     | ascii |lck| info
[=] -----+----------+-------+---+-----
[=]   00 | 00040072 | ...r  |   | Info/User
[=]   01 | 787079F0 | xpy.  | x | UID
[=]   02 |          |       |   | Password   write only
[=]   03 | 00009838 | ...8  |   | User
[=]   04 | 0002C10F | ....  |   | Config
[=]   05 | 80000001 | ....  |   | User
[=]   06 | DBF78C76 | ...v  |   | User
[=]   07 | 8082E716 | ....  |   | User
[=]   08 | 71195A3E | q.Z>  |   | User
[=]   09 | BB0EA7EF | ....  |   | User
[=]   10 | B51498C8 | ....  |   | User
[=]   11 | 9B24CA8D | .$..  |   | User
[=]   12 | 00000000 | ....  |   | User
[=]   13 | 00000000 | ....  |   | User
[=]   14 | 00008002 | ....  |   | Lock       active
[=]   15 | 00000000 | ....  |   | Lock       

[+] saved 64 bytes to binary file /Users/a/lf-4x05-787079F0-dump.bin
[+] saved to json file /Users/a/lf-4x05-787079F0-dump.json
2

Have you tried the lf indala clone command?

1 Like
3

you likely don’t need to make a copy of the whole em4305 just the indala it emulates.

try the ^ recommendation above and let us know how it goes.

4

Yep. Tried the clone and it didn’t work on the elevator or door access. It might have some type of encryption. I’m thinking maybe I need to pass that password someway

5

is there any branding on the readers?

2 Likes
6

I’m suspicious. Are you sure it’s Indala? Do you think that because that’s what the proxmark3 is saying? If so, can you confirm the ID is the same each time you search? If not then it may just be noise being misidentified as Indala

1 Like
7

The fob looks like an E8 Indala fob.

IMG_1343
IMG_13433024×4032 1.15 MB

IMG_1344
IMG_13443024×4032 2.09 MB

The door accesses look like this

image
image1024×1024 45.6 KB

1 Like
8

Well I’ll be :slight_smile:

Interesting that it refuses to clone. Can you do a specific Indala read command on both the fob and cloned target?

1 Like