Proxmark 3 HID Clone to card or fob

RichardH · November 1, 2025, 11:41am

I’m struggling to copy an HID fob. I’ve tried following similar threads but none of the solutions seem to work for me.

[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] [H10301  ] HID H10301 26-bit                FC: 197  CN: 48122  parity ( ok )
[+] [ind26   ] Indala 26-bit                    FC: 3163  CN: 3066  parity ( ok )
[=] found 2 matching 26-bit formats

[=] Trying with a preamble bit...
[+] [ind27   ] Indala 27-bit                    FC: 7725  CN: 14324
[+] [indasc27] Indala ASC 27-bit                FC: 4575  CN: 7132
[+] [Tecom27 ] Tecom 27-bit                     FC: 879  CN: 64464
[=] found 3 matching 27-bit formats

[=] raw: 0000000000000020078b77f4

[+] Valid HID Prox ID found!

[+] Chipset... EM4x05 / EM4x69
[?] Hint: Try `lf em 4x05` commands

I have a card and a fob I’ve tried to copy onto.

The Card:

[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID 3D00D51E2C
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID      : BC00AB7834
[=] HoneyWell IdentKey
[+]     DEZ 8          : 13966892
[+]     DEZ 10         : 0013966892
[+]     DEZ 5.5        : 00213.07724
[+]     DEZ 3.5A       : 061.07724
[+]     DEZ 3.5B       : 000.07724
[+]     DEZ 3.5C       : 213.07724
[+]     DEZ 14/IK2     : 00262006971948
[+]     DEZ 15/IK3     : 000807465089076
[+]     DEZ 20/ZK      : 11120000101107080304
[=]
[+] Other              : 07724_213_13966892
[+] Pattern Paxton     : 1038703660 [0x3DE95C2C]
[+] Pattern 1          : 14896340 [0xE34CD4]
[+] Pattern Sebury     : 7724 85 5578284  [0x1E2C 0x55 0x551E2C]
[+] VD / ID            : 061 / 0013966892
[+] Pattern ELECTRA    : 15616 13966892
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[!] timeout while waiting for reply
[#] unknown command:: 0x037a
[!] timeout while waiting for reply
[#] unknown command:: 0x037e
[!] timeout while waiting for reply
[+] Chipset... EM4x70
[?] Hint: Try `lf em 4x70` commands

The fob:

[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID 0000002049
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID      : 0000000492
[=] HoneyWell IdentKey
[+]     DEZ 8          : 00008265
[+]     DEZ 10         : 0000008265
[+]     DEZ 5.5        : 00000.08265
[+]     DEZ 3.5A       : 000.08265
[+]     DEZ 3.5B       : 000.08265
[+]     DEZ 3.5C       : 000.08265
[+]     DEZ 14/IK2     : 00000000008265
[+]     DEZ 15/IK3     : 000000000001170
[+]     DEZ 20/ZK      : 00000000000000040902
[=]
[+] Other              : 08265_000_00008265
[+] Pattern Paxton     : 1334857 [0x145E49]
[+] Pattern 1          : 5888 [0x1700]
[+] Pattern Sebury     : 8265 0 8265  [0x2049 0x0 0x2049]
[+] VD / ID            : 000 / 0000008265
[+] Pattern ELECTRA    : 0 8265
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[!] timeout while waiting for reply
[#] unknown command:: 0x037a
[!] timeout while waiting for reply
[#] unknown command:: 0x037e
[!] timeout while waiting for reply
[+] Chipset... EM4x70
[?] Hint: Try `lf em 4x70` commands
[usb] pm3 -->

For both I’ve tried permutations of:

lf hid clone -r 20078b77f4 -em

lf em 4x05 wipe -p 50524F58

lf hid clone -w H10301 --fc 197 --cn 48122 --em

lf io clone --vn 2 --fc 197 --cn 48122

However whenever I then run the read I see nothing. e.g.

[usb] pm3 --> lf hid clone -w H10301 --fc 197 --cn 48122 --em
[!] Beware some EM4305 tags don't support FSK and datarate = RF/50, check your tag copy!
[=] Preparing to clone HID tag
[+] [H10301  ] HID H10301 26-bit                FC: 197  CN: 48122  parity ( ok )
[+] Done!
[?] Hint: Try `lf hid reader` to verify
[usb] pm3 --> lf hid reader
[usb] pm3 -->

Not sure what else to try, I’m also not sure how to check the datarate for the tag. Any suggestions greatly appreciated.

Aoxhwjfoavdlhsvfpzha · November 1, 2025, 12:16pm

I don’t know if this variety of EM chip is capable of cloning in this way, the --em flag specifies different chipsets:

--em optional - specify writing to EM4305/4469 tag

It would probably be easiest to pick up some new blanks, T5577 or a compatible EM

TSMC55 · November 1, 2025, 10:06pm

I don’t think the EM chip you have can be converted to a HID.

I’d suggest getting a new card and fob which contain T5577 chips as they can operate in both formats.

RichardH · November 20, 2025, 7:31pm

I got some 125KHz T5577/EM4305 Writable RFID Keychains NFC Tokens however I seem to be in the same place.

[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 3D00D51E2C
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : BC00AB7834
[=] HoneyWell IdentKey
[+] DEZ 8 : 13966892
[+] DEZ 10 : 0013966892
[+] DEZ 5.5 : 00213.07724
[+] DEZ 3.5A : 061.07724
[+] DEZ 3.5B : 000.07724
[+] DEZ 3.5C : 213.07724
[+] DEZ 14/IK2 : 00262006971948
[+] DEZ 15/IK3 : 000807465089076
[+] DEZ 20/ZK : 11120000101107080304
[=]
[+] Other : 07724_213_13966892
[+] Pattern Paxton : 1038703660 [0x3DE95C2C]
[+] Pattern 1 : 14896340 [0xE34CD4]
[+] Pattern Sebury : 7724 85 5578284 [0x1E2C 0x55 0x551E2C]
[+] VD / ID : 061 / 0013966892
[+] Pattern ELECTRA : 15616 13966892
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[!] timeout while waiting for reply
[#] unknown command:: 0x037a
[!] timeout while waiting for reply
[#] unknown command:: 0x037e
[!] timeout while waiting for reply
[+] Chipset… EM4x70
[?] Hint: Try lf em 4x70 commands

This looks to be exactly the same as the previous ones. I’ve tried lf t55xx wipe to try to reset it, but also the same.

Any help much appreciated. Thanks

Not · November 21, 2025, 12:12am

Try lf t55 detect on the new token(s).

Aoxhwjfoavdlhsvfpzha · November 21, 2025, 12:53am

Also, can we see the output from the PM3 client starting up?

RichardH · November 21, 2025, 9:03pm

Thanks. This is what I get.

c:\Proxmark\ProxSpace-master>runme64.bat
[=] Session log C:\Proxmark\ProxSpace-master\pm3/.proxmark3/logs/log_20251121210130.txt
[+] loaded C:\Proxmark\ProxSpace-master\pm3/.proxmark3/preferences.json
[+] Using UART port COM4
[+] Communicating with PM3 over USB-CDC

8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 “Y8888P”

[ too many secrets! ]

[ Proxmark3 ]
MCU....... AT91SAM7S512 Rev B
Memory.... 512 KB ( 67% used )
[#] unknown command:: 0x0147
[!] timeout while waiting for reply
Client.... Iceman/master/v4.20728-90-ge2751606b 2025-10-29 23:52:11
[usb] pm3 → lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with ‘lf t55xx config’
[usb] pm3 → lf t55xx config
[=] — current t55xx config --------------------------
[=] Chip type… T55x7
[=] Modulation… ASK
[=] Bit rate… 0 - RF/8
[=] Inverted… No
[=] Offset… 0
[=] Seq. terminator… No
[=] Block0… 00000000 (n/a)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

Aoxhwjfoavdlhsvfpzha · November 21, 2025, 11:59pm

Can you try re-flashing the firmware to the PM3?

Also, can you confirm that you edited the Makefile.Platform file if you are using a PM3 Easy?

RichardH · November 22, 2025, 3:16pm

I had already updated it, as per the video, before trying

# By default PM3 RDV4 image is generated.

Comment the line below and uncomment further down according to which device you have

#PLATFORM=PM3RDV4

# For PM3 RDV1, RDV2, Easy or rysccorps etc

uncomment the line below

PLATFORM=PM3GENERIC

Aoxhwjfoavdlhsvfpzha · November 22, 2025, 3:20pm

These errors really make it sound like the client and the device are disagreeing to me, as seems to be confirmed here too:

github.com/Proxmark/proxmark3

#db# unknown command:: 0x0399 error when ever I try and read from a iclass tag

opened 02:52AM - 04 Mar 17 UTC

closed 08:41PM - 06 Mar 17 UTC

thesle3p

So when ever I try and read from a Iclass tag with the proxmark I get a ```#db# …unknown command:: 0x0399``` error, tried with multiple cards and same issue, I can pull the CSN off the card using ``` hf iclass readblk b 0A k <key>``` but again get the ```#db# unknown command:: 0x0399 ``` error. Any ideas as to whats going on here? Below is a copypasta of trying to dump a card. ``` hf iclass dump k <key> Authing with diversified key: <key> #db# unknown command:: 0x0399 Waiting for a response from the proxmark... Don't forget to cancel its operation first by pressing on the button Auth Command execute timeout Authing with diversified key: <key> #db# unknown command:: 0x0399 Waiting for a response from the proxmark... Don't forget to cancel its operation first by pressing on the button Auth Command execute timeout ```

Are you certain the PM3 is flashing correctly when you run pm3-flash-all?

