xEM received, injected and readable just cant write?

I have a proxmark3 rdv2 and I can read my card consistently:

Checking for known tags:
          
EM410x pattern found:           

EM TAG ID      : 2015061314          

Possible de-scramble patterns          
Unique TAG ID  : 04A860C828          
HoneyWell IdentKey {          
DEZ 8          : 00398100          
DEZ 10         : 0352719636          
DEZ 5.5        : 05382.04884          
DEZ 3.5A       : 032.04884          
DEZ 3.5B       : 021.04884          
DEZ 3.5C       : 006.04884          
DEZ 14/IK2     : 00137791673108          
DEZ 15/IK3     : 000020004784168          
DEZ 20/ZK      : 00041008060012080208          
}
Other          : 04884_006_00398100          
Pattern Paxton : 538595604 [0x201A5114]          
Pattern 1      : 606362 [0x9409A]          
Pattern Sebury : 4884 6 398100  [0x1314 0x6 0x61314]          

Valid EM410x ID Found!      

unfortunately I cannot issue the 'lf t55xx detect" command as it returns nothing but I can get this from t55xx info:

proxmark3> lf t55xx info
          
-- T55x7 Configuration & Tag Information --------------------          
-------------------------------------------------------------          
 Safer key                 : 8          
 reserved                  : 25          
 Data bit rate             : 4 - RF/50          
 eXtended mode             : No          
 Modulation                : 0x0D (Unknown)          
 PSK clock frequency       : 0          
 AOR - Answer on Request   : Yes          
 OTP - One Time Pad        : No          
 Max block                 : 7          
 Password mode             : No          
 Sequence Start Terminator : Yes          
 Fast Write                : Yes          
 Inverse data              : Yes          
 POR-Delay                 : Yes          
-------------------------------------------------------------          
 Raw Data - Page 0          
     Block 0  : 0x8330D2EF  10000011001100001101001011101111          
-------------------------------------------------------------  

All reads return this wave form: https://i.imgur.com/Cu4WviR.png

Is my implant bricked?

1 Like

More info, can pull this from the tag:

proxmark3> lf t55xx read
Reading Page 0:          
blk | hex data | binary          
----+----------+---------------------------------          
  255 | 60CC34BB | 01100000110011000011010010111011          
proxmark3> lf t55xx dump
Reading Page 0:          
blk | hex data | binary          
----+----------+---------------------------------          
  0 | 8330D2EF | 10000011001100001101001011101111          
  1 | 8330D2EF | 10000011001100001101001011101111          
  2 | 8330D2EF | 10000011001100001101001011101111          
  3 | 0661A5DF | 00000110011000011010010111011111          
  4 | 8330D2EF | 10000011001100001101001011101111          
  5 | 0661A5DF | 00000110011000011010010111011111          
  6 | 0661A5DF | 00000110011000011010010111011111          
  7 | 0661A5DF | 00000110011000011010010111011111          
Reading Page 1:          
blk | hex data | binary          
----+----------+---------------------------------          
  0 | 8330D2EF | 10000011001100001101001011101111          
  1 | 0661A5DF | 00000110011000011010010111011111          
  2 | 0661A5DF | 00000110011000011010010111011111          
  3 | 0661A5DF | 00000110011000011010010111011111          
proxmark3>
1 Like

For Reference the LOT# was 15250001
MFG Date: 2015 :06
EXP Date: 2020 :05

1 Like

UPDATE:

Have tried Icemans fork to no benefit and I have also tried the access antenna from the site to no benefit. This seems to be the best coupling I’ve got… should I remove the tag before it heals over?

What is it you’re trying to accomplish with “lf t55xx detect”, and are you sure it’s included in the version of iceman fork you’re trying?

@TomHarkness opened an issue similar to this here; https://github.com/RfidResearchGroup/proxmark3/issues/3 … sounds like a bug, because we set our T5577 chips to EM mode by default.

1 Like

Thanks for the reply! Im trying to wipe the card and then clone an indala card to my implant. To answer your question I’m using the latest iceman fork I flashed my proxmark back to the master branch though. Is there a version for the rdv2 that you recommend?

