Hey guys, I’m trying to write a HID tag to my RFID ring I got from Dangerous Things and it won’t write as a HID tag. I’m using the ProxMark rdv4 and whenever I try to write my HID tag to the ring it just won’t work - its “lf search” keeps coming up as: “Valid EM410x ID found!”
I am able to write the HID tag to multiple T5577 cards that I have but for some reason my ring just won’t write to become a HID tag… I’ve tried dozens of times and it works flawlessly on every other card I have, just not the ring. Do you think there’s a problem with the rings antenna? Maybe the RFID side is broken? The NFC side works perfect, just not the RFID side.
Post everything. Screenshots of the proxmark 3 client with version numbers, your commands, etc. Also try to post a picture of how you’re holding the ring to the pm3 antenna
1 Like
Oh also, did you ever try to write anything to the ring with anything else? Like a cloner device?
1 Like
┌──(motoko㉿iwakura)-[~]
└─$ pm3
[=] Session log /home/motoko/.proxmark3/logs/log_20210719.txt
[+] loaded from JSON file /home/motoko/.proxmark3/preferences.json
[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC
██████╗ ███╗ ███╗█████╗
██╔══██╗████╗ ████║╚═══██╗
██████╔╝██╔████╔██║ ████╔╝
██╔═══╝ ██║╚██╔╝██║ ╚══██╗
██║ ██║ ╚═╝ ██║█████╔╝ Iceman 
╚═╝ ╚═╝ ╚═╝╚════╝ 
bleeding edge
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:07
compiled with GCC 10.2.1 20210110 OS:Linux ARCH:x86_64
[ PROXMARK3 ]
device… RDV4
firmware… RDV4
external flash… present
smartcard reader… present
FPC USART for BT add-on… absent
[ ARM ]
bootrom: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:33
os: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:46
compiled with GCC 8.3.1 20190703 (release) [gcc-8-branch revision 273027]
[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30
[ Hardware ]
–= uC: AT91SAM7S512 Rev A
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 59% used )
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 206 CN: 20128 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 3300 CN: 3744 parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556696A596A66555
[=] raw: 0000000000000020059c9d40
[+] Valid HID Prox ID found!
[=] Couldn’t identify a chipset
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 2021020023
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 04844000C4
[=] HoneyWell IdentKey
[+] DEZ 8 : 00131107
[+] DEZ 10 : 0553779235
[+] DEZ 5.5 : 08450.00035
[+] DEZ 3.5A : 032.00035
[+] DEZ 3.5B : 033.00035
[+] DEZ 3.5C : 002.00035
[+] DEZ 14/IK2 : 00137992732707
[+] DEZ 15/IK3 : 000019398656196
[+] DEZ 20/ZK : 00040804040000001204
[=]
[+] Other : 00035_002_00131107
[+] Pattern Paxton : 538328611 [0x20163E23]
[+] Pattern 1 : 526880 [0x80A20]
[+] Pattern Sebury : 35 2 131107 [0x23 0x2 0x20023]
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[=] Couldn’t identify a chipset
[usb] pm3 → lf hid clone -r 20059c9d40
[=] Preparing to clone HID tag using raw 20059c9d40
[=] Done
[?] Hint: try lf hid reader to verify
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 2021020023
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 04844000C4
[=] HoneyWell IdentKey
[+] DEZ 8 : 00131107
[+] DEZ 10 : 0553779235
[+] DEZ 5.5 : 08450.00035
[+] DEZ 3.5A : 032.00035
[+] DEZ 3.5B : 033.00035
[+] DEZ 3.5C : 002.00035
[+] DEZ 14/IK2 : 00137992732707
[+] DEZ 15/IK3 : 000019398656196
[+] DEZ 20/ZK : 00040804040000001204
[=]
[+] Other : 00035_002_00131107
[+] Pattern Paxton : 538328611 [0x20163E23]
[+] Pattern 1 : 526880 [0x80A20]
[+] Pattern Sebury : 35 2 131107 [0x23 0x2 0x20023]
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[=] Couldn’t identify a chipset
[usb] pm3 →
Thanks for the quick reply Amal! Yes, when I first got the ring, I tried to do a quick copy with my Keysy… it didn’t work and I didn’t put it onto the ProxMark rdv4 before I did that. I noticed the Keysy didn’t work so I have been trying to make anything work on it since then with the ProxMark.
I would try setting the ring flat down on the LF antenna of the rdv4.
Also I would try doing an
lf t5 detect
On the ring
Aa far as I know the keysy works with T5577 chips that have a signature on them of some kind… lock-in… dunno if it also sets passwords like other cloners do.
1 Like
[usb] pm3 → lf t5 detect
[=] Chip type… T55x7
[=] Modulation… BIPHASEa - (CDP)
[=] Bit rate… 5 - RF/64
[=] Inverted… Yes
[=] Offset… 59
[=] Seq. terminator… No
[=] Block0… A01781E5 (auto detect)
[=] Downlink mode… default/fixed bit length
[=] Password set… No
After I tried the Keysy a while ago I looked at the Keysy support - they stated that it only works with Keysy cards/antennas. Maybe it changed the password or something. Not too sure; is there a way to erase it to make it blank? Should I buy a new ring and this time I’ll never try to clone with anything other than the rdv4.
