Got a bit of a mystery here today. In my apartment complex, they use a Schlage 9691T fob for most of the access control, which does both LF (HID Prox ID) and and HF (Classic 1K). The LF is used for readers around the property, like pool and office access, while the HF side is for your specific apartment door. I have been toying around with the HF side and trying to get it on all my various implants.
Despite not getting the encryption keys, I cloned what I could with the default keys and managed to get it working on both my flexMT and on a separate KSEC 1K Magic Gen1A card. Here is what it looked like before popping the encryption:
[usb] pm3 --> hf mf chk --1k
[+] loaded 63 hardcoded keys
[=] Start check for keys...
[=] .................................
[=] Time in checkkeys 11 seconds
[=] Testing to read key B...
[+] -----+-----+--------------+---+--------------+----
[+] Sec | Blk | key A |res| key B |res
[+] -----+-----+--------------+---+--------------+----
[+] 000 | 003 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] 001 | 007 | ------------ | 0 | ------------ | 0
[+] 002 | 011 | ------------ | 0 | ------------ | 0
[+] 003 | 015 | ------------ | 0 | ------------ | 0
[+] 004 | 019 | ------------ | 0 | ------------ | 0
[+] 005 | 023 | ------------ | 0 | ------------ | 0
[+] 006 | 027 | ------------ | 0 | ------------ | 0
[+] 007 | 031 | ------------ | 0 | ------------ | 0
[+] 008 | 035 | ------------ | 0 | ------------ | 0
[+] 009 | 039 | ------------ | 0 | ------------ | 0
[+] 010 | 043 | ------------ | 0 | ------------ | 0
[+] 011 | 047 | ------------ | 0 | ------------ | 0
[+] 012 | 051 | ------------ | 0 | ------------ | 0
[+] 013 | 055 | ------------ | 0 | ------------ | 0
[+] 014 | 059 | ------------ | 0 | ------------ | 0
[+] 015 | 063 | FFFFFFFFFFFF | 1 | FFFFFFFFFFFF | 1
[+] -----+-----+--------------+---+--------------+----
[+] ( 0:Failed / 1:Success )
and the contents (basically only Blk 3 and Blk 63):
[+] Succeeded in dumping all blocks
[+] time: 25 seconds
[=] -----+-----+-------------------------------------------------+-----------------
[=] sec | blk | data | ascii
[=] -----+-----+-------------------------------------------------+-----------------
[=] 0 | 0 | EB 43 3E 22 B4 88 04 00 C8 39 00 20 00 00 00 24 | .C>".....9. ...$
[=] | 1 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 2 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 3 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] 1 | 4 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 6 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 7 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 2 | 8 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 9 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 11 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 3 | 12 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 13 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 14 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 15 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 4 | 16 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 17 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 19 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 5 | 20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 21 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 22 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 23 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 6 | 24 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 25 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 26 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 27 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 7 | 28 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 29 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 31 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 8 | 32 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 33 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 34 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 35 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 9 | 36 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 37 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 38 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 39 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 10 | 40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 41 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 42 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 43 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 11 | 44 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 45 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 46 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 47 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 12 | 48 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 49 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 51 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 13 | 52 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 53 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 54 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 55 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 14 | 56 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 57 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 58 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 59 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] 15 | 60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 61 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 62 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
[=] | 63 | FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF | .........i......
[=] -----+-----+-------------------------------------------------+-----------------
Seeing this and knowing the Gen1A card and flexMT worked off of just this data, I figured the door reader was just doing a UID/AT!A/SAK check and cloned that over to the Gen4 and set it to emulate the 1K format. Suffice to say, the door reader did not respond at all. Cut forward after a lot of troubleshooting and I still can’t get the reader to recognize the dUG4T despite now having cracked the keys and fully cloning the entire fob (minus Sector 1). I’ve added all the files into the attached zip, but I’m honestly not sure what steps are left.
From the trace, it seems like the tag never even responds to the reader while the other two do. Is it possible that the Gen4 architecture is just not responding well to this particular reader? I’ve tried a bunch of coupling angles and can get a pretty far read with the flexMT, so I’m not sure it’s skin depth or anything. The lock in question is a Schlage Control BE467F Smart Deadbolt.
Dumps and Traces.zip (8.0 KB)