My chip don't work

[planstedt91]

      #31932 my chip dont work cant find it white pacman i have putt it in under skin and i cant find it whit my proxmark 3  my other nfc i cqn find butt not the new what do i do ??    

[philidelphiaChickens]

A few questions:

• What chip is this? NeXt, xEM, xNT, xSIID, something else?
• Did you install it yourself, or have someone professional install it?

[Az_F]

Judging from the photos it looks like the install is pretty recent. It’s common for chips to not be readable during 1-2 weeks after the installation due to the swelling even if it’s not visible externally.

[planstedt91]

I had no swelling it’s von 4/5 vecks

[planstedt91]

Xem yes a nurse install it

[planstedt91]

My other nfc I find after 2 days in my left hand 3/4 weak now and I still don’t find it

[amal]

• First, I would use the delay command;

How to add a delay to Proxmark3 commands for implantees

This will make it much easier to place the proxmark3 on your implant correctly before it will try to search.

• Second, please place the proxmark3 on your hand and take a photo and post the photo. We need to confirm how you are holding your proxmark3 to your implant.

[planstedt91]

I’ve tried and tried and can’t read the implant. I didn’t try delay, as my brother run the commands and I focus on trying to hold it right. I’ve got a reading on a keyfob now showed in the pictures and output. I also tried to clone the keyfob to the chip to “wake” it up, just a thought. Didn’t work.

This is some info of the device.

[=] Session log /home/pixitux/.proxmark3/logs/log_20230507.txt
[+] loaded from JSON file /home/pixitux/.proxmark3/preferences.json
[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC


  8888888b.  888b     d888  .d8888b.   
  888   Y88b 8888b   d8888 d88P  Y88b  
  888    888 88888b.d88888      .d88P  
  888   d88P 888Y88888P888     8888"  
  8888888P"  888 Y888P 888      "Y8b.  
  888        888  Y8P  888 888    888  
  888        888   "   888 Y88b  d88P 
  888        888       888  "Y8888P"    [ ☕ ]


  [ Proxmark3 RFID instrument ]

    MCU....... AT91SAM7S512 Rev A
    Memory.... 512 KB ( 60% used )

    Client.... Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:18
    Bootrom... Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:07 
    OS........ Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:16 
    Target.... PM3 GENERIC

[usb] pm3 --> hw ver

 [ Proxmark3 RFID instrument ]

 [ CLIENT ]
  Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:18 24e01a23a
  compiled with............. GCC 11.3.0
  platform.................. Linux / x86_64
  Readline support.......... present
  QT GUI support............ present
  native BT support......... present
  Python script support..... present
  Lua SWIG support.......... present
  Python SWIG support....... present

 [ PROXMARK3 ]
  firmware.................. PM3 GENERIC

 [ ARM ]
  bootrom: Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:07 24e01a23a
       os: Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:16 24e01a23a
  compiled with GCC 10.3.1 20210621 (release)

 [ FPGA ] 
  LF image 2s30vq100 2022-03-23 17:21:05
  HF image 2s30vq100 2022-03-23 17:21:16
  HF FeliCa image 2s30vq100 2022-03-23 17:21:27
  HF 15 image 2s30vq100 2022-03-23 17:21:38

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev A
  --= Embedded Processor: ARM7TDMI
  --= Internal SRAM size: 64K bytes
  --= Architecture identifier: AT91SAM7Sxx Series
  --= Embedded flash memory 512K bytes ( 60% used )

[usb] pm3 -->

And this if the keyfob I can read.

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
[+] EM 410x ID 0A004E65C3
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID      : 500072A6C3
[=] HoneyWell IdentKey
[+]     DEZ 8          : 05137859
[+]     DEZ 10         : 0005137859
[+]     DEZ 5.5        : 00078.26051
[+]     DEZ 3.5A       : 010.26051
[+]     DEZ 3.5B       : 000.26051
[+]     DEZ 3.5C       : 078.26051
[+]     DEZ 14/IK2     : 00042954810819
[+]     DEZ 15/IK3     : 000343604897475
[+]     DEZ 20/ZK      : 05000000070210061203
[=] 
[+] Other              : 26051_078_05137859
[+] Pattern Paxton     : 174236611 [0xA62A3C3]
[+] Pattern 1          : 9278247 [0x8D9327]
[+] Pattern Sebury     : 26051 78 5137859  [0x65C3 0x4E 0x4E65C3]
[+] VD / ID            : 010 / 0005137859
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[=] Couldn't identify a chipset

And some pictures.

