IO Prox to T5577

Support
#1

Hi Everyone,

I am trying to copy data from my IO Prox to a T5577 implant. Here is what I have done so far:

[usb] pm3 → lf io reader
[+] IO Prox - XSF(01)8a:48462, Raw: 007862a03bda75e7 ( ok )

[usb] pm3 → lf io clone --vn 1 --fc 8 --cn 48462 --q5
[+] IO raw bits:
[+] 0000000001111000010000100010000000111011110110100111011111101111

[=] Preparing to clone ioProx to Q5/T5555 with Version: 1 FC: 8 (0x08) CN: 48462
[+] Blk | Data
[+] ----±-----------
[+] 00 | 6001F0D4
[+] 01 | 00784220
[+] 02 | 3BDA77EF
[=] Block0 write detected, running detect to see if validation is possible
[+] Done
[?] Hint: try lf io reader to verify

The FC shows 8a. It would not accept that in the pm3 programming software so I just put in “8”. Does anyone know why it would show 8a? is this going to work with just the “8”?

#2

8a is the representation is hexidecimal

I would assume the PM3 wants it in decimal when passed as a flag, 8a in decimal is 138. I would assume that’s the facility code (they’re always from 0-255) that the PM3 wants.

(I’m not the most knowledgeable on ioprox card cloning, I’m fairly certain that’s right, but if I’m wrong, someone please feel free to correct me).

#3

Hey thanks for this. I tried the 138 in there without success. The reader just remained red and didnt react at all.

#4

I was very wrong haha.

Satur9 wrote an awesome comment here:

Hope that gives you everything you need.

1 Like
#5

The command syntax has been changed since that post

1 Like
#6

Of course it has…

I love Iceman and everyone who contributes, but it is absolutely impossible to rely on any syntax in the entire project…

Thanks for noting that, hopefully they can still figure it out, think you still had some good info there.

#7

Yes I noticed that. I used the following:

[usb] pm3 → lf t55xx write -b 0 -d 00147040
[=] Writing page 0 block: 00 data: 0x00147040
[usb] pm3 →

[usb] pm3 → lf io clone 007862a03bda75e7
lf io clone: unexpected argument “007862a03bda75e7”
[!] :warning: Try ‘lf io clone --help’ for more information.

It appears that you cannot use the raw data to program and have to do it with the FC and CN:

[usb] pm3 → lf io clone --vn 1 --fc 138 --cn 48462 --q5
[+] IO raw bits:
[+] 0000000001111000011000101010000000111011110110100111010111100111

[=] Preparing to clone ioProx to Q5/T5555 with Version: 1 FC: 138 (0x8a) CN: 48462
[+] Blk | Data
[+] ----±-----------
[+] 00 | 6001F0D4
[+] 01 | 007862A0
[+] 02 | 3BDA75E7
[=] Block0 write detected, running detect to see if validation is possible
[+] Done
[?] Hint: try lf io reader to verify
[usb] pm3 →

I try and use the lf io reader and it does not function. it is not showing up as a IO card when I go to auto scan it

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] Indala (len 134) Raw: 80000000000000000000000000000000000800000000000000000000

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset

I think I am on the right track but cant figure this out.

1 Like
#8

agree… but… for the most part he is driving toward consistency across all commands, which I approve :slight_smile:

1 Like
#9

we got it fixed over on discord, a few write to block commands and it’s nicely cloned :slight_smile:

1 Like
#10

Hey thanks! ill just post the solution on here for everyone, thanks to all that helped!

lf t55 wipe

lf t55 write -b 0 -d 00147040
lf t55 write -b 1 -d 007862a0
lf t55 write -b 2 -d 3bda75e7

Thats it. Working on a T5577

3 Likes
#11

nice solve, dude!

Can you tell me what those values correspond to?

#12

block 0 is the configuration that says it’s ioprox

the next 2 blocks are the raw wiegand which would be individual to the card

#13

If anyone is struggling with this, here’s how I figured it out:
With your chip OFF of the reader, run this on open air:
lf io clone --vn <version number --fc <facility number, convert hexidecimal to decimal here> --cn <card number>
This will spit out something like

[=] Preparing to clone ioProx to Q5/T5555 with Version: 1 FC: 8 (0x08) CN: 48462
[+] Blk | Data
[+] ----±-----------
[+] 00 |  6001F0D4
[+] 01 |  00784220
[+] 02 |  3BDA77EF

Great. Now use the t55 write commands re: @hogan029

lf t55 wipe

lf t55 write -b 0 -d 00147040
lf t55 write -b 1 -d 00784220
lf t55 write -b 2 -d 3BDA77EF
1 Like