Proxmark3 easy - cloning HID Prox (em 4305) key fob

ggww · October 16, 2024, 9:18am

I have a HID Prox Key fob which I tried to clone but unfortunately couldnt’ figure out how.

here is the output from the key:

usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 2xx CN: 111xx parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 38xx CN: 29xx parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556AA9556669AAxx

[=] raw: 000000000000002007e056xx

[+] Valid HID Prox ID found!

[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try lf em 4x05 commands
[usb] pm3 → lf hid read
[+] [H10301 ] HID H10301 26-bit FC: 2xx CN: 111xx parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 38xx CN: 29xx parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556AA9556669AAxx

[=] raw: 000000000000002007e056xx

[usb] pm3 → lf em 4x05 dump
[=] Found a EM4305 tag

I tried a few different ways to clone it to the same type of key fob with no luck:

command tried so far:

lf hid clone --em -w H10301 --fc 2xx --cn 111xx (also w/o --em)
lf hid clone --em -r 2007e056xx (also w/o --em)
lf hid clone -w ind26 --fc 38xx --cn 29xx --em

lf indala clone --fc 38xx --cn 29xx --em
lf indala clone --fc 38xx --cn 29xx --4035

all these commands execute ok without error but it didn’t write to the new card.

Any help will be much appreciated.

Equipter · October 16, 2024, 8:00pm

lf hid clone -w h10301 --fc [fc value] --cn [cn value]

if you’re cloning to a T5577 that’s all you’ll need. if you’re cloning to em4305 you’ll need to add --em to the end of the command

edit:

what new card? what did you buy specifically? is it another hidprox fob exactly the same?

ggww · October 16, 2024, 8:57pm

Thanks Equipter, yes the new card looks exactly the same and the “lf seach” command produced same sort of information.
I added “–em” sometimes not as the last parameter but hope that doesn’t make a difference.

Equipter · October 16, 2024, 9:52pm

oh then you’ll need to wipe it with the password before you can write to it.

Hid prox creds are em4305 with the password “PROX” in ascii converted hex (hilarious right)

 lf em 4x05 wipe -p 50524F58

lf hid clone -w h10301 --fc [fc] --cn [cn] --em

you don’t need to put the password back on. it’s not used by the system it’s just there for HID to be able to configure the chips to be different hidprox bitlengths and formats

hope this helps! let me know if it doesn’t (it should) and we will investigate further

ggww · October 17, 2024, 8:59am

Hi Equipter,

Legend!, it works like a charm after running the wipe command. I actually tried the wipe command without the password but it didn’t work as expected.

Another quesiton, can I clone this thing to the HID ProxCard target?

the output from that card is as below:

[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 118 CN: 32496 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 1895 CN: 3824 parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D5559555565A9A5AAA6A955

[=] raw: 000000000000002004ecfde0

[+] Valid HID Prox ID found!

[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands
[usb] pm3 → lf t55xx detect
[=] Chip type… T55x7
[=] Modulation… FSK2a
[=] Bit rate… 4 - RF/50
[=] Inverted… Yes
[=] Offset… 33
[=] Seq. terminator… No
[=] Block0… 00107060 (auto detect)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

I have tried

lf t55xx wipe
lf hid clone -w h10301 --fc [fc] --cn [cn]
but this doesn’t work for me.

thanks a tone!

Equipter · October 17, 2024, 9:08am

you want to clone this t5577 encoded as h10301 to the em4305 from earlier? or the reverse? i’m confused

the lf hid clone command should just work off the bat (no em needed but i see you’ve got that covered)

where did this t5577 come from?

ggww · October 17, 2024, 9:14am

Hi Equipter, This is a blank card I had earlier, I was trying to copy the EM key fob to this card to see if that will also work.
it behaves just like what occured to the key fob (that I can’t write to it prior to running the magic command you showed). is there another magic wipe command for this card? but the det output did say there is no password set.

cheers,

Equipter · October 17, 2024, 9:48am

you should be able to just overwrite it since there’s no password set.

you can do lf t55 wipe

for shits and giggles but i don’t know that it will do anything to help since there should be nothing impeding your write command from working anyway

try holding it an inch above the lf antenna

ggww · October 17, 2024, 11:19am

THanks mate, this is indeed very strange, I have tried all these now, I start suspecting there is a problem with the card itself.

Equipter · October 17, 2024, 11:59am

likely a problem because it should be a flawless write.