Texecom Premier Elite LCDLP-W Alarm System (125KHz) - xEM RFID Tag


#1

First up: I fully understand and appreciate that I may not be able to interact with this system, it isn’t the main reason why I was implanted, but it would be a lovely addition if possible…

I’m looking to see if I can interact with this alarm system that I own and have a (125KHz) Fob for.

The alarm: Premier Elite LCDLP-W

Data sheet: https://www.texe.com/uk/uploads/Premier_Elite_LCDLP-W_LIT-256.pdf

The Fob Front:

The Fob Back:

I have implanted with me a xEM RFID Tag [T5577 Emulator] which is 125kHz and I have determined that the alarm system above is 125kHz also.

I don’t presently have the equipment to read or write on 125kHz, but I have a PenTesting friend who does have equipment. I gave him a spare fob that came with the alarm that has not been authorised or added to the system, to do some analysis.

Now I would like to note at this point; when going through the process of adding a new fob to the system it seems to allow you to do one of two things:

  1. Write to the fob and add to the system
  2. Authorise and existing fob (read only)

From my PenTesting pal’s analysis he got the following from the spare fob:

ASKRAW: 0CCCCF0CCCF30CF0F330F1CF330CF31F1CCCCF0CCCF30CF0F331F0CF330CF30F

PSK1RAW: 2AAAAAAAAAA555555555555555555555552AAAAAAAAAAAAAAAAAAAAAAAAB5555

I’m new to all this, could anyone give me some pointers on how to best move forward; do I need to work on:

  • Decoding these data schemes?
  • Cracking some basic form of encryption?
  • Or just clone this data to my xEM (if possible)

I would be intrigued to know if anyone else out there is interacting with a alarm system like this from the same manufacturer & via a implant etc. I also appreciate that it could be the case that the alarm system may not be able to read the chip due to coupling issues.

If anyone could give me any indications as to whether they think this will be possible and any suggested next steps, it would be greatly appreciated.

I’m all set up for readers & writers for my other chip (xNT - 13.56MHz) but I don’t have any for my 125KHz - if anyone also has recommendations on what writers/clones are good to use in conjunction with a xEM chip that would be good to know, I noted that it looks like a previous cloner has been pulled from DangerousThings & Digiwell from what looks like compatibility / writing issues in rare cases, will that always be a risk with any reader or is there reader out there which is deemed reliable and safe?

Sorry for all the questions, thank you for your time and help.


#2

What equipment did they use to get this data from your fob? If they used a proxmark3, it should be able to determine the tag type. If it is EM, HID ProxCardII, or Indala then the xEM should work with it… provided the antenna coupling is good enough.

I need to change the wording on this… it has nothing to do with the reader… it has to do with the inherent issues with the T5577 chip inside the xEM. There is no fixing it… it will always be a risk when writing changes to the xEM. https://forum.dangerousthings.com/t/quirks-of-the-t5577-cloning-tags-to-the-xem