Halo scanner: what's an EM4102 "BME" chip?

Support
1

I received my Halo scanner in the mail yesterday, and played with it some, to see what it can do. In this video, the dude scans his xEM chip also - which, I assume, he left in 40-bit UID EM41xx mode.

So I tried to scan my own, non-DT, EM4200 implant. No matter how much I tried, the Halo reported nothing. I doubt very much it didn’t pick it up though, because my EM implant is oversized and usually has a pretty good read range. More likely, the Halo is very particular with what type of EM chip it supports, and really, REALLY wants a EM4102 and nothing else.

Anyhow, I looked at the scanner’s specs to try and figure out what it supports, and that page says “Reads all FDX-B 15 digit, FDX-A 10 digit and EM4102 (BME)chips”. Anybody knows what BME stands for? I’ve googled it up several times in different contexts, but nothing much turns up. The best guess I have is that it stands for “bio-medical equipment”, but that’s probably not it.

Side question about the Halo scanner - or rather, the Scanner Angel software that loads up a database of lost pets into the unit when you charge it with a Windows PC: anybody knows where that program stores the database?

Normally the pets’ statuses in it are supposed to be one of “lost”, “recovered” and a couple other statuses or something, and the Halo scanner is supposed to display it when it encounters a matching UID. I was goofing around with the idea of figuring out the format of the database, and if possible, patching it to make my Halo scanner displays my status as “fabulous” when it scans my xBT :slight_smile:

Trouble is, I can’t find it. I only find a big, mostly empty file with a few phone numbers of shelters around the world and a dozen garbled entries. That can’t be it.

2

A quick search brings up (bme) base metal electrode. Don’t know if that’s it or not but might be a place to start. https://www.avx.com/products/ceramic-capacitors/surface-mount/militaryaerospace/escc-3009041-space-level-bme-x7r-mlcc/

3

I don’t have a halo, and it seems that the Program is built to automatically pull the updated database/registry when it detects the scanner is attached. I’m still kinda curious to see what the file you found looks like, would you be cool posting it here or DM-ing me?

4

I just sent you the file. Let me know if the upload thingy worked.
It’s so empty it went from 2.5M to 4.5K when I zipped it :slight_smile:

5

That’s @Vicarious in that video, and funny enough the best way to scan a chip implant in your hand is to actually put it inside the hole… basically put your hand through the hole in the center and when the tag passes through the reader will read it much more readily than trying to position it on the outside of the scanner body. Try that?

2 Likes
6

I just did. No joy.

Also, I tried passing my hand through upside down - just in case the chip needed to face the other way - and I got stuck, much to the amusement of the missus. You managed to make me look like a fool. Nice trick Amal :slight_smile:

Seriously though, you’re right: the xBT reads from miles away while still inside the needle when I present it through the loop, orthogonal to the reader - as opposed to flat against the backside. Amazing!

1 Like
7

Don’t know if it’s an undocumented feature (bug) or not, but I’ve noticed before that the Halo reader doesn’t support all UID numbers.

  • do you know which UID number your xEM has?
  • do you have RFID cloning/writing devices to change the UID number of your xEM tag?
    You might want to try different UID numbers, such as the one from my video, or for example: 01DEADBEEF

Vicarious

2 Likes
8

:open_mouth: what?! holy shit. :confused:

1 Like
9

My chip isn’t a xEM and it’s not writable. I’ll read the UID tomorrow. The reader is in the other room and it’s 2am here: I’ll wake everybody up if I go dig it up now :slight_smile:

Did you notice the bug/feature only with EM chip or with FDX chips also? Cuz if it’s the later, it would be a real bummer for shelters and vets: some chipped dogs would go undetected.

10

I only noticed it with certain EM4200 RFID tags or when emulating EM4200 RFID tags using a proxmark or with the Hack ID emulator from 360 unicorn team

image
image4032×3024 2.27 MB

11

Maybe there’s a particular range of UIDs that’s reserved for animal tagging.

