Here is the User guide.
1 Like
Ok so I downloaded NFCtaginfo, NFCtools, NFC and NFCtap (all on iOS) and none read my fob key. Again, its 1 fob key for BOTH these readers. So that probably means they are both low frequency?
Interesting the Schlage user guide above makes no mention of the protocol or RFID type etc. But I was able to unscrew the entire door lock and got the model number etc (attached photo) So what now? I guess my only option is to buy a diagnostic card? or if they are both low frequency am I good to go? Baltimore here. Hopelessly, technology unsavvy here. Thanks for all the responses.
1 Like
Hmmm, well OK.
The Schlage FE410F data sheet says
Credential: Supports smart and multi-technology aptiQ MIFARE classic or
aptiQ DESFire EV1
DT sell options for both of these
MIFARE classic
xM1
FlexM1 gen1
FlexM1 gen2a
FlexMT
DESFire EV1
FlexDF
but also likely to work
FlexDF2
xDF2
I still think we have a bit of work to do here to get this correct for you.
Of the above, Initially I would suggest you go down the Mifare path (because you can change the NUID numbers) however the DESFire are still viable.
If you can enroll them (home SHOULD be easy) Work you will need administrators on side.
If you can’t enroll, then of the Mifare, the FlexM1 gen2 would be my most reccomended, ONLY because you can use your phone to change the UID.
Otherwise you would need to buy a ProxMark3 and I don’t think you would have fun setting it up.
And you would likely only use it once
However, if we have a community member near Baltimore They maybe able to help you out.
@Satur9 springs to mind (Philidelphia) but my USA Georgraphy is not great.
@philidelphiaChickens may also be useful to try
@Satur9 is a very Knowledgeable and helpful member, plus for him having another “local” installer might be awesome for him.
HOWEVER
I still think we need to get to the bottom of you acess cards
Damn that is bothersome
Neither my georgraphy nor my geography or my spelling or my grammar are/is great
Anyway new post here is the manual for the Schlage
schlage-control-smart-interconnected-lock-installation-instructions-FE410F (1).pdf (9.2 MB)
interactive instructions here
The fob number you mentioned near the beginning is dual frequency, that isn’t a problem. There are dual frequency implants, and I wear a dual frequency ring.
Most locks I have played with use NFC (high frequency) but only really care about the UID.
The elevator reader appears to be low frequency. A diagnostic card will confirm this but it isn’t necessary. A proxmark 3 easy should make it easier to clone your fob. I am not sure that the low frequency side can be cloned with a phone to be honest.
There are basically three form factors for implants that you need to consider, as well as the capabilities.
There are the X series which are encapsulates in a bio glass. These tend to be smaller, are injected into the fascia but have worse connectivity.
Next come the flex series with a small oval shape. They can be installed either with an incision and a dermal lifter, or with a large (4 ga) needle to make a pocket. They have better range and connectivity than the glassies but are harder to install.
Finally there are the round flex series, these tend to be around an inch in diameter have the best connectivity but require a scalpel install.
As you can see there are tradeoffs between the different styles, but all styles have some options that should work for you.
yeah Im an ER doctor so Im fine carving out my own flesh for better connectivity:) As for administrator privileges my building is run by gen Z fascists. I can’t even pee without using a fob. So I would assume its’ a no for admin access - I don’t want to raise any flags and prefer to do it discreetly Honestly, I just need to be told what to do (when do you ever hear that from a doctor). I’ll buy a Proxmark if you all think that is the next step. If someone in the BMV area wants to help I would be honoured.
1 Like
You have a few of options available to you.
If you were to get a Proxmark, you could be self sufficient but your learning curve will be steep.
You would
- Buy proxmark3
- Confirm cards
- Buy implants
- Clone your access cards
- Write to implants
OR
- You could wait for @Satur9 to jump in here and see what he has to say and follow his local guidence as to whether he can help you which implants to get.
OR
- You could just best guess and “Wing it”
Buy a NExT Implant or xEM or FlexEM
AND
Blue cloner
AND
FlexM1 gen2a
Use your Blue Cloner to copy and write your hospital card to your LF Implant
Use your phone and MCT app to copy and write to your FlexM1
( There is a lot of guess work in this option )
OR
You wouldn’t need admin access you just need them to add your implant instead of your normal pass to their system. It is more secure as you can’t actually lose an implant. But that is your choice.
I work in Healthcare IT and I can’t say I have ever heard a doctor ask me what to do. But then the ones that need my advice tend to be smart enough to arrange meetings where I tell them without being asked. 
