NExT xEM stopped working

I have had my NExT a little under a month and was going good, played around mostly with the xNT side because I could just use my phone. I did add the xEM to my front door so I know it was working but about a week ago It stopped responding. I bought a proxmark3 easy to diagnose and build a pretty good antenna but I am not getting anything.
I have tried the following-
lf t55xx detect
lf t55xx p1detect
lf t55xx wipe
lf t55xx write b 0 d 00088040
lf t55xx write b 1 d E0150A48 1
lf t55xx write b 2 d 2D782308 1
still no detect
I have confirmed I have no issues with a another t55 card
lf t55xx trace looks the same as if I have nothing on the antenna

hw tune gives

LF antenna: 28.60 V @ 125.00 kHz

LF antenna: 21.59 V @ 134.00 kHz

LF optimal: 28.19 V @ 123.71 kHz

HF antenna: 25.35 V @ 13.56 MHz

and screen cap of lf t55xx trace with my NExT

any suggestions on what else I can try
Thanks

I stand to be corrected here, Iā€™m no expert on Proxmark commands.
The NExt is a T5577 chip but comes pre-configured as a EM4100 so it will work with the DT EM access controller.
Therefore my guess is just use a generic
lf search
and that should ā€œsee itā€
Again I could be wrong, but itā€™s worth a crackā€¦

I suspect the antenna is your issue. Itā€™s very difficult to read/write to the tags, the shape and position of the antenna needs to be pretty perfect. Have you ever been able to get a response from your tag using this antenna and the lf search command?

I had not read or written to the xEM with the proxmark prior to needing to diagnose the issue with it. But I do understand the importance of a good antenna and positioning on the antenna. I have the test 125hz led to check position and have found the best spot on the antenna I built. lf search finds nothing

do you have an xEM Access controller
to see if you can enroll it?
or
have you considered getting a proxmark lf antenna

1 Like

Yeah I have the xEM Access controller and it was enrolled and working but just stopped one day thatā€™s what prompted me to get a proxmark and investigate. Clearing the Access controller and trying to renrole gives no result also it still works with fobs. I have a feeling that the xEM silicone has died. I build an antenna to use with the proxmark and is tuned to 125khz. I dont think this is an coupling issue with the proxmark

Sounds like you have done all the correct things to fault find.
It might be time to contact DT support


Ticket receivedā€¦ taking this internal. Thanks guys.

Amal

1 Like

would love to know the outcome of this, I have the same problem

EXACT same?
Both LF and HF?
Can you share some more details?
Hopefully we can help you figure out a solutionā€¦
What diagnostic tools do you have?
When did it stop working? HF / LF

What have you done so far to fault find?

1 Like

I know that was November 2019, but in case anyone else sees this, that antenna works with the Proxmark3 RDV4, not the Proxmark3 Easy that Dangerous Things sell.

There are instructions for making a home brew ferrite core antenna for the Proxmark3 Easy on this site, in particular this thread.

1 Like

Just the lf has stopped working, it was 2 days I think, I was playing with it with the proxmark and it got less and less reliable untill I couldnā€™t find anything with an ā€˜lf searchā€™

How long ago was your NExT installed?

The 25th if June

So it totally could be swelling related.

When you first install, there is a little trauma but your body has fully fought back, slowly your body starts to blood pool and swell (even though it is not always obvious from the outside)

Think of the swelling and of reduction of readability like a bell curve.

image

At the peak and either side you may get intermittent on no reads at all.
(BLUE ZONE from the graph above)

This forum is full of people experiencing the same issue as you, and more often than not, this is the ā€œissueā€, It is just your body working correctly

We normally say give it around 2 weeks to be reliable and properly healed

I would still give it another week before you start getting too concerned.

I hope this helps

OR what Amal says down there

what-he-said

this is sorta the key i thinkā€¦ chances are itā€™s left in a misconfigured state and LF SEARCH will not find anything if itā€™s not configured perfectly. I would try this;

orā€¦ as I like to doā€¦ just write an EM410x ID to it a few times and then try LF SEARCHā€¦ that can also work to clear a simple misconfigā€¦

1 Like

ok, so Iā€™m not getting nothing anymore, but I canā€™t write to it, and it doesnā€™t turn up on an lf search or lf t55 detect

