xEM acting strange, unable to write


#1

Hi,

I got the xEM installed a week ago. I wanted to clone an access card to it, but it does not respond to write commands. I am using proxmark3 and I am convinced I get strong signal. Can anyone please help me fix it or at least debug? Thanks. Here are some outputs from proxmark3:

proxmark3> lf t55 detect
Chip Type  : T55x7
Modulation : BIPHASEa - (CDP)
Bit Rate  : 5 - RF/64
Inverted  : Yes
Offset    : 57
Seq. Term. : No
Block0    : 0xE01780BE

proxmark3> lf t55 dump
Reading Page 0:
blk | hex data | binary
----+----------+---------------------------------
  0 | E01780BE | 11100000000101111000000010111110
  1 | E01780BE | 11100000000101111000000010111110
  2 | E01780BE | 11100000000101111000000010111110
  3 | C02F017C | 11000000001011110000000101111100
  4 | E01780BE | 11100000000101111000000010111110
  5 | C02F017C | 11000000001011110000000101111100
  6 | AE01780B | 10101110000000010111100000001011
  7 | C02F017C | 11000000001011110000000101111100
Reading Page 1:
blk | hex data | binary
----+----------+---------------------------------
  0 | E01780BE | 11100000000101111000000010111110
  1 | C02F017C | 11000000001011110000000101111100
  2 | C02F017C | 11000000001011110000000101111100
  3 | C02F017C | 11000000001011110000000101111100
proxmark3> lf t55xx trace
The modulation is most likely wrong since the ACL is not 0xE0.
proxmark3> lf search
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:

EM410x pattern found:

EM TAG ID      : 2015060494

Possible de-scramble patterns
Unique TAG ID  : 04A8602029
HoneyWell IdentKey {
DEZ 8          : 00394388
DEZ 10        : 0352715924
DEZ 5.5        : 05382.01172
DEZ 3.5A      : 032.01172
DEZ 3.5B      : 021.01172
DEZ 3.5C      : 006.01172
DEZ 14/IK2    : 00137791669396
DEZ 15/IK3    : 000020004741161
DEZ 20/ZK      : 00041008060002000209
}
Other          : 01172_006_00394388
Pattern Paxton : 538591892 [0x201A4294]
Pattern 1      : 589853 [0x9001D]
Pattern Sebury : 1172 6 394388  [0x494 0x6 0x60494]

Valid EM410x ID Found!

Xem came with a password
#2

I have the same issue did you ever figure this out?


#3

No I did not. I did not have much time to look into it and my knowledge is probably not sufficient to solve this.


#4

Ok, I see your post and all the detection process output… but nothing about writes… can you show your work?

Also, one thing to keep in mind is that writing data to any tag requires more power than reading the tag, and thus successfully writing data to the T5577 requires a better coupling than reading it does… so maybe you have a good enough coupling to read your tag but not a good enough one to write. It’s unlikely, but possible.