I am trying to copy Pyramid FSK2 fob by using this code:
lf pyramid clone --fc 123 --cn 11223
But I can’t figure out how to get fc and cn digits?
(Side note: I was able to copy the fob by referring to clonewars’s comment: ANYTIME FITNESS Pyramid - Cloning Gym Fob to implant - #40 by clonewars)
The following command doesn’t work:
lf t5 det
lf search
auto
Any help is highly appreciated.
What do you mean? What is the output of lf search?
Sorry I don’t know coding that well; this the output:
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf t5 det
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> auto
[=] lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[=] hf search
[!] No known/supported 13.56 MHz tags found
[=] lf search - unknown
[=] --> trying ( 125.00 kHz )
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[=] --> trying ( 134.83 kHz )
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[=] --> trying ( 250.00 kHz )
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[=] --> trying ( 375.00 kHz )
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[=] --> trying ( 500.00 kHz )
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[=] Failed both LF / HF SEARCH,
[=] Trying `lf read` and save a trace for you
[#] LF Sampling config
[#] [q] divisor............. 95 ( 125.00 kHz )
[#] [b] bits per sample..... 8
[#] [d] decimation.......... 1
[#] [a] averaging........... yes
[#] [t] trigger threshold... 0
[#] [s] samples to skip..... 0
[#]
[+] saved 40000 bytes to PM3 file
Can you post the output when you first start the pm3 client? This will show your firmware version etc.
Also, please post a photo of the pyramid transponder on the proxmark3 when you are attempting to read it.
Firstly thank you so much for a quick response.
Here is the output for pm3
Pyramid (Anytime Fitness) transponder looks like this:
This is approximately where you should be placing your fob
EDIT
I’M A FUCKEN RETARD
this is for HF.
Nothing to see here! Move along!
Link to the very next post, so you dont see my stupidity right below this
Why are you reading this???
I told you to ignore it!!!
WHAT IS WRONG WITH YOU?
Why did you look at the picture I told you not to look at?
You’re one of those people that slow down to look at an accident aren’t you???
Well, now you have come this far, you can actually read the next bit, it is actually accurate
END OF EDIT
Also make sure you PM3 is not sitting on a conductive surface.
Isn’t that for hf?
I tried on both side on top as well as bottom but it’s still showing the same error as before.
Also it’s on conductive surface.
Ah shit, I’m a DICK
Sorry
Top side!!!
with a fob, “anywhere” should be OK, but try
lf tune
to find the largest voltage drop, that’ll be your sweet spot, but probably overkill for this.
???
Did you mean non conductive? (looks like wood)
The non conductive surface is still important
Apologies again
My bad it’s on non conductive surface, I missed type earlier.
I did try lf tune command and place it on the sweet spot but still getting the same error, I don’t think it’s the placement of fob on lf antenna, for some reason pm3 can’t recognize pyramid chip, or maybe I’m looking in the wrong command (ref. to lf search).
I’ve had issues with these purple fobs too, no advice sorry.
Are we sure they are LF? Could put an RDC up to the reader to check frequency. Anyone shine a light through the silicone looking encapsulation of that purple fob?
I’m certain it is lf tag because I was able to copy the fob to T5577 tag by using lf command mentioned here
Are we sure they are LF?
What is RDC?
Could put an RDC up to the reader to check frequency.
Fob is pretty opaque, I tired to put flash light behind the fob to check the chip but I can’t see anything.
Anyone shine a light through the silicone looking encapsulation of that purple fob?
It is a diagnostic card to differentiate between frequencies 
FYI
In the forum, blue text denotes a link you can follow.
RDC
Thanks for clarifying
Oh that’s right! I remember that post.
@Pilgrimsmaster We should probably move that piece of information into a FAQ or wiki or something. Really call it out as a pyramid/anytime fitness fob copy method.
@amal By anychance you know how to get the fc and cn in this scenario?
Not really. The demod data is not recognized format so it’s hard to tell. However if the fob has a code written on it and you posted that and the data then it might be possible to decide at least some of the raw data.
Sorry but my fob don’t have any code written on it.
Can you peel back the rubber a bit to see what’s under it? I don’t have one of these fobs so that might not be possible.
It’s a plastic fob, hard to get in.
