Magic Ring LF unwrittable stuck to Indala ID

I’ve received a magic ring a couple of days ago and tried to add credentials to both sides. Mifare went without too much hassle but when trying

“lf paradox -r […]” nothing happened

lf search returns

Indala

[+] Indala (len 167) Raw: 8000000000000000000000000000000058190a00500000000000000b

Which I thought was weird but figured it just needed t55xx wiped and should be good. There starts my slow descent into madness of a subject I don’t really understand… Wipe seems to add just a bunch of scrambled data on all blocks? lf write -b 0 -d 00088040 -t doesn’t seem to actually write anything.

Tried to

HW tune

[=] ---------- LF Antenna ----------
[+] LF antenna: 36.84 V - 125.00 kHz
[+] LF antenna: 26.34 V - 134.83 kHz
[+] LF optimal: 36.64 V - 123.71 kHz
[+] Approx. Q factor (): 5.5 by frequency bandwidth measurement
[+] Approx. Q factor (
): 6.4 by peak voltage measurement
[+] LF antenna is OK

Seems fine to my rookie eyes

Tried

LF detect

[=] Chip type… T55x7
[=] Modulation… PSK1
[=] Bit rate… 1 - RF/16
[=] Inverted… Yes
[=] Offset… 30
[=] Seq. terminator… No
[=] Block0… 80061FFF (auto detect)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

Which I’m not sure where to begin with.
And here’s an example of dump after a wipe

lf wipe/dump

[usb] pm3 → lf t55xx wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0

[=] Begin wiping…
[=] Writing page 0 block: 00 data: 0x000880E0
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 → lf t55xx dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[+] 00 | 030FFFFF | 00000011000011111111111111111111 | …
[+] 01 | 061FFFFF | 00000110000111111111111111111111 | …
[+] 02 | 0061FFFF | 00000000011000011111111111111111 | .a…
[+] 03 | 061FFFFF | 00000110000111111111111111111111 | …
[+] 04 | 0187FFFF | 00000001100001111111111111111111 | …
[+] 06 | 030FFFFF | 00000011000011111111111111111111 | …
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[+] 00 | 0061FFFF | 00000000011000011111111111111111 | .a…
[+] 01 | 0187FFFF | 00000001100001111111111111111111 | …
[+] 02 | 0187FFFF | 00000001100001111111111111111111 | …
[+] 03 | 00C3FFFF | 00000000110000111111111111111111 | …

Maybe I’m just a bit lost but help would be appreciated

Indala is often a false read.

What type of tag are you trying to clone?

Do you have the ring positioned across the LF antenna, in the correct orientation? Try rotating it 90°.

Figured but I’m absolutely unable to get another read from the ring.

I’d say a paradox c704, that one reads fine

Yeah tried every side of the antenna, middle, rotating the ring on it’s side, facing one way no go always return search as indala

Try looking at this:

can you show a picture of how the ring is placed on the proxmark3? in short the dot should be facing down overtop the red ring.

with that positioning, try first cloning it into EM mode with lf em 410x clone --id 0102030405 and run that a few times… then lf search it.

Tried that with the random garbled password lf t5 chk returns.

Trying with password

[usb] pm3 → lf t5 write -b 0 -d 000880E0 -p 000D8787 -t
[=] Writing page 0 block: 00 data: 0x000880E0 pwd: 0x000D8787
[#] Using Test Mode
[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[=] Odd size, false positive?
[+] Indala (len 168) Raw: 8000000000000000000000000000000058190a00280160642800a200

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset
[usb] pm3 → lf t5 wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0

[=] Begin wiping…
[=] Writing page 0 block: 00 data: 0x000880E0
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 → lf t5 trace
[-] The modulation is most likely wrong since the ACL is not 0xE0.

*f em 410x clone --id 0102030405*

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[=] Odd size, false positive?
[+] Indala (len 168) Raw: 8000000000000000000000000000000058190a002800000000160642

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset
[usb] pm3 → lf em 410x clone --id 0102030405
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0102030405 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8060280c048142

[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf em 410x clone --id 0102030405
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0102030405 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8060280c048142

[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf em 410x clone --id 0102030405
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0102030405 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8060280c048142

[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf em 410x clone --id 0102030405
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0102030405 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8060280c048142

[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf em 410x clone --id 0102030405
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0102030405 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8060280c048142

[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf em 410x clone --id 0102030405
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0102030405 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8060280c048142

[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[=] Odd size, false positive?
[+] Indala (len 168) Raw: 8000000000000000000000000000000058190a00280b032140051000

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset

No go :confused:

Do you have a low frequency antenna? Have you set the switches appropriately? All I see in that picture is a high frequency antenna.

From other photos I found it looks like there are tuning switches on the underside. How are they set? (Can you see where the actual coil is in that antenna pack?)

1 Like

Yeah, Thats the RDV4 antenna layout, he has it sitting on it over the LF antenna trace

Correct, on the newer Versions, there is a Q switch, you can toggle between 125 and 134kHZ, also 2 options, that would be worth trying
7 for accuracy and 14 for range

haha,
OR
paste a picture, fir simple people like myself

image

Yep
Switches are set to f125, and q7

Have you tried q14?

Yeah same result but it seems way finickier to get a read, with q14 the ring goes between not finding a LF tag and getting indala without moving it

Sounds a lot like this post:

No go as well, starting to think the LF on the ring is just busted