Proxmark cloning, multiple matching formats

Support
1

I’m super new to electronic access control, fresh off the lock picking boat. I feel pretty dumb posting this and should probably be able to answer it from all the existing PM3 questions, but something is just not clicking. I’m trying to clone a source card to the T5577 card that came with the PM3.

The lf search returns 4 matching formats, and I can’t for the life of me figure out which result should go into what clone parameters, or what multiple results even means - examples/tutorials I’ve seen usually return just one format

[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [HCP32 ] HID Check Point 32-bit FC: 0 CN: 4150603
[+] [HPP32 ] HID Hewlett-Packard 32-bit FC: 1013 CN: 177689600
[+] [Kantech ] Indala/Kantech KFS 32-bit FC: 213 CN: 21226
[+] [WIE32 ] Wiegand 32-bit FC: 4010 CN: 42453
[=] found 4 matching formats
[+] DemodBuffer:
[+] 1D555A9556AA99999966A666

[=] raw: 00000000000000381faaa5d5

[+] Valid HID Prox ID found!

[+] Chipset detection: EM4x05 / EM4x69

The 4x05 dump shows read denied, and 4x05 chk finds a valid password of 50524F58. But, I have no idea if that’s even actually relevant to cloning.

[usb] pm3 → lf em 4x05 dump
[=] Found a EM4305 tag

[=] Addr | data | ascii |lck| info
[=] -----±---------±------±–±----
[=] 00 | 00040072 | …r | ? | Info/User
[=] 01 | 6D7CC5D9 | m|… | ? | UID
[=] 02 | | | | Password write only
[=] 03 | | | | User read denied
[=] 04 | | | | Config read denied
[=] 05 | | | | User read denied
[=] 06 | | | | User read denied
[=] 07 | | | | User read denied
[=] 08 | | | | User read denied
[=] 09 | | | | User read denied
[=] 10 | | | | User read denied
[=] 11 | | | | User read denied
[=] 12 | | | | User read denied
[=] 13 | | | | User read denied
[=] 14 | | | | Lock read denied
[=] 15 | | | | Lock read denied
[=] -----±---------±------±–±----

Any pointers in the right direction or explanation of what I’m looking at? Much appreciated in advance.

2

if it had this password it’s a HID product.

all of those formats are just the same data decoded in potentially valid ways, use the lf hid clone command to copy this onto a t5577/em4305.

2 Likes
3

Thank you. That narrows it down, but I think I’m still missing something.

Running ‘lf hid clone -w H10301 --fc 1013 --cn 4150603’ returns:
[!] The card data could not be encoded in the selected format.

running ‘lf hid clone -w H10301 --fc 213 --cn 21226’ seemed promising and gave me
[=] Preparing to clone HID tag
[+] [H10301 ] HID H10301 26-bit FC: 213 CN: 21226 parity ( ok )
[?] Hint: try lf hid reader to verify
[=] Done!

But trying to validate afterwards it seems like nothing actually took:
[usb] pm3 → lf t55xx info
[usb] pm3 → lf t55xx info
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands

Do you know is there a step or 3 I’m missing? Or is there any prep I need to do to the target card before?

4

you are missing something. you have selected the format as H10301 which is 26 bit. the information in your initial post shows you have a 32bit fob. encode as the original format.

5

That makes sense. That’d be the HCP32 or HPP32 or etc. right? If I’ve got that right, I still seem to be running into issues,

‘lf hid clone -w HCP32 --fc 0 --cn 4150603’ also returns
‘[!] The card data could not be encoded in the selected format.’

‘lf hid clone -w HPP32 --fc 1013 --cn 177689600’
Seemed promising but didn’t seem to take either, much the same as the Kantech & WIE32 for good measure

[usb] pm3 → lf hid clone -w HPP32 --fc 1013 --cn 177689600
[=] Preparing to clone HID tag
[+] [HPP32 ] HID Hewlett-Packard 32-bit FC: 1013 CN: 0
[?] Hint: try lf hid reader to verify
[=] Done!
[usb] pm3 → lf hid read
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx