NExT LF Not Reading or Writing

I got the NExT installed in Nov or Dec of 2023 (at the time of post it’s June 2024). I was able to read the T5577 chip and write to it two or three days after install and I was able to read from it for a week or so. Ever since then I haven’t been able to read or write to it using a proxmark3 easy from DT or a flipper zero. When using ‘lf tune’ on the proxmark3 I go from 22900 to around 22300, I have gotten it to 21900 but it’s rare and I have to push the proxmark so hard against the implant it causes bruising right above the chip. I have read many of the support threads on the same issue with no luck.

(the NTAG216 works great and I use it daily)

Here’s the hw tune if that helps

[usb] pm3 → hw tune
[=] ---------- Reminder ------------------------
[=] hw tune doesn’t actively tune your antennas,
[=] it’s only informative.
[=] Measuring antenna characteristics, please wait…
[/] 9
[=] ---------- LF Antenna ----------
[+] LF antenna: 22.76 V - 125.00 kHz
[+] LF antenna: 14.99 V - 134.83 kHz
[+] LF optimal: 25.37 V - 118.81 kHz
[+] Approx. Q factor (): 6.3 by frequency bandwidth measurement
[+] Approx. Q factor (
): 7.4 by peak voltage measurement
[+] LF antenna is OK
[=] ---------- HF Antenna ----------
[+] HF antenna: 15.56 V - 13.56 MHz
[+] Approx. Q factor (*): 4.5 by peak voltage measurement
[+] HF antenna is OK

Its been so long since I’ve written or read anything from the t5577 chip it may be emulating a EM4100 chip or a indala26

1 Like

Can you do a lf search and then an lf t5 detect and post that?

1 Like

[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[=] Couldn’t identify a chipset
[usb] pm3 → lf t5 detect
[!] Could not detect modulation automatically. Try setting it manually with ‘lf t55xx config’

Hmm try this…

1 Like

Okay, I’ve done it a few times now and this is pretty much the best I get

[usb] pm3 → lf t5 detect
[!] Could not detect modulation automatically. Try setting it manually with ‘lf t55xx config’
[usb] pm3 → lf t5 p1detect
[+] T55xx chip found!
[+] Downlink Mode used : default/fixed bit length
[usb] pm3 → lf em 410x clone --id 0102030405
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0102030405 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8060280c048142

[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!] Specify one authentication mode
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands

The force block 0 write isn’t show there but I did do it a few times.

Update - I Installed the extreme firmware for the flipper zero and used the “Clear T5577 Password” option, found under RFID, Extra Actions, Clear T5577 Password. I used the X field detector found on DT’s website to mark on the back of the flipper where the greatest coupling is before clearing the password. Doing this fixed my issue. I am now able to read and write to the T5577 chip.

I don’t ever remember setting a password though, If I copy things using the flipper can it set the password that way?

4 Likes

Did you ever use one of the dedicated 125kHz cloners/duplicator? Some of them will set a password by default.

1 Like