RichardH · November 22, 2025, 3:30pm

Thanks - I’ve just been following the video and re-making the images. When I run it now I get the following error

[=] Session log C:\Proxmark\ProxSpace-master\pm3/.proxmark3/logs/log_20251122152810.txt
[+] loaded C:\Proxmark\ProxSpace-master\pm3/.proxmark3/preferences.json
[-] Error - can’t find bootrom.elf
[!!] Aborted on error

[=] Have a nice day!

RichardH · November 22, 2025, 4:00pm

I think it is to do with this error I’ve just spotted earlier in the logs.

[*] MAKE bootrom/all
/bin/sh: line 1: arm-none-eabi-gcc: command not found
compiler version:
[=] CHECK version_pm3.c
[-] CC version_pm3.c
make[1]: arm-none-eabi-gcc: No such file or directory
make[1]: *** [../common_arm/Makefile.common:133: obj/version_pm3.o] Error 127
make: *** [Makefile:168: bootrom/all] Error 2

RichardH · November 22, 2025, 5:09pm

Ran

pacman -S mingw-w64-x86_64-arm-none-eabi-gcc

Now updated.

pm3 ~/proxmark3$ ./pm3-flash-all
[=] Session log C:\Proxmark\ProxSpace-master\pm3/.proxmark3/logs/log_20251122170301.txt
[+] loaded C:\Proxmark\ProxSpace-master\pm3/.proxmark3/preferences.json
[+] About to use the following files:
[+] C:\Proxmark\ProxSpace-master\pm3\proxmark3\client../bootrom/obj/bootrom.elf
[+] C:\Proxmark\ProxSpace-master\pm3\proxmark3\client../armsrc/obj/fullimage.elf
[+] Loading ELF file C:\Proxmark\ProxSpace-master\pm3\proxmark3\client../bootrom/obj/bootrom.elf
[+] ELF file version Iceman/master/v4.20728-153-gd29d912ff-suspect 2025-11-22 16:15:45 7bbbe9cd7

[+] Loading ELF file C:\Proxmark\ProxSpace-master\pm3\proxmark3\client../armsrc/obj/fullimage.elf
[+] ELF file version Iceman/master/v4.20728-153-gd29d912ff-suspect 2025-11-22 17:01:53 7bbbe9cd7

[+] Waiting for Proxmark3 to appear on COM4
[|] 59 found
[+] Entering bootloader…
[+] (Press and release the button only to abort)
[+] Trigger restart…
[+] Waiting for Proxmark3 to appear on COM4
[|] 49 found
[=] Available memory on this board: 512K bytes

[=] Permitted flash range: 0x00100000-0x00180000
[+] Loading usable ELF segments:
[+] 0: V 0x00100000 P 0x00100000 (0x00000200->0x00000200) [R X] @0x94
[+] 1: V 0x00200000 P 0x00100200 (0x00000f4c->0x00000f4c) [R X] @0x298

[+] Loading usable ELF segments:
[+] 0: V 0x00102000 P 0x00102000 (0x00053f0c->0x00053f0c) [R X] @0x98
[+] 1: V 0x00200000 P 0x00155f0c (0x00001cae->0x00001cae) [R X] @0x53fa8
[=] Note: Extending previous segment from 0x53f0c to 0x55bba bytes

[+] Flashing…
[+] Writing segments for file: C:\Proxmark\ProxSpace-master\pm3\proxmark3\client../bootrom/obj/bootrom.elf
[+] 0x00100000..0x001001ff [0x200 / 1 blocks]
[+] . ok
[+] 0x00100200..0x0010114b [0xf4c / 8 blocks]
[+] … ok

[+] Writing segments for file: C:\Proxmark\ProxSpace-master\pm3\proxmark3\client../armsrc/obj/fullimage.elf
[+] 0x00102000..0x00157bb9 [0x55bba / 686 blocks]

$$$$$$\ $$$$$$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$\ $$
_$$ |$$ __$$\ $$ _____|$$$\ $$$ |$$ __$$\ $$$\ $$ |
$$ | $$ / _|$$ | $$$$\ $$$$ |$$ / $$ |$$$$\ $$ |
$$ | $$ | $$$$$\ $$$$$$ $$ |$$$$$$$$ |$$ $$$$ |
$$ | $$ | $$ | $$ $$$ $$ |$$ $$ |$$ $$$$ |
$$ | $$ | $$\ $$ | $$ |$ /$$ |$$ | $$ |$$ |$$$ |
$$$$$$\ $$$$$$ |$$$$$$$$\ $$ | _/ $$ |$$ | $$ |$$ | $$ |
_| _____/ __|_| _|_| _|_| _|
…
…
… ok

[+] All done

[=] Have a nice day!

