Honeywell IK3 compatible Implantat

Hello all,

I am looking for an Implantat compatible to Honeywell IK3 fobs
I know the existing fobs are 125kHz and they seems to use rolling code procedure.

This is the reader:
https://www.security.honeywell.de/de/produkte/7299600/sicherheitstechnik/leser/accentic/ik3-leser/023320/
Seems there are no english datasheets available.
This should be helpful:
proX2 / IK3 mit Wechselcode (EM4102 und EM4150 Transponder)

Our Admin said he could learn the Impantat so I do not need to clone it.
Is there any reading device I should buy to read the fob to find out what is the right implantat?

While I cannot guarantee that a t5577 will work its probably your best bet. You would have to have it programmed with a valid prox id before you enrol it as its an emulation chip. I deffinatly recommend getting a couple of cards to play with first (like those KSEC SOLUTIONS sell in the uk/eu)

3 Likes

I forgot to mention, I also have a china RFID door lock at home.

It uses also 125kHz china fobs.

I tried to learn my Honeywell fob from the office but the reader cannot read it.

The very best solution would be a Implantat for both systems, at home and office.

If I can just get one of them, I would buy a Honeywell reader for at home….

What hardware for read/write should I buy to get started?

This card?

https://www.amazon.de/KSEC-T5577-125-kHz-NEXT/dp/B08C36VLKT/ref=sr_1_16?dchild=1&m=A3GBGDRQ62ZDGA&marketplaceID=A1PA6795UKMFR9&qid=1600242100&s=merchant-items&sr=1-16

If one tag won’t work with the other its unlikely 1 implant will do both. Yes there the cards I was referring to.

I received my t5577 card.
Our local admin tried to read it with thair hardware.
He can read by two ways, with the same reader
1 Console / Putty, it showes a 20 digit UID
2 company own tool to manage the fobs

Both, the t5577 and the Honeywell fob shows a 20 digits UID
The company tool showes a 7 digit number with the geniue fobs and with the t5577 it showes its UID only

This cannot been used to unlock doors etc., software shows a error message.

What can i try now?
Should i bus any 125kHz read/write Hardware?
Wich one?

I think it’s pretty safe to say you need a Proxmark to identify which chip your company tag is exactly, and probably to reprogram your T5577 to match it.

2 Likes

Yep what rosco said, depending on where you got the t5577 its likely to be programmed to emulate a em400x card

Can you take a photo of your Reader(s) at your work.

Just so we can confirm for you.

You have a couple of options, and depending on what you plan to do in the future.

A honeywell fob is capable of HID Prox, EM4102 and AWID.

If you are just after a quick solution
I would reccomend the DT Blue Cloner as it is capable of reading / writing all of those modes. There are other options out there, that you may find for cheaper, but they are a luck of the draw as some will visually look the same, but their internals could be something different.
:warning: if you use a blue cloner, you will then have a pin put on it, This won’t affect the functionality, but it will prevent you using other writers.

Other than that, it is a simple and cheap solution for you. $40

Your other option is a Proxmark, of which there are a couple of choices there also $50 - $300 one of which you will need at some stage IF you need deal with the blue cloner pin.

But first, take the reader photos so we have a better idea of what we are dealing with

Hi,

i got my Proxmark3 today.

Thats what I get with lf search

Found data at sample: 3590 - using clock: 64
Block 0: b44fd540
Parities Passed

Valid EM4x50 ID Found!

lf em 4x50read

Note: one block = 50 bits (32 data, 12 parity, 6 marker)

Block 0:
10110100 0 -> 0xb4
01001111 1 -> 0x4f
11010101 1 -> 0xd5
01000000 1 -> 0x40

01101110 0 -> 0x6e
Parity Passed
Found data at sample: 3590 - using clock: 64
Block 0: b44fd540
Parities Passed

the blue cloner cannot clone the Honeywell fob

Seems the Proxmark3 cannot do much with the Honeywell fobs
Really basic read / identify, no clone function.
Is there any implantat that can emulate the EM4x50 ?

you should still be able to do a dump and write the T5577 pages manually… in theory… never tried it.

How can I dump the EM4x50 ?

i’ve not done it before but my hunch is that the T5577 can easily be set up to emulate a honeywell chip, particularly the EM4x50 family… possibly the proxmark forums can shed some light?