Problem reading FlexUG4

Hallic · July 8, 2024, 5:25am

Figured since I was getting it installed on Wed, I should probably get it programmed a bit before hand to see if it works. Proxmark3 Easy doesn’t even detect it:

script run hf_mf_ultimatecard.lua -t 4

[usb] pm3 → script run hf_mf_ultimatecard.lua -t 4
[+] executing lua /usr/local/bin/…/share/proxmark3/luascripts/hf_mf_ultimatecard.lua
[+] args ‘-t 4’

Setting: Ultimate Magic card to Mifare 1k S50 4-byte
ERROR: iso14443a card select failed
[#] Warning: HF field is off
[#] Warning: HF field is off
ERROR: iso14443a card select failed
ERROR: iso14443a card select failed

[+] finished hf_mf_ultimatecard.lua

“hf 14a read” doesn’t do anything. Tried it anywhere from touching on the antenna to an inch or so away moving slowly reading multiple times, both top and bottom of the PM3 and still nothing.

PM3 still reads all my other HF fobs, glassies, and Apex Flex.

FlipperZero can read the FlexUG4 only if using a small MFGC and pulls up as a Mifare classic 4k (which I understand is the default setup for this chip). Unable to read the FlexUG4 at all with stock F0 antenna.

Fresh git pull, also tried flashing latest release (dated may 28). Generic PM3 easy clone off Ali years ago, this is the first time it’s ever given me problems.

hw version

[ Proxmark3 RFID instrument ]

[ Client ]
Iceman/master/v4.18589-69-gef97dd3f7-suspect 2024-07-07 21:58:02 f1dc6862f
compiled with… GCC 12.2.0
platform… Linux / x86_64
Readline support… present
QT GUI support… present
native BT support… present
Python script support… present
Lua SWIG support… present
Python SWIG support… present

[ Proxmark3 ]
firmware… PM3 GENERIC

[ ARM ]
bootrom: Iceman/master/v4.18589-69-gef97dd3f7-dirty-suspect 2024-07-07 22:57:55 f1dc6862f
os: Iceman/master/v4.18589-69-gef97dd3f7-dirty-suspect 2024-07-07 22:58:04 f1dc6862f
compiled with GCC 12.2.1 20221205

[ FPGA ]
fpga_pm3_lf.ncd image 2s30vq100 2024-02-03 15:12:10
fpga_pm3_hf.ncd image 2s30vq100 2024-02-03 15:12:20
fpga_pm3_felica.ncd image 2s30vq100 2024-02-03 15:12:41
fpga_pm3_hf_15.ncd image 2s30vq100 2024-02-03 15:12:31

[ Hardware ]
–= uC: AT91SAM7S512 Rev B
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 63% used )

hw status

[#] Memory
[#] BigBuf_size… 41796
[#] Available memory… 41796
[#] Tracing
[#] tracing … 1
[#] traceLen … 0
[#] Current FPGA image
[#] mode… fpga_pm3_hf.ncd image 2s30vq100 2024-02-03 15:12:20
[#] LF Sampling config
[#] [q] divisor… 95 ( 125.00 kHz )
[#] [b] bits per sample… 8
[#] [d] decimation… 1
[#] [a] averaging… yes
[#] [t] trigger threshold… 0
[#] [s] samples to skip… 0
[#]
[#] LF T55XX config
[#] [r] [a] [b] [c] [d] [e] [f] [g]
[#] mode |start|write|write|write| read|write|write
[#] | gap | gap | 0 | 1 | gap | 2 | 3
[#] ---------------------------±----±----±----±----±----±----±-----
[#] fixed bit length (default) | 31 | 20 | 18 | 50 | 15 | n/a | n/a |
[#] long leading reference | 31 | 20 | 18 | 50 | 15 | n/a | n/a |
[#] leading zero | 31 | 20 | 18 | 40 | 15 | n/a | n/a |
[#] 1 of 4 coding reference | 31 | 20 | 18 | 34 | 15 | 50 | 66 |
[#]
[#] HF 14a config
[#] [a] Anticol override… std ( follow standard )
[#] [b] BCC override… std ( follow standard )
[#] [2] CL2 override… std ( follow standard )
[#] [3] CL3 override… std ( follow standard )
[#] [r] RATS override… std ( follow standard )
[#] Transfer Speed
[#] Sending packets to client…
[#] Time elapsed… 500ms
[#] Bytes transferred… 302080
[#] Transfer Speed PM3 → Client… 604160 bytes/s
[#] Various
[#] Max stack usage… 3520 / 8184 bytes
[#] Debug log level… 1 ( error )
[#] ToSendMax… -1
[#] ToSend BUFFERSIZE… 2308
[#] Slow clock… 30951 Hz
[#] Installed StandAlone Mode
[#] LF HID26 standalone - aka SamyRun (Samy Kamkar)
[#]

hw tune

=] -------- Reminder ----------------------------
[=] hw tune doesn’t actively tune your antennas.
[=] It’s only informative.
[=] Measuring antenna characteristics…
9

[=] -------- LF Antenna ----------
[+] 125.00 kHz … 27.23 V
[+] 134.83 kHz … 18.97 V
[+] 123.71 kHz optimal… 27.17 V
[+]
[+] Approx. Q factor measurement
[+] Frequency bandwidth… 6.8
[+] Peak voltage… 7.9
[+] LF antenna… ok

[=] -------- HF Antenna ----------
[+] 13.56 MHz… 15.27 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage… 4.4
[+] HF antenna ( ok )

[=] -------- LF tuning graph ------------
[+] Orange line - divisor 95 / 125.00 kHz
[+] Blue line - divisor 88 / 134.83 kHz

[=] Q factor must be measured without tag on the antenna

It’s possible my PM3 has a hardware issue, but I am a bit concerned about the troubles the F0 has reading it also.

