So I just picked up a proxmark5 from defcon. I’ve had the NeXT implant for a whole but I’ve really only used the NFC side of it. I was testing the LF side by trying to clone my gym tag which is read as a T55xx HID Prox tag. See Below (all numbers changed to xxxx for reasons)
[usb] pm3 --> lf search
[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] [H10301 ] HID H10301 26-bit FC: xxx CN: xxxxx parity ( ok )
[+] [ind26 ] Indala 26-bit FC: xxxx CN: xxxx parity ( ok )
[=] found 2 matching 26-bit formats
[=] Trying with a preamble bit...
[+] [ind27 ] Indala 27-bit FC: xxxx CN: xxxx
[+] [indasc27] Indala ASC 27-bit FC: xxxx CN: xxxx
[+] [Tecom27 ] Tecom 27-bit FC: xxx CN: xxxxx
[=] found 3 matching 27-bit formats
[=] raw: 00000000000000xxxxxxxxxx
[+] Valid HID Prox ID found!
[=] Searching for auth LF and special cases...
[+] Chipset... T55xx
[?] Hint: Try lf t55xx commands
I am able to clone my gym badge onto the provided T5577 card that came with my PM5 by using lf hid clone -r XXXXXXXXXX (the last 10 of the RAW field from the search command). I was able to verify this with lf search.
I am also able to clone my implant’s ID itself onto the T5577 card provided, again, verified with lf search and lf hid reader -@.
However, when I try to clone anything onto the LF side of my chip by using lf hid clone -r XXXXXXXXXX, when I run lf search or lf hid reader -@ if shows the original data, fully unchanged.
Does anyone have any guidance, documentation, or criticisms that may help me figure this out? I am very well open to the issue being a skill issue on my own part as well lol.
EDIT: Figured it would be best to add the output from lf t55xx detect as well: [usb] pm3 --> lf t55xx detect [=] Chip type......... T55x7 [=] Modulation........ FSK2a [=] Bit rate.......... 15 - (Unknown) [=] Inverted.......... Yes [=] Offset............ 252 [=] Seq. terminator... No [=] Block0............ 6CCCC71C (auto detect) [=] Downlink mode..... default/fixed bit length [=] Password set...... No
(Note: one of the several times I read the chip, the Bit Rate read as [=] Bit rate.......... 15 - RF/32 but this was once out of about 15 reads.)
Personally I’ve had this issue with antenna coupling, writing to a T5577 chip needs strong, sustained and stable magnetic field. An lf search can fail to deliver enough energy for a write block cycle.
First verify chipset diagnostics, if the hardware can’t reliably detect a T55xx chipset through your skin it won’t be able to write data until you modify the alignment. pm3 --> lf t55xx detect
Try and get perfect alignment, the Proxmark3 should be firmly against the skin and the implant should be perpendicular to the outer edge of the antenna. I have success when standing it upright (vertically).
Try a delayed command to give yourself a few seconds to position the Proxmark3 statically, neither your hand or the Proxmark3 should move at all during the write session. pm3 --> lf hid clone -r XXXXXXXXXX --delay 3000
Even when i get the PM5 placed on my hand in the perfect way where it reads consistently, I feel like coupling is still likely an issue. I noticed DT made an antenna specifically for implants: (*****) ProxLF antenna for the Proxmark3 RDV4 but this is unfortunately for the PM3 RDV4. I may be able to work out the pin-out to adapt it to my PM5 but that may require some research.
Probably; I dont have a PM5 so cant attest to its LF performance.
There are things you can do to increase your chance of a read.
Let it heal
Present your NExT perpendicular to the LF antenna like a
(Be aware, the next has an LF antenna at one end and HF at the other, so presentation end does matter)
Run LF tune and look for largest voltage drop, and thats your “best” spot
Do a test read before writing and DO NOT MOVE, not even a mm. THEN do a write and DO NOT MOVE, remember, it takes longer to write than read.
I hope that helps, sing out of you need clarification on any of that.
