T5577 Batch Appears Pre-Programmed as EM410x — Same UID on All Cards and No Response to lf t55 Commands

I recently bought 10 T5577 cards from Aliexpress. A quick lf search shows that they have been programmed as EM410 cards. All the 10 cards show up as EM410 with the same EM410 ID and the same Unique ID

[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 3D00D51E2C
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : BC00AB7834
[=] HoneyWell IdentKey
[+] DEZ 8 : 13966892
[+] DEZ 10 : 0013966892
[+] DEZ 5.5 : 00213.07724
[+] DEZ 3.5A : 061.07724
[+] DEZ 3.5B : 000.07724
[+] DEZ 3.5C : 213.07724
[+] DEZ 14/IK2 : 00262006971948
[+] DEZ 15/IK3 : 000807465089076
[+] DEZ 20/ZK : 11120000101107080304
[=]
[+] Other : 07724_213_13966892
[+] Pattern Paxton : 1038703660 [0x3DE95C2C]
[+] Pattern 1 : 14896340 [0xE34CD4]
[+] Pattern Sebury : 7724 85 5578284 [0x1E2C 0x55 0x551E2C]
[+] VD / ID : 061 / 0013966892
[+] Pattern ELECTRA : 15616 13966892
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] UID… 000000000000
[+] Chipset… Hitag µ / 8265
[?] Hint: Try ⁠ lf hitag htu ⁠ commands

But running a lf t55 detect returns nothing, same with info and check commands,

[usb] pm3 → lf t55 dete
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config

[usb] pm3 → lf t55 info
[usb] pm3

[usb] pm3 → lf t55 chk
[=] Press to exit

[+] Loaded 125 keys from dictionary file ⁠ D:\proxmark\ProxSpace-master\pm3\proxmark3\client\dictionaries/t55xx_default_pwds.dic ⁠
[=] Press to exit
[=] testing 00000000
[=] testing 51243648
[=] testing 000D8787
[=] testing 19920427
[=] testing 002BCFCF
[=] testing 50524F58
[=] testing F9DCEBA0
[=] testing 65857569
[=] testing 05D73B9F
[=] testing 89A69E60
[=] testing 314159E0
[=] testing 7B3D5C48
[=] testing AA55BBBB
[=] testing A5B4C3D2
[=] testing 1C0B5848
[=] testing 00434343
[=] testing 50415353
[=] testing 444E4752
[=] testing 4E457854
[=] testing 44B44CAE
[=] testing 88661858
[=] testing E9920427
[=] testing 575F4F4B
[=] testing 50520901
[=] testing 20206666
[=] testing 5469616E
[=] testing 7686962A
[=] testing C0F5009A
[=] testing 07CEE75D
[=] testing FEEDBEEF
[=] testing DEADC0DE
[=] testing A9EF2AFC
[=] testing 11111111
[=] testing 22222222
[=] testing 33333333
[=] testing 44444444
[=] testing 55555555
[=] testing 66666666
[=] testing 77777777
[=] testing 88888888
[=] testing 99999999
[=] testing AAAAAAAA
[=] testing BBBBBBBB
[=] testing CCCCCCCC
[=] testing DDDDDDDD
[=] testing EEEEEEEE
[=] testing FFFFFFFF
[=] testing A0A1A2A3
[=] testing B0B1B2B3
[=] testing 00000001
[=] testing 00000002
[=] testing 0000000A
[=] testing 0000000B
[=] testing 01020304
[=] testing 02030405
[=] testing 03040506
[=] testing 04050607
[=] testing 05060708
[=] testing 06070809
[=] testing 0708090A
[=] testing 08090A0B
[=] testing 090A0B0C
[=] testing 0A0B0C0D
[=] testing 0B0C0D0E
[=] testing 0C0D0E0F
[=] testing 01234567
[=] testing 12345678
[=] testing 10000000
[=] testing 20000000
[=] testing 30000000
[=] testing 40000000
[=] testing 50000000
[=] testing 60000000
[=] testing 70000000
[=] testing 80000000
[=] testing 90000000
[=] testing A0000000
[=] testing B0000000
[=] testing C0000000
[=] testing D0000000
[=] testing E0000000
[=] testing F0000000
[=] testing 10101010
[=] testing 01010101
[=] testing 11223344
[=] testing 22334455
[=] testing 33445566
[=] testing 44556677
[=] testing 55667788
[=] testing 66778899
[=] testing 778899AA
[=] testing 8899AABB
[=] testing 99AABBCC
[=] testing AABBCCDD
[=] testing BBCCDDEE
[=] testing CCDDEEFF
[=] testing 0CB7E7FC
[=] testing FABADA11
[=] testing 87654321
[=] testing 12341234
[=] testing 69696969
[=] testing 12121212
[=] testing 12344321
[=] testing 1234ABCD
[=] testing 11112222
[=] testing 13131313
[=] testing 10041004
[=] testing 31415926
[=] testing ABCD1234
[=] testing 20002000
[=] testing 19721972
[=] testing AA55AA55
[=] testing 55AA55AA
[=] testing 4F271149
[=] testing 07D7BB0B
[=] testing 9636EF8F
[=] testing B5F44686
[=] testing 9E3779B9
[=] testing C6EF3720
[=] testing 7854794A
[=] testing F1EA5EED
[=] testing 69314718
[=] testing 57721566
[=] testing 93C467E3
[=] testing 27182818
[!] failed to find password

[+] time in check pwd 38 seconds

Any idea on whats going on and how i can get them to work?

