IO Prox to T5577

[hogan029]

Hi Everyone,

I am trying to copy data from my IO Prox to a T5577 implant. Here is what I have done so far:

[usb] pm3 → lf io reader
[+] IO Prox - XSF(01)8a:48462, Raw: 007862a03bda75e7 ( ok )

[usb] pm3 → lf io clone --vn 1 --fc 8 --cn 48462 --q5
[+] IO raw bits:
[+] 0000000001111000010000100010000000111011110110100111011111101111

[=] Preparing to clone ioProx to Q5/T5555 with Version: 1 FC: 8 (0x08) CN: 48462
[+] Blk | Data
[+] ----±-----------
[+] 00 | 6001F0D4
[+] 01 | 00784220
[+] 02 | 3BDA77EF
[=] Block0 write detected, running detect to see if validation is possible
[+] Done
[?] Hint: try lf io reader to verify

The FC shows 8a. It would not accept that in the pm3 programming software so I just put in “8”. Does anyone know why it would show 8a? is this going to work with just the “8”?

[darthdomo]

8a is the representation is hexidecimal

I would assume the PM3 wants it in decimal when passed as a flag, 8a in decimal is 138. I would assume that’s the facility code (they’re always from 0-255) that the PM3 wants.

(I’m not the most knowledgeable on ioprox card cloning, I’m fairly certain that’s right, but if I’m wrong, someone please feel free to correct me).

[hogan029]

Hey thanks for this. I tried the 138 in there without success. The reader just remained red and didnt react at all.

[darthdomo]

I was very wrong haha.

Satur9 wrote an awesome comment here:

Cloning a Kantech ioProx?

Alright, my blank t5577 cards arrived (same chip as the xEM and NExT). I was able to clone a Kantech ioProx card to a t5577 card with minimal difficulty. I have not been able to write the same information to my NExT with my original proxmark3 using the stock antenna. If I am able to roll my own cylindrical antenna, I’ll come back and update this thread. Here is the rundown of how to perform the operation using the base repo found on this page: Install and configure proxmark3 software/drivers …

Hope that gives you everything you need.

[Satur9]

The command syntax has been changed since that post

[darthdomo]

Of course it has…

I love Iceman and everyone who contributes, but it is absolutely impossible to rely on any syntax in the entire project…

Thanks for noting that, hopefully they can still figure it out, think you still had some good info there.

[hogan029]

Yes I noticed that. I used the following:

[usb] pm3 → lf t55xx write -b 0 -d 00147040
[=] Writing page 0 block: 00 data: 0x00147040
[usb] pm3 →

[usb] pm3 → lf io clone 007862a03bda75e7
lf io clone: unexpected argument “007862a03bda75e7”
[!] Try ‘lf io clone --help’ for more information.

It appears that you cannot use the raw data to program and have to do it with the FC and CN:

[usb] pm3 → lf io clone --vn 1 --fc 138 --cn 48462 --q5
[+] IO raw bits:
[+] 0000000001111000011000101010000000111011110110100111010111100111

[=] Preparing to clone ioProx to Q5/T5555 with Version: 1 FC: 138 (0x8a) CN: 48462
[+] Blk | Data
[+] ----±-----------
[+] 00 | 6001F0D4
[+] 01 | 007862A0
[+] 02 | 3BDA75E7
[=] Block0 write detected, running detect to see if validation is possible
[+] Done
[?] Hint: try lf io reader to verify
[usb] pm3 →

I try and use the lf io reader and it does not function. it is not showing up as a IO card when I go to auto scan it

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] Indala (len 134) Raw: 80000000000000000000000000000000000800000000000000000000

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset

I think I am on the right track but cant figure this out.

[amal]

@darthdomo

I love Iceman and everyone who contributes, but it is absolutely impossible to rely on any syntax in the entire project…

agree… but… for the most part he is driving toward consistency across all commands, which I approve

[Equipter]

we got it fixed over on discord, a few write to block commands and it’s nicely cloned

[hogan029]

Hey thanks! ill just post the solution on here for everyone, thanks to all that helped!

lf t55 wipe

lf t55 write -b 0 -d 00147040
lf t55 write -b 1 -d 007862a0
lf t55 write -b 2 -d 3bda75e7

Thats it. Working on a T5577

[neintynein]

nice solve, dude!

