Jablotron card reading/writing basics

Hoping someone can help with my basic understanding as I am still learning how to correctly identify the correct source and destination card and then clone it to another tag.

I have a jablotron card where I have used the command: lf jablotron reader.
This returns Card: 78e08, RAW: FFFF000049511296, Printed: number which matches the text on the card.

If i try to run the command lf jablotron clone --cn 78e08 --em
The card ID is too short. I can’t see any other options with this command set to get the card number, any ideas?

I can also run this command which provides some additional info, but not sure if i should be using this instead of the jablotron specific command, and/or if this helps me at all as i don’t see the card number still. Running the lf em 4x05 chk command will find a valid password. Help would be appreciated, can i use these commands instead and just write to a new card?

[usb] pm3 → lf em 4x05 info
[=] — Tag Information ---------------------------
[+] Block0: 00040072
[+] Chip Type: 9 | EM4305
[+] Cap Type: 3 | 330pF
[+] Cust Code: 0x200 | Default
[+] Serial #: 34D0B099

[=] — Config Information ------------------------
[=] ConfigWord: 0001809F ( JABLOTRON / NEDAP 64 )
[=] Data Rate: 31 | RF/64
[=] Encoder: 2 | Biphase
[=] Delay: 0 | no delay
[=] LastWordR: 06 | Address of last word for default read - meaning 2 blocks are output
[=] ReadLogin: 0 | Read login is not required
[=] WriteLogin: 0 | Write login is not required
[=] Disable: 0 | Disable command is not accepted
[=] R.T.F.: 0 | Reader talk first is disabled
[=] Pigeon: 0 | Pigeon mode is disabled

[=] — Protection --------------------------------
[=] ProtectionWord: 0000FFFF (Word 15)
[=] Word: 00 | write Locked
[=] Word: 01 | write Locked
[=] Word: 02 | write Locked
[=] Word: 03 | write Locked
[=] Word: 04 | write Locked
[=] Word: 05 | write Locked
[=] Word: 06 | write Locked
[=] Word: 07 | write Locked
[=] Word: 08 | write Locked
[=] Word: 09 | write Locked
[=] Word: 10 | write Locked
[=] Word: 11 | write Locked
[=] Word: 12 | write Locked
[=] Word: 13 | write Locked
[=] Word: 14 | write Locked
[=] Word: 15 | write locked

[usb] pm3 → lf em 4x05 dump
[=] Found a EM4305 tag

[=] Addr | data | ascii |lck| info
[=] -----±---------±------±–±----
[=] 00 | 00040072 | …r | x | Info/User
[=] 01 | 34D0B099 | 4… | x | UID
[=] 02 | | | | Password write only
[=] 03 | 000049AC | …I. | x | User
[=] 04 | 0001809F | … | x | Config
[=] 05 | 0000FFFF | … | x | User
[=] 06 | 69488A92 | iH… | x | User
[=] 07 | 00000000 | … | x | User
[=] 08 | 00000000 | … | x | User
[=] 09 | 00000000 | … | x | User
[=] 10 | 00000000 | … | x | User
[=] 11 | 00000000 | … | x | User
[=] 12 | 00000000 | … | x | User
[=] 13 | 00000000 | … | x | User
[=] 14 | 00000000 | … | x | Lock
[=] 15 | 0000FFFF | … | x | Lock active

[+] saved to json file lf-4x05-34D0B099-dump-1.json
[+] saved 16 blocks to text file lf-4x05-34D0B099-dump-1.eml
[+] saved 64 bytes to binary file lf-4x05-34D0B099-dump-1.bin

can you drop an lf search on the jablotron card plz

and are you writing to another em3405 you’ve bought specially for this? if you’re trying to clone to another jablotron it wont work they come write locked.

ive managed to clone it using raws so if you wanna go down that route i can help ya with it

just need to know if you have em4305/t5577s ready

I am trying to clone to these fobs
10Pcs EM4305 125Khz Key Copy Rewritable Writable Rewrite EM ID T5577 keyfobs RFID Tag Ring Card Proximity Token Access Duplicate|writable rewrite|rfid tag125khz card - AliExpress

Happy to clone using RAWs if that is going to work

place em4305 on proxmark and run

lf em 4x05 write -a 4 -d 0001809F 
lf em 4x05 write -a 5 -d FFFF0000
lf em 4x05 write -a 6 -d 49511296

that’ll do it

1 Like

So the line 6 is the number from the original card, but the numbers from the HEX output
Is this just a case of writing the HEX code directly to the sectors that match the original card

that’s the config of Jablo cards period not just that one card and yes the rest is writing the raw weig

Excellent, thanks for your help. Will give it a try and check it works

1 Like

My cards have turned up and I did the steps as above and the card isn’t read on the reader. It will beep twice, but the access light will stay red and the door won’t open.
Possibly the cards i have are incorrect?

I used the lf Jablotron clone --cn HEX Card ID–em command to see if that helped, and that takes line 2 from the card, has the same issue.

Feel like posting screen shots of what you tried? I understand if you don’t want to post the IDs though

I used the commands that Equipter posted about, i also used the Jablotron specific command as above with the clone option which wrote IDs 2 4 and 5 ( if i recall).

Oh sorry I didn’t read haha. The devil is always in the details… something isn’t adding up here and the best way to figure it out is to be extremely verbose and walk through all testing and actions step by step.

  • Scan of source card
  • Scan of target fob before writing
  • Confirm target fob chip type
  • Attempt write to target
  • Scan target after write (confirmation)

Take screenshots of all these steps and post.

Scan of source card ( lf search )
image

Scan of target fob before writing ( lf search )

Confirm target fob chip type ( lf t5 detect )
image

Attempt write to target ( lf jablontron clone --cn 34D0B099 )
image

Scan target after write ( lf search )
image

When using the card on the reader using the above commands, i don’t get any ACK from the reader.
Using the original commands for the 4x05 as above, i get a denied beep and a red light.

ok thanks for the screenshots, but please edit your post to put titles and chronology together for your screenshots. think back to school when you had to write a report… make it clean and easy to read for the people trying to help you.

  • Scan of source card (lf search)
  • Scan of target fob before writing (lf search)
  • Confirm target fob chip type (lf t5 detect)
  • Attempt write to target (lf jablontron clone --cn 34D0B099)
  • Scan target after write (lf search)

Take the above bulletpoints and put the appropriate screenshots under each of them. That will make it very clear the order of things and what’s happening… and importantly it will be clear if you are missing any information… which i kinda think you might be.

Ultimately I think the target fobs/chips you got are T5577 but the instructions above are for writing to EM4x05 … which is a different chip… but really the primary concern is that the fobs you got are not actually writable at all… the url you gave for where you bought them seems to indicate they are T5577 but your screenshots indicate they might not be… that or the screenshots are out of order and confusing me.

I reordered the previous post to make it a bit clearer. It does feel like the details either aren’t being written correctly, or i am missing something.

Ok great! Now all we need to do is figure out why the correct ID is not being written. I can’t do that now because I’m mobile at the moment… but I’ll check it out later if nobody else can pop in on this before then.

Hey psycosis, how did this ever turn out? I have a similiar isssue with EM4305 chipsets I need to clone but I only have T5577 cards/fobs. I think I need cards/fobs with the EM4305 chipset.

I ended up shelving it as I had some other stuff on and haven’t revisited it. Never figured out what was up with it, or as you said, I just need different cards.