NExT Implant - Prox Issue

Support
1

Hello, While attempting to clone a new work HID card to the T55xx in my hand, Something went wrong sigh

The issue I am having is that from where I am and where I am trying to get I’d rather F things up further. So with that being said, I’m hoping someone can give me some help. Looking at my other T55xx cards that came with it (which are defaultly coded) I can see this one had some settings changed along the way. I’m trying to LF HID clone -r 37099aa192. Any thoughts on how I can get there from here? Please see attach

T55xx Info:

[=] — T55x7 Configuration & Information ---------
[=] Safer key : 15
[=] reserved : 15
[=] Data bit rate : 63 - RF/128
[=] eXtended mode : Yes - Warning
[=] Modulation : 0x1F (Unknown)
[=] PSK clock frequency : 3 - (Unknown)
[=] AOR - Answer on Request : Yes
[=] OTP - One Time Pad : Yes - Warning
[=] Max block : 7
[=] Password mode : Yes
[=] Sequence Start Marker : Yes
[=] Fast Write : Yes
[=] Inverse data : Yes
[=] POR-Delay : Yes
[=] -------------------------------------------------------------
[=] Raw Data - Page 0, block 0
[=] FFFFFFFF - 11111111111111111111111111111111
[=] — Fingerprint ------------

T55xxDump:

[usb] pm3 → lf t5 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[+] 00 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 01 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 02 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 03 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 04 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 05 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 06 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 07 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----±---------±---------------------------------±------
[+] 00 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 01 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 02 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] 03 | FFFFFFFF | 11111111111111111111111111111111 | …
[+] saved to json file lf-t55xx-dump-4.json
[+] saved 12 blocks to text file lf-t55xx-dump-4.eml
[+] saved 48 bytes to binary file lf-t55xx-dump-4.bin

Current reader configuration:

[=] — current t55xx config --------------------------
[=] Chip type… T55x7
[=] Modulation… FSK
[=] Bit rate… 0 - RF/8
[=] Inverted… No
[=] Offset… 0
[=] Seq. terminator… No
[=] Block0… 000F0000 (user set)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

2

That dump makes no sense as far as I know, there should not be a way to set every bit to F.
Try " lf t55xx write -b 0 -d 000880E8 -p 00000000 " as a recovery or if you have access to a blue cloner or something similar, sometimes they can force a t55 in a normal state

3

Thanks @iahimsogard seems odd to me as well. I have several other implants I’ve never had any issues so this one is a head scratcher. Could it possibly be due to the reader configuration / modulation, etc? I can manage to get various different results on the dump using the modulation, but on none of them can I get the LF T5 Detect command to pick up the settings from the chip. I would be open to try a specific config setup you might recommend and share the dump from that if you have any thoughts?