T5577 Batch Appears Pre-Programmed as EM410x — Same UID on All Cards and No Response to lf t55 Commands

I recently bought 10 T5577 cards from Aliexpress. A quick lf search shows that they have been programmed as EM410 cards. All the 10 cards show up as EM410 with the same EM410 ID and the same Unique ID

[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 3D00D51E2C
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : BC00AB7834
[=] HoneyWell IdentKey
[+] DEZ 8 : 13966892
[+] DEZ 10 : 0013966892
[+] DEZ 5.5 : 00213.07724
[+] DEZ 3.5A : 061.07724
[+] DEZ 3.5B : 000.07724
[+] DEZ 3.5C : 213.07724
[+] DEZ 14/IK2 : 00262006971948
[+] DEZ 15/IK3 : 000807465089076
[+] DEZ 20/ZK : 11120000101107080304
[=]
[+] Other : 07724_213_13966892
[+] Pattern Paxton : 1038703660 [0x3DE95C2C]
[+] Pattern 1 : 14896340 [0xE34CD4]
[+] Pattern Sebury : 7724 85 5578284 [0x1E2C 0x55 0x551E2C]
[+] VD / ID : 061 / 0013966892
[+] Pattern ELECTRA : 15616 13966892
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] UID… 000000000000
[+] Chipset… Hitag µ / 8265
[?] Hint: Try ⁠ lf hitag htu ⁠ commands

But running a lf t55 detect returns nothing, same with info and check commands,

[usb] pm3 → lf t55 dete
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config

[usb] pm3 → lf t55 info
[usb] pm3

[usb] pm3 → lf t55 chk
[=] Press to exit

[+] Loaded 125 keys from dictionary file ⁠ D:\proxmark\ProxSpace-master\pm3\proxmark3\client\dictionaries/t55xx_default_pwds.dic ⁠
[=] Press to exit
[=] testing 00000000
[=] testing 51243648
[=] testing 000D8787
[=] testing 19920427
[=] testing 002BCFCF
[=] testing 50524F58
[=] testing F9DCEBA0
[=] testing 65857569
[=] testing 05D73B9F
[=] testing 89A69E60
[=] testing 314159E0
[=] testing 7B3D5C48
[=] testing AA55BBBB
[=] testing A5B4C3D2
[=] testing 1C0B5848
[=] testing 00434343
[=] testing 50415353
[=] testing 444E4752
[=] testing 4E457854
[=] testing 44B44CAE
[=] testing 88661858
[=] testing E9920427
[=] testing 575F4F4B
[=] testing 50520901
[=] testing 20206666
[=] testing 5469616E
[=] testing 7686962A
[=] testing C0F5009A
[=] testing 07CEE75D
[=] testing FEEDBEEF
[=] testing DEADC0DE
[=] testing A9EF2AFC
[=] testing 11111111
[=] testing 22222222
[=] testing 33333333
[=] testing 44444444
[=] testing 55555555
[=] testing 66666666
[=] testing 77777777
[=] testing 88888888
[=] testing 99999999
[=] testing AAAAAAAA
[=] testing BBBBBBBB
[=] testing CCCCCCCC
[=] testing DDDDDDDD
[=] testing EEEEEEEE
[=] testing FFFFFFFF
[=] testing A0A1A2A3
[=] testing B0B1B2B3
[=] testing 00000001
[=] testing 00000002
[=] testing 0000000A
[=] testing 0000000B
[=] testing 01020304
[=] testing 02030405
[=] testing 03040506
[=] testing 04050607
[=] testing 05060708
[=] testing 06070809
[=] testing 0708090A
[=] testing 08090A0B
[=] testing 090A0B0C
[=] testing 0A0B0C0D
[=] testing 0B0C0D0E
[=] testing 0C0D0E0F
[=] testing 01234567
[=] testing 12345678
[=] testing 10000000
[=] testing 20000000
[=] testing 30000000
[=] testing 40000000
[=] testing 50000000
[=] testing 60000000
[=] testing 70000000
[=] testing 80000000
[=] testing 90000000
[=] testing A0000000
[=] testing B0000000
[=] testing C0000000
[=] testing D0000000
[=] testing E0000000
[=] testing F0000000
[=] testing 10101010
[=] testing 01010101
[=] testing 11223344
[=] testing 22334455
[=] testing 33445566
[=] testing 44556677
[=] testing 55667788
[=] testing 66778899
[=] testing 778899AA
[=] testing 8899AABB
[=] testing 99AABBCC
[=] testing AABBCCDD
[=] testing BBCCDDEE
[=] testing CCDDEEFF
[=] testing 0CB7E7FC
[=] testing FABADA11
[=] testing 87654321
[=] testing 12341234
[=] testing 69696969
[=] testing 12121212
[=] testing 12344321
[=] testing 1234ABCD
[=] testing 11112222
[=] testing 13131313
[=] testing 10041004
[=] testing 31415926
[=] testing ABCD1234
[=] testing 20002000
[=] testing 19721972
[=] testing AA55AA55
[=] testing 55AA55AA
[=] testing 4F271149
[=] testing 07D7BB0B
[=] testing 9636EF8F
[=] testing B5F44686
[=] testing 9E3779B9
[=] testing C6EF3720
[=] testing 7854794A
[=] testing F1EA5EED
[=] testing 69314718
[=] testing 57721566
[=] testing 93C467E3
[=] testing 27182818
[!] failed to find password

[+] time in check pwd 38 seconds

Any idea on whats going on and how i can get them to work?