2 further questions:

In regards to Tom’s reply:

Just checked this in the original pm3 fork and.
the issue does not present with rdv4 hardware.
Edit: just tested this fork with rdv2 / 3 - same issue. 
Definitely software related guys.

I understand that the latest rdv4 proxmark3 resolves the timing issues?

Second question, what is the correct baud rate, offset and extended t55xx config to be able to wipe this chip? Should I use the proposed:

lf t55xx deviceconfig a 29 b 17 c 15 d 47 e 15
lf t55xx detect

Thanks again amal

1 Like

It appears I have either bricked the chip or wiped it as I can no longer read the chip and the waveform has changed:

1 Like

hmm possibly… why the wipe step? it’s not necessary and it may be the issue. @TomHarkness … any secret commands to bring it back to life?

2 Likes

Ok so you’ve wiped all blocks to 0s with the “Lf t5 wipe” command?

If so you should be able to simply write a new ID to recover the chip. “Lf Hid clone 1123434455” or similar command.

Because these specific t55 chips are fully writable you’ve also wiped clear the traceability and manufacturer data which is stored in blocks 1,2 & 3 of PAGE 1 - not page 0 which stores your ID data.

I’m 99% sure that your chip is just fine and simply needs some valid data written. If your having issues it may be a coupling issue.

After reading the thread a bit more properly I’m pretty sure this is a coupling issue. Currently at the 9-5 job but will try and replicate this as soon as I get home this evening.

1 Like

Ok guys:

See below (ignore the automatic t5 detect with lf search, you won’t get that without an insanely good antenna):


[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[+] HID Prox TAG ID: 2004840532 (665) - Format Len: 26bit - OEM: 000 - FC: 66 - Card: 665

[+] Valid HID Prox ID found!

[+] Chipset detection : T55xx found

[+] Try lf t55xx commands
[fpc] pm3 --> lf t5 det
Chip Type : T55x7
Modulation : FSK2a
Bit Rate : 4 - RF/50
Inverted : Yes
Offset : 33
Seq. Term. : No
Block0 : 0x00107060

[fpc] pm3 --> lf t5 wipe

[=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)

[=] Writing page 0 block: 00 data: 0x000880E0 pwd: 0x00000000
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[-] No known 125/134 kHz tags found!
lf h
[+] Chipset detection : T55xx found

[fpc] pm3 --> lf t5 det
Chip Type : T55x7
Modulation : ASK
Bit Rate : 2 - RF/32
Inverted : No
Offset : 32
Seq. Term. : Yes
Block0 : 0x000880E0

[fpc] pm3 -->

[+] Try lf t55xx commands
[fpc] pm3 --> lf hid clone 1122334455
[=] Preparing to clone HID tag with ID 1122334455
[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[+] HID Prox TAG ID: 1122334455 (107050) - Format Len: 37bit - OEM: 000 - FC: 4643 - Card: 107050

[+] Valid HID Prox ID found!

[+] Chipset detection : T55xx found

[+] Try lf t55xx commands
[fpc] pm3 -->


So what I want you to try is:

  1. Set the LF config as per the above config displayed after the wipe command. Note that the bitrate is 2, not 4 as it would be for EM / HID modulation, it’s now just a blank t5. The config is “lf t5 config b 2 L”

  2. Get your xEM orientated with the antenna as best you possibly can (whatever orientation you had for the wipe seemed to work so try that)

  3. Write a HID ID to your tag with the command “lf hid clone 2004840534” - This will be FC:66 CC: 666.

  4. Issue the “hw reset” command to clear the lf config you set above as it will now need to be RF 4.

  5. Exit and restart the proxmark client just to be sure

  6. Lf search and see if you get an ID.

I’ve just tested this 5-6 times while on the bus to work and can assure you if it does not work, your issue is antenna related and your implant it not broken in any way.