PM3 output
[usb] pm3 --> l t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 00000000 | 00000000000000000000000000000000 | ....
[+]  01 | 00000000 | 00000000000000000000000000000000 | ....
[+]  02 | 00000000 | 00000000000000000000000000000000 | ....
[+]  03 | 00000000 | 00000000000000000000000000000000 | ....
[+]  04 | 00000000 | 00000000000000000000000000000000 | ....
[+]  05 | 00000000 | 00000000000000000000000000000000 | ....
[+]  06 | 00000000 | 00000000000000000000000000000000 | ....
[+]  07 | FFFFFFFC | 11111111111111111111111111111100 | ....
[+] Reading Page 1:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 00000000 | 00000000000000000000000000000000 | ....
[+]  01 | 00000000 | 00000000000000000000000000000000 | ....
[+]  02 | 00000000 | 00000000000000000000000000000000 | ....
[+]  03 | 00000000 | 00000000000000000000000000000000 | ....
[+] saved to json file lf-t55xx-dump-4.json
[+] saved 12 blocks to text file lf-t55xx-dump-4.eml
[+] saved 48 bytes to binary file lf-t55xx-dump-4.bin
[usb] pm3 --> l t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 0007FFFF | 00000000000001111111111111111111 | ....
[+]  01 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  02 | 00000000 | 00000000000000000000000000000000 | ....
[+]  03 | 00000000 | 00000000000000000000000000000000 | ....
[+]  04 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  05 | 00000000 | 00000000000000000000000000000000 | ....
[+]  06 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  07 | 00000000 | 00000000000000000000000000000000 | ....
[+] Reading Page 1:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 00000000 | 00000000000000000000000000000000 | ....
[+]  01 | 07FFFFFF | 00000111111111111111111111111111 | ....
[+]  02 | 00000000 | 00000000000000000000000000000000 | ....
[+]  03 | 003FFFFF | 00000000001111111111111111111111 | .?..
[+] saved to json file lf-t55xx-dump-5.json
[+] saved 12 blocks to text file lf-t55xx-dump-5.eml
[+] saved 48 bytes to binary file lf-t55xx-dump-5.bin
[usb] pm3 --> l t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 00000000 | 00000000000000000000000000000000 | ....
[+]  01 | 00000000 | 00000000000000000000000000000000 | ....
[+]  02 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  03 | 00000000 | 00000000000000000000000000000000 | ....
[+]  04 | 00000000 | 00000000000000000000000000000000 | ....
[+]  05 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  06 | 00000000 | 00000000000000000000000000000000 | ....
[+]  07 | 00000000 | 00000000000000000000000000000000 | ....
[+] Reading Page 1:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 00000000 | 00000000000000000000000000000000 | ....
[+]  01 | 0000007F | 00000000000000000000000001111111 | ....
[+]  02 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  03 | 00000000 | 00000000000000000000000000000000 | ....
[+] saved to json file lf-t55xx-dump-6.json
[+] saved 12 blocks to text file lf-t55xx-dump-6.eml
[+] saved 48 bytes to binary file lf-t55xx-dump-6.bin
[usb] pm3 --> l t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> l t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> l t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | FFFFFFFC | 11111111111111111111111111111100 | ....
[+]  01 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  02 | 00000000 | 00000000000000000000000000000000 | ....
[+]  03 | 00000000 | 00000000000000000000000000000000 | ....
[+]  04 | 00000000 | 00000000000000000000000000000000 | ....
[+]  05 | 00000000 | 00000000000000000000000000000000 | ....
[+]  06 | FFFFFFC0 | 11111111111111111111111111000000 | ....
[+]  07 | 00000000 | 00000000000000000000000000000000 | ....
[+] Reading Page 1:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | FFFFFFFF | 11111111111111111111111111111111 | ....
[+]  01 | 007FFFC0 | 00000000011111111111111111000000 | ....
[+]  02 | 00000000 | 00000000000000000000000000000000 | ....
[+]  03 | 001FFFF0 | 00000000000111111111111111110000 | ....
[+] saved to json file lf-t55xx-dump-7.json
[+] saved 12 blocks to text file lf-t55xx-dump-7.eml
[+] saved 48 bytes to binary file lf-t55xx-dump-7.bin

so itā€™s getting different data each time you run a dump? it looks almost like noise. howā€™s your antenna positioning? is someone helping you by pressing enter or are you juggling all that yourself?

PS ā€¦ just asked iceman if he could add a delay to the search / clone commandsā€¦

just a small suggestion that is a serious pain in the ass for a small group of peopleā€¦ adding a delay to any kind of operation would be very helpful. Basically when you are trying to position a proxmark3 over your implant you are typically using one hand to hold the proxmark3 over the otherā€¦ and then having to use an elbow or awkwardly extended finger to press enterā€¦ if a settable delay could be added as a parameter to allow like -d 3 to delay 3 seconds before executingā€¦ it would be super helpful. the most important commands of course are the hf/lf search and various cloning commands.

weā€™ll see what he says.

3 Likes