xEM received, injected and readable just cant write?

I have a proxmark3 rdv2 and I can read my card consistently:

Checking for known tags:
          
EM410x pattern found:           

EM TAG ID      : 2015061314          

Possible de-scramble patterns          
Unique TAG ID  : 04A860C828          
HoneyWell IdentKey {          
DEZ 8          : 00398100          
DEZ 10         : 0352719636          
DEZ 5.5        : 05382.04884          
DEZ 3.5A       : 032.04884          
DEZ 3.5B       : 021.04884          
DEZ 3.5C       : 006.04884          
DEZ 14/IK2     : 00137791673108          
DEZ 15/IK3     : 000020004784168          
DEZ 20/ZK      : 00041008060012080208          
}
Other          : 04884_006_00398100          
Pattern Paxton : 538595604 [0x201A5114]          
Pattern 1      : 606362 [0x9409A]          
Pattern Sebury : 4884 6 398100  [0x1314 0x6 0x61314]          

Valid EM410x ID Found!      

unfortunately I cannot issue the 'lf t55xx detect" command as it returns nothing but I can get this from t55xx info:

proxmark3> lf t55xx info
          
-- T55x7 Configuration & Tag Information --------------------          
-------------------------------------------------------------          
 Safer key                 : 8          
 reserved                  : 25          
 Data bit rate             : 4 - RF/50          
 eXtended mode             : No          
 Modulation                : 0x0D (Unknown)          
 PSK clock frequency       : 0          
 AOR - Answer on Request   : Yes          
 OTP - One Time Pad        : No          
 Max block                 : 7          
 Password mode             : No          
 Sequence Start Terminator : Yes          
 Fast Write                : Yes          
 Inverse data              : Yes          
 POR-Delay                 : Yes          
-------------------------------------------------------------          
 Raw Data - Page 0          
     Block 0  : 0x8330D2EF  10000011001100001101001011101111          
-------------------------------------------------------------  

All reads return this wave form: https://i.imgur.com/Cu4WviR.png

Is my implant bricked?

More info, can pull this from the tag:

proxmark3> lf t55xx read
Reading Page 0:          
blk | hex data | binary          
----+----------+---------------------------------          
  255 | 60CC34BB | 01100000110011000011010010111011          
proxmark3> lf t55xx dump
Reading Page 0:          
blk | hex data | binary          
----+----------+---------------------------------          
  0 | 8330D2EF | 10000011001100001101001011101111          
  1 | 8330D2EF | 10000011001100001101001011101111          
  2 | 8330D2EF | 10000011001100001101001011101111          
  3 | 0661A5DF | 00000110011000011010010111011111          
  4 | 8330D2EF | 10000011001100001101001011101111          
  5 | 0661A5DF | 00000110011000011010010111011111          
  6 | 0661A5DF | 00000110011000011010010111011111          
  7 | 0661A5DF | 00000110011000011010010111011111          
Reading Page 1:          
blk | hex data | binary          
----+----------+---------------------------------          
  0 | 8330D2EF | 10000011001100001101001011101111          
  1 | 0661A5DF | 00000110011000011010010111011111          
  2 | 0661A5DF | 00000110011000011010010111011111          
  3 | 0661A5DF | 00000110011000011010010111011111          
proxmark3>

For Reference the LOT# was 15250001
MFG Date: 2015 :06
EXP Date: 2020 :05

UPDATE:

Have tried Icemans fork to no benefit and I have also tried the access antenna from the site to no benefit. This seems to be the best coupling I’ve got… should I remove the tag before it heals over?

What is it you’re trying to accomplish with “lf t55xx detect”, and are you sure it’s included in the version of iceman fork you’re trying?

@TomHarkness opened an issue similar to this here; https://github.com/RfidResearchGroup/proxmark3/issues/3 … sounds like a bug, because we set our T5577 chips to EM mode by default.

Thanks for the reply! Im trying to wipe the card and then clone an indala card to my implant. To answer your question I’m using the latest iceman fork I flashed my proxmark back to the master branch though. Is there a version for the rdv2 that you recommend?

2 further questions:

In regards to Tom’s reply:

Just checked this in the original pm3 fork and.
the issue does not present with rdv4 hardware.
Edit: just tested this fork with rdv2 / 3 - same issue. 
Definitely software related guys.

I understand that the latest rdv4 proxmark3 resolves the timing issues?

