Strange LF chip. 😱

Sorry for the click bite title.

Has anyone seen one of this?

It came inside my key for my apartment in Japan.

I scanned the readers on the entrance, elevator and post boxes that use this key to work. All of them seem to turn on with the xLED LF chip and The LF X Field Detectors.
So my guess was that is 125khz?

But I can’t even get it to detect it or even read its UID with the Proxmark Easy (much less copy it to an implant)

Perhaps some of the amazing community has seen them around?

Looks like the ones you get inside car keys. I.e. there a challenge response rather than just spitting a uid at you.

Have you verified the chip still works?

Could have taken damage during removal?

:joy: yeah actually I put it on a 3D printed ring and use that cuz I hate to carry 1 key while other people in this building show off their keychains full of keys like they are so important :joy: it works fine.

1 Like

Sooooo the reader would actually need to send some info first before this thing spill the beans? (show it’s uid)

Did ONLY the lf on the XFD light up?
Perhaps it’s actually a Hf and the readers have both lf and Hf?

Holly balls! Well also used the card and yeah only the LF side glow up.

Yes precisely.

So there is a chance that this LF chip will absolutely not say anything back if there is no specific questions asked?
Like shouldn’t it at least give its own ID or react to a LF field of a normal (LF) card reader?

‘Should’ is a relative thing - you’re a programmer! If you didn’t want someone messing with a security system, and you don’t have the budget for proper encryption, would you…

A) Spit out your serial number anytime someone gives your tag power and hope people don’t figure out how to use that data

B) Program the chip to only give a response after a handshake so its inert to anyone who doesn’t do a lot more work to figure it out

C) Something that doesn’t rely on security through obscurity

Most LF stuff is older stuff, and yes most of it should return its UID when you give it power, but ‘should’ is based on datasheets not just the common methods.

Also a note that just because typical LF cards don’t do encryption doesn’t mean there is anything fundamental about the frequency that means it couldn’t be done (slower data rate, but you could download pictures on dial up internet!)

1 Like

Ahh puff goes my dream of cloning this thing into an implant. :sob:

Maybe, maybe not! The Proxmark can also be used between the tag and reader to sniff the whole sequence!

There’s also the option of seeing if @amal can convert it for you - not as turnkey but if you’re gonna be there for a while its an option.

1 Like

Just a guess, but that potentially looks like a HiTag to me…
Looks similar to some vehicle fob chips

Googling…

pretty close, Likely a vehicle key transponder

OMG yeah looks like that!

1 Like

Low Frequency (LF) but probably 134 kHz

The RDV4 has a 134kHz switch on the antenna; Although your 125kHz Antenna on the easy should be absolutely fine for reading it.

I need a quick tut on that!!
I got no flipping idea how to use this proxmark easy thing.
Tried something like
lf search
But it was completely ignored no matter how I placed the chip near the antenna,

The set up and installation of PM3s is harder than the use of it.

It kind of feeds you the answers.
I am running older firmware so my syntax would likely be different from yours.

Here is what you can try
Type out a command one command at a time then add to it after it gives you some options / promts.
ie.
Type
lf
it will return a bunch of results
then type
lf `ONE OF THOSE OPTIONS

then
lf OPTION NEW OPTION

I explained that poorly, but do you get what I mean?

eg.
lf
get results, choose best option
lf em
get results, choose best option
lf em 410x_read

Also there is a help option

help

Yeah I poked arround with all the help thingies for LF commands and tuning the antenas and stuff but couldn’t get it to read nothing from it. It does change, like if I am tunning the anteana and get the chip close to the reader I can see that the numbers change so it figures there is something there, but not much more than that.

Sorry I can be much more help, but did you work your way through the list?

I know there are some odd ones (not sure exactly,but the odd ones I can think of, not 100% on spelling)
like
lf gprox
lf nexwatch
lf paradox
lf pyramid
lf viking

I hope that is of some help for you!

Just thought of another tip for you ( although you are probably already aware )
With cmd prompt, :arrow_up: to scroll through previous commands you have sent…