Cloning my work ID

Support
1

I’m trying to clone my work ID to my NExT but I’m not sure I’m doing it right. When I do lf searchI get:

[+] [C1k35s  ] HID Corporate 1000 35-bit std    FC: XXX  CN: XXXXXX  parity ( ok )
[=] found 1 matching format 
[+] DemodBuffer:
[+] XXXXXXXXXXXXXXXXXXXXXXXXX

[=] raw: 00000000000000XXXXXXXXXX

[+] Valid HID Prox ID found!

[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try `lf em 4x05` commands

So I tried lf hid clone -r 00000000000000XXXXXXXXXXand verified that when I read it back I got the same raw value but by work reader doesn’t even give me a beep to let me know it was declined. So I looked at the lf em 4x05 commands and I tried a dump and I get this:

[=] Found a EM4305 tag

[=] Addr | data     | ascii |lck| info
[=] -----+----------+-------+---+-----
[=]   00 | XXXXXXXX | ....  | ? | Info/User
[=]   01 | XXXXXXXX | ....  | ? | UID
[=]   02 |          |       |   | Password   write only
[=]   03 |          |       |   | User       read denied
[=]   04 |          |       |   | Config     read denied
[=]   05 |          |       |   | User       read denied
[=]   06 |          |       |   | User       read denied
[=]   07 |          |       |   | User       read denied
[=]   08 |          |       |   | User       read denied
[=]   09 |          |       |   | User       read denied
[=]   10 |          |       |   | User       read denied
[=]   11 |          |       |   | User       read denied
[=]   12 |          |       |   | User       read denied
[=]   13 |          |       |   | User       read denied
[=]   14 |          |       |   | Lock       read denied
[=]   15 |          |       |   | Lock       read denied

I’m not sure what to do with that.

1 Like
2

You are on the right lines but I think the wrong value. Trylf hid clone xxxxxxxxxx with the demod value rather than the raw value.

1 Like
3

When I try that I get:

[=] Preparing to clone HID tag using raw XXXXXXXXXXXXXXXXXXXXXXXXX
[#] Tags can only have 84 bits
[=] You can cancel this operation by pressing the pm3 button
1 Like
4

Try

lf hid read

And you should get something like

[+] [H10301] - HID H10301 26-bit; FC: 118 CN: 1603 parity: valid

But with [C1k35s] you will either get a raw code that you can use in

lf hid clone -r

Or an FC and CN as shown above.

If the latter use

lf hid clone -w C1k35s --fc xxxx --cn yyyy

You did list the edited out FC and CN already.

1 Like
5

OOooohhhhh! It’s the -w C1k35s that I couldn’t figure out! I didn’t know where the -w argument came from.

1 Like
6

weigand list will list all of the -w formats it knows.

1 Like
7

Perfect! Thank you! I’ll let you know how it goes tomorrow!

1 Like
8

If the clone can now be read with the Proxmark3 (it should look identical with the lf hid read) then any remaining issues are with the reader.

Do you know what make and model the reader is? Search online and hopefully you can find an internal shot that shows where the antenna is.

You usually want to swipe across part of the antenna, rather than just placing it in the middle.

2 Likes
9

That makes me think it is a placement issue rather than a format issue. If you have an lf xled detector you should be able to move it around on the pad to see where the signal is brightest.

1 Like
10

The info does look identical now when I scan my badge and my NExT. The reader is a HID multiCLASS SE RP15. I’m looking for pictures of the antenna now.

11

Good call! I have the xField Detectors that came with the bundle I got.

1 Like
12

Unfortunately it looks like that reader is fully potted with resin. So unless someone bought one to deliberately to take it apart (and found a way to remove the resin) the xfield detector is your best bet.

1 Like
13

Sounds good! I’ll do some digging tomorrow. Thankfully I’m one of the few people in the office now so there’s no one to try to avoid! LOL!

1 Like
14

I still can’t scan my implant on the work reader. I used the LF xField Detector to try to find the hot spot but unsuccessful. I ran it slowly over the whole face of the reader horizontally, vertically, at 45 degrees and -45 degrees but it never lit up. Testing with my work badge it can be read ~2" away. I guess the next step is to try to clone my badge to another card and try that

15

this

2 Likes
16

Can you also try your diagnostic card
:card_diagnostic_dt:
and let us know if the HF led also lights up.

This should also show your how the reader is searching for cards…ie. constant / pulsing

1 Like
17

I cloned my badge to a T5577 card but I still get nothing on the reader. The diagnostic card lights up the HF side which is weird because the TagInfo app on my phone won’t scan the badge and my ProxMark3 I gives me the info that I posted above:

[+] [C1k35s  ] HID Corporate 1000 35-bit std    FC: XXX  CN: XXXXXX  parity ( ok )
[=] found 1 matching format 
[+] DemodBuffer:
[+] XXXXXXXXXXXXXXXXXXXXXXXXX

[=] raw: 00000000000000XXXXXXXXXX

[+] Valid HID Prox ID found!

[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try `lf em 4x05` commands

[=] Found a EM4305 tag

[=] Addr | data     | ascii |lck| info
[=] -----+----------+-------+---+-----
[=]   00 | XXXXXXXX | ....  | ? | Info/User
[=]   01 | XXXXXXXX | ....  | ? | UID
[=]   02 |          |       |   | Password   write only
[=]   03 |          |       |   | User       read denied
[=]   04 |          |       |   | Config     read denied
[=]   05 |          |       |   | User       read denied
[=]   06 |          |       |   | User       read denied
[=]   07 |          |       |   | User       read denied
[=]   08 |          |       |   | User       read denied
[=]   09 |          |       |   | User       read denied
[=]   10 |          |       |   | User       read denied
[=]   11 |          |       |   | User       read denied
[=]   12 |          |       |   | User       read denied
[=]   13 |          |       |   | User       read denied
[=]   14 |          |       |   | Lock       read denied
[=]   15 |          |       |   | Lock       read denied
18

did you do an HF SEARCH with your proxmark3 on your work badge? could be dual frequency and still use a chip your phone can’t scan or doesn’t understand.

1 Like
19

I didn’t. I’ll do that tonight when I get home.

20

That is exactly what I thought, what I was going to ask next and why I asked this

however,

I was/am confused by that.

Out of curiosity, can you try an NFC Tools scan (remembering that it is not as accurate at chip identification as TagInfo, but I would like to see if it is “seeing” anything)