LUA script for Proxmark3

Support
1

Can someone help me make a script in lua that will execute the following instructions for proxmark3???

lf search

] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x Short ID found on a 128b frame
[+]     Data after ID: 7C700000000
[+]     Possibly an Electra (RO), 0x7C7 = 1991
[+]     Short ID details:
[+] EM 410x ID 03E8A955A1
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID      : C01795AA85
[=] HoneyWell IdentKey
[+]     DEZ 8          : 11097505
[+]     DEZ 10         : 3903411617
[+]     DEZ 5.5        : 59561.21921
[+]     DEZ 3.5A       : 003.21921
[+]     DEZ 3.5B       : 232.21921
[+]     DEZ 3.5C       : 169.21921
[+]     DEZ 14/IK2     : 00016788313505
[+]     DEZ 15/IK3     : 000825029405317
[+]     DEZ 20/ZK      : 12000107090510100805
[=]
[+] Other              : 21921_169_11097505
[+] Pattern Paxton     : 62755745 [0x3BD93A1]
[+] Pattern 1          : 3590663 [0x36CA07]
[+] Pattern Sebury     : 21921 41 2708897  [0x55A1 0x29 0x2955A1]
[+] VD / ID            : 003 / 3903411617
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[=] Couldn't identify a chipset

Read EM ID 410x ID 03E8A955A1 and next command:
lf em 410x clone --id 03E8A955A1
and next command :
lf t55xx write -b 0 -d 00148080
lf t55xx write -b 3 -d 7E1EAAAA
lf t55xx write -b 4 -d AAAAAAAA

or possibly lua with the command: read ID e.g.: 03E8A955A1, so it looks like this (electra.lua):
script run electra 03E8A955A1
and the script executes the command:
lf em 410x clone --id 03E8A955A1
and then overwrites blocks 0, 3, 4 with constant values:
lf t55xx write -b 0 -d 00148080
lf t55xx write -b 3 -d 7E1EAAAA
lf t55xx write -b 4 -d AAAAAAAAA

ICEMAN, unfortunately, does not want to help.
This is the new ELECTRA fob and requires these three blocks to work properly

2

Why a script? Are you planning on cloning a boatload of Electra fobs?

3

Old ELECTRAs work with proxmark3… Unfortunately, the new ones don’t. For the T5577 copy to work, you need to add two blocks and change the content of block 0.

The copy is tested and opens the door. Normal EM4102 copy procedure: lf em 410x clone --id… The copy does not open the door. The topic was discussed on the flipper zero forum. This is a simple script…I’ll master it myself…I was hoping someone with knowledge would master it in 5 minutes…well…for me it’s not a problem…especially since i have TMD-5s duplicator much better than proxmark3. I just reported a bug with the new ELECTRA fob. Scripts shorten the number of executed commands. I made a simple script myself. Three command lines.

lf search
lf em 410x clone --id.........
script run electra

The script writes to T55 three blocks - 0, 3, 4. A copy ELECTRA fob made in this way works and opens the door. But I would like one less command line.

1 Like
4

Ahh I see… makes sense

5

lf search
lf em 410x clone --id.........
script run electra

Don’t search for the fob, Just HOPE its lined up :rofl:

You’re welcome

5 Likes
6

Very funny. I have a rule. If I can, I help, if not, I don’t post to boost my account. If you don’t want to help, don’t comment. I don’t know why some people find it fun to make mean posts.
You’re welcome

7

I don’t think Pilgrim needs to post in order to boost his account. He’s plugged into the mainframe, if there was a day that someone came close to his stats, he could adjust the numbers in the database if he wanted to :stuck_out_tongue:

2 Likes
8

I’ll say it again. My rule is simple. I’m helping, I don’t comment.

You can close the topic - I made a script

9

Wouldn’t it be helpful for you to share your script for the next person?

4 Likes
10

giphy (4)

4 Likes
15

electra.zip (1.8 KB)
v1.1.2

I’ll make an automatic script: script run electra clone plus the option to continue from the last id and enter the EM id…just cosmetic at the moment.

5 Likes
16

1.1.5 - fix errors
electra.zip (1.9 KB)

2 Likes
17

v.1.1.9 Description fix
[electra.zip|atta
electra.zip (2.4 KB)

Only one command: script run electra -e (Fixed option -e)

1 (2)
1 (2)902Ă—600 7.27 KB

2 (2)
2 (2)902Ă—600 10.8 KB

3 (2)
3 (2)902Ă—600 9.21 KB

3 Likes
18

v.1.1.10
I added cloning of the regular EM410x in the options plus graphical changes.

electra.zip (2.6 KB)

2 Likes
19

You know what would be cool… a script for cloning multiple EM IDs into “slots” based on carved up memory;

This is a cool hack but doing it is a pain. Would be awesome if you could make a script where you define memory block targets based on “slots” for 40 but IDs to clone into… so slot 1 would be the first ID, slot 2 the second etc.

2 Likes
20

Little changes v.1.1.13

electra.zip (2.6 KB)

21

Explain it to me based on: lf t 55 dump. Do you want to save the EM4102 ID in individual blocks from 1 to 7?

22

Something like this

[+] Page 0
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[+] 00 | 00148040 | 00000000000101001000000001000000 | …@
[+] 01 | FFA98F8C | 11111111101010011000111110001100 | …
[+] 02 | A2F6293A | 10100010111101100010100100111010 | …):
[+] 03 | FFA98F8C | 11111111101010011000111110001100 | …
[+] 04 | A2F6293A | 10100010111101100010100100111010 | …):
[+] 05 | FFA98F8C | 11111111101010011000111110001100 | …
[+] 06 | A2F6293A | 10100010111101100010100100111010 | …):
[+] 07 | 00000000 | 00000000000000000000000000000000 | …
block0---- em4102
1-2 ID
3-4 ID
5-6 ID
???

23

Cool stuff @Jeybee btw if you like, you can open a PR to iceman repo and add the script there. Therefore the whole community can benefit from your time investment.

25

I can do it, but I do not want to take credit for your work. If you like I can show you how this is done(the whole versioning control mumbo jumbo). it’s not a quantum mechanics at all. I will pm you later in the day when I am done with my work related stuff.
p.s. I am not a native english speaker :slight_smile:

1 Like