Got NeXT 3 weeks ago, LF is dead. Options?

I got my NeXT implanted at DefCon 3 weeks ago.

The HF side is working pretty well. The LF side appears to be dead. I cannot read it with any LF-capable equipment that I own, including:

Proxmark 3 RDV4 with LF antenna rotated to the side
Proxmark 3 RDV4 with ProxLF antenna
Promark Pro with dedicated LF antenna
iCopy X
Flipper Zero

So I’ve pretty much concluded that it is dead.

I’ve tried running lf t55xx wipe, that doesn’t seem to do anything; lf t55xx detect fails (documented below).

So, is there ANYTHING else I can do, or do I start asking for a replacement? What does the removal/reinsertion process look like?

Thanks for any info/suggestions.

Joe

Here’s the latest try with the ProxLF antenna, coil parallel to the implant.

[usb] pm3 --> hw tune
[=] ---------- Reminder ------------------------
[=] `hw tune` doesn't actively tune your antennas,
[=] it's only informative.
[=] Measuring antenna characteristics, please wait...
 🕛   9
[=] ---------- LF Antenna ----------
[+] LF antenna: 27.07 V - 125.00 kHz
[+] LF antenna: 26.78 V - 134.83 kHz
[+] LF optimal: 28.25 V - 129.03 kHz
[+] Approx. Q factor (*): 4.0 by frequency bandwidth measurement
[+] Approx. Q factor (*): 4.9 by peak voltage measurement
[+] LF antenna is OK
[=] ---------- HF Antenna ----------
[!] ⚠️  HF antenna is UNUSABLE

(*) Q factor must be measured without tag on the antenna

[+] Displaying LF tuning graph. Divisor 88 (blue) is 134.83 kHz, 95 (red) is 125.00 kHz.

[!] ⚠️  You appear to be on an environment without an X11 server or without DISPLAY environment variable set.
[!] ⚠️  Plot may not work until you resolve these issues.

[usb] pm3 --> lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] 26950 mV / 26 V / 27 Vmax

[=] Done.
[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] ⛔ No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf t55xx wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0

[=] Begin wiping...
[=] Writing page 0  block: 00  data: 0x000880E0
[=] Writing page 0  block: 01  data: 0x00000000
[=] Writing page 0  block: 02  data: 0x00000000
[=] Writing page 0  block: 03  data: 0x00000000
[=] Writing page 0  block: 04  data: 0x00000000
[=] Writing page 0  block: 05  data: 0x00000000
[=] Writing page 0  block: 06  data: 0x00000000
[=] Writing page 0  block: 07  data: 0x00000000
[usb] pm3 --> lf t55xx detect
[!] ⚠️  Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55xx detect
[!] ⚠️  Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55xx detect
[!] ⚠️  Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 -->
1 Like

Actually I am in a similar position. Almost 3 weeks since install and the HF side is readable but the LF isn’t.

It is in my dominant hand in R0 and I am wondering if that is causing it to take longer to heal. The read on the HF seems to be improving over the last few days and works perfectly now. The LF is still yet to show up.

I plan on giving it another week before I panic.

Edit: this is my 2nd next. First one went fine and was good on both HF and LF just under two weeks. It was in L0.

1 Like

image

2 Likes

I would like to jump in as well.
Its coming up on three weeks since I installed my NExT and it kinda works fine.
I was able to clone my work access card to the T5577 chip and it works fine. However I can’t seem to get it to read back the information to me.
Proxmark Easy 3 says its “indala” and thats it and my Flipper can’t even scan it.
If I use the original card on either the Proxmark Easy 3 or Flipper then I get a full read out.

Hi, tomorrow will be a week since I have NExT as above, HF works fine, reading improves day by day but LF can’t read now I have RC522 but Proxmark 3 Easy is on the way. Please tell me if there is any chance that the RC522 will see the T5577?

I have Chinese blue gun but i heard that can lock the chip, is it true? And if so is it reversible using for example PM3 Easy?

1 Like

Yes. Probably highly unlikely but yes.

It will put a password on it that will be fun to remove, made the mistake of using a blue cloner on my flexEM and thankfully some smart people here helped me fix it. I would avoid the blue cloner and just wait until your proxmark arrives and then use that :slight_smile:

1 Like

What mode is your T5577 in?
Indala is a common result when the PM3can not quite read it (more like noise) You need to be exact with your PM3 antenna, millimeters matter.

For the Flipper, it doesn’t have the full library like the PM3, so could that be the reason?

Yep

https://forum.dangerousthings.com/t/handy-dandy-tips-and-tricks/13041/11?u=pilgrimsmaster

1 Like

I’m pretty sure the rc522 is hf and I know the t5577 is lf so no I don’t think so. It should be able to pick up the hf side of a NExT, but not the lf.

I’m not sure on the mode. I’m not home at the moment so I can’t check.
I scanned my work card with my flipper and it says its an “Indala23[Motorola]”

I was about to give out on my NexT thinking the LF side was dead until I made the round antenna for the PM3.

It did work on access door, but nothing out of the PM3 …
Do you have something on the implants and access to a door you can test with?

I’m having a devil of a time trying to read my implant. Having one of them coiled antennas is going to be a dream.

I scanned a test card I made before using the same settings on my implant, modulation is PSK1
I’m assuming thats what you mean by mode.

Semi reviving/hijacking this thread

For the life of me I can not get a read on my implant. Using a PM3 I use

lf tune

to try and find the sweet spot with the coil and my implant. 21329 mV is as good of a reading I can get.

I’ve also tried getting a Flipper Zero to read the implant. No dice at all. Reads the NFC side no problem but nothing on the LF side.

Implant works fine at work. Door readers can see it no problem.

Maybe I installed the implant a little too deep and as a result I need a little more power to read the implant through my flesh?

Hmm. The final voltage from the tune command isn’t as important as the amount of the drop. What is the starting voltage and the peak drop voltage, then subtract and get the total drop.

It’s possible it’s totally dead though which sucks… but let’s at least clarify the total drop.

Top is no card/implant
Middle is where I think the implant is.
Bottom is with a ID-5577 card

[usb] pm3 → lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] 21175 mV / 21 V / 21 Vmax

[=] Done.
[usb] pm3 → lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] 21346 mV / 21 V / 22 Vmax

[=] Done.
[usb] pm3 → lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] 7871 mV / 7 V / 21 Vmax

What mode is your LF side in currently?

This is your LF side correct?
So its only PM3 and Flipper that cant read it?

Sorry, just want to make sure I have all the info correct before replying further

This is confusing because the no card voltage is lower than the implant voltage?

What I mean is start with no card, get a sense of the voltage… then sweep around where your implant is until you can narrow in on the peak voltage drop… the lowest the voltage gets when sweeping around… however you have your proxmark3 positioned to get the maximum voltage drop is likely the best position you’ll get a read with your implant.

Also, you are using the LF antenna face down on your hand right?

Can you have someone take some photos or a video of you doing this process?

1 Like

I hate to say it but I am now up to 4 weeks tomorrow, and havng the same problem with the LF side. Can read HF, and have used LF tune to work out the spot (which correspondes to where the LF side should be as well) and there is voltage drop (by about 40%) but no read.

I have tried:

lf search
lf t5 detect
lf t5 wipe
lf hid clone -r XXX (being the raw number)

No luck so far. Happy to take any suggestions.

1 Like