Just to clarify, the process looks like this:

[fpc] pm3 --> lf t5 wipe

[=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)

[=] Writing page 0 block: 00 data: 0x000880E0 pwd: 0x00000000
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[fpc] pm3 --> lf conf b 2 L
#db# LF Sampling config
#db# [q] divisor…95 ( 125 kHz )
#db# [b] bps…2
#db# [d] decimation…1
#db# [a] averaging…Yes
#db# [t] trigger threshold…0
[fpc] pm3 --> lf hid clone 2004840534
[=] Preparing to clone HID tag with ID 2004840534
[fpc] pm3 --> hw reset
[=] Proxmark3 has been reset.
[fpc] pm3 --> exit

tom@SilverBox:~/proxmark3-RRG$ ./client/proxmark3 /dev/cu.PM3_RDV40-DevB

[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[+] HID Prox TAG ID: 2004840534 (666) - Format Len: 26bit - OEM: 000 - FC: 66 - Card: 666

[+] Valid HID Prox ID found!

[+] Chipset detection : T55xx found

[+] Try lf t55xx commands
[fpc] pm3 -->

Let me know how this goes for you!

2 Likes

@TomHarkness, I am experiencing a similar problem trying to clone a HID tag to my xEM with a proxmark3 RDV2. Anything obvious stand out as incorrect?

For obvious reasons, I didn’t post the actual UID that I’m trying to copy. I just used the one from the previous example for this test.

> 
> pm3 --> lf t55xx detect
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>           
> pm3 --> lf t55xx wipe
>           
> [=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)
>           
> [=] Writing page 0  block: 00  data: 0x000880E0 pwd: 0x00000000          
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0x00000000           
> [=] Writing page 0  block: 03  data: 0x00000000           
> [=] Writing page 0  block: 04  data: 0x00000000           
> [=] Writing page 0  block: 05  data: 0x00000000           
> [=] Writing page 0  block: 06  data: 0x00000000           
> [=] Writing page 0  block: 07  data: 0x00000000           
> pm3 --> lf t55xx detect
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>           
> pm3 --> lf conf b 2 L
> #db# LF Sampling config           
> #db#   [q] divisor.............95 (125 kHz)          
> #db#   [b] bps.................2          
> #db#   [d] decimation..........1          
> #db#   [a] averaging...........Yes          
> #db#   [t] trigger threshold...0          
> pm3 --> lf hid clone 2004840534
> [=] Preparing to clone HID tag with ID 2004840534          
> pm3 --> hw reset
> [=] Proxmark3 has been reset.          
> [=] Running in OFFLINE mode. Use "hw connect" to reconnect
>           
> [offline] pm3 --> exit
> root@test-system:/opt/proxmark3/client# ./proxmark3 /dev/ttyACM0 
> 
>           
> ██████╗ ███╗   ███╗ ████╗      ...iceman fork          
> ██╔══██╗████╗ ████║   ══█║       ...dedicated to RDV40           
> ██████╔╝██╔████╔██║ ████╔╝           
> ██╔═══╝ ██║╚██╔╝██║   ══█║     iceman@icesql.net          
> ██║     ██║ ╚═╝ ██║ ████╔╝    https://github.com/rfidresearchgroup/proxmark3/          
> ╚═╝     ╚═╝     ╚═╝ ╚═══╝  pre-release v4.0          
> 
> Support iceman on patreon,   https://www.patreon.com/iceman1001/          
> 
>           
> [=] Using UART port /dev/ttyACM0           
> [=] Communicating with PM3 over USB-CDC           
> 
>  [ Proxmark3 RFID instrument ] 
>           
> 
>  [ CLIENT ]          
>   client: RRG/Iceman          
> 
>  [ PROXMARK RDV4 ]          
>   external flash:                  absent           
>   smartcard reader:                absent           
> 
>  [ PROXMARK RDV4 Extras ]          
>   FPC USART for BT add-on support: absent           
>           
>  [ ARM ]
>  bootrom: RRG/Iceman/master/d4c3d077 2019-05-15 15:03:25
>       os: RRG/Iceman/master/d4c3d077 2019-05-15 15:03:39
> 
>  [ FPGA ]
>  LF image built for 2s30vq100 on 2019/ 4/18 at  9:35:32
>  HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23          
> 
>  [ Hardware ]           
>   --= uC: AT91SAM7S512 Rev A          
>   --= Embedded Processor: ARM7TDMI          
>   --= Nonvolatile Program Memory Size: 512K bytes, Used: 248458 bytes (47%) Free: 275830 bytes (53%)          
>   --= Second Nonvolatile Program Memory Size: None          
>   --= Internal SRAM Size: 64K bytes          
>   --= Architecture Identifier: AT91SAM7Sxx Series          
>   --= Nonvolatile Program Memory Type: Embedded Flash Memory          
> 
>           
> pm3 --> lf sear
> [=] NOTE: some demods output possible binary          
> [=] if it finds something that looks like a tag          
> [=] False Positives ARE possible          
> [=]           
> [=] Checking for known tags...
>           
> [+] EM410x  pattern found          
> 
> EM TAG ID      : 2018070414          
> 
> Possible de-scramble patterns          
> Unique TAG ID  : 0418E02028          
> HoneyWell IdentKey {          
> DEZ 8          : 00459796          
> DEZ 10         : 0403112980          
> DEZ 5.5        : 06151.01044          
> DEZ 3.5A       : 032.01044          
> DEZ 3.5B       : 024.01044          
> DEZ 3.5C       : 007.01044          
> DEZ 14/IK2     : 00137842066452          
> DEZ 15/IK3     : 000017597210664          
> DEZ 20/ZK      : 00040108140002000208          
> }
> Other          : 01044_007_00459796          
> Pattern Paxton : 538657300 [0x201B4214]          
> Pattern 1      : 720924 [0xB001C]          
> Pattern Sebury : 1044 7 459796  [0x414 0x7 0x70414]          
>           
> [+] Valid EM410x ID  found!

