CLONING - White Cloner How To ( Don't do it, but incase you already have! )

White Multi-Frequency Cloner:

**PRE-AMBLE**

This WIKI is very similar to the Blue-Cloner Wiki and all credit should go to @TomHarkness; his xem-cloning-emulation-modes-and-the-perils-of-chinese-cloners and the white-cloner-password-found threads are the main sources of this information; between them, they could probably be used as a wiki. I have tried to condense them down to just the HOW TO!

There hasn’t been any people on this forum recently with questions about “The WHITE CLONER” so either people have:-
Adhered to the advice to avoid :skunk:
OR
They are using @TomHarkness threads to rectify their issues.

Therefore this Wiki may be redundant but just in case, Info and solutions compiled below

.

DO NOT USE THE WHITE CLONER TO CLONE:exclamation::exclamation:

.

**UNLOCK**

Firstly You will
Need:-
A Proxmark or Find somebody to help

Highly Recommend
ProxLF antenna for the Proxmark3 RDV4

Suggest
spare t5577 keychain fobs, break them, un-break them and learn as you go.

The stock proxmark3, proxmark3 RDV2 and proxmark3 easy antennas are NOT designed to work with the cylindrical antennas in xEM’s or NExTs. This causes a few issues with accuracy when we try to read / write to the chip so a Proxmark and LF antenna is recommended but not always necessary. (DT antenna only compatible with PM3 RDV4)

There is one known password already on the proxmark forum but unfortunately it is only for some very old models.

If you have an xEM or NExT that you have locked with the White Cloner pictured and wish to be able to write to it with other devices.

A tip on coil placement:

  1. Try and issue an lf t55xx p1detect command. If the Proxmark can detect the chip then you are close to a good spot (if the chip is locked the Proxmark will not return anything - this is part of what makes unlocking implants & antenna placement tricky)
  2. After the lf t55xx detect, issue an lf t55xx trace a few times, if the proxmark returns the t55 tractability data screen you are in the “sweet spot” and writes should work cleanly.

Therefore the Proxmark commands are as follows:-
lf t55xx detect
lf t5 trace

You can unlock it with the following password:

AA55BBBB

The full command is:
lf t55xx write b 0 d 00148041 p AA55BBBB

Updated command for “current” PM3 Syntax

SIMPLE!!!
Thanks @TomHarkness

.

REFERENCE INFORMATION

xem-cloning-emulation-modes-and-the-perils-of-chinese-cloners
white cloner password found
proxmark lf t55 operations
ATA5577C datasheet
xEM_Atmel-9187-RFID-ATA5577C_Datasheet.pdf

10 Likes