[amal]

Are you making sure the red ring LF antenna is crossing perpendicularly over the implant and the implant is not sitting in the center of the LF antenna ring?

[planstedt91]

I’ve tried that also now. It reads the keyfob in the same place.

[planstedt91]

it’s not working

[amal]

Have you have a chance to try the lf tune approach to finding the best position for your proxmark? Basically you run lf tune with nothing on the proxmark. You will see a constantly updating voltage level. As you present your proxmark3 to your implant, the voltage will drop. Once you find the position and orientation that has the largest voltage drop, that is the place where you should try lf search

[planstedt91]

This is the lf tune. With keyfob it’s ok but not the chip.

[amal]

[planstedt91]

Thanks for the great video explanation. I see the reading now, But still nothing with lf search.
I share another video what I’ve tried now.

[amal]

Odd… that lf search seems to be finishing quite fast… what version of client and firmware are you running?

Ultimately though it looks like a good attempt regardless. The chip might just be borked. Let me know about the versions and we’ll go from there, but replacement may just be necessary

[planstedt91]

Isn’t this all info, that I shared earlier?

[=] Session log /home/pixitux/.proxmark3/logs/log_20230507.txt
[+] loaded from JSON file /home/pixitux/.proxmark3/preferences.json
[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC


  8888888b.  888b     d888  .d8888b.   
  888   Y88b 8888b   d8888 d88P  Y88b  
  888    888 88888b.d88888      .d88P  
  888   d88P 888Y88888P888     8888"  
  8888888P"  888 Y888P 888      "Y8b.  
  888        888  Y8P  888 888    888  
  888        888   "   888 Y88b  d88P 
  888        888       888  "Y8888P"    [ ☕ ]


  [ Proxmark3 RFID instrument ]

    MCU....... AT91SAM7S512 Rev A
    Memory.... 512 KB ( 60% used )

    Client.... Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:18
    Bootrom... Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:07 
    OS........ Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:16 
    Target.... PM3 GENERIC

[usb] pm3 --> hw ver

 [ Proxmark3 RFID instrument ]

 [ CLIENT ]
  Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:18 24e01a23a
  compiled with............. GCC 11.3.0
  platform.................. Linux / x86_64
  Readline support.......... present
  QT GUI support............ present
  native BT support......... present
  Python script support..... present
  Lua SWIG support.......... present
  Python SWIG support....... present

 [ PROXMARK3 ]
  firmware.................. PM3 GENERIC

 [ ARM ]
  bootrom: Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:07 24e01a23a
       os: Iceman/master/v4.16191-348-g149cc025c 2023-05-07 21:24:16 24e01a23a
  compiled with GCC 10.3.1 20210621 (release)

 [ FPGA ] 
  LF image 2s30vq100 2022-03-23 17:21:05
  HF image 2s30vq100 2022-03-23 17:21:16
  HF FeliCa image 2s30vq100 2022-03-23 17:21:27
  HF 15 image 2s30vq100 2022-03-23 17:21:38

 [ Hardware ]
  --= uC: AT91SAM7S512 Rev A
  --= Embedded Processor: ARM7TDMI
  --= Internal SRAM size: 64K bytes
  --= Architecture identifier: AT91SAM7Sxx Series
  --= Embedded flash memory 512K bytes ( 60% used )

[usb] pm3 -->

And the chip is 2x12mm bioglass encased 125kHz Atmel T5577

[amal]

Ah yeah so it’s not looking good. The only other thing I would try at this point is some of the special recovery commands for.tbr t5577;

Reviving a bricked T5577

The T5577 chip is a great wonder of the world. That said, it is sensitive. The chip’s memory is arranged in blocks, and block 0 is a critical block that holds configuration data for how the chip should behave, if a password is set or not, and other critical settings. It is vulnerable to tearing - the act of leaving writable memory corrupted if the write operation is interrupted or suffers from insufficient power available to complete properly. If you have a T5577 chip based product that appe…

[planstedt91]

I see. I’ve tried the commands from the bricked T5577 page 4 times over. In the best positions from lf tune and no luck I’m afraid.

[amal]

Hmm bummer. Ok if you reply to your order confirmation email it will create a ticket. Mention this forum thread and we’ll get you a replacement shipped out ASAP… Assuming that’s what you want to do. Otherwise we can offer you a full refund. Let me know how we can make this right.