To expand on this… pages E5 and E6 cannot be read from, however taginfo will do a pwd_auth attempt with factory default and if it comes back with a pack and not an error code it will know the password and display the default password and pack it responded with in the full data report… but this is not because it read the data from E5 and E6. It’s also a shitty thing to do because I seriously doubt they are checking the config bytes for authlim setting and could mess up a secured tag really bad by systematically checking passwords on tags.