Problems with FlexMN HF and NExT LF chips

Support
1

Howdy y’all, back again after a little hiatus. I recently moved into a new place with RFID tags and took it as an opportunity to go through and audit all of my current implants and make sure they are operating correctly. Of relevance for this apartment complex are my FlexMN, FlexMT, and NExT. The FlexMT works like a dream and hasn’t been giving me any issues, but my FlexMN and NExT are each having issues in their own ways.

FlexMN - HF Read Issues

I got my FlexMN back in September 2021 and it worked well when I got it for the next year or so, until I moved out of the apartment that required the Ultralight emulation and didn’t have an opportunity to use it anywhere else. It’s in an interesting spot (see picture below), where it also butting up against the NExT and a xSIID lower down. I have been using my Proxmark3 Easy to try to get ahold of the HF side of the FlexMN, but can’t seem to get it. I have tried on my Android as well, but I can only ever get the NExT and the xSIID. The LF side of the FlexMN still registers, but nothing from the HF side. I read in the forum about the FlexMN being notorious for taking itself out from flexing, but I wanted to check if there was anything I might have missed.

Commands tried:

hf mfu wipe - I couldn’t find the card even after spamming wipes

script run hf_mfu_magicwrite -w - Similarly, didn’t appear after magic wipes

script run hf_mfu_magicwrite -t 7 - Failed to write to the card with iso14443a card select failed

NExT - LF Read Issues

This one was a bit weirder. I got the NExT back in 2019 in the p0 position of my right hand and I’ve reprogrammed it a bunch of times, but only recently ran into weird issues where it wouldn’t rewrite on the LF side. Today I was getting

[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] [H10302  ] HID H10302 37-bit huge ID          CN: 10400771  parity ( ok )
[+] [H10304  ] HID H10304 37-bit                FC: 19  CN: 439299  parity ( ok )
[+] [P10004  ] HID P10004 37-bit PCSC           FC: 2  CN: 125760
[+] [MDI37   ] PointGuard MDI 37-bit            FC: 0  CN: 10400771  parity ( ok )
[=] found 4 matching 37-bit formats

[=] Trying with a preamble bit...
[+] [BQT38   ] BQT 38-bit                       FC: 5123  CN: 262223  Issue: 5  parity ( fail )
[+] [ISCS    ] ISCS 38-bit                      FC: 2  CN: 2012163  OEM: 8  parity ( fail )
[=] found 2 matching 38-bit formats
[-] Parity tests failed

[=] raw: 0000000000000010013d6806

[+] Valid HID Prox ID found!

However, when I tried to clone it to my new tag (lf hid clone -w H10301 --fc 77 --cn 57906) or wipe it with lf t55xx wipe, they wouldn’t take and the output remained the same as the above lf search. I then started to wonder if there was a password issue I had forgotten about, so I tried a lf t55xx chk with no success. I then went and tried to bruteforce the passwords, but none worked. Then I tried all the block 0 writes that Amal posted here, but kept getting the same search results, as well as with some -p switches for other passwords that the bruteforce hadn’t tried.

Finally, I then made what I think the fatal mistake was, which was trying a block 0 write with a new password:

[usb] pm3 --> lf t55xx wipe -p AA55BBBB -t
lf t55xx wipe: invalid option "-t"
[!] Try 'lf t55xx wipe --help' for more information.

[usb] pm3 --> lf t55xx write -b 0 -d 000880E0 -p AA55BBBB -t
[=] Writing page 0  block: 00  data: 0x000880E0 pwd: 0xAA55BBBB
[#] Using Test Mode
[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[=] DEBUG: detectindala | 38
[-] No known 125/134 kHz tags found!
[=] Searching for auth LF and special cases...
[=] Couldn't identify a chipset

Suddenly, the LF side of the chip was no longer reachable. I tried lf tune, lf t5 detect, lf t5 p1detect, all the force block 0 writes from earlier, hail mary EM410 cloning with `lf em 410x clone --id 0102030405, but nothing seemed to revive it. I think it may well and truly be bricked, but if anyone has any other possible tests, I am more than happy to give it a go.

Here is the log file of my command prompt session for those that want to see the complete erraticism:

ProxSpace v3.11 - UCRT64~.txt (217.9 KB)

image
image690×432 70.2 KB

2

https://media.tenor.com/kWejy2kDcTwAAAAM/office.gif

maybe. probably. yeah.. likely.

2 Likes
3

@amal Given that it seems both might be bricked, I’m looking at swapping them out. Do you think that the dUG4T could pretty easily swap places for the flexMN or is the back of the hand not ideal for the more rigid bioresin/a flexUG4 would be better? Similarly, if I got the NeXT pulled out, could I get the NeXTv2 put back in p0 or is the pocket too small for v2?

I’m also trying to get my xSIID in my right hand moved further down towards my wrist. If we are able to pop it out and disinfect it, could we then just reload it in a 12g/13g and put it further down?

4

the dUG4T is thicker than the flexMN since it’s resin but it should be able to fit as long as the incision made to remove the flexMN is wide enough.

the NExT is 2.1mm diameter while the NExT v2 is 3mm and around 1mm longer.. but the body tends to stretch a little.. as long as the removal process leaves enough of a deep pocket that the NExT v2 won’t zipper-heal it’s way back out of the incision, it should be fine.. but if you want a no-fuss install I’d inject the NExT v2 in a new spot.

if working with a professional who can autoclave the xSIID and use a sterile piercing needle (11g is the typical size) to make an incision and pocket, then remove the needle and insert the xSIID into the pocket, this should be fine. I would not try to put the xSIID through the needle since it’s difficult to ensure it ejects out of the needle without using additional tools, which are usually metal, and could damage the xSIID.

1 Like