Newbie: Trying to understand if NExT is compatible with work entry system

additionaldangerous · 10 June 2020 16:01

Hey there,
I’m newer to this, but I’ve tried to do as much research as possible to do my part. Would love some help with the rest!

My work uses a card access system, with the Schlage MT15 Card Reader (which can read both 13.56MHz and 125kHz). The card I’ve been given is a Schlage 9551 MIFARE ISO Smart Card (which is 13.56MHz only).

My goal is to purchase a NExT implant, and use it to give me access to the building.

I’m guessing that the next step is to figure out if the NExT can clone my current 13.56MHz work card, which seems the easiest route. And if that fails, ask the admin to add my NExT info into the system, which would give me more flexibility as the card reader supports both frequencies. I’m sure work would be would be open to adding my chip into the system.

Where I’m stuck is: is the NExT capable of cloning this specific type of card, and being accepted by the card reader? My limited knowledge and research says yes, as the card specs seem to line up with the NExT specs.

But am I missing anything here? Trying to avoid messing it up, would like to do it right the first time

I would love your advice! Thanks so much,

Backpackingvet · 10 June 2020 17:10

~~I am not the expert on this, but my guess is yes it would emulate the HF.~~

~~They all have iso 14443 so I imagine you can duplicate it.~~

Listen to the others.

@Pilgrimsmaster
Or @Rosco
Or @leumas95
Or @Devilclarke
Would be way better to answer.

Devilclarke · 10 June 2020 17:10

Can you scan your work card with the taginfo app and post some screen shots. Hide the UID so we can’t see it if it makes you feel better.

Looking at the info you have given I’m pretty sure the NExT won’t work for this as it looks like one of the newer mifar 1k with “increased security” you may be able to use an xM1 OR flexM1 but won’t know for sure until we see tag info.

Edit: love the edit @Backpackingvet

additionaldangerous · 10 June 2020 17:28

@Backpackingvet lol thank you

@Devilclarke thank you! I tried to scan with my iPhone, but it couldn’t read the card. Tried a couple apps, including the one you suggested. The card successfully reads at work. I have an old Nexus tablet that I grabbed and am charging, maybe I’ll be able to scan it with that?

Screenshot:

amal · 10 June 2020 18:59

Are you using TagInfo?

additionaldangerous · 10 June 2020 19:14

Yes, but iPhone wasn’t reading the card (I tried a few other apps too). TagInfo worked on my Nexus!

** TagInfo scan (version 4.24.6) 2020-06-10 15:04:49 **
Report Type: External

-- IC INFO ------------------------------

# IC manufacturer:
NXP Semiconductors

# IC type:
MIFARE Classic EV1 (MF1S50)

-- NDEF ------------------------------

# No NDEF data storage present:
Maximum NDEF storage size after format: 716 bytes

-- EXTRA ------------------------------

# Memory size:
1 kB
* 16 sectors, with 4 blocks per sector
* 64 blocks, with 16 bytes per block

# IC detailed information:
Full product name: MF1S503xX/V1

# Originality check:
Signature verified with NXP public key

-- FULL SCAN ------------------------------

# Technologies supported:
MIFARE Classic compatible
ISO/IEC 14443-3 (Type A) compatible
ISO/IEC 14443-2 (Type A) compatible

# Android technology information:
Tag description:
* TAG: Tech [android.nfc.tech.MifareClassic, android.nfc.tech.NfcA, android.nfc.tech.NdefFormatable]
* Maximum transceive length: 253 bytes
* Default maximum transceive time-out: 618 ms

# Detailed protocol information:
ID: 56:01:24:1B
ATQA: 0x0400
SAK: 0x08

# Memory content:
Sector 0 (0x00)
[00] r--  56 01 24 1B 68 88 04 00 C8 48 00 20 00 00 00 18 |V.$.h....H. ....|
[01] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[02] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[03] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
      Factory default key           Factory default key (readable)

Sector 1 (0x01)
[04] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[05] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[06] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[07] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 2 (0x02)
[08] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[09] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0A] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0B] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 3 (0x03)
[0C] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0D] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0E] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[0F] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 4 (0x04)
[10] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[11] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[12] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[13] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 5 (0x05)
[14] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[15] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[16] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[17] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 6 (0x06)
[18] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[19] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[1A] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[1B] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 7 (0x07)
[1C] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[1D] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[1E] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[1F] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 8 (0x08)
[20] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[21] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[22] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[23] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 9 (0x09)
[24] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[25] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[26] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[27] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 10 (0x0A)
[28] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[29] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[2A] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[2B] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 11 (0x0B)
[2C] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[2D] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[2E] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[2F] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 12 (0x0C)
[30] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[31] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[32] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[33] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 13 (0x0D)
[34] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[35] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[36] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[37] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 14 (0x0E)
[38] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[39] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[3A] ???  -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
[3B] ???  XX:XX:XX:XX:XX:XX --:--:-- -- XX:XX:XX:XX:XX:XX
      (unknown key)                 (unknown key)

Sector 15 (0x0F)
[3C] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3D] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3E] rwi  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
[3F] wxx  FF:FF:FF:FF:FF:FF FF:07:80 69 FF:FF:FF:FF:FF:FF
      Factory default key           Factory default key (readable)

r/R=read, w/W=write, i/I=increment,
d=decr/transfer/restore, x=r+w, X=R+W
data block: r/w/i/d:key A|B, R/W/I:key B only,
  I/i implies d, *=value block
trailer (order: key A, AC, key B): r/w:key A,
  W:key B, R:key A|B, (r)=readable key
AC: W implies R+r, R implies r

--------------------------------------

Devilclarke · 10 June 2020 19:59

Good news (I think) looks like a mifar 1k classic (s50) In which case get yourself an xM1 or a flexM1 and clone away.