Second question, what is the correct baud rate, offset and extended t55xx config to be able to wipe this chip? Should I use the proposed:

lf t55xx deviceconfig a 29 b 17 c 15 d 47 e 15
lf t55xx detect

Thanks again amal

It appears I have either bricked the chip or wiped it as I can no longer read the chip and the waveform has changed:

hmm possibly… why the wipe step? it’s not necessary and it may be the issue. @TomHarkness … any secret commands to bring it back to life?

1 Like

Ok so you’ve wiped all blocks to 0s with the “Lf t5 wipe” command?

If so you should be able to simply write a new ID to recover the chip. “Lf Hid clone 1123434455” or similar command.

Because these specific t55 chips are fully writable you’ve also wiped clear the traceability and manufacturer data which is stored in blocks 1,2 & 3 of PAGE 1 - not page 0 which stores your ID data.

I’m 99% sure that your chip is just fine and simply needs some valid data written. If your having issues it may be a coupling issue.

After reading the thread a bit more properly I’m pretty sure this is a coupling issue. Currently at the 9-5 job but will try and replicate this as soon as I get home this evening.

1 Like

Ok guys:

See below (ignore the automatic t5 detect with lf search, you won’t get that without an insanely good antenna):


[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[+] HID Prox TAG ID: 2004840532 (665) - Format Len: 26bit - OEM: 000 - FC: 66 - Card: 665

[+] Valid HID Prox ID found!

[+] Chipset detection : T55xx found

[+] Try lf t55xx commands
[fpc] pm3 --> lf t5 det
Chip Type : T55x7
Modulation : FSK2a
Bit Rate : 4 - RF/50
Inverted : Yes
Offset : 33
Seq. Term. : No
Block0 : 0x00107060

[fpc] pm3 --> lf t5 wipe

[=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)

[=] Writing page 0 block: 00 data: 0x000880E0 pwd: 0x00000000
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[-] No known 125/134 kHz tags found!
lf h
[+] Chipset detection : T55xx found

[fpc] pm3 --> lf t5 det
Chip Type : T55x7
Modulation : ASK
Bit Rate : 2 - RF/32
Inverted : No
Offset : 32
Seq. Term. : Yes
Block0 : 0x000880E0

[fpc] pm3 -->

[+] Try lf t55xx commands
[fpc] pm3 --> lf hid clone 1122334455
[=] Preparing to clone HID tag with ID 1122334455
[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[+] HID Prox TAG ID: 1122334455 (107050) - Format Len: 37bit - OEM: 000 - FC: 4643 - Card: 107050

[+] Valid HID Prox ID found!

[+] Chipset detection : T55xx found

[+] Try lf t55xx commands
[fpc] pm3 -->


So what I want you to try is:

  1. Set the LF config as per the above config displayed after the wipe command. Note that the bitrate is 2, not 4 as it would be for EM / HID modulation, it’s now just a blank t5. The config is “lf t5 config b 2 L”

  2. Get your xEM orientated with the antenna as best you possibly can (whatever orientation you had for the wipe seemed to work so try that)

  3. Write a HID ID to your tag with the command “lf hid clone 2004840534” - This will be FC:66 CC: 666.

  4. Issue the “hw reset” command to clear the lf config you set above as it will now need to be RF 4.

  5. Exit and restart the proxmark client just to be sure

  6. Lf search and see if you get an ID.

I’ve just tested this 5-6 times while on the bus to work and can assure you if it does not work, your issue is antenna related and your implant it not broken in any way.

Just to clarify, the process looks like this:

[fpc] pm3 --> lf t5 wipe

[=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)

[=] Writing page 0 block: 00 data: 0x000880E0 pwd: 0x00000000
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[fpc] pm3 --> lf conf b 2 L
#db# LF Sampling config
#db# [q] divisor…95 ( 125 kHz )
#db# [b] bps…2
#db# [d] decimation…1
#db# [a] averaging…Yes
#db# [t] trigger threshold…0
[fpc] pm3 --> lf hid clone 2004840534
[=] Preparing to clone HID tag with ID 2004840534
[fpc] pm3 --> hw reset
[=] Proxmark3 has been reset.
[fpc] pm3 --> exit

tom@SilverBox:~/proxmark3-RRG$ ./client/proxmark3 /dev/cu.PM3_RDV40-DevB

[fpc] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags…

[+] HID Prox TAG ID: 2004840534 (666) - Format Len: 26bit - OEM: 000 - FC: 66 - Card: 666

[+] Valid HID Prox ID found!

[+] Chipset detection : T55xx found

[+] Try lf t55xx commands
[fpc] pm3 -->

Let me know how this goes for you!