Looks like bad coupling to me. Custom antenna would help. Can you get a read out from t5 detect, “Lf t5 trace” or “t5 info” commands? They require super good coupling so if you can find a position that works with them try again.

Also no need to wipe the tag in stock config just make sure to Lf t5 detect to get the config correct.

pm3 --> lf t5 info
          
-- T55x7 Configuration & Tag Information --------------------          
-------------------------------------------------------------          
 Safer key                 : 14          
 reserved                  : 0          
 Data bit rate             : 5 - RF/12          
 eXtended mode             : Yes - Warning           
 Modulation                : 24 - Biphase a - AKA Conditional Dephase Encoding(CDP)          
 PSK clock frequency       : 0 - RF/2          
 AOR - Answer on Request   : No          
 OTP - One Time Pad        : No          
 Max block                 : 4          
 Password mode             : Yes           
 Sequence Start Marker     : No          
 Fast Write                : No          
 Inverse data              : Yes           
 POR-Delay                 : Yes           
-------------------------------------------------------------          
 Raw Data - Page 0          
     Block 0  : 0xE0178093  11100000000101111000000010010011          
------------------------------------------------------------- 

pm3 --> lf t5 det
Chip Type  : T55x7          
Modulation : BIPHASEa - (CDP)          
Bit Rate   : 5 - RF/64          
Inverted   : Yes           
Offset     : 59          
Seq. Term. : No          
Block0     : 0xE0178093          

Does that config look accurate? It differs significantly from your example above. Also, Do you have any recommendations or know of writeups for a custom antenna for a proxmark3 RDV2?

1 Like

Hmm interesting, seems you’re getting right on the edge of good coupling. Just enough to read cleanly buyt maybe not write.

Can you try and:

  1. Get in that same position that allows t5 trace to give output

  2. t5 detect to get the modulation right

  3. lf t5 write block 5 data 00000666

  4. lf t5 dump

Does block 5 show the data written above in step 3?

Also is your RDV2 a genuine model or an ebay / amazon China special? IF the former I can maybe loan you a test coil that should work just fine for you.

Cheers,
Tom

1 Like

Thank you - will try and get back to you.

I bought RDV2 from a fellow security professional that upgraded. He takes his job seriously and I’m fairly certain it is a genuine model.

