I can detect the t5577 chip with the lf t55xx detect command and it gives me the following output:
Chip Type : T55x7
Modulation : BIPHASEa - (CDP)
Bit Rate : 5 - RF/64
Inverted : Yes
Offset : 57
Seq. Term. : No
Block0 : 0x201780BE
From my reading online, it seems like that may be an invalid block 0. I’ve tried to clone an HID card onto the tag, but no writes seem to take. The values always stay the same.
Still waiting for this… @justSomeGuy posted all the detection output, but not the actual write attempts.
One thing to keep in mind is that writing data to any tag requires more power than reading the tag, and thus successfully writing data to the T5577 requires a better coupling than reading it does… so maybe you have a good enough coupling to read your tag but not a good enough one to write. It’s unlikely, but possible.
I also am trying to program the xEM with a Proxmark 3 RDV2. I spent a good amount of time going through the forums and didn’t see anyone do it successfully? I’m trying to clone a HID tag to it.
pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
Found this thread by @TomHarkness. Linking for future reference.
Not sure if it will work, will update after I’m able to try it…
=======================================
This is the output I received. Suggested commands did partially work. It appears the failure is due to a poor coupling of my chip with my LF antenna. Working on a solution. The link above provides the best info I can find on this forum for writing to the xEM with a proxmark3 with specific focus on the RDV2 version.
[ FPGA ]
LF image built for 2s30vq100 on 2019/ 4/18 at 9:35:32
HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23
[ Hardware ]
–= uC: AT91SAM7S512 Rev A
–= Embedded Processor: ARM7TDMI
–= Nonvolatile Program Memory Size: 512K bytes, Used: 248458 bytes (47%) Free: 275830 bytes (53%)
–= Second Nonvolatile Program Memory Size: None
–= Internal SRAM Size: 64K bytes
–= Architecture Identifier: AT91SAM7Sxx Series
–= Nonvolatile Program Memory Type: Embedded Flash Memory
pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…
For the sake of others with the same problem, I was finally able to resolve the issue and write to the xEM chip. Here is what worked for me -
I am using a Proxmark3 RDV2 as shown above and was only able to read the chip with the included antenna. After searching through these forums in addition to the proxmark forums, it seemed like the only solution was a different LF antenna.
I found one that is essentially the same as the one sold in the xEM Access Controller kit.
I removed the antenna, spliced and soldered it into an MMCX antenna cable… And IT WORKED. After checking the new antenna with “hw tune” and “hw status”, I was able to both read and write to the xEM T5577 chip!
Just so everyone is aware… this is not typically a cut & splice antenna replacement job. The proxmark3 is open source and as such there are now so many different versions out there, and some versions are made by Chinese vendors who don’t use the best components (like tuning caps that have huge tolerances) and so it there is a 99% chance that simply splicing in a different LF antenna will NOT work, and only a 1% chance it will work… so @black_sam, you won the lottery.