Trouble configuring new xEM implant


#1

I’m having some trouble configuring a new xEM implant. I’m using the ProxMark3 RDV2.

I can reliably detect and read the tag, it shows up as an EM410x when using the generic lf search command.

EM410x pattern found:

EM TAG ID : 2015060657

Possible de-scramble patterns
Unique TAG ID  : 04A86060EA
HoneyWell IdentKey {
    DEZ 8          : 00394839
    DEZ 10         : 0352716375
    DEZ 5.5        : 05382.01623
    DEZ 3.5A       : 032.01623
    DEZ 3.5B       : 021.01623
    DEZ 3.5C       : 006.01623
    DEZ 14/IK2     : 00137791669847
    DEZ 15/IK3     : 000020004757738
    DEZ 20/ZK      : 00041008060006001410
}
Other          : 01623_006_00394839
Pattern Paxton : 538592343 [0x201A4457]
Pattern 1      : 590780 [0x903BC]
Pattern Sebury : 1623 6 394839  [0x657 0x6 0x60657]

Valid EM410x ID Found!

I can detect the t5577 chip with the lf t55xx detect command and it gives me the following output:

Chip Type  : T55x7
Modulation : BIPHASEa - (CDP)
Bit Rate   : 5 - RF/64
Inverted   : Yes
Offset     : 57
Seq. Term. : No
Block0     : 0x201780BE

From my reading online, it seems like that may be an invalid block 0. I’ve tried to clone an HID card onto the tag, but no writes seem to take. The values always stay the same.

Thanks for any help!


#2

Have you attempted to write to the xEM with any other device? A handheld cloner perhaps?


#3

Nope, I’d read your thread about the trouble with those before attempting anything.


#4

Can you walk me through the proxmark3 commands used to attempt an HID clone to the xEM?


#5

This looks very similar to the output I am receiving from my xEM. Did the OP figure this out?