LF of NExT Implant not reading after 3 Weeks, HF Works

As Jirvin said

but it is doable. And once you find the spot you will find it slightly easier to relay each time.

The above tells me you are doing the correct thing.
The next thing I would add is, maybe some more pressure.
Press down as you try to read (lf tune) see if you can get that voltage drop we are after.

I imagine you have from your description above, but watch this video for some more tips.(sorry if it’s sucking eggs)

This one from about the 5min mark

and this one all the way through

and just leave this one going in the background whilst you are trying to get your LF to read and bump up the DT video viewing time

This was something that I started recommending for those with an RDV4 and, from my experience, works better than the ProxLF. However, OP appears to have an Easy thus this isnt a viable option at present.

Image Showing Flipped Stock LF Antenna | RDV4

Another idea Ive had mixed success with is trying to locate the HF end of the NExT with hf tune then a read to confirm the positioning is correct. Once the HF side is found, the LF side is the opposite end of the implant so the idea would be to have the orientation of the implant in mind and try finding the LF side with lf tune again.

This may seem like a loosing battle but anytime I want to write to the LF side of my NExT, I spend ~5mins each time finding the right coupling, ensuring I can do it consistently (by reading) the issuing write operations.

Again, you can issue several commands in the one line by separating them with semicolons.
Example: lf search; lf search; lf search; lf search will issue 4 LF search commands back to back as each of the previous commands finish.

That’s really clever. Thank you for sharing that trick. I need to try that: the ProxLF antenna really isn’t much to write home about. At least mine isn’t.

1 Like

I imagine it would be unlikely that you missed it, but did you ever see this thread? ( You didn’t post in it !)

Which thread?

You’re so pedantic, wanting information and links I implied that I would provide :wink:

Geez, here you go


Thanks bubba. I was about to ask the same thing, but I figured I’d let someone confirm that I wasn’t the only one thoroughly confused by Pilgrim’s post first :slight_smile:

I don’t recall seeing it.

1 Like

Thanks for the Answer,

after trying maybe 20x lf search with pressure I found a spot I could get a read.

But it shows up as an “Indala Chip”. As I understand the T5577 can emulate/function as a Indala, but shouldn’t the xEM/T5577 Chip of the NeXT come preprogrammed as an EM410x ?

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] Checking for known tags…
[+] Indala (len 322) Raw: 80000000500220040000002088002040001420088912a28421000002
[+] Valid Indala ID found!
[=] Couldn’t identify a chipset

But it still cannot identify the T5577 chipset :frowning:

I got repeating Reads of the Indala ID, but as soon as I removed the Proxmark from my Hand to copy the Text, I was unable to get a read again (tried like 20x again around that position)

I have no clue what Indala is used for / how it works.

But I tried the following:
Took one of the, with the Proxmark included, T5577 cards that I had programmed as an EM410x (which functions perfectly). I programmed the Card with the following command:

[ usb ] pm3 —> lf indala clone -r 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5

[=] Preparing to clone Indala 224 bit to T55x7 raw 80000001B23523A6C2E31EBA3CBEE4AFB3C6AD1FCF649393928C14E5
[+] Blk | Data
[+] ----±-----------
[+] 00 | 000820E0
[+] 01 | 80000001
[+] 02 | B23523A6
[+] 03 | C2E31EBA
[+] 04 | 3CBEE4AF
[+] 05 | B3C6AD1F
[+] 06 | CF649393
[+] 07 | 928C14E5
[=] Block0 write detected, running detect to see if validation is possible
[+] Done
[?] Hint: try lf indala reader to verify

that’s the example Commands given by the Proxmark when typing lf indala clone

After writing I was unable to read the Card and saw the same error as with my Implant

[ usb ] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] Checking for known tags…
[-] No known 125/134 kHz tags found!
[=] Couldn’t identify a chipset

When doing a lf em 410x clone --id 0F0368568B right after I im able to read the Card again:

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] Checking for known tags…
[+] EM 410x ID 0F0368568B
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : F0C0166AD1
[=] HoneyWell IdentKey
[+] DEZ 8 : 06837899
[+] DEZ 10 : 0057169547
[+] DEZ 5.5 : 00872.22155
[+] DEZ 3.5A : 015.22155
[+] DEZ 3.5B : 003.22155
[+] DEZ 3.5C : 104.22155
[+] DEZ 14/IK2 : 00064481678987
[+] DEZ 15/IK3 : 001034014845649
[+] DEZ 20/ZK : 15001200010606101301
[+] Other : 22155_104_06837899
[+] Pattern Paxton : 259822731 [0xF7C948B]
[+] Pattern 1 : 9750181 [0x94C6A5]
[+] Pattern Sebury : 22155 104 6837899 [0x568B 0x68 0x68568B]
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands

But I am still unable to read my Implant again :frowning:

Also the lowest Voltage I can get with lf tune is 37800 mV (normal Voltage, with the Proxmark far away from any Metal is 38200 mV). Is that a normal Voltage Drop for the NexT LF Side?

Indala is a common false positive for LF searches. Id usually recommend to confirm that output by getting another 2 or 3 searches of the same card and ensure its the Indala ID it comes out as.

If this is a stock NExT, as in the LF side hasnt been written to before, out of the box it should read as an EM (I tried to fact check but couldnt find a source) tag so it reading as an Indala leads me to believe more that its a false positive.

I would be interested to see where and how your implant looks in your hand. My NExT in R0 is quite visible when I flex my fist and doing so dramatically increases my read success.



