Unable to write to this card

Support
1

I bought what I think might be a t5577 card. However when I did a “lf search” it is coming up as this.

[+] EM 410x ID 0000001450
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : 000000280A
[=] HoneyWell IdentKey
[+] DEZ 8 : 00005200
[+] DEZ 10 : 0000005200
[+] DEZ 5.5 : 00000.05200
[+] DEZ 3.5A : 000.05200
[+] DEZ 3.5B : 000.05200
[+] DEZ 3.5C : 000.05200
[+] DEZ 14/IK2 : 00000000005200
[+] DEZ 15/IK3 : 000000000010250
[+] DEZ 20/ZK : 00000000000002080010
[=]
[+] Other : 05200_000_00005200
[+] Pattern Paxton : 1331792 [0x145250]
[+] Pattern 1 : 16652 [0x410C]
[+] Pattern Sebury : 5200 0 5200 [0x1450 0x0 0x1450]
[+] VD / ID : 000 / 0000005200
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[+] Chipset detection: T55xx

I am trying to write Indala data onto this but unable to. Can I get your help please?

2

Try an lf t5 detect

3

Thanks for your quick reply.

[=] Chip type… T55x7
[=] Modulation… ASK
[=] Bit rate… 5 - RF/64
[=] Inverted… No
[=] Offset… 33
[=] Seq. terminator… Yes
[=] Block0… 00148040 (auto detect)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

it is showing as this.

4

What commands are you using to write the indala?

5

using lf indala clone -r

6

Try running
lf t5 detect
and
lf t5 wipe
and then retry the cloning process

7

remains the same:

[=] Chip type… T55x7
[=] Modulation… ASK
[=] Bit rate… 5 - RF/64
[=] Inverted… No
[=] Offset… 33
[=] Seq. terminator… Yes
[=] Block0… 00148040 (auto detect)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

Wondering if I need to do something to Block 0

8

You re-did the cloning step?

What does lf search show now?

9

Also remember that these commands do not indicate successful write to the chip. They only say the command completed successfully. The data is screamed into the void. The chip either hears it and complies, or doesn’t. The proxmark3 doesn’t follow up and ask the chip if it updated itself.

1 Like
10

Thanks for chiming in all. Copying all my steps here.

I did the wipe, clone and search

[usb] pm3 → lf t55xx wipe -c 00081040
[=] Target T55x7 tag
[=] User provided configuration block 00081040

[=] Begin wiping…
[=] Writing page 0 block: 00 data: 0x00081040
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 → lf indala clone -r a0000000af0a1491
[=] Preparing to clone Indala 64 bit to T55x7 raw A0000000AF0A1491
[+] Blk | Data
[+] ----±-----------
[+] 00 | 00081040
[+] 01 | A0000000
[+] 02 | AF0A1491
[=] Block0 write detected, running detect to see if validation is possible
[=] Chip type… T55x7
[=] Modulation… ASK
[=] Bit rate… 5 - RF/64
[=] Inverted… No
[=] Offset… 33
[=] Seq. terminator… Yes
[=] Block0… 00148040 (auto detect)
[=] Downlink mode… default/fixed bit length
[=] Password set… Yes
[=] Password… FFFFFFFF

[+] Done
[?] Hint: try lf indala reader to verify
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx

11

At this point the commands seem right, I’d try re-doing the cloning step and the lf search step a few times with the card in different positions and see if you can’t get it to take

Is your PM3 client up to date?

12

Hi Aoxhw…

Yes here is the client version i got

Client… Iceman/master/v4.18218-77-g9de6f5913 2024-03-08 01:02:29
Bootrom… Iceman/master/v4.18218-77-g9de6f5913-suspect 2024-03-08 01:01:42
OS… Iceman/master/v4.18218-77-g9de6f5913-suspect 2024-03-08 01:01:59
Target… PM3 GENERIC

Will work on your suggestion. Are you saying there is nothign wrong with the card that I am trying to write into and it is a valid t5577 card?

13

As far as I can tell the T5577 is working, but that doesn’t mean I’m right

Unfortunately the only method I’m aware of to really test it is to keep trying to write to it and see if it works

14

Try cloning a basic EM type and see if that sticks…

lf em 410x --clone --id 0102030405

1 Like