Unable to clone AWID to T5577 fob

Support
1

I’m relatively new to the proxmark so forgive me if this is a really basic question.

I have some T5577 fobs that I got online and am trying to clone my condo fob which is AWID but am running into issues.

My initial lf search shows that the fobs are EM410x which led me to thinking that I got the wrong fob type.

[+] EM 410x ID 01C8F00800
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 80130F1000
[=] HoneyWell IdentKey
[+] DEZ 8 : 15730688
[+] DEZ 10 : 3371173888
[+] DEZ 5.5 : 51440.02048
[+] DEZ 3.5A : 001.02048
[+] DEZ 3.5B : 200.02048
[+] DEZ 3.5C : 240.02048
[+] DEZ 14/IK2 : 00007666141184
[+] DEZ 15/IK3 : 000550075568128
[+] DEZ 20/ZK : 08000103001501000000
[=]
[+] Other : 02048_240_15730688
[+] Pattern Paxton : 33834496 [0x2044600]
[+] Pattern 1 : 15728704 [0xF00040]
[+] Pattern Sebury : 2048 112 7342080 [0x800 0x70 0x700800]
[+] VD / ID : 001 / 3371173888
[+] Pattern ELECTRA : 456 15730688
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[=] Couldn’t identify a chipset

However, I am able to clone a different EM 410x ID

[usb] pm3 → lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0F0368568B (RF/64)
[=] Encoded to FF 83 C0 33 22 A6 46 E4
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done!
[?] Hint: Try lf em 410x reader to verify
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 0F0368568B
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : F0C0166AD1
[=] HoneyWell IdentKey
[+] DEZ 8 : 06837899
[+] DEZ 10 : 0057169547
[+] DEZ 5.5 : 00872.22155
[+] DEZ 3.5A : 015.22155
[+] DEZ 3.5B : 003.22155
[+] DEZ 3.5C : 104.22155
[+] DEZ 14/IK2 : 00064481678987
[+] DEZ 15/IK3 : 001034014845649
[+] DEZ 20/ZK : 15001200010606101301
[=]
[+] Other : 22155_104_06837899
[+] Pattern Paxton : 259822731 [0xF7C948B]
[+] Pattern 1 : 9750181 [0x94C6A5]
[+] Pattern Sebury : 22155 104 6837899 [0x568B 0x68 0x68568B]
[+] VD / ID : 015 / 0057169547
[+] Pattern ELECTRA : 3843 6837899
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[=] Couldn’t identify a chipset

but, for some reason, I am unable to detect the fob as a t55xx

[usb] pm3 → lf t55 det
[!] Could not detect modulation automatically. Try setting it manually with ‘lf t55xx config’

I’ve tried cloning HID and AWID to no change

[usb] pm3 → lf hid clone -r 2006ec0c86 --em
[!] Beware some EM4305 tags don’t support FSK and datarate = RF/50, check your tag copy!
[=] Preparing to clone HID tag using raw 2006ec0c86
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf hid clone -w H10301 --fc 118 --cn 1603 --em
[!] Beware some EM4305 tags don’t support FSK and datarate = RF/50, check your tag copy!
[=] Preparing to clone HID tag
[+] [H10301 ] HID H10301 26-bit FC: 118 CN: 1603 parity ( ok )
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[+] EM 410x ID 0F0368568B
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : F0C0166AD1
[=] HoneyWell IdentKey
[+] DEZ 8 : 06837899
[+] DEZ 10 : 0057169547
[+] DEZ 5.5 : 00872.22155
[+] DEZ 3.5A : 015.22155
[+] DEZ 3.5B : 003.22155
[+] DEZ 3.5C : 104.22155
[+] DEZ 14/IK2 : 00064481678987
[+] DEZ 15/IK3 : 001034014845649
[+] DEZ 20/ZK : 15001200010606101301
[=]
[+] Other : 22155_104_06837899
[+] Pattern Paxton : 259822731 [0xF7C948B]
[+] Pattern 1 : 9750181 [0x94C6A5]
[+] Pattern Sebury : 22155 104 6837899 [0x568B 0x68 0x68568B]
[+] VD / ID : 015 / 0057169547
[+] Pattern ELECTRA : 3843 6837899
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[=] Couldn’t identify a chipset

Cloning without using --em gives me a weird output

[usb] pm3 → lf hid clone -r 2006ec0c89
[=] Preparing to clone HID tag using raw 2006ec0c89
[+] Done!
[?] Hint: Try lf hid reader to verify
[usb] pm3 → lf hid reader
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[=] Odd size, false positive?
[+] Indala (len 537) Raw: 800000000007ffffffffffffffffffffffffffffffffffffffffffff

[+] Valid Indala ID found!

Any ideas?

2

Everything here is telling me that these are not t5577.

1 Like
3

that seems to be my suspicion too, just wanted to see if there was anything glaring that I’m missing.

On that note, any idea what type of fobs there would be if not t5577?

4

Looks like an EM4102 or something similar.

Before giving up, try lf search then lf t5 detect

1 Like
5

Hmm I thought the EM4102s were read only
And still can’t detect the t5577

[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[=] Odd size, false positive?
[+] Indala (len 591) Raw: 800000000007fffffffffffffffffffffffffffffffffdffffffffff

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset
[usb] pm3 → lf t55 det
[!] Could not detect modulation automatically. Try setting it manually with ‘lf t55xx config’

1 Like
6

Ahh right I missed the part where you could clone other EMs to it… might be an EM4305 or EM4450 which would allow EM IDs but not other analog configurations like hid prox would require. Looks like you got scammed maybe.

1 Like
7

fwiw em4305 can do hidprox, it’s what HID uses as the base chip for their hidprox so they don’t need to manufacture a bunch of different silicone for the various encodings and bitlengths:}

this is one of the em410 base chips used for a similar purpose but locked to em410, mass produced to encode at later date for clients instead of during prod.

get a refund

2 Likes
8

Ahh that sucks, will try and see if I can return these.
Thanks for all the help!

9

Ah nice … didn’t know that. I’ve never seen an EM4305 in HID prox but I’ve not seen much… or maybe I did without realizing it.

1 Like
10

Where did you get the fobs from? Link?