Hello.
0) I have a door lock “Cisa E-volution”. It can be opened via normal metal key or via RFID token.
- I have scanned RFID and it seems to be “EM410x” type.
- I have cloned to T5577 chip and T5577 card
- … but clones DO NOT open the door.
- However Flipper Zero can emulate EM410x and lock is opened.
What am I missing in clone process?
“Original rfid” scan:
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 04184EDCBA
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 2018723B5D
[=] HoneyWell IdentKey
[+] DEZ 8 : 05168314
[+] DEZ 10 : 0407821498
[+] DEZ 5.5 : 06222.56506
[+] DEZ 3.5A : 004.56506
[+] DEZ 3.5B : 024.56506
[+] DEZ 3.5C : 078.56506
[+] DEZ 14/IK2 : 00017587690682
[+] DEZ 15/IK3 : 000137849092957
[+] DEZ 20/ZK : 02000108070203110513
[=]
[+] Other : 56506_078_05168314
[+] Pattern Paxton : 73603770 [0x4631ABA]
[+] Pattern 1 : 9301101 [0x8DEC6D]
[+] Pattern Sebury : 56506 78 5168314 [0xDCBA 0x4E 0x4EDCBA]
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[=] Couldn’t identify a chipset
=====
“Clone scan”
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 04184EDCBA
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 2018723B5D
[=] HoneyWell IdentKey
[+] DEZ 8 : 05168314
[+] DEZ 10 : 0407821498
[+] DEZ 5.5 : 06222.56506
[+] DEZ 3.5A : 004.56506
[+] DEZ 3.5B : 024.56506
[+] DEZ 3.5C : 078.56506
[+] DEZ 14/IK2 : 00017587690682
[+] DEZ 15/IK3 : 000137849092957
[+] DEZ 20/ZK : 02000108070203110513
[=]
[+] Other : 56506_078_05168314
[+] Pattern Paxton : 73603770 [0x4631ABA]
[+] Pattern 1 : 9301101 [0x8DEC6D]
[+] Pattern Sebury : 56506 78 5168314 [0xDCBA 0x4E 0x4EDCBA]
[+] VD / ID : 004 / 0407821498
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[=] Couldn’t identify a chipset
[usb] pm3 →
=========
I have proxmark, bought from dt, and quite fresh software:
MCU....... AT91SAM7S512 Rev B
Memory.... 512 Kb ( 60% used )
Client.... Iceman/master/v4.16191-54-g3ee7ac325 2023-02-12 22:17:05
Bootrom... Iceman/master/v4.16191-54-g3ee7ac325 2023-02-12 22:16:03
OS........ Iceman/master/v4.16191-54-g3ee7ac325 2023-02-12 22:16:23
Target.... PM3 GENERIC
====
Probably I must tell T5577 to get into some special state?!
Once again to summarize - I have several different T5577 and all are “ignored” by lock. But Flipper can emulate.
Please give me an ideas