Hey everyone. Got the NExT implant installed a few weeks ago. After “patiently” waiting for it to heal, I’ve bought a Proxmark3easy from DT and have cloned by apartment fob to the implant.
Putting up my hand to the reader yields nothing. No beep, nothing. My flipper doesn’t pick up the RFID side either.
Today i put up the field detector up the Schlage brand reader and to my surprise, only the HF side lit up. So i’m totally confused right now.
Any ideas? Thanks =)
what chipset is your original fob when you scan it on the flipper using NFC and RFID
what was the surprise here? did you assume it was LF?
schlage domestic operates a HF only model for personal door access and LF for shared common areas.
do you have administrative access over the schlage system or are you a tennant/student with someone else overseeing the system?
if you are the administrator you can add the 7 byte NTAG UID to your lock to allow access but if you aren’t, you’ll be unlikely to get that kind of permission to have the admin do it themselves
The fob is HID H10306 34-bit
Yeah i was assuming it was using LF as thats what the fob is using. I’m able to emulate the apartment fob with my flipper.
you were able to emulate the H10306 LF credential with the flipper on your apartment door, not a shared access door?
use the flipper to write that h10306 credential onto your implant and try it on the door.
Schlage fobs are printed with a product code IE 9651, what does yours say?
hypothesis for the moment is your door may be a dual tech (LF&HF) and the reader is polling for HF first which might cause it to see your HF UID and then reject (which it does silently as it doesn’t fit the configured format) causing it to not read the LF credential in your next, beginning the session again with a HF poll. this is a very common methodology with various different readers such as the HID MultiClass readers.
Sorry I worded it poorly, the door im trying to open is a shared access door and the flipper emulating the fob opens that same door.
Also, the fob isn’t Schlage branded. I was able to copy the original fob to a T5577 fob i got off amazon and it worked.
I tried a “hf search” with the proxmark and nothing came up with the fob, although hf tune went from ~16500 to ~16000 when i put the fob up to it.
okay, so the field detector on the common area door shows up HF but your fob copied to a T5577 works meaning it’s taking in LF
is your hand programmed to be the h10306 now? if not try that (i recommend doing the write with your flipper instead of proxmark)
if it doesn’t succeed i would go back to the field detector and try all manners of positioning, if the LF still doesn’t show up unfortunately it might be a case of the reader not being strong enough / designed in a way that allows it to couple with such small antennas.
i will test again with the field detector and report back 
while you’re there can you grab a pic of the reader? i’ll confer with the dark forces and see what i can find re optimising placement for scanning & any behavioural tricks to get it to pick up
where are you chipped btw?
Chip is in L0.
Sorry for the bad quality, took a screenshot from a video. Looks like it might be [this reader?]
guessing the different positionings weren’t successful?
Not successful with LF. HF worked like a charm around the edges.
Might be this one instead? I’m guessing in this case, the RFID side of the NExT won’t work with this reader.
ok word, definitely a multi tech reader its a shared model between a few companies, but looks like it’s not enough to pick up LF on an xseries sized antenna unfortunately.
The only recourse for using your implant with this reader would be to persuade the sysadmin to add your HF 14a UID to the user group, which would come with its challenges but is not impossible.
Do you have any communications channel with the system administrator? What is your living situation? student? private tenant? condo owner etc? – just trying to gauge the likelihood of them agreeing to a change–
A lot of the time, sysadmins for residential access control is just a facet of the facility managers job and therefore they only know the essential steps needed to add a fob to the system so they might not know the intricacies of creating an exception user beholdent to a different credential type entirely, i can help with this, i know the schlage panel software intricately so if needs be i can help organise this with you if their excuse is that they don’t know how to do this.
Given HF is enabled on the reader, they’ve not disabled it on the backend which is good because re-activting it when disabled is a whole kerfuffle with schlage and having to beg them to help with it etc.
TLDR; LF side of the implant is out of the question but HF is doable with some collaboration with the admin.
If this situation shakes out in a way that means you cant use your implant at all, i understand the frustration but there are a lot of cadgets, locks and things you can still do with the NExT besides using it with this system.
have a think on how you want to proceed, don’t make any moves yet as approaching a sysadmin about things like implants especially when you want them to do something for you is like convincing a sleeping bear to make you a cup of tea, its got to be done with a very fine hand and something we can go over and prepare you for if that is the route you wish to take.
first of all, i really appreciate you taking the time to help out with this.
i’m a private tenant so i assume the property management company runs the access control system. it would great to add my HF UID as that’d mean I could still use NFC with my phone and whatnot but like you said, its
like convincing a sleeping bear to make you a cup of tea
that being said, id love to attempt to have the sys admin add my UID, but i’ve got no idea what the best way is to do that.
ok word! its near 5am for me over in the remains of the empire but i will reach out to you later in private messages with a battle strategy.
we can approach this in the best practiced way available but do be prepared for them to shut down the idea, fear of the unknown is the killer of progress and even if we outline exactly what we want to achieve and how to do it and what it means, they might shy away from it like a vampire with sunlight because they dont fully understand it and arent confident that it wont cause problems.
we shall try though!
thank you so much!
OP, before you give up on LF: my door has a reader that I thought was not working with the NExT implant for months (same situation as yours: LF clonning/emulating the fob worked fine), card would not detect LF (but not HF either).
The trick was to find the right position/orientation for the implant. And it may require several reapproximations, as a bad read seems to stun the reader for a short period (not sure if this is actually the case). Once I figured out a place that worked once, I spent a few days (in short 10 minute sessions, after that I’d get too stressed) trying to find the right hand movement. My implant-indicator tattoo helped quite a bit (you can use a marker).
In the end I managed to make it work at first about 50% of the time, and on the 2nd or third attempt in all others. Not great, but enough for me to phase out physical keys. Hope you can work out something like that.
It turns out that it has a weak AF antenna, so you have to find
