Recovering a ioProx fob

[rookiematador97]

Hello,
I am new to this community so I apologize for the ignorance.
I have accidentally wiped my ioProx fob with my Proxmark, when I meant to wipe another card.
Before I wiped it, I did lf search on my fob and the following was the result:

[+] IO Prox - XSF(01)2d:26024, Raw: 00784b60365d4753 ( ok )

I am not sure if the digits above are sufficient to repair the fob.

Based on forums I’ve read, it appears to be possible to at least clone it to a T55XX card. Although cloning it would be nice, I’d like to get the fob to work again.

I tried to write back to the ioProx fob and a T55XX card the following command:

lf io clone --vn 1 --fc 45 --cn 26024

Although it does not appear to work at all.
Does anyone know how to recover and clone an ioProx card based on the information above?
Guide I’ve been following which failed to clone to t55XX:

Cloning a Kantech ioProx?

Has someone in here succesfully cloned a “Kantech ioProx - Keyfob” to the xEM/NeXT chip? If so, could you kindly write a “how to”? i found this through a quick google search: https://bit.ly/2P1P5Zp Is it really “that easy”? Thank’s in advance!

Equipment: Proxmark: NFC RFID Credit Card Reader, NFC RFID IC Card 13.56Mhz ID Card 125Khz Contactless Smart Card Reader Writer, 512kb Memory IC ID Card Copier Reader Writer with UID Cards Key Fob 1 T5577 Card 3 UID Cards : Amazon.ca: Electronics

[Aoxhwjfoavdlhsvfpzha]

What command did you run that wiped the tag?

Can you post the full output of running lf search on the fob now?

[rookiematador97]

Hello,
I don’t recall the command, I’ll take a look.
As per lf search, this is the result when I use it on the ioProx fob:

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset

The “Couldn’t identify a chipset” makes me believe that the fob is broken.

I do have another HID EM4x05 / EM4x69 fob, although when I try to clone the ioProx fob onto the HID, it does not work. Any thoughts?

[Aoxhwjfoavdlhsvfpzha]

It’s weird that it doesn’t identify it at all. You might try an lf search -u just for the fun of it

HID Chips are password locked by default:

Proxmark3 easy - cloning HID Prox (em 4305) key fob

oh then you’ll need to wipe it with the password before you can write to it. Hid prox creds are em4305 with the password “PROX” in ascii converted hex (hilarious right) lf em 4x05 wipe -p 50524F58 lf hid clone -w h10301 --fc [fc] --cn [cn] --em you don’t need to put the password back on. it’s not used by the system it’s just there for HID to be able to configure the chips to be different hidprox bitlengths and formats hope this helps! let me know if it doesn’t (it should) and we will inv…

lf em 4x05 wipe -p 50524F58

and then lf io clone --vn 1 --fc 45 --cn 26024 --em

Should work for that, I believe

[rookiematador97]

Thank you for your help! See below for the output from the two commands above.

[usb] pm3 --> lf io clone --vn 1 --fc 45 --cn 26024 --em

[+] IO raw bits:
[+] 0000000001111000010010110110000000110110010111010100011101010011

[=] Preparing to clone ioProx to EM4305/4469 with Version: 1 FC: 45 (0x2d) CN: 26024
[+] Blk | Data
[+] ----±-----------
[+] 00 | 0001825F
[+] 01 | FF87B49F
[+] 02 | C9A2B8AC
[=] 0001825f == 0001825f
[=] f92de1ff == f92de1ff
[=] 351d4593 == 351d4593
[+] Data written and verified
[+] Done!
[?] Hint: try lf io reader to verify

[usb] pm3 --> lf io reader
[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!!] CRC Error! Calculated CRC is 63 but card CRC is 144.
[=] Paradox - ID: 0040b9d00 FC: 75 Card: 40192, Checksum: 90, Raw: 0f096c06cba8ea600f096c06

[+] Valid Paradox ID found!

[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try lf em 4x05 commands

I had tried this exact commands before, unfortunately no avail. Do you know what to do about the “> [!!] CRC Error! Calculated CRC is 63 but card CRC is 144.”?
Also, should the FC, Card Number match the ones from the ioProx fob?

As per the lf search -u:

[usb] pm3 --> lf search -u

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-] No known 125/134 kHz tags found!
[=] Checking for unknown tags…

[=] FSK clock… no
[=] ASK clock… no
[=] NRZ clock… no
[=] PSK clock… detected
[=] PSK demodulation… failed
[-] Failed to demodulated signal
[=] Couldn’t identify a chipset

[Aoxhwjfoavdlhsvfpzha]

@rookiematador97

Also, should the FC, Card Number match the ones from the ioProx fob?

This part?

@rookiematador97

Paradox - ID: 0040b9d00 FC: 75 Card: 40192,

That’s the PM3 trying to read it as the wrong protocol, it’s not weird that it doesn’t match

@rookiematador97

“> [!!] CRC Error! Calculated CRC is 63 but card CRC is 144.”?

Unfortunately I’m not familiar with this, a quick google sounds like it might be related to the Paradox protocol it’s trying to read the card as, which would mean it probably isn’t an issue either

I’m not entirely certain why it isn’t cloning properly at this point. Fortunately there are people on here who know a lot more than me about stuff like this, so don’t lose hope quite yet!

[Iceman]

@rookiematador97

lf io clone --vn 1 --fc 45 --cn 26024

I would say your target might not have been wiped and unlocked from potential password before you tried cloning to it.