1 Like

@TomHarkness, I am experiencing a similar problem trying to clone a HID tag to my xEM with a proxmark3 RDV2. Anything obvious stand out as incorrect?

For obvious reasons, I didn’t post the actual UID that I’m trying to copy. I just used the one from the previous example for this test.

> 
> pm3 --> lf t55xx detect
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>           
> pm3 --> lf t55xx wipe
>           
> [=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)
>           
> [=] Writing page 0  block: 00  data: 0x000880E0 pwd: 0x00000000          
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0x00000000           
> [=] Writing page 0  block: 03  data: 0x00000000           
> [=] Writing page 0  block: 04  data: 0x00000000           
> [=] Writing page 0  block: 05  data: 0x00000000           
> [=] Writing page 0  block: 06  data: 0x00000000           
> [=] Writing page 0  block: 07  data: 0x00000000           
> pm3 --> lf t55xx detect
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>           
> pm3 --> lf conf b 2 L
> #db# LF Sampling config           
> #db#   [q] divisor.............95 (125 kHz)          
> #db#   [b] bps.................2          
> #db#   [d] decimation..........1          
> #db#   [a] averaging...........Yes          
> #db#   [t] trigger threshold...0          
> pm3 --> lf hid clone 2004840534
> [=] Preparing to clone HID tag with ID 2004840534          
> pm3 --> hw reset
> [=] Proxmark3 has been reset.          
> [=] Running in OFFLINE mode. Use "hw connect" to reconnect
>           
> [offline] pm3 --> exit
> root@test-system:/opt/proxmark3/client# ./proxmark3 /dev/ttyACM0 
> 
>           
> ██████╗ ███╗   ███╗ ████╗      ...iceman fork          
> ██╔══██╗████╗ ████║   ══█║       ...dedicated to RDV40           
> ██████╔╝██╔████╔██║ ████╔╝           
> ██╔═══╝ ██║╚██╔╝██║   ══█║     iceman@icesql.net          
> ██║     ██║ ╚═╝ ██║ ████╔╝    https://github.com/rfidresearchgroup/proxmark3/          
> ╚═╝     ╚═╝     ╚═╝ ╚═══╝  pre-release v4.0          
> 
> Support iceman on patreon,   https://www.patreon.com/iceman1001/          
> 
>           
> [=] Using UART port /dev/ttyACM0           
> [=] Communicating with PM3 over USB-CDC           
> 
>  [ Proxmark3 RFID instrument ] 
>           
> 
>  [ CLIENT ]          
>   client: RRG/Iceman          
> 
>  [ PROXMARK RDV4 ]          
>   external flash:                  absent           
>   smartcard reader:                absent           
> 
>  [ PROXMARK RDV4 Extras ]          
>   FPC USART for BT add-on support: absent           
>           
>  [ ARM ]
>  bootrom: RRG/Iceman/master/d4c3d077 2019-05-15 15:03:25
>       os: RRG/Iceman/master/d4c3d077 2019-05-15 15:03:39
> 
>  [ FPGA ]
>  LF image built for 2s30vq100 on 2019/ 4/18 at  9:35:32
>  HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23          
> 
>  [ Hardware ]           
>   --= uC: AT91SAM7S512 Rev A          
>   --= Embedded Processor: ARM7TDMI          
>   --= Nonvolatile Program Memory Size: 512K bytes, Used: 248458 bytes (47%) Free: 275830 bytes (53%)          
>   --= Second Nonvolatile Program Memory Size: None          
>   --= Internal SRAM Size: 64K bytes          
>   --= Architecture Identifier: AT91SAM7Sxx Series          
>   --= Nonvolatile Program Memory Type: Embedded Flash Memory          
> 
>           
> pm3 --> lf sear
> [=] NOTE: some demods output possible binary          
> [=] if it finds something that looks like a tag          
> [=] False Positives ARE possible          
> [=]           
> [=] Checking for known tags...
>           
> [+] EM410x  pattern found          
> 
> EM TAG ID      : 2018070414          
> 
> Possible de-scramble patterns          
> Unique TAG ID  : 0418E02028          
> HoneyWell IdentKey {          
> DEZ 8          : 00459796          
> DEZ 10         : 0403112980          
> DEZ 5.5        : 06151.01044          
> DEZ 3.5A       : 032.01044          
> DEZ 3.5B       : 024.01044          
> DEZ 3.5C       : 007.01044          
> DEZ 14/IK2     : 00137842066452          
> DEZ 15/IK3     : 000017597210664          
> DEZ 20/ZK      : 00040108140002000208          
> }
> Other          : 01044_007_00459796          
> Pattern Paxton : 538657300 [0x201B4214]          
> Pattern 1      : 720924 [0xB001C]          
> Pattern Sebury : 1044 7 459796  [0x414 0x7 0x70414]          
>           
> [+] Valid EM410x ID  found!

