Good call!
I hope your move and new job goes well.
1 Like
Okay so I got my Proxmark3 in the mail today (ended up ordering one before moving, since France is closer). Conveniently, it came with a T5577 test card.
It successfully identified my company-issued tag as a 224-bit Indala tag. So I tried to clone it, but I did it in steps, to try and figure out the pitfalls when the time comes to do it on a chip implanted in my hand:
1/ I took a dozen readings and compared the UIDs, to make sure I got a solid read from the original tag. No problem there.
2/ I issued the clone command, but without the test card on the Proxmark. The Proxmark proceeded and told me it was all done. Uh oh… That means it blasts the programming commands without any checks whatsoever, meaning trouble if the coupling isn’t good enough. Not good…
3/ I placed the test card on the Proxmark, as well positioned as possible and redid the clone command. Then I re-read it several times and compared the UID against the original UID: half of it was corrupted, despite the test card having a full-size coil and being located perfectly over the antenna. Uh oh… The trouble I expected happened rightaway with an easy-to-read card. This really doesn’t bode well for operation with an implant.
4/ I redid the clone command once more, and this time the UID matched.
So, when I return to my new workplace, I’ll see if the (now properly cloned) test card opens the door. If it does, then I’ll order a xEM and a DT coupling coil. I think that’ll be a must. In the meantime, I’ll try to figure out if I can get the Proxmark to report the quality of the coupling in real time, so I can locate the implant as best I can before the final cloning operation. I may also encase the DT coil in a plaster cast of my hand so it stays put at the ideal location even if I move around. I can see this has the potential to end up in a bricked chip very easily…
Did you first do a “hw tune”, unlikely that is your issue, but lets “do this in steps”
run hw tune and post your results so some of the 
can have a look at it
You definitely sound like you are on track,
I would suggest / agree with most of your ideas
Test your cloned card
Order a @TomHarkness DT LF antenna, it just couples sooo much better because it is designed to do so.
THIS might be a bit extreme, defnately try the TH/DT PM3 RDV4 LF antenna first before a CaSO4.1/2H2O.
Did you first do a “hw tune”, unlikely that is your issue, but lets “do this in steps”
run hw tune and post your results so some of the
I did. Here’s the graph. Not sure what I’m looking at to be honest: the scales don’t mean anything to me. But I assume it self-calibrates or something.
THIS might be a bit extreme
Plaster rolls are cheap, and making a small cast is easier and less annoying that bricking a chip you got implanted inside you because you couldn’t be assed to ensure everything was setup as well as can be 
Order placed. I’ll probably implant the xEM even if the test card doesn’t work, just because I want one
1 Like
Hmm, things are more complicated than expected.
So I arrived in Finland today, and the first thing I did was swing by the office to get a couple of things I had left there. Trouble is, my “official” Indala badge didn’t work, and neither did the clone I did on the T5577 test card that came with the Proxmark3.
So one of two things have happened:
1/ Somehow the readers outside are deactivated on Saturdays. My boss says he’s a 100% sure they aren’t though.
2/ The mere act of reading an Indala card increments a counter or moves along a list of OTPs, and now my badge is out of sync with the readers at the office because I read it with my Proxmark.
Anybody knows if #2 is a thing in the HID Indala system? Because if it is, I think I can shelve my idea of implanting a clone of the badge…
I got issued a new tag. They told me the old one was broken because it didn’t register on their reader. Only I know it’s not true because I could read it just fine on the Proxmark only yesterday.
All I did on the old badge was a lf search then a bunch of lf indala read. My guess is lf search put it in a funky state somehow - and the funky state got cloned into the T5577 card too, because that didn’t open the door either this morning.
I’ll do a single lf indala read on the new badge when I get back home tonight and I’ll see if it kills it
1 Like
I have never seen this in any commercial access control system that uses shitty insecure 125khz crap ever.
dunno man, but I have seen the slow takeover of T5577 and other T55xx chips in the commercial badge space… so rather than original indala or EM chips you are now seeing T55xx chips because card and badge makers can easily program a single inventory item as anything they want now… so it’s possible THEY left the original source chip in the badge in a shitty state and maybe there was something kicked over by your proxmark3 messing about, but honestly I have seen government keyfobs use T5577 chips and get screwed by a simple pass of a crappy blue cloner and accidentally hitting the write button with nothing in the read buffer… toasted it… person had to go through a bunch of nonsense and interrogation to get a new fob…
2 Likes
Yes, that is my understanding also. It’s just that it was the only logical explanation I could come up with, if the tag didn’t genuinely “die enough” to prevent the company readers from reading it while staying “live enough” for the Proxmark to read it okay. The latter seemed very unlikely.
