Help Me Please! Cloning Xerox tag please

Hi, I’m using the proxmark3 easy and I’m having trouble cloning hf xerox tag

This is what I got when I do Hf search

[usb] pm3 → hf search
[|] Searching for Fuji/Xerox tag…
[+] UID…
[+] ATQB… 00 00 00 00 00 00 00

[+] Valid Fuji/Xerox tag found

[-] Searching for ISO14443-B tag…
[+] ASK C-Ticket
[+] UID: CC BA 11 00 ( 0001227477 )
[+] Product Code: 00
[+] Facility Code: 00

[+] Valid ISO 14443-B tag found

[?] Hint: try hf xerox commands

[?] Hint: try hf 14b commands

I tried using (hf xerox dump) and (hf 14b dump) commands but its not working. Any Ideas?

1 Like

I am so curious… can you tell me a bit about yourself?

  • Approximate age?
  • What country you are located in?
  • Is English your first / native language or learned later?
1 Like

Cool cool ok thanks. Basically I was curious because typically, when you are asking for help on a forum, the worst thing you can do is start your post with “Help me!”… it’s a demand, not a question. For anything less than a mortal emergency, it’s just off-putting.

To answer your question though, basically I think the problem right now is that I’m not aware of any magic transponders (tags you can change the UID for) exist. What are you trying to clone this tag to?

Also, the ataq value of all zeros from your source tag is a little suspicious… not sure what that’s about.

1 Like

Ok I fixed the topic so it’s not a demand it’s a crynout loud . I tried a “hf mf autopwn” and “CHK -*” it couldn’t read any segment it only shows dashed in red “-----------” . The tag says "schlage " on it . I’m trying to clone it on a similiar token and hopefully on my implant . I also deleted my personal info no need to have that on public. Also the zero numbers in the main post I changed it for security purposes.

1 Like

To make a clone of a tag you need a specific type of tag. Normal transponders don’t let you change the UID because it’s like a serial number. Even if you were able to get a dump of the data, you’d not be able to just make a clone to another one. I don’t think it’s worth figuring out how to dump the data because you’d not be able to use it to make a clone.

To prefix my reply, Amal is almost always correct, and he probably is in this instance too.

The following is me clutching at straws for you, so lets see how it goes.

Is it Xerox written on the lock and Schlage written on the fob?
or the other way around?

I know fuck all about Xerox, but I do know that some Schlage locks can be dual frequency. Your fob might be also.

Can you try an lf search on your fob.

With regards to the UID of the HF side, how many bytes is it? 4 (xx xx xx xx) or 7 (xx xx xx xx xx xx xx)

I saw in your first hf search the first UID came up blank (or you deleted it) the second one had a 4 byte UID (2 UIDS, is weird in and of it self)

Because the HF side of some Schlage llocks are Mifare classic.

If there is an LF side to it, we might have another approach.
If it is pick-a-backing on Mifare Classic we might yet again have another approach to try.

Again, I know shit about fuck with Xerox, but if they only use the UID for what you are wanting to do.
There might be some options for you.

However, if it requires more than a simple UID and is not Mifare Classic compatible, you might be shit out of luck.

All this :point_up: is based on your Schlage straw you offered up and i am clutching at

2 Likes

Hi, the original fob says “schlage” and the lock also says “schlage” I bought the exact fob which was advertised as "mifare " fob and it looks identical. The part number for it is sc9651t . Lf search doesn’t return anything. Hf shows two uids (which I hid the numbers ) but the top says Xerox (7bytes) and the bottom says iso14443b (4bytes) (I also happen to have a blank iso14443b fob as well) I tried almost all mf CHK, dump and autopwn commands with no luck. Hf Xerox dump says tag not found and 14b dump tries to read sectors but returns nothing (sectors show in red ---------) and doesn’t save a bin file

:thinking:

if you use the search function,
You will find a few threads that may have some suggestions for you to try.

I couldn’t find a solution using search. Do you know what frequency is the Xerox chipset ? Is it higher than 13.56? Or it could be my proxmark isn’t reading very well. What is the best way to do an update for the proxmark3 easy ?

But I think my proxmark3 is fine because I was able to clone an hid iclass without any problems

It is in the hf list, so it will be 13.56MHz

  • cd proxmark3
  • git pull
  • make clean && make all
  • make -j

Agreed, there is still a posibility XEROX recieved an update, but that is probably a stretch

1 Like

Also need to flash the update with
./pm3-flash-all

2 Likes