Im trying to clone my Hitag tag for work both as an experiment but also because I want a second tag. I am under the impression that the system we use at work are only utilising the UID of the card since there are a reader both on the entry gate as well as the admin building.
My primary concern is getting it to work on the entry gate, as I have a code that also works for the admin building (ie either using the tag or code will give me entry into the building). But the entry gate is badge only, reading the existing tag is peachy enough, but actually getting the UID written to a hitag(2) protocol can, AND finding such a card is where I am stuck at.
Because I tried writing it to a TS5557 card and while the UID got applied, the both readers refuse to acknowledge the card making me suspect that the reader ONLY listens for an accepts hitag protocols.
is it a HITAG S? those support challenge / response security features based on 40 bit keys and you canāt clone that to a T5577.. it doesnāt have the feature set.
The problem is that HITAG chips are āreader talk firstā chips, while T5577 chips are chip talk first. When a T5577, EM41xx, HID Prox, etc. are powered up, they just start yelling their ID into the void. The HITAG is a gentleman.. it waits for the reader to specifically call for IDs using an anti-collision sequence.
Bits 7-4; RFU (always 0)
Bit 3; 0 = Password Mode (not Crypto Mode so no Crypto1)
Bits 2-1; 11 = Hitag 2 type
Bit 0; 0 = Manchester encoding (not Biphase)
So the chip is a HITAG 2. There is a mode called Public TTF mode these chips can be in which dose not utilize the password feature so it might be possible for a T5577 to emulate the UID. Unfortunately your HITAG 2 chip is in password mode, not public mode. It is not using crypto challenge / response, just plain password mode.. which is something.. but still the T5577 does not have a way to handle password authentication commands.
If youāre using a recent Iceman firmware and client you could try using lf hitag clone --t55x7 -u 707E5F1F to write the UID to your T5577. If not, you can manually configure your T5577 using;
I already have a T5577 that has the UID written to it and it didnāt work. So is there anything I can do from this point to progress?. I just find it odd that we have 2 different readers, one for the gate and one of the office that isnāt the same ones, and ideally I would be more than happy if I could just get the gate working.
But I take it the way forward from this point wonāt be easy with the Proxmark3 unless I want to drag it with me to emulate the card, which isnāt going to work.
Given the information above, this is very likely inaccurate. Your source FOB has password mode enabled. Youāve copied the UID to a T5577. The clone doesnāt work at either reader. To me, this means the access system that controls both the door and gate are actually using the password feature enabled on your fob. Your T5577 chip lacks this feature, hence it does not work.
I havenāt played with HiTag for a while and it was not very successful, it was for a car, and I found some good documentation (you woukd need access to the reader to use it) but at the same time I found a workaround and didnāt have to deal with the HiTag againā¦
What I would try is rather than drill down in the HiTag menu, go via the T5577 commands.
Maybe something like
lf t55xx clone -t hitag2 -u [UID]
Al though, as mentioned above, the UID only probably wont work
BUT
You might be able to manually write the block
I detailed this already. The manual process of writing block 0 is what puts the T5577 into āhitag modeā.. it configures the analog front-end of the chip to operate in a similar fashion to how hitag chips work, however they still do not support reader-talk-first like real hitag chips do.. so ymmv. Writing block 1 is what actually programs the memory correctly to output what the hitag read expects as a response.. so if youāre timing is lucky the chip will transmit just after the reader makes its request.. even though the chip wonāt hear it. Itās all about timing.
That said, like I mentioned above, the T5577 doesnāt have any idea how to do the password operation the real hitag does.. and since your hitag is in password mode, chances are even if you got lucky and the reader received the UID at just the right timing, the next operation would likely be a password operation and it would fail.
Which brings me back to one of my original questions. Is there some way to clone a hitag tag, much like other tags. And im talking in general here and not just t5577
[-] No known 125/134 kHz tags found!
[=] Searching for auth LF and special casesā¦
[=] Couldnāt identify a chipset
[usb] pm3 ā lf t5 detect
[!] Could not detect modulation automatically. Try setting it manually with ālf t55xx configā