1 Like

Generally when we see unexpected results it is either:
Firmware mismatch ( Pretty sure yours looked good )


You are not Quuiittee in the right spot,

It sounds like you are a gnats cock away from the right spot, Frustrating I know, but when you finally get a read
Something like:

pm3 → lf search
Blah Blah Blah

Checking for known tags:

Valid EM41xx Chip Found
Try lf EM41xx commands

and can replicate it a few times, you are good to write! so have your script ready to cut and paste. ( Or Up arrow :arrow_up: if you have it in your command history.
The tricky thing comes, not moving AT ALL when trying to type etc. If you have an assistant that will help also.

It is more difficult / takes longer to write compared to a read.

Anyway, that all comes AFTER you get a read.

Keep us updated as to your progress and good luck.

1 Like

Ok, I will try again to find that reeeaalll small Spot where I can get a EM Read :slight_smile:

Another Question: Is that Voltage Drop normal?:

In the meanwhile, here are some Pictures of my hand (The Chip is directly under that black line):


Check this post, Amal will answer better than I could

It looks like a good shallow install and you really shouldn’t be struggling as much as you are,
It is unlikely a faulty implant, but Proxmarks can be finnicky when dealing with xSeries implants.
That’s what I think we are seeing…

Ok, so it’s now been four weeks since I got the NExT installed.

In the Last Days, I tried to read maybe 300 times, but cannot for the life of me get a successful LF read :frowning:

Only one false Cotag ID read:

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] Checking for known tags…
Searching for COTAG tag…
[+] Valid COTAG ID found!

I really don’t know what to do next. I’ve tried every position.

Voltage Drop seems to be normal, as Amal said in that linked Comment.

But It also looks like the Chip is alive given from the Voltage Drop (but that could also come from the ferrite Core, right?) And the false reads I have been getting.

Any ideas what to try?

It cannot be normal that the Chip is sooo difficult to read after 4 Weeks with such a good installation :frowning: If I cannot even get a read with the proxmarks big antenna & pressure against the Skin, how would I be able to use it in the Real World on readers, Door Knobs, etc.?

I know it’s not ideal but can you find someone with a Proxmark RDV4?

There will always be a voltage drop given the copper coil and the ferrite but this doesnt mean the chip is alive/healthy; just that something is pulling some voltage.

The challenge here is that the proxmark Easy is a cheap, mass produced clone of another device so the quality isnt amazing.
Its also very common, given those conditions, that the LF antenna isnt tuned anywhere near 125kHz but close enough that LF cards can be read reliably.
The LF antenna is also made to couple with flat antennae found in cards and fobs, not a round antenna that is present in an implant.
Since the LF antenna is most likely going to have bad tuning, you may be better with some distance between the implant and the antenna. This should, hopfully, offset the bad tuning of the LF antenna and allow it to couple with the implant antenna. Ive personally found I can get consistent reads with 1-3mm of distance/air between my skin and the proxmark antenna.

All of these factors combined is what you are working with and trying to overcome. I find it very difficult to read my NExT with my Easy, slightly less difficult with my RDV4 (using the flipped antenna) and even less difficult with some PACs readers.

Your implant looks shallow enough that there should be no inherent difficulty penetrating the skin and, since its been >=4 weeks post install, there should be no swelling/fluid build up to make things more difficult.

I actually tried to get some distance between the Antenna & Skin a couple of times. Didn’t help either.

Given what you guys said I am thinking of getting an RDV4.
Finding Someone in my Region who has one of those would be almost impossible given I live in a rural area. So buying would be the only reasonable option, and I also could use it for Pentesting and IT-related things.
Unfortunately, the price is a bit high for having a pm3 Easy and an RDV4.

I have to say I’m not really familiar with the RDV4. I think of it as the “complete” “high quality” proxmark3 package.
Are any good Docs or Videos like “Exploring the Proxmark3 RDV4” as Amal did for the PM3 Easy?

Living in Germany, i think the suggested Website for buying would be lab401.com?
So the Perfect setup for my Problem of Reading my Implant would be the RDV4 (Proxmark 3 RDV4.01 – Lab401) and the 125 kHz Antenna designed for Implants (ProxRF 125KHz Biochip Antenna – Lab401), right?

I have a couple of questions.

  1. can you read the HF side consistently? If you can then there are other options than an RDV4 that might work.

  2. do you have a use case for the LF side in particular? I am wondering because using a Proxmark3 would only be needed for some use cases.

If you can read the HF side consistently you might consider making a small ferrite coil for your Proxmark3 LF Antenna. There are several posts on the subject on here. People have had better luck reading with a homebrew antenna before.

The other option worth testing would be to get a larger reader and see if that is any better. I have a battery powered HID pad with an ESP-RFID-Tool which I use for some testing.

I can read/write the HF side without Problem using my Phone and the PM3 Easy.
I want to use the LF side for Access Control, Vehicle Start, etc.

Unfortunately, I have no bigger Reader than the Proxmark3 Easy.

For a custom Ferrite Core Antenna, I found this thread:

Before going through all that trouble of Optimizing and buying the parts I need for that project, I would consider just buying the pretested Version of the RDV4 and ProxLF antenna, they should (I hope at least) work definitely. :slight_smile:

From memory some people have found the proxlf doesn’t solve coupling problems, but it is up to you.

I spent about $45 making my HIDprox pad, and while it is a bit small to use as a huntpad (read range is about 6") it was an interesting experiment in some physical penetration techniques.

There are quite a few Germans on here, so it is possible that someone in your area could help. (As a Scot in the US I am well aware that In the US 100 years is a long time but in Europe 100 miles is a long distance.)