2 Likes
IF you are dealing with LF and Mifare 1K, your “best” may well be the FlexMT, The Range is fantastic so your coupling shouldn’t cause you any issues.
I had one, but did not install it.
I didn’t want it on the back of my hand, and I felt it was too large for my girly wrists.
I would reccomend you cut out a template
“33mm total diameter” to see how you would feel about it.
Maybe cut it out of a very flexible plastic, and stick it to your hand / wrist for a few days.
In saying all that, I would also say as you are a doctor, you will be aware of the risks installing this on the back of you hand, and your hands are you job!!!
An xSeries in your thenar space ( What we call #0 ) of each hand ( or the same hand depending on implants) will do minimal disruption for a shorter period of time…
The sacrifice would be reduced range on your readers.
If you went xSeries route an example would be
Left hand NExT for your Work access
Right Hand xM1 for home
(or the other way around)
OR
In either Left OR Right
xM1 and xEM
Also, you maybe able to help us ( the community out with this ) A simple and effective naming convention for install locations
OK. Thank for all this info and satire. We doctors are our own worst enemies. I would LOVE to help with the nomenclature - let me take a look at what has already been developed and I can work off that.
As for proceeding, Im thinking
1-wait for Satu9 to chime in if not
2-Ill buy a proxmark3 and “learn” as I go, all the while annoying all of you
3-help with nomenclature
One last question. I found “dangerous things” thru my google search. The name is epic but I am new to this space. If you were what top 2 other competitors should I check out? 
Sounds like a good plan.
@Satur9 is pretty active, so you shouldn’t have to wait long.
Also, you are not annoying at all, that’s what this forum is for.
That would be appreciated
I wouldn’t
The weakest answer is, that DT is in North America like you, therefore faster postage, same currency, timely support, supporting USA business etc.
There are some European “competition”, but just let me link you to the below thread and you can decide if you still want other links after you have read it.
Remembering, the votes are completely anonymous
I think the 96.4% rating speaks for itself
I’m just outside of Philly like an hour and a half from you. If definitely be willing to meet up if you want some help investigating or cloning. If you’re willing to buy a proxmark3 I think that’s a better option though. The community here is pretty good at getting people up and running on those. Teach a man to fish, and all that
2 Likes
I’m briefly up to speed with the details.
Those Schalage locks are usually MFC but I have seen one that’s Desfire. Given you said it’s run by less tech savy individuals, I’m leaving more towards MFC since its the easier tech to implement.
From my experience most elevator readers are LF and usually use EM or another generic type of card tech. This is supported by it not being read by your HF phone. I have seen that reader somewhere too and its odd grey shade but not too sure where.
Given you’re a doctor and work in a major trauma centre, those cards are usually HID Prox from my experience which is an LF tech. Again supported by it not being read by your phone.
I would be more interested in screenshots from the output from any of the NFC apps for your Schalage card since there maybe more information to help guide this investigation.
If you do get a Proxmark, I’d be happy to run you through everything from setup to some card investigation. I’m on Discord if that makes things easier should you aquire a Proxmark and take me up on the offer.
Alas, my username is a reference to a song by the children’s author Sandra Boynton.
I should change my username to “MinneapolisChickens” to be more accurate.
3 Likes
I was in the DC area for 15 years. I would have suggested he get the gear and help him as you just said. Teach a man to fish.
DOC, you are on the right track. Get the Proxmark3 . Personally I am using the Proxmark3 RDV4.01 plus the bluetooth/ battery module with the LF antenna coil and a Chameleon Tiny Pro.
By far, the Proxmark3 that Dangerous things offers is more reasonably priced. the RDV4 with accessories is a larger investment.
Proxmark 3 it is!
I should add that the apartment complex comes with an app called butterflyMX which allows me to make “virtual” keys and send them in a text to visitors, which I assume can then open doors/elevators thru their phone…Maybe that helps
1 Like
The ButterflyMX system appears to be an add on to access control systems that allows you to override the access control system from your phone. It is limited but it basically overrides the elevator access control so that it will go from the lobby to your floor without swiping for a short period of time.
After a brief bit of digging I think your lock is also part of an access control system. Meaning that your building management gave you a key fob and they programmed your lock to accept that fob, through a central control system.
This doesn’t change much, it just means that you have to clone your key fob rather than add a new id to the lock.
This means that you probably need a “magic” NFC chip rather than just a regular one.
1 Like
Which version are you ordering? RDV4.01 or EASY?
Proxmark easy…
1 Like
Feel free to let me know when it arrives if you need any support with the setup or research of the tags when your proxmark arrives.
Id be happy to jump on Discord and have a call to speed up the entire process of setup/research if thats something youre open to.