Please correct me if im wrong DT masses.

Pilgrimsmaster · 10 June 2020 20:05

@Devilclarke beat me to it, but yep, these are your key indicators that the xM1, FlexM1gen1a or FlexM1gen2 are your options.
Now you need to decide which one, do you know the difference between them? (All “Should” work for your purpose)

Devilclarke · 10 June 2020 20:09

Yay I beat @Pilgrimsmasterfor once lol.

Here is the differences. Biggest take away is if your a newbie or dont want to risk a bricked chip in your hand then grab a gen1.
"magic" Mifare chips

I would highly recommend grabbing yourself a proxmark3 easy as well if you go for the gen1 or xm1 here is a guide how to clone cards to it.

additionaldangerous · 10 June 2020 20:24

@Devilclarke @Pilgrimsmaster
Thank you both!

Now my question is… do you think these various M1 implants are as versatile as the NExT? I mentioned this a bit in original post, but I may have the option to ask work to add my NEXT implant’s ID to the access system (the card reader seems to read both 13.56MHz and 125kHz).

My assumption is that NExT is more versatile than these M1 impants for use in other projects, like if I wanted to do some home automation stuff. Am I wrong on that?

Ultimately trying to find something that is useful at work and at home for my own personal projects.

amal · 10 June 2020 20:25

This is because Mifare chips are not NFC compliant. Only android phones with NXP reader chip hardware inside support the MifareClassic “pseudo-standard” pushed by NXP… but since it’s not an actual NFC standard, it flat out doesn’t work on iPhone.

Pilgrimsmaster · 10 June 2020 20:34

Should I snipe him?

Screenshot_20200611-082656_Chrome
tumblr_4e6c7717f8f47a94d170a63ee97b4e7d_42fbd055_640

Yes, Yes I Should

Lest see what @Devilclarke says, but I would do some more investigation around the 125kHz access.
xM1 you know will work, the 125khz highly likely, but you will need some equipment (proxmark) to take your T5577 and put it into the mode the reader is expecting ie. Indiana, HID…
You could first grab a Proxmark and a T5577 card to experiment.

Update.

Yeah, what @Devilclarke said down there

Devilclarke · 10 June 2020 20:34

Thanks @Pilgrimsmaster

Really its down to what you want to do, most projects people undertake only juse the UID of the chip (thats the 4 bit number). The NExT is definatly versatile but its also a case of personal preference.

The HF side of the NExT is a NTAG216 iirc which would not be able to function the same as a mifar 1k however if you have the option to enrol an implant the first thing i would try would be to pick up a ntag216 card/tag and try getting that enrolled. Most systems only like one card type but others don’t care as long as it has a valid UID.

If that works fine then great go for a NExT if you want. If not the only thing you loose is the LF side which if you don’t mind another needle can be picked up for i $40 iirc (xEM)

Locutus · 10 June 2020 20:43

I think an M1 and xEM combo chip would be pretty sweet and get you the best of both frequencies. Unfortunately it doesn’t exist yet. There is, however, a survey started by @Pilgrimsmaster where you can vote if you’d like to give a suggestion for future products.

Pilgrimsmaster · 10 June 2020 21:03

images (63)

A 2in1 xM1 / xEM would be

tenor (22)

Devilclarke · 10 June 2020 21:26

I still recon we need a dual flex, flexEM + apex or flexEM + flexM1

Pilgrimsmaster · 10 June 2020 22:06

Yeah, and specifically the flexEMgen2 the problem is the LF antenna, OR just have a giant implant.
I have poised this before, with a potential antenna layout, the problem is, just because you can draw it, doesn’t mean it will be as small as you want it to be…stoopid physics.
I would LOVE a wedge shaped FlexEM

But you could get one of each and put them next to each other.
Ideally, one ontop of the other…but not sure how this would read or if chaffing would become an issue

Ohhhh, I am about to drop an Amal teaser comment …
I have been having a little tinker on my bench with something related to this, but only as and when I have time, I will let you know how it goes, but won’t be anytime soon.
( FYI even if it works, It won’t be as cool as any of Amals actual products )

Teaser

Locutus · 10 June 2020 22:20

@Pilgrimsmaster

leumas95 · 11 June 2020 00:25

I thought a flexEMgen1a is probably better? Your likely to have a PM3 for the t5577 anyway so they seem to fit together.

Pilgrimsmaster · 11 June 2020 01:00

I don’t know about “better”, but yes another option.
I did have the exact same thought, but why not make it easy if you can?
For this thing that doesn’t exist…yet