Proxmark3 scripts - lua, python

Support
1

paxton_clone.lua (18.1 KB)
The script automates the copying of Paxton fobs read - write.
It also allows manual input of data for blocks 4-7.
The third option is reading data stored in the log file and create new fob.
Additionally, the script calculates the ID for downgrading Paxton to EM4102.

t55_chk.lua (4.9 KB)
A simple script for searching the password for T5577. The script creates a
dictionary starting from the entered starting year to the entered ending year.
There are two search methods - DDMMYYYY or YYYYMMDD. Checking the entire year
takes about 1 minute and 50 seconds. Date from 1900 to 2100. The script may be
useful if the password is for example a date of birth.

Paxton_convert.py (4.6 KB)
Convert Paxton Net2 and Switch2 to EM4102

Paxton_switch.py (3.0 KB)
paxton_switch.py - Convert Paxton Switch2 to EM4102

PAXTON_NET.py (3.4 KB)
paxton_net.py - Convert Paxton Net2 to EM4102

lf_electra.lua (11.0 KB)
Cloning new ELECTRA tags or EM410x to T5577 tag. This script changes
block 0. Additional data is written to block 3 and 4. The last
ELECTRA ID can be accessed through the option ā€œ-cā€. For copy
directly from the original ELECTRA tag to T5577 is option ā€œ-eā€. For copy
from input EM4102 ID to T5577 is option ā€œ-sā€. Another option is cloning simple EM4102 to T5577.

5 Likes
2

All are included in the repo: GitHub - RfidResearchGroup/proxmark3: Iceman Fork - Proxmark3

5 Likes
3

t55_fix.lua (3.3 KB)

This simple script first checks if a password has been set for the T5577.
It uses the dictionary t55xx_default_pwds.dic for this purpose. If a password
is found, it uses the wipe command to erase the T5577. Then the reanimation
procedure is applied. If the password is not found or doesnā€™t exist the script
only performs the reanimation procedure. The script revives 99% of blocked tags.

5 Likes
4

v1.03
lf_t55xx_multiwriter.lua (7.1 KB)

This simple script stores 1, 2 or 3 different EM4102 on a single T5577.
There is an option to enter the number engraved on the fob in decimal form.
The script can therefore be useful if the original EM4102 doesnā€™t work but
has an engraved ID number. By entering such an ID as a single EM4102, we
can create a working copy of our damaged fob.
A tag T5577 created in this way works with the following USB readers:

  • ACM08Y
  • ACM26C
  • Sycreader R60D
  • Elatech Multitech TWN4
5 Likes
5

v1.0.1
lf_t55xx_fix.lua (4.3 KB)

v1.02 - fix error

print('Recovery of '..ac.cyan..'T5577'..ac.reset..' was unsuccessful !!!')

lf_t55xx_fix.lua (4.5 KB)

v1.19
paxton_clone.lua (18.0 KB)

6 Likes
6

v1.20
paxton_clone.lua (18.7 KB)

Added verification

print(ac.green..'  Verification successful. Data was written correctly.' .. ac.reset)

I manually modified Block 7. I added a 10-second pause in the code to have time to switch the FOBs. And here is the result :wink:

Capture_2025_03_18_16_55_16_131
Capture_2025_03_18_16_55_16_131868Ɨ753 22.7 KB

4 Likes
7

Capture_2025_03_20_14_54_40_429
Capture_2025_03_20_14_54_40_429916Ɨ761 41.2 KB

v1.05
lf_t55xx_multiwriter.lua (9.3 KB)

Added - verification blocks
If someone doesnā€™t want a timer - I made for tag swapping to test - just add ā€œā€“ā€ in the timer(3) lines

       write(blocks)
	   timer(3)
       verified = verify_written_data(blocks)
4 Likes
8

v1.06
Fix verification block 0
lf_t55xx_multiwriter.lua (9.4 KB)

Capture_2025_03_20_19_32_20_135
Capture_2025_03_20_19_32_20_135840Ɨ607 21 KB

Verification will be useful for anyone who has an RFID implant :wink:

4 Likes
9

I want to create a script similar to iCopy-X styleā€¦ reading RFIDā€¦ identificationā€¦ adding to a databaseā€¦ and writing to T5577ā€¦ does that make sense? Or is it a waste of my time? :thinking:

My next ideaā€¦ checking if the code is dynamic. That is, before creating the copy, re-reading the RFID that was in contact with the door reader to verify if the tagā€™s content hasnā€™t changed. Something like comparing the counter stored in the reader with the counter on the fob.

2 Likes
10

Like a menu or wrapper for the Proxmark?

11

Proxmark3 is a good toolā€¦ but in my opinion, it lacks automated functions that would simplify the process of copying fobs. Thatā€™s why someone came up with iCopy-X.

12

I think the Icopy-x is a Proxmark with a wrapper. Its too bad itā€™s pretty much dead and they havenā€™t released an update in 2-3 years.

13

Thatā€™s why Iā€™m thinking about scripts to automate the copying of fobs. Maybe then someone will realize that the iCopy-X device is unnecessary because Proxmark3 offers the same automation.

For example, my script automating the copying of Paxton fobs.

14

I think this would be wonderful and itā€™s something I wished existed for a while.