Should I go ahead with the install anyway?

My Apex Flex gets read almost instantly by both the F0 and PM3. Is it possible there’s an antenna problem on the FlexUG4? Was careful when taking it out of the box.

XEMON · July 8, 2024, 5:40am

Try
script run hf_mf_ultimatecard -t 4

Hallic · July 8, 2024, 5:44am

[usb] pm3 → script run hf_mf_ultimatecard -t 4
[+] executing lua /usr/local/bin/…/share/proxmark3/luascripts/hf_mf_ultimatecard.lua
[+] args ‘-t 4’

Setting: Ultimate Magic card to Mifare 1k S50 4-byte
ERROR: iso14443a card select failed
[#] Warning: HF field is off
[#] Warning: HF field is off
ERROR: iso14443a card select failed
ERROR: iso14443a card select failed

[+] finished hf_mf_ultimatecard

XEMON · July 8, 2024, 5:46am

Dam …

Can you read HF cards?
(Run hf search with a plain mifare card)

Hallic · July 8, 2024, 5:51am

Everything but the FlexUG4.

tac0s · July 8, 2024, 6:03am

I think I’m seeing something @Pilgrimsmaster mentioned to me… Detach the lube from the procedure pouch and try again.

Hallic · July 8, 2024, 6:12am

Tried it under and on top of the PM3, facing up and facing down. Unless the lube packet itself is causing some crazy interference ?

2 minutes later

WHY IS THE LUBE PACKET WELDED ONTO THE BAG WITH THE FORCE OF A THOUSAND SUNS!?!?!?!

Tore the shit out of the outside bag, and now I have lube everywhere. First time I’ve ever had a problem with too much lube, brb.

tac0s · July 8, 2024, 6:15am

it had been reported that the lube package was interfering with reads. I’m sure we can get you more lube! Reply to your order or click on the help button.

Hallic · July 8, 2024, 6:21am

Lube soaked into the inner bag and got the back of it a bit wet. Tried to dry it off quickly as I could, don’t know if it will soak through the inner bag and ruin the sterilization?

But:

[usb] pm3 → script run hf_mf_ultimatecard.lua -t 4
[+] executing lua /usr/local/bin/…/share/proxmark3/luascripts/hf_mf_ultimatecard.lua
[+] args ‘-t 4’

Setting: Ultimate Magic card to Mifare 1k S50 4-byte
ERROR: iso14443a card select failed
[#] Warning: HF field is off
[#] Warning: HF field is off
ERROR: iso14443a card select failed
ERROR: iso14443a card select failed

[+] finished hf_mf_ultimatecard.lua

Still not reading. “hf 14a read” does nothing, and “hf search” doesn’t find it either.

Oh well, I’m going to bed.

tac0s · July 8, 2024, 6:23am

What does script run hf_mf_ultimatecard -c do? Regardless, hit the orange button on the website or reply to your order confirmation and we’ll get your sorted out. Sorry for the hassle!

Hallic · July 8, 2024, 6:25am

[usb] pm3 → script run hf_mf_ultimatecard -c
[+] executing lua /usr/local/bin/…/share/proxmark3/luascripts/hf_mf_ultimatecard.lua
[+] args ‘-c’

ERROR: iso14443a card select failed

[+] finished hf_mf_ultimatecard

Hallic · July 8, 2024, 6:30am

Not your fault (unless… was it your fault? )

Just glad I decided to try to read it before getting it implanted, if it is antenna related. The FlexEM I ordered in the box works fine so I’ll still get that installed.

Replied to my Order email. Now I’m going to bed.

amal · July 8, 2024, 7:18am

Show me a pic of you reading it with the proxmark… try laying it at a 45 across a corner of the antenna.

Pilgrimsmaster · July 8, 2024, 7:36am

Yeah, apologies, I should have broadcast that wide and far, rather than a DM

My bad.
@Hallic If it makes you feel better, it took me 2 or 3 failed attempts to work it out. So you weren’t alone.

Not crazy, just foil lined…but interference nonetheless

Haha, I could visualise your whole situation thanks to your running commentary.
Thanks for bringing us along on your luby journey.

No point letting good lube go to waste

Yeah, Im an idiot, I should have posted on the flexug4 announcement.

I actually liked the tidy and professional packaging with the lube pouch attached.
What’s a little luby interference between friends!?

I trust DangerousThings LLC implicitly, but if I can, I’ll still test read an implant before I implant, because why not!?

@Hallic WAKE UP!!! the boss is talking to you…Dont make him press the mind control button.

Could you also try a TagInfo read.
Pretty sure it should read as a MFC 1k…
in your own time of course

Hallic · July 8, 2024, 3:10pm

Tried all kinds of iterations of positioning and distances last nite, just tried em again. here’s about 1/4 too hard to take pics of it while holding it in the air also.