The new badge I have has “HEDSAM Indala” written across it. A quick googling reveals it’s one of them guys, and some more googling indicate it’s a NXP Mifare 1434NSSNN programmable chip. Unless it’s not a chip and it’s a T5577 behind it, I don’t know.
Anyway, I did a single lf indala read on it. One read command, that’s all. If it’s dead when I arrive at work in a few hours, I’ll know for sure the Proxmark killed it - and I’ll have some explaining to do I guess
That’s not making sense to me… Mifare is 13.56MHz … and all the hits I found for Mifare 1434NSSNN indicates it’s 13.56MHz… so the T5577 is not applicable… unless you have a dual frequency card as well, it should not have gotten a read with lf indala read
I’m not sure to be honest. The fog I have is identical to the photo and I just did 2 minutes of googling. Maybe there are several versions and the ones Google comes up with are 13.56MHz. But mine is definitely 125KHz.
And for the good news: my new fob got me inside the company building this morning, and so did the cloned test card. Now all I have to do is attach the ProxLF antenna, try to clone the fob into the xEM in the needle if possible, then head off downtown to meet my new piercer .)
I went to the local piercing shop in my new town and explained my request. At first the guy balked at the idea. But then he explained it was because he didn’t do anything involving sutures. Perfect I said, it’s just an injection - no butchery involved.
So he’s cool about it. He’s never implanted a chip, but he agrees to do it and to let me direct him from A to Z, He’ll also call his friend who runs a shop at the other end of the country, who’s done it before, to get extra advice. He looks serious and willing to help.
So, I have an appointment tomorrow evening already. That went swimmingly.
4 Likes
The xEM opens my company door while still inside the needle. What a great thing! Now all there is left to do is stick it inside me.
2 Likes
Okay, the xEM is in my hand and it opens the doors. Job done!
It was the piercer’s first implant job, but he was willing to let me direct him provided I let him do everything with his own hands, to gain experience. I explained everything to him step by step, and all in all he did a pretty good job. The chip landed 5 mm off the mark, but that was my fault because I instructed him to go deeper than he should have with the needle.
Anyway, after we were done, I asked him how much I owed him: he said nothing because I had taught him something new and I had let him practice on my own meat. Nice! So instead I invited him for a couple brewskies to thank him, and we ended up spending a nice evening together at the bar.
So, a very professional and friendly guy, and a real class act. On top of that, he wants an implant too now
@amal: I mentioned to the piercer that he might want to be added to your network of partners. He said he’d be interested and gave me his business card for me to pass along. Do you want it? Shall I PM you his name and the address of his shop?
8 Likes
The needle should basically go nearly to the hub… so the problem was probably not the depth the needle went in, but the incision spot was probably too close to where you wanted it to sit. Also, keep in mind, the chip will typically work it’s way back by 4mm - 8mm as it heals, so it’ll probably land in just the right spot in a few weeks.
Ideally he would contact us via the floating “help” button on our website and indicate interest, then we could take it from there. It keeps comms organized in our ticket system that way.
2 Likes
Lmao I figured it was I always see you on here, well welcome to the world of “major implantation work” lol
Yeah okay, I’ll tell him to contact you himself.
1 Like
3 degree, frigid, windy weather when I arrived at work this morning, and I realized the implant has another added value: I can get in without taking my glove off. That’s something I didn’t think of when I lived in warmer western Europe. One colleague following close behind finally told me he saw the added value in the Finnish winter, and that he was kind of envious.
Ah! Up to now, I was “that weird foreigner who has chips in his hands”. Apparently it’s really quite uncommon in my neck of the woods, even more so than where I used to live before. Also, god knows it takes some effort for a Finn to admit to being envious to a guy he barely know, so it really must be appealing
4 Likes