Just to confirm, the correct modulation should be ASK… correct?

1 Like

I was never able to get ‘lf t5 trace’. I could get “info” and “det” to work but not “trace”. Following up to note that I was not able to get “lf t5 trace” to work even on large form factor cards (T5577 chip) that was successfully able to clone a prox UID to.

I just ordered the xEM Access Controller with the 125kHz antenna. I’m going to see if I can make the antenna work with the proxmark3 RDV2. If anyone knows whether that will work and have done that before, please let me know.

> 
> pm3 --> script run test_t55x7
> [+] Executing: test_t55x7.lua, args ''
>       
> ----------------------------------------
> ----------------------------------------
> Wiping card
>       
> [=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)
>       
> [=] Writing page 0  block: 00  data: 0x000880E0 pwd: 0x00000000          
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0x00000000           
> [=] Writing page 0  block: 03  data: 0x00000000           
> [=] Writing page 0  block: 04  data: 0x00000000           
> [=] Writing page 0  block: 05  data: 0x00000000           
> [=] Writing page 0  block: 06  data: 0x00000000           
> [=] Writing page 0  block: 07  data: 0x00000000           
> Detecting card
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 2 - RF/32          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x000880E0          
>       
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0xFFFFFFFF           
> [=] Writing page 0  block: 03  data: 0x80000000           
> [=] Writing page 0  block: 04  data: 0x00000001           
> ASK
> Start test of ASK
> ###	lf t55xx write b 0 d 00008040
> [+] Found [2] possible matches for modulation.          
> --[1]---------------          
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 0 - RF/8          
> Inverted   : No          
> Offset     : 30          
> Seq. Term. : Yes           
> Block0     : 0x00008040          
>       
> --[2]---------------          
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 0 - RF/8          
> Inverted   : Yes           
> Offset     : 31          
> Seq. Term. : No          
> Block0     : 0x000180C0          
>       
> can't detect modulation, skip to next config
> 2019-08-02T23:55:23Z remark: [ERR:DETECT:00008040] Failed to detect modulation          
> 2019-08-02T23:55:23Z remark: [SUMMARY:00008040] FAIL detection          
> ###	lf t55xx write b 0 d 00048040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 1 - RF/16          
> Inverted   : No          
> Offset     : 33          
> Seq. Term. : Yes           
> Block0     : 0x00048040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:23Z remark: [ERR:READ:00048040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 00000001 Failed
> 2019-08-02T23:55:24Z remark: [ERR:READ:00048040:3] block 3: read 00000001 instead of 80000000          
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:24Z remark: [SUMMARY:00048040] FAIL 2 tests          
> ###	lf t55xx write b 0 d 00088040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 2 - RF/32          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00088040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:24Z remark: [ERR:READ:00088040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:25Z remark: [SUMMARY:00088040] FAIL 1 test          
> ###	lf t55xx write b 0 d 000c8040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 3 - RF/40          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x000C8040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:26Z remark: [ERR:READ:000c8040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:27Z remark: [SUMMARY:000c8040] FAIL 1 test          
> ###	lf t55xx write b 0 d 00108040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 4 - RF/50          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00108040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:27Z remark: [ERR:READ:00108040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:28Z remark: [SUMMARY:00108040] FAIL 1 test          
> ###	lf t55xx write b 0 d 00148040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 5 - RF/64          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00148040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:29Z remark: [ERR:READ:00148040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:29Z remark: [SUMMARY:00148040] FAIL 1 test          
> ###	lf t55xx write b 0 d 00188040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 6 - RF/100          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00188040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:30Z remark: [ERR:READ:00188040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:31Z remark: [SUMMARY:00188040] FAIL 1 test          
> ###	lf t55xx write b 0 d 001c8040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 7 - RF/128          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x001C8040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:31Z remark: [ERR:READ:001c8040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:32Z remark: [SUMMARY:001c8040] FAIL 1 test          
> ----------------------------------------
> ----------------------------------------
> Tests finished
> 
> 2019-08-02T23:55:32Z remark: [SUMMARY] Success rate: 20/32 tests passed, help me improving that number!          