Looks like bad coupling to me. Custom antenna would help. Can you get a read out from t5 detect, “Lf t5 trace” or “t5 info” commands? They require super good coupling so if you can find a position that works with them try again.

Also no need to wipe the tag in stock config just make sure to Lf t5 detect to get the config correct.

pm3 --> lf t5 info
          
-- T55x7 Configuration & Tag Information --------------------          
-------------------------------------------------------------          
 Safer key                 : 14          
 reserved                  : 0          
 Data bit rate             : 5 - RF/12          
 eXtended mode             : Yes - Warning           
 Modulation                : 24 - Biphase a - AKA Conditional Dephase Encoding(CDP)          
 PSK clock frequency       : 0 - RF/2          
 AOR - Answer on Request   : No          
 OTP - One Time Pad        : No          
 Max block                 : 4          
 Password mode             : Yes           
 Sequence Start Marker     : No          
 Fast Write                : No          
 Inverse data              : Yes           
 POR-Delay                 : Yes           
-------------------------------------------------------------          
 Raw Data - Page 0          
     Block 0  : 0xE0178093  11100000000101111000000010010011          
------------------------------------------------------------- 

pm3 --> lf t5 det
Chip Type  : T55x7          
Modulation : BIPHASEa - (CDP)          
Bit Rate   : 5 - RF/64          
Inverted   : Yes           
Offset     : 59          
Seq. Term. : No          
Block0     : 0xE0178093          

Does that config look accurate? It differs significantly from your example above. Also, Do you have any recommendations or know of writeups for a custom antenna for a proxmark3 RDV2?

Hmm interesting, seems you’re getting right on the edge of good coupling. Just enough to read cleanly buyt maybe not write.

Can you try and:

  1. Get in that same position that allows t5 trace to give output

  2. t5 detect to get the modulation right

  3. lf t5 write block 5 data 00000666

  4. lf t5 dump

Does block 5 show the data written above in step 3?

Also is your RDV2 a genuine model or an ebay / amazon China special? IF the former I can maybe loan you a test coil that should work just fine for you.

Cheers,
Tom

Thank you - will try and get back to you.

I bought RDV2 from a fellow security professional that upgraded. He takes his job seriously and I’m fairly certain it is a genuine model.

Just to confirm, the correct modulation should be ASK… correct?

I was never able to get ‘lf t5 trace’. I could get “info” and “det” to work but not “trace”. Following up to note that I was not able to get “lf t5 trace” to work even on large form factor cards (T5577 chip) that was successfully able to clone a prox UID to.

I just ordered the xEM Access Controller with the 125kHz antenna. I’m going to see if I can make the antenna work with the proxmark3 RDV2. If anyone knows whether that will work and have done that before, please let me know.