1 Like
12

Here’s the lowdown on my chip:

proxmark3> lf search
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
          

Checking for known tags:
          
EM410x pattern found:           

EM TAG ID      : 8EBC910025          

Possible de-scramble patterns          
Unique TAG ID  : 713D8900A4          
HoneyWell IdentKey {          
DEZ 8          : 09502757          
DEZ 10         : 3163619365          
DEZ 5.5        : 48273.00037          
DEZ 3.5A       : 142.00037          
DEZ 3.5B       : 188.00037          
DEZ 3.5C       : 145.00037          
DEZ 14/IK2     : 00613048975397          
DEZ 15/IK3     : 000486363693220          
DEZ 20/ZK      : 07010313080900001004          
}
Other          : 00037_145_09502757          
Pattern Paxton : 2393194021 [0x8EA53E25]          
Pattern 1      : 6425104 [0x620A10]          
Pattern Sebury : 37 17 1114149  [0x25 0x11 0x110025]          

Valid EM410x ID Found!          

Valid EM4x05/EM4x69 Chip Found
Try lf em 4x05... commands
          
proxmark3> lf em 4x05info

 Chip Type:   9 | EM4305          
  Cap Type:   3 | 330pF          
 Cust Code: 512 | Default          

  Serial #: 41F9DD10
          
ConfigWord: 0081805F (Word 4)
          
Config Breakdown:          
 Data Rate:  31 | RF/64          
   Encoder:   1 | Manchester          
    PSK CF:   0 | RF/2          
     Delay:   0 | no delay          
 LastWordR:  06 | Address of last word for default read - meaning 2 blocks are output          
 ReadLogin:   0 | Read Login is Not Required          
   ReadHKL:   0 | Read Housekeeping Words Login is Not Required          
WriteLogin:   0 | Write Login is Not Required          
  WriteHKL:   0 | Write Housekeeping Words Login is Not Required          
    R.A.W.:   0 | Read After Write is Off          
   Disable:   1 | Disable Command is Accepted          
    R.T.F.:   0 | Reader Talk First is Disabled          
    Pigeon:   0 | Pigeon Mode is Disabled
          
      Word:  00 | Is Write Locked          
      Word:  01 | Is Write Locked          
      Word:  02 | Is Not Write Locked          
      Word:  03 | Is Not Write Locked          
      Word:  04 | Is Not Write Locked          
      Word:  05 | Is Not Write Locked          
      Word:  06 | Is Not Write Locked          
      Word:  07 | Is Not Write Locked          
      Word:  08 | Is Not Write Locked          
      Word:  09 | Is Not Write Locked          
      Word:  10 | Is Not Write Locked          
      Word:  11 | Is Not Write Locked          
      Word:  12 | Is Not Write Locked          
      Word:  13 | Is Not Write Locked          
      Word:  14 | Is Not Write Locked          
      Word:  15 | Is Not Write Locked

So it’s not a EM4200 after all, but an EM4305.

Incidentally, I have a “real” EM4200 fob that my Halo scanner reads with great difficulty if I present it sideways just right on the edge of the reader at a very precise location near the CE symbol, once every 10 tries or so. Maybe my scanner is just exceedingly bad at reading EM chips, and it simply doesn’t have a snowball’s chance in hell to read my implant if it’s already struggling with a full-size fob.

13

I think the Halo reader has a problem with zero’s.
Using the RFID tag emulator (Hack ID from 360 unicorn team), I’m emulating your UID number and indeed, the Halo reader doesn’t respond.
Then I changed the UID number to 8EBC911125 and the Halo reader found the emulated RFID tag right away and shows the UID number in it’s display.

image
image3068×2301 2.15 MB

Vicarious

3 Likes
14

Wow, that’s such a weird bug :slight_smile:
I’ll report it to the maker. There’s got to be a reason for this, surely…

1 Like