Jablotron card reading/writing basics

Support
#1

Hoping someone can help with my basic understanding as I am still learning how to correctly identify the correct source and destination card and then clone it to another tag.

I have a jablotron card where I have used the command: lf jablotron reader.
This returns Card: 78e08, RAW: FFFF000049511296, Printed: number which matches the text on the card.

If i try to run the command lf jablotron clone --cn 78e08 --em
The card ID is too short. I can’t see any other options with this command set to get the card number, any ideas?

I can also run this command which provides some additional info, but not sure if i should be using this instead of the jablotron specific command, and/or if this helps me at all as i don’t see the card number still. Running the lf em 4x05 chk command will find a valid password. Help would be appreciated, can i use these commands instead and just write to a new card?

[usb] pm3 → lf em 4x05 info
[=] — Tag Information ---------------------------
[+] Block0: 00040072
[+] Chip Type: 9 | EM4305
[+] Cap Type: 3 | 330pF
[+] Cust Code: 0x200 | Default
[+] Serial #: 34D0B099

[=] — Config Information ------------------------
[=] ConfigWord: 0001809F ( JABLOTRON / NEDAP 64 )
[=] Data Rate: 31 | RF/64
[=] Encoder: 2 | Biphase
[=] Delay: 0 | no delay
[=] LastWordR: 06 | Address of last word for default read - meaning 2 blocks are output
[=] ReadLogin: 0 | Read login is not required
[=] WriteLogin: 0 | Write login is not required
[=] Disable: 0 | Disable command is not accepted
[=] R.T.F.: 0 | Reader talk first is disabled
[=] Pigeon: 0 | Pigeon mode is disabled

[=] — Protection --------------------------------
[=] ProtectionWord: 0000FFFF (Word 15)
[=] Word: 00 | write Locked
[=] Word: 01 | write Locked
[=] Word: 02 | write Locked
[=] Word: 03 | write Locked
[=] Word: 04 | write Locked
[=] Word: 05 | write Locked
[=] Word: 06 | write Locked
[=] Word: 07 | write Locked
[=] Word: 08 | write Locked
[=] Word: 09 | write Locked
[=] Word: 10 | write Locked
[=] Word: 11 | write Locked
[=] Word: 12 | write Locked
[=] Word: 13 | write Locked
[=] Word: 14 | write Locked
[=] Word: 15 | write locked

[usb] pm3 → lf em 4x05 dump
[=] Found a EM4305 tag

[=] Addr | data | ascii |lck| info
[=] -----±---------±------±–±----
[=] 00 | 00040072 | …r | x | Info/User
[=] 01 | 34D0B099 | 4… | x | UID
[=] 02 | | | | Password write only
[=] 03 | 000049AC | …I. | x | User
[=] 04 | 0001809F | … | x | Config
[=] 05 | 0000FFFF | … | x | User
[=] 06 | 69488A92 | iH… | x | User
[=] 07 | 00000000 | … | x | User
[=] 08 | 00000000 | … | x | User
[=] 09 | 00000000 | … | x | User
[=] 10 | 00000000 | … | x | User
[=] 11 | 00000000 | … | x | User
[=] 12 | 00000000 | … | x | User
[=] 13 | 00000000 | … | x | User
[=] 14 | 00000000 | … | x | Lock
[=] 15 | 0000FFFF | … | x | Lock active

[+] saved to json file lf-4x05-34D0B099-dump-1.json
[+] saved 16 blocks to text file lf-4x05-34D0B099-dump-1.eml
[+] saved 64 bytes to binary file lf-4x05-34D0B099-dump-1.bin

#2

can you drop an lf search on the jablotron card plz

and are you writing to another em3405 you’ve bought specially for this? if you’re trying to clone to another jablotron it wont work they come write locked.

#3

ive managed to clone it using raws so if you wanna go down that route i can help ya with it

image
image1080×600 9.5 KB

just need to know if you have em4305/t5577s ready

#4

I am trying to clone to these fobs
10Pcs EM4305 125Khz Key Copy Rewritable Writable Rewrite EM ID T5577 keyfobs RFID Tag Ring Card Proximity Token Access Duplicate|writable rewrite|rfid tag125khz card - AliExpress

#5

Happy to clone using RAWs if that is going to work

#6

place em4305 on proxmark and run

lf em 4x05 write -a 4 -d 0001809F 
lf em 4x05 write -a 5 -d FFFF0000
lf em 4x05 write -a 6 -d 49511296

that’ll do it

1 Like
#7

So the line 6 is the number from the original card, but the numbers from the HEX output
Is this just a case of writing the HEX code directly to the sectors that match the original card

#8

that’s the config of Jablo cards period not just that one card and yes the rest is writing the raw weig

#9

Excellent, thanks for your help. Will give it a try and check it works

1 Like