At first I though they had shipped me a set of EM cards but all 10 having the same ID’s made me doubt that.

Proxmark 3 Easy with Iceman fork used

[ Proxmark3 ]

[ Client ]
Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:06:49 8bdfb8a31
Compiler… MinGW-w64 15.2.0
Platform… Windows (64b) / x86_64
Readline support… present
QT GUI support… present
Native BT support… absent
Python script support… present ( 3.12.11 )
Python SWIG support… present
Lua script support… present ( 5.4.8 )
Lua SWIG support… present

[ Model ]
Firmware… PM3 GENERIC

[ ARM ]
Bootrom… Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:08:15 8bdfb8a31
OS… Iceman/master/v4.20728-63-g4556492fe-suspect 2025-10-12 09:08:48 8bdfb8a31
Compiler… GCC 13.3.0

[ FPGA ]
fpga_pm3_hf.ncd image 2s30vq100 21-09-2025 09:57:32
fpga_pm3_lf.ncd image 2s30vq100 21-09-2025 09:57:32
fpga_pm3_felica.ncd image 2s30vq100 21-09-2025 09:57:32
fpga_pm3_hf_15.ncd image 2s30vq100 21-09-2025 09:57:32

[ Hardware ]
–= uC: AT91SAM7S512 Rev B
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 68% used )

Thank you in advance.

1 Like

Seems they aren’t T5577 chips

2 Likes

Seems like you are correct. I am new to the world of RFID and still learning but I though hitag couldn’t be used to clone LF cards.

I just want to clone one of my EM410x cards.

I dont know if this is the right commands to user here.

[usb] pm3 → lf hitag htu reader
[+] UID… 000000000000
[usb] pm3 → lf hitag htu list
[+] Recorded activity ( 90 bytes )
[=] start = start of start frame. end = end of frame. src = source of transfer.
[=] Hitag 1 / Hitag 2 / Hitag S / Hitag µ - Timings in ETU (8us)

  Start |        End | Src | Data (! denotes parity error)                                           | CRC | Annotation

------------±-----------±----±------------------------------------------------------------------------±----±-------------------
0 | 643 | Rdr |27: 22 04 20 00 | ok | Flg: CRCT|Cmd: READ UID
893 | 3131 | Tag |65: 00 00 00 00 00 00 00 00 00 | ok |
3252 | 3944 | Rdr |27: 27 54 85 00 | ok | Flg: CRCT|Cmd: GET SYSTEM INFORMATION
4193 | 5391 | Tag |33: 64 40 07 3A 80 | ok |
5511 | 6575 | Rdr |43: 22 5F E0 0B 09 00 | ok | Flg: CRCT|Cmd: READ MULTIPLE BLOCK start:255 num:0
6825 | 8535 | Tag |49: 02 80 00 00 5E 22 80 | ok |
[usb] pm3

1 Like

It’s the first I’ve heard of it too :classic_tongue:

You might try something along the lines of: lf em 410x clone --id 0F0368568B --htu

2 Likes

Well that works. What the hell are these cards.

[usb] pm3 → lf em 410x clone --id 3600863FE7 --htu
[+] Preparing to clone EM4102 to Hitag µ/82xx tag with EM Tag ID 3600863FE7 (RF/64)
[=] Encoded to FF 99 80 04 58 6F 75 FC
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 1, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[!] Something went wrong in step 2, retrying… Press to exit
[+] Done!
[?] Hint: Try ⁠ lf em 410x reader ⁠ to verify
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 3600863FE7
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 6C0061FCE7
[=] HoneyWell IdentKey
[+] DEZ 8 : 08798183
[+] DEZ 10 : 0008798183
[+] DEZ 5.5 : 00134.16359
[+] DEZ 3.5A : 054.16359
[+] DEZ 3.5B : 000.16359
[+] DEZ 3.5C : 134.16359
[+] DEZ 14/IK2 : 00231937032167
[+] DEZ 15/IK3 : 000463862889703
[+] DEZ 20/ZK : 06120000060115121407
[=]
[+] Other : 16359_134_08798183
[+] Pattern Paxton : 916094439 [0x369A7DE7]
[+] Pattern 1 : 2710519 [0x295BF7]
[+] Pattern Sebury : 16359 6 409575 [0x3FE7 0x6 0x63FE7]
[+] VD / ID : 054 / 0008798183
[+] Pattern ELECTRA : 13824 8798183
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] UID… 000000000000
[+] Chipset… Hitag µ / 8265
[?] Hint: Try ⁠ lf hitag htu ⁠ commands

1 Like

@Aoxhwjfoavdlhsvfpzha Thank you very much for your help I’m going to try and find out more about these cards and learn about them a bit more.

Thanks again for the help.

1 Like