Help cloning ioProx to EM4305

Hey guys! Still very new to the community, trying to use my ProxMark3 to clone my apartment’s ioProx keyfob to my shiny new key organizer, which has an EM4305 chip built-in. I think i’m roughly halfway there, but completely out of my depth.

I’ve started by running lf io clone --vn x --fc xx --cn xxxxx --em. This gives a successful output, but when running lf search it doesn’t detect anything. I know that when cloning this fob to a T55xx series card, the blank card has to be formatted first by running lf t55xx write -b 0 -d 00147040

I’ve tried running lf em 4x05 write -a 0 -d 00147040 as my caveman-brain translation to the EM format, but it still isn’t being detected as a valid ioprox card on lf search.

What confuses me more is when running lf em 4x05 info it outputs

[=] ConfigWord: 0001825F ( IOPROX )
[=] Data Rate: 31 | RF/64
[=] Encoder: 9 | FSK2
[=] LastWordR: 06 | Address of last word for default read - meaning 2 blocks are output
[=] ReadLogin: 0 | Read login is not required
[=] WriteLogin: 0 | Write login is not required
[=] Disable: 0 | Disable command is not accepted
[=] R.T.F.: 0 | Reader talk first is disabled

Which makes it seem like it should be configured as an IOPROX card? based off of the configword

Further more, comparing the config of my ioprox and E4305 chip, I noticed that the Data rate is set to RF/64 on my target card, and RF/8 on my ioprox.

I can see that the data rate is set by the config word in address 4, but I can’t for the life of me figure out what I need to change that address 4 text to in order to change the data rate and/or FSK version.
Currently address 4 reads as: 0001825F

It’s also entirely possible that i’m completely offtrack, and missing something simple somewhere. Any help or assistance with this would be greatly appreciated!

convert your fc into decimal and write it like that

lf ioprox clone —vn x —fc (decimal) —cn (hexadecimal) —em

I believe I have it in decimal already, I’m using the exact same syntax as I do when cloning to a T55xx chip, just adding --em. lf search on my ioprox spits out XSF(01)3c:XXXXX. I’m running lf io clone --vn 1 --fc 60 --cn XXXXX --em, and it acts as if it succeeds but isn’t readable. When trying to input --CN as hex, it errors and requests decimal instead.

can you PM the output of your ioprox scan on the original ill craft you a command

1 Like