Help progamming weird HID format with sequential cardnumbers

sccsltd · February 5, 2024, 11:27am

Morning,

This is going to be a weird one so not sure anyone will be able to help but hopefully someone can make sense of it,

I have a clock system that uses125khz HID fobs, I am able to clone these to a T5577 without issue using lf hid clone -r 95156014605 for example will create a fob with the number 15601460 and this will work fine.

I am trying to create additional fobs and i am having some issues, the cards atr is ATR: 3B051415601460 using a omikey5427 with pacsprobe which would mean it should be a H10320 (C&D) format fob but proxmark gives me this when i read it,

[usb] pm3 → lf hid read
[!] Wiegand unknown bit len 43
[?] Try 0xFFFF’s http://cardinfo.barkweb.com.au/
[+] DemodBuffer:
[+] 1D9666566669555665695566
[=] raw: 000000000000095156014605

however the fob works perfectly with the clock machine, I am able to program additional fobs by using

lf hid clone-r 95CCCCCCCCP

where C represents the 8 digits I want to use and P is some form of check digit, currently I have to program each fob with an increasing P value until I find the correct value.

does anyone recognise this or know a way to calculate the P value

if I program the fob as a valid HID H10320 they do work but they return a 20digit number on the machine witch doesn’t work as its expecting 8 digits.

here is a sample of working fob numbers using clone -r these work fine.

95 15601970 9
95 15601971 8
95 15601972 b
95 15601973 a
95 15601974 d
95 15601975 c
95 15601976 f
95 15601977 e
95 15601978 1
95 15601979 0

Aoxhwjfoavdlhsvfpzha · February 5, 2024, 1:01pm

I’m not sure I understand exactly what you’re looking for, but:

Here’s the bit format for HID’s 36 bit H10320, if you convert your raw hexadecimal to binary and compare it to the chart, it may help you see some patterns related to the P values

sccsltd · February 5, 2024, 4:06pm

Thanks.

Sorry its hard to explain when i dont fully understand it myself.

The last invoice for these fobs lists them as 8 digit C&D 125khz.

as far as i can tell they don’t conform to the H10320 format or any other that I can see. yet they are readable with a hid reader.

I need to be able to calculate the last digit(parity) for a given card number but I cannot figure out the algorithm used as it does not match any of the HID formats that i can see.

Aoxhwjfoavdlhsvfpzha · February 6, 2024, 4:01am

I haven’t tried all of your numbers but as far as I can tell the binary is:

ABCD ABCD ABCD ABCD ABCD ABCD ABCD ABCD ABCD ABCD (ABCD)P
P(A) is odd parity and the rest are even parity

This works for at least 4 of them

Aoxhwjfoavdlhsvfpzha · February 6, 2024, 4:51am

I was bored, here’s a python calc that’ll do it for you:

github.com

aoxhwjfoavdlhsvfpzha/DNGRS/blob/main/weird.py

print("Input Hex: ")
hexi = input()
parities = [[], [], [], []]
print()

try:
    #Convert from hex
    number = hexi
    number = number.replace(" ", "")
    decinum = int(number, 16)
    binanum = bin(decinum)[2:]
except Exception as e:
    print("Error! Maybe not Hexidecimal?")
    exit()

x = 0;
i = 0;
while (i < 4):
    while (x < len(binanum)):
        parities[i].append(binanum[x])

This file has been truncated. show original

it works for all the sample numbers you gave

punch in the hex minus the P value obviously and it’ll find the parity

sccsltd · February 6, 2024, 10:36am

Looks like you nailed it perfectly thank you,

using your code as a base I created a generator that will give me the next X numbers in the sequence with the party calculated which is exactly what I needed,

I think I understand the parity now also, still have no idea how your figured it out but thanks again saved me a ton of messing around.

Aoxhwjfoavdlhsvfpzha · February 6, 2024, 10:46am

It was a lucky guess!

If you ever feel like making a post showing off this clock and how it works, I’d be fascinated to learn what you needed the sequenced wiegand for!

sccsltd · February 6, 2024, 3:31pm

Its nothing special.

its these clock machines that are used in work for clocking in/out

they will read pretty much any hid fob and a few others when configured to.

the issue I had was the software that collects the data can only handle the 8 digit card numbers so I needed to either find a supplier who could supply pre-coded fobs or find a way to program them myself, one supplier wanted £8 per fob and wouldn’t even send a sample to make sure it worked…

so began my trip down the rfid rabbit hole, once I knew I could clone the fobs I knew there would be a way to write any fob number I wanted, I was originally brute forcing my way through programming every combination to a fob then find the fob that worked repeat until I had enough fobs.

I think I’m getting a better grasp of how it all works now, I hadn’t figured that it would be being done on a binary level…

so lucky guess or not, its very much appreciated, I just tested a completely different number combination and it worked first time

Pilgrimsmaster · February 6, 2024, 5:34pm

I think it is, pretty great example of
Problem found
Problem shared
Problem halved
Problem Solved
Solution made
Now we just need a solution shared ( With a little more detail )

If you wanted to give back to the community, Would you mind writing up a quick Project for it

If you go to
Projects

And just throw something together with as much time as you have to spare
including
Links
the code
etc

Its pretty much a copy and paste from a few posts above

It can be rough if thats all you have time for, I can grab more info from this thread to tidy it up if it needs it

and of course

Thanks in advance