Your detect works and says no password so I’d keep trying with the clone command, but lay the ring down flat. Sounds like a coupling problem.
1 Like
Flat like this right? I’ll keep trying, I’ve tried over a dozen times already but will keep trying to find that sweet spot.
It is detecting which does show that it’s working but somethings just wrong with the coupling like you said.
I’ll keep at it! Thanks Amal! <3
’
So with the following test, I “lf search” the T5577 card that came with the proxmark - the HID ID was another key… Then, I scanned with “lf search” on the new key I wanted to copy… After both those scans I copied the key to the card with the previous HID ID to it. It replaced the key perfectly and I can switch keys with this card as many times as I want but with the ring, I’m not able to do anything with it…
┌──(motoko㉿iwakura)-[~]
└─$ pm3
[=] Session log /home/motoko/.proxmark3/logs/log_20210719.txt
[+] loaded from JSON file /home/motoko/.proxmark3/preferences.json
[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC
██████╗ ███╗ ███╗█████╗
██╔══██╗████╗ ████║╚═══██╗
██████╔╝██╔████╔██║ ████╔╝
██╔═══╝ ██║╚██╔╝██║ ╚══██╗
██║ ██║ ╚═╝ ██║█████╔╝ Iceman
╚═╝ ╚═╝ ╚═╝╚════╝ bleeding edge
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:07
compiled with GCC 10.2.1 20210110 OS:Linux ARCH:x86_64
[ PROXMARK3 ]
device… RDV4
firmware… RDV4
external flash… present
smartcard reader… present
FPC USART for BT add-on… absent
[ ARM ]
bootrom: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:33
os: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:46
compiled with GCC 8.3.1 20190703 (release) [gcc-8-branch revision 273027]
[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30
[ Hardware ]
–= uC: AT91SAM7S512 Rev A
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 59% used )
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 206 CN: 30603 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 3303 CN: 1931 parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556696A5A9AA5669
[=] raw: 0000000000000020059cef16
[+] Valid HID Prox ID found!
[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 206 CN: 20128 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 3300 CN: 3744 parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556696A596A66555
[=] raw: 0000000000000020059c9d40
[+] Valid HID Prox ID found!
[=] Couldn’t identify a chipset
[usb] pm3 → lf hid clone -r 20059c9d40
[=] Preparing to clone HID tag using raw 20059c9d40
[=] Done
[?] Hint: try lf hid reader to verify
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 206 CN: 20128 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 3300 CN: 3744 parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556696A596A66555
[=] raw: 0000000000000020059c9d40
[+] Valid HID Prox ID found!
[+] Chipset detection: T55xx
[?] Hint: try lf t55xx commands
[usb] pm3 →
I tried with the casing off and still not coupling properly… I’m not sure what to do, maybe I bricked it? Should I buy another ring and test the new one?
Ok at this point I’d put the ring back standing up over the LF antenna with the pm3 case off… try that.
1 Like
I use that same dual frequency ring with a Proxmark3 Easy.
I found the easiest way was for me to stand it on edge over the antenna coil. You did make sure that you are using the LF antenna? Have you tried hw tune?
1 Like
Bellow is the “lf tune” results. I will post pictures of the angles I’ve been trying. Nothing I’ve been doing seems to be working; I’m trying my best at troubleshooting with many different angles, positions, lengths, above/bellow, trying the edges of the antenna like I would with the chip… the best position with the “lf tune” was in the middle pressing it against the device - it got me a 66V reading.
Thank you all for your help and suggestions! <3
┌──(motoko㉿iwakura)-[~]
└─$ pm3
[=] Session log /home/motoko/.proxmark3/logs/log_20210719.txt
[+] loaded from JSON file /home/motoko/.proxmark3/preferences.json
[=] Using UART port /dev/ttyACM0
[=] Communicating with PM3 over USB-CDC
██████╗ ███╗ ███╗█████╗
██╔══██╗████╗ ████║╚═══██╗
██████╔╝██╔████╔██║ ████╔╝
██╔═══╝ ██║╚██╔╝██║ ╚══██╗
██║ ██║ ╚═╝ ██║█████╔╝ Iceman
╚═╝ ╚═╝ ╚═╝╚════╝ bleeding edge
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:07
compiled with GCC 10.2.1 20210110 OS:Linux ARCH:x86_64
[ PROXMARK3 ]
device… RDV4
firmware… RDV4
external flash… present
smartcard reader… present
FPC USART for BT add-on… absent
[ ARM ]
bootrom: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:33
os: RRG/Iceman/master/v4.9237-3969-gc45331e1e 2021-05-31 18:40:46
compiled with GCC 8.3.1 20190703 (release) [gcc-8-branch revision 273027]
[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30
[ Hardware ]
–= uC: AT91SAM7S512 Rev A
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 59% used )
[usb] pm3 → lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] 66601 mV / 66 V / 72 Vmax
[=] Done.