Now when it connects I get…

[=] Session log C:\Proxmark\ProxSpace-master\pm3/.proxmark3/logs/log_20251122170425.txt
[+] loaded C:\Proxmark\ProxSpace-master\pm3/.proxmark3/preferences.json
[+] Using UART port COM7
[+] Communicating with PM3 over USB-CDC

8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 “Y8888P”

[ 343 Gulity Spark: offline! ]

[ Proxmark3 ]
MCU....... AT91SAM7S512 Rev B
Memory.... 512 KB ( 69% used )
Target.... PM3 GENERIC

Client.... Iceman/master/v4.20728-153-gd29d912ff 2025-11-22 16:18:10
Bootrom... Iceman/master/v4.20728-153-gd29d912ff-suspect 2025-11-22 16:15:45 7bbbe9cd7
OS........ Iceman/master/v4.20728-153-gd29d912ff-suspect 2025-11-22 17:01:53 7bbbe9cd7
[usb] pm3 →

So, the following have disappeared…

[#] unknown command:: 0x0147
[!] timeout while waiting for reply

Though I still get

[usb] pm3 → lf hid clone -w H10301 --fc 197 --cn 48122
[=] Preparing to clone HID tag
[+] [H10301 ] HID H10301 26-bit FC: 197 CN: 48122 parity ( ok )
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf hid clone -r 20078b77f4
[=] Preparing to clone HID tag using raw 20078b77f4
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf hid clone -w H10301 --fc 197 --cn 48122
[=] Preparing to clone HID tag
[+] [H10301 ] HID H10301 26-bit FC: 197 CN: 48122 parity ( ok )
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with ‘lf t55xx config’
[usb] pm3 → lf t55xx config
[=] — current t55xx config --------------------------
[=] Chip type… T55x7
[=] Modulation… ASK
[=] Bit rate… 0 - RF/8
[=] Inverted… No
[=] Offset… 0
[=] Seq. terminator… No
[=] Block0… 00000000 (n/a)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

[usb] pm3 →

RichardH · November 22, 2025, 5:18pm

I also tried the following but still no luck.

[usb] pm3 → lf t55xx wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0

[=] Begin wiping…
[=] Writing page 0 block: 00 data: 0x000880E0
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 → lf em 4x05 wipe -p 50524F58
[usb] pm3 → lf hid clone -r 20078b77f4
[=] Preparing to clone HID tag using raw 20078b77f4
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf hid clone -r 20078b77f4 --em
[!] Beware some EM4305 tags don’t support FSK and datarate = RF/50, check your tag copy!
[=] Preparing to clone HID tag using raw 20078b77f4
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf hid clone -w H10301 --fc 197 --cn 48122
[=] Preparing to clone HID tag
[+] [H10301 ] HID H10301 26-bit FC: 197 CN: 48122 parity ( ok )
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf hid clone -w H10301 --fc 197 --cn 48122 --em
[!] Beware some EM4305 tags don’t support FSK and datarate = RF/50, check your tag copy!
[=] Preparing to clone HID tag
[+] [H10301 ] HID H10301 26-bit FC: 197 CN: 48122 parity ( ok )
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 →

amal · November 22, 2025, 7:10pm

The fobs you bought off Amazon are not T5577. That is the problem.

RichardH · November 23, 2025, 9:58pm

Humm… that is what they are sold as. 125KHz T5577/EM4305 Writable RFID Keychains NFC Token. Is there a way I can prove this back to the seller because this does not seem to be correct?

Do these RFID 125KHz Blank Card Writable and Rewritable White T5577 RFID Copy Repeat 125khz Smart Access Control Clone Card Key Card Reader and Writer Program look correct?

Aoxhwjfoavdlhsvfpzha · November 23, 2025, 10:28pm

Is pretty compelling

The reviews don’t seem overly promising to me…

Perhaps DT’s card pack?

Pilgrimsmaster · November 23, 2025, 10:39pm

Also an LF T5577 detect

amal · November 23, 2025, 11:11pm

Amazon has become a hive of garbage similar to alibaba where product descriptions are just packed with keywords trying to rake in sales.. but what you get in the end will depend on a lot of pre-sale communication to ensure you getting what you actually want. If the vendor looks.. not.. domestic.. and the listing says “T5577/EM4305” which are to entirely different chip types.. then it’s going to be a crapshoot.