I just picked up a 2023 BMW f750GS motorcycle. It’s keyless. If something happens to the FOB it has an emergency key. That key is just a simple plastic key used to access below the seat. Then you place it on what is clearly an antenna ring and the bike starts. It has ot be VERY close to the ring. The ring itself is about 2-2.5 inches in diameter.
The problem? I can’t seem to scan the key at all. Both my Proxmark and my flipper don’t see anything there. I’ve tried both LF and HF, though I imagine it’s LF.
Any ideas on how to scan this thing?
edit: I just used my DangerousThings Diag card and it definitely ID’ed as a LF 125.
Congrats on your gs purchase. Great bike. I wish you a lot of happy moments with this machine.
So, my lucky guess is bmw came up with some proprietary comm protocol implementation. I may be wrong thou. I do not have gs to reverse engineer it, I ride '07 cbr
I’m loving it so far, but now I’m going down the upgrade hole.
I was thinking it was a hitag, but bit I can’t even pull a UID off of it with my prox3. I think you’re right that is some sort of proprietary reader-speaks-first protocol.
You might need to try the knock method, knock the card to the bike and then immediately scan it with the prox, sounds like some password is sent that unlocks the card and allows it to be read.
My bet is that it is a Texas Instruments automotive transponder with 48-bit challenge response mechanism. This is a very common transponder type for many different vehicles. NXP also makes an automotive transponder. They operate in the 125 kHz to 134 kHz range typically.
I think these transponders are reader talk first types, meaning the reader has to initiate the command for the transponder to respond to. I’m not sure the LF search command will issue any commands for reader talk first, but I could be wrong
