Unable to read LF side of xMagic

I recently got my xMagic implanted and using my pm3 easy as well as my flipper I get no reads on the lf side of the implant. The hf side seems to be fine. lf tune shows an idle reading of ~23800mv and over the implant around 23700mv. I have the magic ring which works fine on the proxmark. Is it possible that the implant has a dud t5577? I am trying reads with the implant perpendicular to the LF coil.

More specifically, lf t55 detect returns that it was unable to detect, and lf search comes back as nothing or on rare occasions as indala with random garbage for the string.

My implant is only a week old so I know I should just be patient, it’s just so hard to! Especially since the hf seems to work fine.

1 Like

The NExT LF comes pre-programmed as an EM credential, so you may try lf em 410x reader -@ on the PM3 to continuously search for that type

2 Likes

Welcome, Jake who likes cake!

Trying wrangle the laws of physics to meet our wants is always challenging. But we could stack the deck such that when it is able to be read, you’re presenting it optimally and most likely to get an easy read :grinning_face:

Have you compared your field detector keychain findings to your presentation method? We include that–as you may recall from the qr code videos–because x-series antennas are not like other contactless device antennas so the presentation is not the same (re: ring v. Implant).

2 Likes

Well today lf search came back with chipset detection: t55xx. So while I still can’t run any other LF commands like detect on it, I guess I’ll just need to patiently wait. I’ll have to grab the field detectors from my office later today and ensure I have good placement against the LF coil.

[usb] pm3 --> lf search
[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] â›” No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: Try `lf t55xx` commands
[usb] pm3 --> lf t55xx detect
[!] ⚠️  Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
2 Likes

have you at all used any other device to write to your implant?

1 Like

I haven’t tried writing to it at all yet.

:backhand_index_pointing_up:

1 Like

Welp. It’s now been around 2.5 weeks since I got the implant installed and it has healed nicely. HF side works great, LF side is still no dice. Doing lf search gives no tags found, but detects the chipset as T55xx, however lf t55 detect fails to detect modulation. If I manually set the config to 0x000880E0 and then to an lf t55 info and lf t55 dump I reliably get the same readout as seen below:

[usb] pm3 --> lf t55 info
[=] --- T55x7 Configuration & Information ---------
[=]  Safer key                 : 12
[=]  reserved                  : 54
[=]  Data bit rate             : 6 - RF/100
[=]  eXtended mode             : No
[=]  Modulation                : 8 - Manchester
[=]  PSK clock frequency       : 0 - RF/2
[=]  AOR - Answer on Request   : Yes
[=]  OTP - One Time Pad        : No
[=]  Max block                 : 4
[=]  Password mode             : Yes
[=]  Sequence Terminator       : Yes
[=]  Fast Write                : Yes - Warning
[=]  Inverse data              : No
[=]  POR-Delay                 : No
[=] -------------------------------------------------------------
[=]  Raw Data - Page 0, block 0
[=]  C6D8829C - 11000110110110001000001010011100
[=] --- Fingerprint ------------

[usb] pm3 --> lf t55 dump

[=] ------------------------- T55xx tag memory -----------------------------

[+] Page 0
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | C6D8829C | 11000110110110001000001010011100 | ??..
[+]  01 | 00000000 | 00000000000000000000000000000000 | ....
[+]  02 | 00000000 | 00000000000000000000000000000000 | ....
[+]  03 | 00000000 | 00000000000000000000000000000000 | ....
[+]  04 | 00000000 | 00000000000000000000000000000000 | ....
[+]  05 | 00000000 | 00000000000000000000000000000000 | ....
[+]  06 | 00000000 | 00000000000000000000000000000000 | ....
[+]  07 | 00000000 | 00000000000000000000000000000000 | ....

[+] Page 1
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | C6D8829C | 11000110110110001000001010011100 | ??..
[+]  01 | A017004F | 10100000000101110000000001001111 | ?..O
[+]  02 | CEFE433C | 11001110111111100100001100111100 | ??C<
[+]  03 | FF9FFFFE | 11111111100111111111111111111110 | ...?
[+] Saved 48 bytes to binary file

Since I’m reliably I’m presuming (and hoping) that the chip is not a dud as I’d expect no reading or just random data each time.

Any assistance is greatly appreciated.

2 Likes

Have you tried writing to it?
ie,

lf em 410x clone --id 0F0368568B

With the implant properly aligned on the LF antenna?

1 Like

Implant is properly aligned, I need up making a ferrite core antenna for better coupling this weekend that seems to be spot on. Doing a write seems to have no luck.

Eh… Well, that’s a whole other ball of wax for our testing… If you’re not going to continue testing with an antenna what shows up as usable, nothing we do with the pm3 will matter… It’s just a new variable :confused:

Have you tried doing the same thing, eg writing an em41xx uid, to the implant with your Flipper since your latest round of testing?

1 Like

I have placed the stock antenna back onto the pm3 for testing, output below.

My understanding may be wrong here, I thought that the hw tune was only reporting unusable on the hf side, not lf. (Which is weird since the hf side is also operating fine. hf antenna was replaced with the pm3 easy field enhancer by hamspiced)

I just attempted a write with the flipper and it acts like the tag isn’t even present, it just ends up sitting on “Still Trying to Write”. Both the pm3 and Flipper work fine with other T5577 tags on hand.

[usb] pm3 → hw tune
[=] -------- Reminder ----------------------------
[=] hw tune doesn’t actively tune your antennas.
[=] It’s only informative.
[=] Measuring antenna characteristics…
đź•›   9
[=] -------- LF Antenna ----------
[+] 125.00 kHz … 23.43 V
[+] 134.83 kHz … 16.38 V
[+] 120.00 kHz optimal… 24.68 V
[+]
[+] Approx. Q factor measurement
[+] Frequency bandwidth… 6.1
[+] Peak voltage… 7.2
[+] LF antenna… ok
[=] -------- HF Antenna ----------
[+] 13.56 MHz… 17.38 V
[+]
[+] Approx. Q factor measurement
[+] Peak voltage… 5.1
[+] HF antenna ( ok )
[=] -------- LF tuning graph ------------
[+] Orange line - divisor 95 / 125.00 kHz
[+] Blue line - divisor   88 / 134.83 kHz
[=] Q factor must be measured without tag on the antenna

1 Like

This is not how things work… The HF antenna is not part of the middle board. The middle board is just a spacer that passes power to the LF antenna.

But, yeah. As usual, doing too many things at once I misread that detail. Sorry.

Well, it doesn’t look good. Here are your options:

  • We can get you a replacement xEM
  • We can swap your xMagic for a new one (this requires us having the old implant, defective)

Either way, to proceed, please reply to your order confirmation email so we’ll have a ticket for the issue.

Sorry for the hassle.

1 Like

Well thank you for the help with this, I have sent an email.

2 Likes

Yeah I’ve had to field a ton of these issues.

Unfortunately with the repeater board the hw tune will show unusable in the HF antenna. That’s expected and I do not know how to resolve it however rest assured it is working properly.

I’ll be putting a disclaimer on my site soon to reflect this.

3 Likes

Someone needs to update the code and allow for a parameter that introduces alternative calculations.

2 Likes