>       
> [+] Finished
>       
> pm3 --> script run test_t55x7
> [+] Executing: test_t55x7.lua, args ''
>       
> ----------------------------------------
> ----------------------------------------
> Wiping card
>       
> [=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)
>       
> [=] Writing page 0  block: 00  data: 0x000880E0 pwd: 0x00000000          
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0x00000000           
> [=] Writing page 0  block: 03  data: 0x00000000           
> [=] Writing page 0  block: 04  data: 0x00000000           
> [=] Writing page 0  block: 05  data: 0x00000000           
> [=] Writing page 0  block: 06  data: 0x00000000           
> [=] Writing page 0  block: 07  data: 0x00000000           
> Detecting card
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0xFFFFFFFF           
> [=] Writing page 0  block: 03  data: 0x80000000           
> [=] Writing page 0  block: 04  data: 0x00000001           
> ASK
> Start test of ASK
> ###	lf t55xx write b 0 d 00008040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:47Z remark: [ERR:READ:00008040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:47Z remark: [ERR:READ:00008040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:48Z remark: [ERR:READ:00008040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:48Z remark: [ERR:READ:00008040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:48Z remark: [SUMMARY:00008040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00048040
> can't detect modulation, skip to next config
> 2019-08-02T23:55:48Z remark: [ERR:DETECT:00048040] Failed to detect modulation          
> 2019-08-02T23:55:48Z remark: [SUMMARY:00048040] FAIL detection          
> ###	lf t55xx write b 0 d 00088040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:49Z remark: [SUMMARY:00088040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 000c8040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:50Z remark: [ERR:READ:000c8040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:50Z remark: [ERR:READ:000c8040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:51Z remark: [ERR:READ:000c8040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:51Z remark: [ERR:READ:000c8040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:51Z remark: [SUMMARY:000c8040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00108040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:51Z remark: [ERR:READ:00108040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:52Z remark: [ERR:READ:00108040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:52Z remark: [ERR:READ:00108040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:52Z remark: [ERR:READ:00108040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:52Z remark: [SUMMARY:00108040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00148040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:53Z remark: [ERR:READ:00148040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:53Z remark: [ERR:READ:00148040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:53Z remark: [ERR:READ:00148040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:54Z remark: [ERR:READ:00148040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:54Z remark: [SUMMARY:00148040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00188040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:54Z remark: [ERR:READ:00188040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:54Z remark: [ERR:READ:00188040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:55Z remark: [ERR:READ:00188040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:55Z remark: [ERR:READ:00188040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:55Z remark: [SUMMARY:00188040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 001c8040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:3] block 3: read 41B2E9E0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:56Z remark: [SUMMARY:001c8040] FAIL 4 tests          
> ----------------------------------------
> ----------------------------------------
> Tests finished
> 
> 2019-08-02T23:55:56Z remark: [SUMMARY] Success rate: 0/32 tests passed, help me improving that number!          
          
[+] Finished
1 Like

Hey @black_sam let me know if using that antenna works because I am running into basically the same issue as you. I’ve been trying to clone awid to my t55x7 and I can not do that or wipe the chip successfully using the default antenna on a proxmark3 easy. I do have a spare t55x7 physical card that I have been able to successfully write and wipe using the proxmark3 easy, however I think that as @TomHarkness pointed out, it probably has to do with poor coupling.

2 Likes

So here is the link to the thread where I walked through troubleshooting with @TomHarkness.

I was eventually able to successfully write to the xEM chip. However, @amal shared that it was probably a 1 out of 100 chance of success. I shared what I did to get it to work in the thread that I just linked to. Good luck!!!

3 Likes

Thanks for sharing! I will definitely have to look at trying it out myself and seeing if I too “can win the lottery”. I was able to write to my xEM today with my proxmark3 easy lf antenna after a lot of repositioning, which, as I understand, can be quite risky as I could have potentially bricked it by writing with a sub par coupling and created a “tear”.

2 Likes