Can you tell me what those values correspond to?

[Equipter]

block 0 is the configuration that says it’s ioprox

the next 2 blocks are the raw wiegand which would be individual to the card

[neintynein]

If anyone is struggling with this, here’s how I figured it out:
With your chip OFF of the reader, run this on open air:
lf io clone --vn <version number --fc <facility number, convert hexidecimal to decimal here> --cn <card number>
This will spit out something like

[=] Preparing to clone ioProx to Q5/T5555 with Version: 1 FC: 8 (0x08) CN: 48462
[+] Blk | Data
[+] ----±-----------
[+] 00 |  6001F0D4
[+] 01 |  00784220
[+] 02 |  3BDA77EF

Great. Now use the t55 write commands re: @hogan029

lf t55 wipe

lf t55 write -b 0 -d 00147040
lf t55 write -b 1 -d 00784220
lf t55 write -b 2 -d 3BDA77EF

[srk998]

How do you verify that the data is written to the blocks?

I’ve tried

lf t55xx read -b 0

to read the data that I just wrote into block 0, but it’s not showing.
are written, but how do I verify it?

[Equipter]

block 0 of T5577s holds the config block, what data does it give you

[srk998]

So, reading the ioProx tag gave me:
IO Prox - XSF(01)5f:46911, Raw: 007857e03b79fee7 ( ok )

Which translates to the command:
lf io clone --vn 1 --fc 95 --cn 46911 --q5

[usb] pm3 → lf io clone --vn 1 --fc 95 --cn 46911 --q5
[+] IO raw bits:
[+] 0000000001111000010101111110000000111011011110011111111011100111

[=] Preparing to clone ioProx to Q5/T5555 with Version: 1 FC: 95 (0x5f) CN: 46911
[+] Blk | Data
[+] ----±-----------
[+] 00 | 6001F0D4
[+] 01 | 007857E0
[+] 02 | 3B79FEE7
[=] Block0 write detected, running detect to see if validation is possible
[+] Done
[?] Hint: try lf io reader to verify

Then I ran the following commands:
lf t55xx wipe
lf t55xx write -b 0 -d 6001F0D4
lf t55xx write -b 1 -d 007857E0
lf t55xx write -b 2 -d 3B79FEE7

Outputs:
[usb] pm3 → lf t55xx wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0

[=] Begin wiping…
[=] Writing page 0 block: 00 data: 0x000880E0
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 →

[usb] pm3 → lf t55xx write -b 0 -d 6001F0D4
[=] Writing page 0 block: 00 data: 0x6001F0D4
[usb] pm3 → lf t55xx write -b 1 -d 007857E0
[=] Writing page 0 block: 01 data: 0x007857E0
[usb] pm3 → lf t55xx write -b 2 -d 3B79FEE7
[=] Writing page 0 block: 02 data: 0x3B79FEE7
[usb] pm3 →

Now I am trying to read block 0:
[usb] pm3 → lf t55xx read -b 0
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[usb] pm3 →

This is where I am stumbling. Each of the blocks I just wrote to shows the same output. How do I verify that I did in fact clone the ioProx card?

[Equipter]

why are you attaching the q5 tag??

[srk998]

Good catch
–q5 is for Q5/T5555 only. Retrying the process without the q5 flag. Will report back shortly.

Update:

Omitting the q5 flag gave new values for the three blocks. I wrote them to the first three blocks. Still not sure how to verify that they were written and my ring will work. (thought my t5577 card was the issue, so started using the smart ring with t5577 chip).

[Equipter]

try lf search it should now show up ioprox

[srk998]

In theory, once I write those values to those blocks of the T5577, it should show up as ioprox when passing the command lf search, right?

Update:
Tried it. Doesn’t work. Both with the T5577 card and ring.

Output…

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands
[usb] pm3 →