School Indala Card not Cloning to NExT Chip

mfrench · October 18, 2020, 1:01am

Hello All,
I’m wondering if I can get some help…

I’m trying to clone an Indala card using the proxmark3 onto my NExT implant, but haven’t had any success. Its a low frequency card. The only out put I can get is from the commands below. The second one below seems to be a valid ID but when the ID is cloned to a T55xx chip it doesn’t work. The detector wont even read the chip.

Any help would be appreciated.

pm3 --> lf search u
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

[-] No known 125/134 KHz tags Found!

[=] Checking for Unknown tags:

[-] no repeating pattern found
PSK1 demoded bitstream:
1100111010101111
1111111111111111
1111111110100110
1000011011100110
1100111010101111
1111111111111111
1111111110100110
1000011011100110
1100111010101111
1111111111111111
1111111110100110
1000011011100110
1100111010101111
1111111111111111
1111111110100110
1000011011100110
1100111010101111
1111111111111111
1111111110100110
1000011011100110
1100111010101111
1111111111111111
1111111110100110
1000011011100110
1100111010101111
1111111111111111
1111111110100110
1000011011100110
1100111010101111
1111111111111111
11
Possible unknown PSK1 Modulated Tag Found above!

Could also be PSK2 - try ‘data rawdemod p2’

Could also be PSK3 - [currently not supported]

Could also be NRZ - try 'data nrzrawdemod
pm3 -->

pm3 --> lf indala read
pm3 --> lf indala altdemod
Recovered 909 raw bits, expected: 937
worst metric (0=best…7=worst): 1 at pos 2
UID=0000000000000000000000000000010110010111100100011001001100010101 (597919315)
Occurrences: 14 (expected 14)
pm3 --> lf indala read
pm3 --> lf indala altdemod
Recovered 909 raw bits, expected: 937
worst metric (0=best…7=worst): 1 at pos 2
UID=0000000000000000000000000000010110010111100100011001001100010101 (597919315)
Occurrences: 14 (expected 14)
pm3 -->

Pilgrimsmaster · October 18, 2020, 1:04am

Whilst I read through your post, Have you read and followed through this? Its a great resource

https://forum.dangerousthings.com/t/proxmark-for-cyborgs-getting-started-and-cloning-your-first-badge/6563/3

mfrench · October 18, 2020, 1:13am

Yeah. I have pretty much been able to emulate most cards I come across but I cant seem to figure out this one.

Pilgrimsmaster · October 18, 2020, 1:13am

A couple of questions

Are you using an RDV4 or an Easy?
If RDV4, do you have a DT LF Antenna

Initially ( First scan, looks like a poor coupling )

Did you do an hw tune?

mfrench · October 18, 2020, 1:15am

Im using the Easy.

I have done a hw tune as well

mfrench · October 18, 2020, 1:18am

Pilgrimsmaster · October 18, 2020, 1:25am

What firmware are you running
Iceman, or factory?

Coupling is super important, do a few
lf search
or
lf t55xx detect

And make sure it is reading correctly, ( you should get something like Chip type: T55xx, Blah blah blah)

THEN
Throw in a
lf t55xx trace
You should get some trace info with block and stuff showing, if so you should be good to write
DO NOT MOVE ANTENNA

try
lf indala clone 597919315

What result do you get?

Then an
lf search

What result do you get

anon3825968 · October 18, 2020, 1:39am

Be careful with Indala - particularly 224-bit Indala: the Proxmark3 seems exceptionally flaky with that particular chip. Even with a ProxLF antenna and a perfect coupling, you’re likely to see the UID get misread from one lf indala read to the next.

My advice is to get 10 solid reads out of the original tag, and only clone once you get 10x the same UID, to be extra sure. And then make sure you get a VERY good coupling with the implant, blast the UID in without moving a hair, then get several reads out of the NExT to make sure it’s the same UID. Chances are, it won’t be: it took me 3 times to get a correct clone out of mine, and I sweated each time for fear of bricking my xEM.

mfrench · October 18, 2020, 1:50am

I’ve been using T55xx Chips to practice on. I also seem to be getting the same UID but its still unsuccessful.

anon3825968 · October 18, 2020, 1:51am

Which PM3 firmware are you using? Iceman?

mfrench · October 18, 2020, 1:53am

That’s what I’m running into. I cant read the card with a simple ‘lf search’. The only way i can get an output is with the commands I posted.

mfrench · October 18, 2020, 1:54am

Yes, Iceman

anon3825968 · October 18, 2020, 1:56am

Strange. Looking at your client’s output, it almost looks like an unknown type of tag.

Silly question, but… Are you sure it’s an Indala?

mfrench · October 18, 2020, 1:57am

Yeah. It has Indala on the front and back. Our readers at school also are Indala but they also use HID.

anon3825968 · October 18, 2020, 1:58am

Okay. Another silly question: are you running the latest Iceman? I’m asking because there a patch in the latest release that increases the sampling accuracy.

mfrench · October 18, 2020, 2:00am

Yeah should be lol. Great questions. I’m still kind of a newbie.
Thank you for your patients.

anon3825968 · October 18, 2020, 2:05am

Well, this doesn’t seem to be a cloning issue. Rather, it seems you might have hit a PM3 shortcoming. You should be able to get a solid read out of the original full-size tag - and you don’t.

If I were you, I’d hit the Proxmark forum and ask for advice there to identify the original chip, and/or work out what’s not working.

At any rate, don’t program anything in your NExT until you get a proper, reliabile read out of the original: no sense in tempting the devil.

anon3825968 · October 18, 2020, 2:06am

Oh yeah and last question: Are you running the client on Windows or Linux?

mfrench · October 18, 2020, 2:06am

Yeah that’s what I was planning on doing, that’s why I figured I check here first.

mfrench · October 18, 2020, 2:06am

Windows 10 Home