Recovering a ioProx fob

Hello,
I am new to this community so I apologize for the ignorance.
I have accidentally wiped my ioProx fob with my Proxmark, when I meant to wipe another card.
Before I wiped it, I did lf search on my fob and the following was the result:

[+] IO Prox - XSF(01)2d:26024, Raw: 00784b60365d4753 ( ok )

I am not sure if the digits above are sufficient to repair the fob.

Based on forums I’ve read, it appears to be possible to at least clone it to a T55XX card. Although cloning it would be nice, I’d like to get the fob to work again.

I tried to write back to the ioProx fob and a T55XX card the following command:

lf io clone --vn 1 --fc 45 --cn 26024

Although it does not appear to work at all.
Does anyone know how to recover and clone an ioProx card based on the information above?
Guide I’ve been following which failed to clone to t55XX:

Equipment: Proxmark: NFC RFID Credit Card Reader, NFC RFID IC Card 13.56Mhz ID Card 125Khz Contactless Smart Card Reader Writer, 512kb Memory IC ID Card Copier Reader Writer with UID Cards Key Fob 1 T5577 Card 3 UID Cards : Amazon.ca: Electronics

1 Like

What command did you run that wiped the tag?

Can you post the full output of running lf search on the fob now?

1 Like

Hello,
I don’t recall the command, I’ll take a look.
As per lf search, this is the result when I use it on the ioProx fob:

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset

The “Couldn’t identify a chipset” makes me believe that the fob is broken.

I do have another HID EM4x05 / EM4x69 fob, although when I try to clone the ioProx fob onto the HID, it does not work. Any thoughts?

1 Like

It’s weird that it doesn’t identify it at all. You might try an lf search -u just for the fun of it

HID Chips are password locked by default:

lf em 4x05 wipe -p 50524F58

and then lf io clone --vn 1 --fc 45 --cn 26024 --em

Should work for that, I believe

2 Likes

Thank you for your help! See below for the output from the two commands above.

[usb] pm3 --> lf io clone --vn 1 --fc 45 --cn 26024 --em

[+] IO raw bits:
[+] 0000000001111000010010110110000000110110010111010100011101010011

[=] Preparing to clone ioProx to EM4305/4469 with Version: 1 FC: 45 (0x2d) CN: 26024
[+] Blk | Data
[+] ----±-----------
[+] 00 | 0001825F
[+] 01 | FF87B49F
[+] 02 | C9A2B8AC
[=] 0001825f == 0001825f
[=] f92de1ff == f92de1ff
[=] 351d4593 == 351d4593
[+] Data written and verified
[+] Done!
[?] Hint: try lf io reader to verify

[usb] pm3 --> lf io reader
[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[!!] CRC Error! Calculated CRC is 63 but card CRC is 144.
[=] Paradox - ID: 0040b9d00 FC: 75 Card: 40192, Checksum: 90, Raw: 0f096c06cba8ea600f096c06

[+] Valid Paradox ID found!

[+] Chipset detection: EM4x05 / EM4x69
[?] Hint: try lf em 4x05 commands

I had tried this exact commands before, unfortunately no avail. Do you know what to do about the “> [!!] CRC Error! Calculated CRC is 63 but card CRC is 144.”?
Also, should the FC, Card Number match the ones from the ioProx fob?

As per the lf search -u:

[usb] pm3 --> lf search -u

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-] No known 125/134 kHz tags found!
[=] Checking for unknown tags…

[=] FSK clock… no
[=] ASK clock… no
[=] NRZ clock… no
[=] PSK clock… detected
[=] PSK demodulation… failed
[-] Failed to demodulated signal
[=] Couldn’t identify a chipset

This part?

That’s the PM3 trying to read it as the wrong protocol, it’s not weird that it doesn’t match

Unfortunately I’m not familiar with this, a quick google sounds like it might be related to the Paradox protocol it’s trying to read the card as, which would mean it probably isn’t an issue either

I’m not entirely certain why it isn’t cloning properly at this point. Fortunately there are people on here who know a lot more than me about stuff like this, so don’t lose hope quite yet!

1 Like

I would say your target might not have been wiped and unlocked from potential password before you tried cloning to it.

4 Likes