At first I though they had shipped me a set of EM cards but all 10 having the same ID’s made me doubt that.

Proxmark 3 Easy with Iceman fork used

[ Proxmark3 ]

[ Client ]
Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:06:49 8bdfb8a31
Compiler… MinGW-w64 15.2.0
Platform… Windows (64b) / x86_64
Readline support… present
QT GUI support… present
Native BT support… absent
Python script support… present ( 3.12.11 )
Python SWIG support… present
Lua script support… present ( 5.4.8 )
Lua SWIG support… present

[ Model ]
Firmware… PM3 GENERIC

[ ARM ]
Bootrom… Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:08:15 8bdfb8a31
OS… Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:08:48 8bdfb8a31
Compiler… GCC 13.3.0

[ FPGA ]
fpga_pm3_hf.ncd image 2s30vq100 21-09-2025 09:57:32
fpga_pm3_lf.ncd image 2s30vq100 21-09-2025 09:57:32
fpga_pm3_felica.ncd image 2s30vq100 21-09-2025 09:57:32
fpga_pm3_hf_15.ncd image 2s30vq100 21-09-2025 09:57:32

[ Hardware ]
–= uC: AT91SAM7S512 Rev B
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 68% used )

Thank you in advance.

1 Like

Seems they aren’t T5577 chips

2 Likes

Seems like you are correct. I am new to the world of RFID and still learning but I though hitag couldn’t be used to clone LF cards.

I just want to clone one of my EM410x cards.

I dont know if this is the right commands to user here.

[usb] pm3 → lf hitag htu reader
[+] UID… 000000000000
[usb] pm3 → lf hitag htu list
[+] Recorded activity ( 90 bytes )
[=] start = start of start frame. end = end of frame. src = source of transfer.
[=] Hitag 1 / Hitag 2 / Hitag S / Hitag µ - Timings in ETU (8us)

  Start |        End | Src | Data (! denotes parity error)                                           | CRC | Annotation

------------±-----------±----±------------------------------------------------------------------------±----±-------------------
0 | 643 | Rdr |27: 22 04 20 00 | ok | Flg: CRCT|Cmd: READ UID
893 | 3131 | Tag |65: 00 00 00 00 00 00 00 00 00 | ok |
3252 | 3944 | Rdr |27: 27 54 85 00 | ok | Flg: CRCT|Cmd: GET SYSTEM INFORMATION
4193 | 5391 | Tag |33: 64 40 07 3A 80 | ok |
5511 | 6575 | Rdr |43: 22 5F E0 0B 09 00 | ok | Flg: CRCT|Cmd: READ MULTIPLE BLOCK start:255 num:0
6825 | 8535 | Tag |49: 02 80 00 00 5E 22 80 | ok |
[usb] pm3

1 Like

It’s the first I’ve heard of it too :classic_tongue:

You might try something along the lines of: lf em 410x clone --id 0F0368568B --htu

3 Likes

Well that works. What the hell are these cards.

[usb] pm3 → lf em 410x clone --id 3600863FE7 --htu
[+] Preparing to clone EM4102 to Hitag µ/82xx tag with EM Tag ID 3600863FE7 (RF/64)
[=] Encoded to FF 99 80 04 58 6F 75 FC
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[+] Done!
[?] Hint: Try ⁠ lf em 410x reader ⁠ to verify
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 3600863FE7
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 6C0061FCE7
[=] HoneyWell IdentKey
[+] DEZ 8 : 08798183
[+] DEZ 10 : 0008798183
[+] DEZ 5.5 : 00134.16359
[+] DEZ 3.5A : 054.16359
[+] DEZ 3.5B : 000.16359
[+] DEZ 3.5C : 134.16359
[+] DEZ 14/IK2 : 00231937032167
[+] DEZ 15/IK3 : 000463862889703
[+] DEZ 20/ZK : 06120000060115121407
[=]
[+] Other : 16359_134_08798183
[+] Pattern Paxton : 916094439 [0x369A7DE7]
[+] Pattern 1 : 2710519 [0x295BF7]
[+] Pattern Sebury : 16359 6 409575 [0x3FE7 0x6 0x63FE7]
[+] VD / ID : 054 / 0008798183
[+] Pattern ELECTRA : 13824 8798183
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] UID… 000000000000
[+] Chipset… Hitag µ / 8265
[?] Hint: Try ⁠ lf hitag htu ⁠ commands

1 Like

@Aoxhwjfoavdlhsvfpzha Thank you very much for your help I’m going to try and find out more about these cards and learn about them a bit more.

Thanks again for the help.

1 Like

Hrm, have you tried
lf hitag info

:thinking:

Edit: also, when you start the proxmark client, what does it say for versions?

2 Likes

pm3 ~/proxmark3$ pm3
[=] Session log D:\proxmark\ProxSpace-master\pm3/.proxmark3/logs/log_20251014104820.txt
[+] loaded D:\proxmark\ProxSpace-master\pm3/.proxmark3/preferences.json
[+] Using UART port COM8
[+] Communicating with PM3 over USB-CDC

8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 “Y8888P”

[ I serve the Builders!! ]

[ Proxmark3 ]

MCU....... AT91SAM7S512 Rev B
Memory.... 512 KB ( 68% used )
Target.... PM3 GENERIC

Client.... Iceman/master/v4.20728-63-g4556492fe 2025-10-12 09:06:49
Bootrom... Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:08:15 8bdfb8a31
OS........ Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:08:48 8bdfb8a31

[usb] pm3 → lf hitag info
[usb] pm3

lf hitag info returns nothing.

1 Like