Cloning issue - EM 410x Badge to Magic Ring

Hey all, I’m fairly new to the rfid cloning space and I’m having issues cloning a badge to my magic ring. I tried searching the forum but I was unable to find a clear answer. I’ve been fiddling around with it for a couple hours with no luck.

This is the badge I’m trying to clone:

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary

[=] if it finds something that looks like a tag

[=] False Positives ARE possible

[=]

[=] Checking for known tags…

[=]

[+] EM 410x ID 128103B09E

[+] EM410x ( RF/32 )

[=] -------- Possible de-scramble patterns ---------

[+] Unique TAG ID : 4881C00D79

[=] HoneyWell IdentKey

[+] DEZ 8 : 00241822

[+] DEZ 10 : 2164502686

[+] DEZ 5.5 : 33027.45214

[+] DEZ 3.5A : 018.45214

[+] DEZ 3.5B : 129.45214

[+] DEZ 3.5C : 003.45214

[+] DEZ 14/IK2 : 00079473914014

[+] DEZ 15/IK3 : 000311414492537

[+] DEZ 20/ZK : 04080801120000130709

[=]

[+] Other : 45214_003_00241822

[+] Pattern Paxton : 303558302 [0x1217EE9E]

[+] Pattern 1 : 685113 [0xA7439]

[+] Pattern Sebury : 45214 3 241822 [0xB09E 0x3 0x3B09E]

[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] Chipset detection: T55xx

[?] Hint: try lf t55xx commands

[usb] pm3 → lf t5 detect

[=] Chip type… T55x7

[=] Modulation… ASK

[=] Bit rate… 2 - RF/32

[=] Inverted… No

[=] Offset… 33

[=] Seq. terminator… Yes

[=] Block0… 00088040 (auto detect)

[=] Downlink mode… default/fixed bit length

[=] Password set… No

vs my ring after cloning:

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary

[=] if it finds something that looks like a tag

[=] False Positives ARE possible

[=]

[=] Checking for known tags…

[=]

[+] EM 410x ID 128103B09E

[+] EM410x ( RF/64 )

[=] -------- Possible de-scramble patterns ---------

[+] Unique TAG ID : 4881C00D79

[=] HoneyWell IdentKey

[+] DEZ 8 : 00241822

[+] DEZ 10 : 2164502686

[+] DEZ 5.5 : 33027.45214

[+] DEZ 3.5A : 018.45214

[+] DEZ 3.5B : 129.45214

[+] DEZ 3.5C : 003.45214

[+] DEZ 14/IK2 : 00079473914014

[+] DEZ 15/IK3 : 000311414492537

[+] DEZ 20/ZK : 04080801120000130709

[=]

[+] Other : 45214_003_00241822

[+] Pattern Paxton : 303558302 [0x1217EE9E]

[+] Pattern 1 : 685113 [0xA7439]

[+] Pattern Sebury : 45214 3 241822 [0xB09E 0x3 0x3B09E]

[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] Chipset detection: T55xx

[?] Hint: try lf t55xx commands

[usb] pm3 → lf t5 detect

[=] Chip type… T55x7

[=] Modulation… ASK

[=] Bit rate… 5 - RF/64

[=] Inverted… No

[=] Offset… 33

[=] Seq. terminator… Yes

[=] Block0… 00148040 (auto detect)

[=] Downlink mode… default/fixed bit length

[=] Password set… No

I did notice that the bit rate and block read out different values and tried using: lf t5 config --rate 32 to address the bit rate but I don’t fully understand the commands and that didn’t seem to make any changes in the outcome. Hoping someone with more experience and knowledge can help me out.

Thank you in advance for the help!

Probably the easiest way to clone a T5577 chip to another T5577 chip with all the settings is to use the dump and restore commands.

lf t5 dump --help

lf t5 restore --help

1 Like

Just tried that. It doesnt seem to create any kind of file. it also reads out all zeros for every block:

[usb] pm3 → lf t5 dump -f my_lf_dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[+] 00 | 00000000 | 00000000000000000000000000000000 | …
[+] 02 | 00000000 | 00000000000000000000000000000000 | …
[+] 03 | 00000000 | 00000000000000000000000000000000 | …
[+] 04 | 00000000 | 00000000000000000000000000000000 | …
[+] 05 | 00000000 | 00000000000000000000000000000000 | …
[+] 06 | 00000000 | 00000000000000000000000000000000 | …
[+] 07 | 00000000 | 00000000000000000000000000000000 | …
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[+] 00 | 00000000 | 00000000000000000000000000000000 | …
[+] 01 | 00000000 | 00000000000000000000000000000000 | …
[+] 02 | 00000000 | 00000000000000000000000000000000 | …
[+] 03 | 00000000 | 00000000000000000000000000000000 | …

you have to do lf t55 detect before lf t55 dump

1 Like

THANK YOU! that seems to have done the trick!

1 Like

all in a days work :sunglasses:

3 Likes