NExT usage with XEM access controller?

[Batbait]

Purchased NExT bundle with the Xem access controller. Followed the youtube tutorial for installation on a garage door and everything went fine. Planned on programming add and delete MACs and my implant after installation. Programming the add and delete tags went smoothly, but the antenna absolutely will not detect my implant no matter where i put it on my implant in any orientation. The KBR wedge reader, proxmark, and multiple phones have all been able to access it and it is visibly very obviously not under muscle.

Any ideas? Never made my own antenna before but thats the only idea i have.

[Aoxhwjfoavdlhsvfpzha]

How recently was the NExT installed?

Is it in EM mode?

[Batbait]

Over a month ago now, I am still learning about the technologies, what do you mean by EM mode?

[XEMON]

Thé lf side (t5577) needs to be programmes to emulate an em chipset as the xem can only read em fob/card/implant

Do you have anything to read/program lf chips?
(Proxmark/flipper/blew cloner/…)

[amal]

Can you post a video of you putting the antenna of the access controller across your NExT? It will need to be placed such that the wire loop of the antenna crosses over the length of the NExT implant, and does not run parallel to it.

[Batbait]

Yes i got the Proxmark3 easy along with my chip. Is there a good tutorial on how to enable EM mode with it?

[Aoxhwjfoavdlhsvfpzha]

You can check that it isn’t already in EM mode with lf search

You can clone an EM credential to it with the lf em 410x clone command

The PM3 client suggests lf em 410x clone --id 0F0368568B as an example, which you could use for testing, but you should probably choose a more unique id long term

[enginerd]

@Batbait

how to enable EM mode

It comes in EM mode out of the box, so if you haven’t cloned another tag to the LF side of your NExT, it’s in EM mode.

[Batbait]

lf search returned no known tags, tried the lf em 410x clone --id 0F03685688 command and proxspace says it was done but the access controller still wont pick it up and lf search still doesnt return anything.

I figure using NFC tools on my phone mightve caused this?

[Aoxhwjfoavdlhsvfpzha]

@Batbait

I figure using NFC tools on my phone mightve caused this?

This is very unlikely, NFCTools is for interacting with the HF side of your implant, and right now we’re focusing on the LF side

@Batbait

but the access controller still wont pick it up and lf search still doesnt return anything.

At this point it’s looking like a coupling issue, and I advise you to listen to Amal’s post from earlier

@amal

Can you post a video of you putting the antenna of the access controller across your NExT? It will need to be placed such that the wire loop of the antenna crosses over the length of the NExT implant, and does not run parallel to it.

It may also help if you were to post pictures/video of your placement with the PM3

[Batbait]

This is me attempting to pair them.

[amal]

Yeah that looks like it’s not programmed in EM mode or there is some other problem. The proxmark3 is your next step.

[Aoxhwjfoavdlhsvfpzha]

As for the PM3 you can use the lf tune command to try to figure out the proper positioning, you’re looking for the spot where the voltage displayed is lowest

It may also help to add a delay to your commands so you can get into position:

How to add a delay to Proxmark3 commands for implantees

Having an implant in your body and trying to use the Proxmark3 can be a tricky balancing act of trying to hold the Proxmark3 antenna just so over your implant and then trying to hit Enter to initiate the command. But, there is a way to solve this by using the msleep command along with command chaining to add a delay between pressing enter and the command you want to execute against your implant is actually run. For example, to perform an lf search with a 3 second delay before actually performing…

And make sure to play around with the LF xFD that came with your implant

[Batbait]

Messed around with lf tune a bunch along with the field detectors, is a variance from 27600ish mV down to 27100mV typical? Seemed very difficult to tell when/whether the antenna was picking up the implant. I could inconsistently get it to 27200mV. lf search still didnt show anything at those orientations though.

Recorded a video of me trying different positions with the proxmark but my internet is too shoddy to upload it atm.

[Apocalypticaust]

Did you put the switch back to 1 after programming the master and clear tag? I just opened mine up yesterday and it was pretty straight forward. Although I used the instructions on the site and not the paper one that came with.

[amal]

@Batbait

Messed around with lf tune a bunch along with the field detectors, is a variance from 27600ish mV down to 27100mV typical? Seemed very difficult to tell when/whether the antenna was picking up the implant. I could inconsistently get it to 27200mV. lf search still didnt show anything at those orientations though.

Hmm unfortunately this isn’t looking great. Can you position the proxmark3 in the best place you can based on the tune work, then try these steps;

Reviving a bricked T5577

The T5577 chip is a great wonder of the world. That said, it is sensitive. The chip’s memory is arranged in blocks, and block 0 is a critical block that holds configuration data for how the chip should behave, if a password is set or not, and other critical settings. It is vulnerable to tearing - the act of leaving writable memory corrupted if the write operation is interrupted or suffers from insufficient power available to complete properly. If you have a T5577 chip based product that appe…

[Batbait]

After countless attempts at that process this is the best output i could get from lf search

[Aoxhwjfoavdlhsvfpzha]

Unfortunately indala reads like that are almost always a false positive

Do you have another LF tage you could try on the PM3 to rule out any issues there?

[Batbait]

My PM3 reads the tags that came with the access controller perfectly fine.

Ill keep trying that revival method from earlier and hope for the time being

[amal]

@Batbait

tags that came with the access controller perfectly fine.

Yeah this is because they are huge diameter antenna coils compared the the very small loop coil antenna used in the implant. Coupling is much more difficult for the implants vs keyfobs and cards.