Hi all,
I have some issues cloning a HID Prox to a T5577 using a Proxmark3.
All seems to work fine except that the raw value does not clone properly to the T5577 missing the second (9) and third (e) values at the start of the raw value. When using watch the Tag ID of both tags read differently.
Has anyone else had this issues or know of a solution?
Yeah that’s odd. How many write attempts did you try? Sometimes writes aren’t perfect… contain errors.
Also have you tried using the hid clone command using the fc cn etc. values vs raw?
I have tried the write numerous times in different positions. I have done the fc and cn manually also. All the blank numbers (fc and cn etc) are equal to the source and clone fine. Just that raw value and DemodBuffer do not fully match and the Tag ID is shorter missing the 9e and following zeros.
Interesting. I guess the obvious question should have been, does it work? The facility code and other data match… have you tried it?
Oh, another obvious question is whether or not the firmware and the client versions match? When you first start the client you should get a list of bootloader, firmware and client version. Can you post those?
It looks like your firmware/software might be out of date to me, so if nothing else works you may try moving to a newer build
I would also try a non-raw clone and see what happens, “lf hid clone -w p10001 --fc [Facility Code] --cn [Card Number]”
Yeah it can’t hurt to update the firmware and client… lots of bug fixes along the way
I did try the non raw clone but it doesn’t help the Tag ID unfortunately.
Ill give an update a go.
Have you tried copying to a different card / fob?
I have tried on multiple chips and it is always the same. It doesn’t seem to like the longer Tag ID.
It’s possible that your source tag is not an HID prox… What does the tag look like? Does it actually have HID embossed on the plastic?
Seems genuine as far as I can tell. Ill get some different HID tags over the next few weeks and see if there are any differences.
Hmm I’m kinda at a loss at this point. Out of curiosity, can you try a LF T5 detect command on the prob fob?
Im assuming its something not worth ripping off, but, Maybeeeeee 
Hopefully somebody here has access to a PM3 and HID card that they can send you a dump to try.
If you get no respose from anyone before I get to my Computer and Cards etc (~4 hours), I’ll send you one
First two runs are two of the T5577 chips I have been trying with and the third I tried the HID just to see.
My HID Prox looks different to yours
However I was able to write your data to a T5577 and got the same raw data
I’m assuming you have redacted some of your data , correct?
I can’t try to replicate it without it, but I would look to use an online calculator
It’s not something I do often, and have only played around with it, so I don’t know if this is a good one or not, but you could try:
Hmmmm interesting. Yes I did redact some data.
I’ll keep having a play around and see what I can figure out.
If you use LF HID WATCH does your clone have the same Tag ID as the original?
