I’m struggling to copy an HID fob. I’ve tried following similar threads but none of the solutions seem to work for me.
[usb] pm3 --> lf search
[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] [H10301 ] HID H10301 26-bit FC: 197 CN: 48122 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 3163 CN: 3066 parity ( ok )
[=] found 2 matching 26-bit formats
[=] Trying with a preamble bit...
[+] [ind27 ] Indala 27-bit FC: 7725 CN: 14324
[+] [indasc27] Indala ASC 27-bit FC: 4575 CN: 7132
[+] [Tecom27 ] Tecom 27-bit FC: 879 CN: 64464
[=] found 3 matching 27-bit formats
[=] raw: 0000000000000020078b77f4
[+] Valid HID Prox ID found!
[+] Chipset... EM4x05 / EM4x69
[?] Hint: Try `lf em 4x05` commands
I have a card and a fob I’ve tried to copy onto.
The Card:
[usb] pm3 --> lf search
[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID 3D00D51E2C
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : BC00AB7834
[=] HoneyWell IdentKey
[+] DEZ 8 : 13966892
[+] DEZ 10 : 0013966892
[+] DEZ 5.5 : 00213.07724
[+] DEZ 3.5A : 061.07724
[+] DEZ 3.5B : 000.07724
[+] DEZ 3.5C : 213.07724
[+] DEZ 14/IK2 : 00262006971948
[+] DEZ 15/IK3 : 000807465089076
[+] DEZ 20/ZK : 11120000101107080304
[=]
[+] Other : 07724_213_13966892
[+] Pattern Paxton : 1038703660 [0x3DE95C2C]
[+] Pattern 1 : 14896340 [0xE34CD4]
[+] Pattern Sebury : 7724 85 5578284 [0x1E2C 0x55 0x551E2C]
[+] VD / ID : 061 / 0013966892
[+] Pattern ELECTRA : 15616 13966892
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[!] timeout while waiting for reply
[#] unknown command:: 0x037a
[!] timeout while waiting for reply
[#] unknown command:: 0x037e
[!] timeout while waiting for reply
[+] Chipset... EM4x70
[?] Hint: Try `lf em 4x70` commands
The fob:
[usb] pm3 --> lf search
[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID 0000002049
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 0000000492
[=] HoneyWell IdentKey
[+] DEZ 8 : 00008265
[+] DEZ 10 : 0000008265
[+] DEZ 5.5 : 00000.08265
[+] DEZ 3.5A : 000.08265
[+] DEZ 3.5B : 000.08265
[+] DEZ 3.5C : 000.08265
[+] DEZ 14/IK2 : 00000000008265
[+] DEZ 15/IK3 : 000000000001170
[+] DEZ 20/ZK : 00000000000000040902
[=]
[+] Other : 08265_000_00008265
[+] Pattern Paxton : 1334857 [0x145E49]
[+] Pattern 1 : 5888 [0x1700]
[+] Pattern Sebury : 8265 0 8265 [0x2049 0x0 0x2049]
[+] VD / ID : 000 / 0000008265
[+] Pattern ELECTRA : 0 8265
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[!] timeout while waiting for reply
[#] unknown command:: 0x037a
[!] timeout while waiting for reply
[#] unknown command:: 0x037e
[!] timeout while waiting for reply
[+] Chipset... EM4x70
[?] Hint: Try `lf em 4x70` commands
[usb] pm3 -->
For both I’ve tried permutations of:
lf hid clone -r 20078b77f4 -em
lf em 4x05 wipe -p 50524F58
lf hid clone -w H10301 --fc 197 --cn 48122 --em
lf io clone --vn 2 --fc 197 --cn 48122
However whenever I then run the read I see nothing. e.g.
[usb] pm3 --> lf hid clone -w H10301 --fc 197 --cn 48122 --em
[!] Beware some EM4305 tags don't support FSK and datarate = RF/50, check your tag copy!
[=] Preparing to clone HID tag
[+] [H10301 ] HID H10301 26-bit FC: 197 CN: 48122 parity ( ok )
[+] Done!
[?] Hint: Try `lf hid reader` to verify
[usb] pm3 --> lf hid reader
[usb] pm3 -->
Not sure what else to try, I’m also not sure how to check the datarate for the tag. Any suggestions greatly appreciated.