How do i figure out what my LF code is

How do i figure out what my LF code is

If you have a NExT, xEM, or flexEM then the LF chip is configured as an EM4100 with a short ID by default. It can be reprogrammed easily to emulate many card types with any ID.

The easiest way to figure out the current ID would be to scan it with a Proxmark3 Easy. If you don’t have one of those it can be a bit more challenging. If you’re trying to enroll your card in the system at work or school or whatever, you can try scanning your LF tag on one of the readers and then ask one of the system administrators to check the swipe log. That will tell you the ID, and usually you can just activate it as your card directly from there.

1 Like

Get yourself one of them el-cheapo RFID keyboard wedges: if your xEM is stock, it should be configured as a EM4xxx, and the reader will type out the UID.

it is a NExT and i tried to scan it on a door and it did not show up in the system, What should i do?

How do you know it is LF?
Did you use your DT Diagnostic card?

Can you share a photo of your authorised card and a reader, and any logos that may be on them? we maybe able to help you, if you can provide us a little more info.

Pretty much, this is what I think might be happening, Your NExT has a T5577 chip in it, which is capable of emulating a few different modes, and when you recieve it from DT it is in the very common EM41xx mode, but if your system is HID, AWID, Indala, Proxcard etc, your system won’t recognise it…yet.

Depending on what system you are dealing with, will depend on what your next steps are.

For example, if your system uses HID or AWID a simple tool like DTs

This will allow you to copy your authorised card / fob and write to your NExT.
to/ from any of these chips
EM41xx/EM4200, HID ProxCard II, or AWID.

If it is using something different, we can then point you to some alternative options

Yes it is LF.
I used the DT card to test it.
it is a honeywell system.

Where did you get the idea that it uses EM tags? It could be anything.

i tried swiping my hand and it did not read anything and it did not pick anything up.

It sounds like the Honeywell system you’re using is not set up to read the default EM configuration on the LF side of your NExT. Can you share pictures of the card you want to replace with an implant and the readers themselves? We may be able to figure out the easiest way to clone.

1 Like

Ok so with LF tags like Honeywell and EM and HID etc. there are a couple different ways they can be incompatible with each other. The first is data encoding… how the ID data is actually reported by the tag to the reader. Those options include;

➤ Manchester 32 and 64 RF clocks per bit
➤ Biphase 32 and 64 RF clocks per bit
➤ PSK 16 RF clocks per bit (subcarrier RF/2)
➤ FSK2 50RF clocks per bit

The T5577 chip in the NExT can be set up to emulate different data coding schemes, but by default it comes programmed to operate like an EM4100 64bit chip, which is configured for Manchester data coding. Your Honeywell system may be wanting a PSK or biphase data coding… so same ID number, but different data coding.

Your best bet, I think, is to get a Proxmark3 so you can investigate exactly how your work badge is configured, and set up your T5577 chip to emulate it properly. Luckily for you, we now have proxmark3 Easy units on the store that are ready to go with the cool hip new Iceman/RRG firmware.


Cool and hip is not something I personally associate with firmware, but how can I argue, if it is Sold by DT and is Iceman loaded :ice_cube: that instantly makes it cool :sunglasses:

1 Like

Yeah, and while the PM firmware and client are definitely cool, they’re kind of 1970’s VT52 terminal sort of hip really…

1 Like