Help identifying/cloning Impro fob for BPT door system (PSK1, 134 kHz)

Support
1

Hi all,

Trying to clone an Impro fob used with a BPT door entry system. Having trouble getting consistent reads. Here’s what I’ve found:

Hardware: Proxmark3 Easy, Iceman fork v4.20728-291-g66c7374e5

Antenna tuning:

  • LF 125 kHz: 11.07V
  • LF 134 kHz: 19.34V (optimal)

Signal characteristics:
Modulation: PSK1
Bit clock: RF/40
Baud rate: 3125
Frequency: 134 kHz (divisor 88)

What I’ve tried:

  1. lf search at both 125 and 134 kHz - occasionally detects as “Indala” but with odd sizes (70, 76, 342, 526 bits) and “false positive?” warnings
  2. lf indala reader - returns nothing
  3. lf indala demod / lf indala altdemod - inconsistent results, worst metric (8), different UIDs every read
  4. data rawdemod --p1 - gets PSK1 bitstream but mostly alternating 010101 carrier pattern, completely different every read

Sample “Indala” detection (likely false positive):
Indala (len 70) Raw: 80000000200001004085fffffffffbffffdfffffffffffffffffffff

Questions:

  1. Is this a known Impro format?
  2. Any scripts or tools specifically for Impro tags?
  3. Could this be rolling code/encrypted?
  4. Any suggestions for getting cleaner reads on PM3 Easy?
  5. Would a different antenna help with coupling?

Fob has no visible model number, used with BPT intercom/door system. Any help appreciated!

2

Have you tried hf search?

2 Likes
3

Indala is a common false positive, and I doubt that most people here have come across an actual Indala fob…

I’d take a look at the HF side of things, like Aoxhwjfoavdlhsvfpzha said.

3 Likes