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] [H10301 ] HID H10301 26-bit FC: 206 CN: 20128 parity ( ok )
[+] [ind26 ] Indala 26-bit FC: 3300 CN: 3744 parity ( ok )
[=] found 2 matching formats
[+] DemodBuffer:
[+] 1D555955556696A596A66555
[=] raw: 0000000000000020059c9d40
[+] Valid HID Prox ID found!
[=] Couldn’t identify a chipset
[usb] pm3 → lf hid clone -r 20059c9d40
[=] Preparing to clone HID tag using raw 20059c9d40
[=] Done
[?] Hint: try lf hid reader to verify
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 2021020023
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 04844000C4
[=] HoneyWell IdentKey
[+] DEZ 8 : 00131107
[+] DEZ 10 : 0553779235
[+] DEZ 5.5 : 08450.00035
[+] DEZ 3.5A : 032.00035
[+] DEZ 3.5B : 033.00035
[+] DEZ 3.5C : 002.00035
[+] DEZ 14/IK2 : 00137992732707
[+] DEZ 15/IK3 : 000019398656196
[+] DEZ 20/ZK : 00040804040000001204
[=]
[+] Other : 00035_002_00131107
[+] Pattern Paxton : 538328611 [0x20163E23]
[+] Pattern 1 : 526880 [0x80A20]
[+] Pattern Sebury : 35 2 131107 [0x23 0x2 0x20023]
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[=] Couldn’t identify a chipset
[usb] pm3 → lf hid clone -r 20059c9d40
[=] Preparing to clone HID tag using raw 20059c9d40
[=] Done
[?] Hint: try lf hid reader to verify
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 2021020023
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 04844000C4
[=] HoneyWell IdentKey
[+] DEZ 8 : 00131107
[+] DEZ 10 : 0553779235
[+] DEZ 5.5 : 08450.00035
[+] DEZ 3.5A : 032.00035
[+] DEZ 3.5B : 033.00035
[+] DEZ 3.5C : 002.00035
[+] DEZ 14/IK2 : 00137992732707
[+] DEZ 15/IK3 : 000019398656196
[+] DEZ 20/ZK : 00040804040000001204
[=]
[+] Other : 00035_002_00131107
[+] Pattern Paxton : 538328611 [0x20163E23]
[+] Pattern 1 : 526880 [0x80A20]
[+] Pattern Sebury : 35 2 131107 [0x23 0x2 0x20023]
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[=] Couldn’t identify a chipset
[usb] pm3 → lf hid clone -r 20059c9d40
[=] Preparing to clone HID tag using raw 20059c9d40
[=] Done
[?] Hint: try lf hid reader to verify
[usb] pm3 → lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 2021020023
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 04844000C4
[=] HoneyWell IdentKey
[+] DEZ 8 : 00131107
[+] DEZ 10 : 0553779235
[+] DEZ 5.5 : 08450.00035
[+] DEZ 3.5A : 032.00035
[+] DEZ 3.5B : 033.00035
[+] DEZ 3.5C : 002.00035
[+] DEZ 14/IK2 : 00137992732707
[+] DEZ 15/IK3 : 000019398656196
[+] DEZ 20/ZK : 00040804040000001204
[=]
[+] Other : 00035_002_00131107
[+] Pattern Paxton : 538328611 [0x20163E23]
[+] Pattern 1 : 526880 [0x80A20]
[+] Pattern Sebury : 35 2 131107 [0x23 0x2 0x20023]
[=] ------------------------------------------------
[+] Valid EM410x ID found!
[=] Couldn’t identify a chipset
[usb] pm3 →
Here’s the “hw tune” results:
[usb] pm3 → hw tune
[=] ---------- Reminder ------------------------
[=] hw tune doesn’t actively tune your antennas,
[=] it’s only informative.
[=] Measuring antenna characteristics, please wait…
9
[=] ---------- LF Antenna ----------
[+] LF antenna: 67.67 V - 125.00 kHz
[+] LF antenna: 34.47 V - 134.83 kHz
[+] LF optimal: 67.67 V - 125.00 kHz
[+] Approx. Q factor (): 11.4 by frequency bandwidth measurement
[+] Approx. Q factor (): 11.8 by peak voltage measurement
[+] LF antenna is OK
[=] ---------- HF Antenna ----------
[+] HF antenna: 48.45 V - 13.56 MHz
[+] Approx. Q factor (*): 8.5 by peak voltage measurement
[+] HF antenna is OK
(*) Q factor must be measured without tag on the antenna
[+] Displaying LF tuning graph. Divisor 88 (blue) is 134.83 kHz, 95 (red) is 125.00 kHz.
[usb] pm3 →
Thanks for the photo of the back of the antenna 
Have you tried lf t5 wipe? It shouldn’t be needed, but I am curious if that clears the em-401. I suspect that the em-401 is basically “noise” as that is the same results I get from an lf search with no chip near the Proxmark3.
Is the lf antenna behind the top board on the RDV4?
1 Like