> 
> pm3 --> script run test_t55x7
> [+] Executing: test_t55x7.lua, args ''
>       
> ----------------------------------------
> ----------------------------------------
> Wiping card
>       
> [=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)
>       
> [=] Writing page 0  block: 00  data: 0x000880E0 pwd: 0x00000000          
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0x00000000           
> [=] Writing page 0  block: 03  data: 0x00000000           
> [=] Writing page 0  block: 04  data: 0x00000000           
> [=] Writing page 0  block: 05  data: 0x00000000           
> [=] Writing page 0  block: 06  data: 0x00000000           
> [=] Writing page 0  block: 07  data: 0x00000000           
> Detecting card
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 2 - RF/32          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x000880E0          
>       
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0xFFFFFFFF           
> [=] Writing page 0  block: 03  data: 0x80000000           
> [=] Writing page 0  block: 04  data: 0x00000001           
> ASK
> Start test of ASK
> ###	lf t55xx write b 0 d 00008040
> [+] Found [2] possible matches for modulation.          
> --[1]---------------          
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 0 - RF/8          
> Inverted   : No          
> Offset     : 30          
> Seq. Term. : Yes           
> Block0     : 0x00008040          
>       
> --[2]---------------          
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 0 - RF/8          
> Inverted   : Yes           
> Offset     : 31          
> Seq. Term. : No          
> Block0     : 0x000180C0          
>       
> can't detect modulation, skip to next config
> 2019-08-02T23:55:23Z remark: [ERR:DETECT:00008040] Failed to detect modulation          
> 2019-08-02T23:55:23Z remark: [SUMMARY:00008040] FAIL detection          
> ###	lf t55xx write b 0 d 00048040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 1 - RF/16          
> Inverted   : No          
> Offset     : 33          
> Seq. Term. : Yes           
> Block0     : 0x00048040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:23Z remark: [ERR:READ:00048040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 00000001 Failed
> 2019-08-02T23:55:24Z remark: [ERR:READ:00048040:3] block 3: read 00000001 instead of 80000000          
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:24Z remark: [SUMMARY:00048040] FAIL 2 tests          
> ###	lf t55xx write b 0 d 00088040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 2 - RF/32          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00088040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:24Z remark: [ERR:READ:00088040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:25Z remark: [SUMMARY:00088040] FAIL 1 test          
> ###	lf t55xx write b 0 d 000c8040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 3 - RF/40          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x000C8040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:26Z remark: [ERR:READ:000c8040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:27Z remark: [SUMMARY:000c8040] FAIL 1 test          
> ###	lf t55xx write b 0 d 00108040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 4 - RF/50          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00108040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:27Z remark: [ERR:READ:00108040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:28Z remark: [SUMMARY:00108040] FAIL 1 test          
> ###	lf t55xx write b 0 d 00148040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 5 - RF/64          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00148040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:29Z remark: [ERR:READ:00148040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:29Z remark: [SUMMARY:00148040] FAIL 1 test          
> ###	lf t55xx write b 0 d 00188040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 6 - RF/100          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x00188040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:30Z remark: [ERR:READ:00188040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:31Z remark: [SUMMARY:00188040] FAIL 1 test          
> ###	lf t55xx write b 0 d 001c8040
> Chip Type  : T55x7          
> Modulation : ASK          
> Bit Rate   : 7 - RF/128          
> Inverted   : No          
> Offset     : 32          
> Seq. Term. : Yes           
> Block0     : 0x001C8040          
>       
> Test 00000000 == FFFFFFFF Failed
> 2019-08-02T23:55:31Z remark: [ERR:READ:001c8040:1] block 1: read FFFFFFFF instead of 00000000          
> Test ffffffff == FFFFFFFF OK
> Test 80000000 == 80000000 OK
> Test 00000001 == 00000001 OK
> 2019-08-02T23:55:32Z remark: [SUMMARY:001c8040] FAIL 1 test          
> ----------------------------------------
> ----------------------------------------
> Tests finished
> 
> 2019-08-02T23:55:32Z remark: [SUMMARY] Success rate: 20/32 tests passed, help me improving that number!          
>       
> [+] Finished
>       
> pm3 --> script run test_t55x7
> [+] Executing: test_t55x7.lua, args ''
>       
> ----------------------------------------
> ----------------------------------------
> Wiping card
>       
> [=] Beginning Wipe of a T55xx tag (assuming the tag is not password protected)
>       
> [=] Writing page 0  block: 00  data: 0x000880E0 pwd: 0x00000000          
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0x00000000           
> [=] Writing page 0  block: 03  data: 0x00000000           
> [=] Writing page 0  block: 04  data: 0x00000000           
> [=] Writing page 0  block: 05  data: 0x00000000           
> [=] Writing page 0  block: 06  data: 0x00000000           
> [=] Writing page 0  block: 07  data: 0x00000000           
> Detecting card
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> [=] Writing page 0  block: 01  data: 0x00000000           
> [=] Writing page 0  block: 02  data: 0xFFFFFFFF           
> [=] Writing page 0  block: 03  data: 0x80000000           
> [=] Writing page 0  block: 04  data: 0x00000001           
> ASK
> Start test of ASK
> ###	lf t55xx write b 0 d 00008040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:47Z remark: [ERR:READ:00008040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:47Z remark: [ERR:READ:00008040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:48Z remark: [ERR:READ:00008040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:48Z remark: [ERR:READ:00008040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:48Z remark: [SUMMARY:00008040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00048040
> can't detect modulation, skip to next config
> 2019-08-02T23:55:48Z remark: [ERR:DETECT:00048040] Failed to detect modulation          
> 2019-08-02T23:55:48Z remark: [SUMMARY:00048040] FAIL detection          
> ###	lf t55xx write b 0 d 00088040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:49Z remark: [ERR:READ:00088040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:49Z remark: [SUMMARY:00088040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 000c8040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:50Z remark: [ERR:READ:000c8040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:50Z remark: [ERR:READ:000c8040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:51Z remark: [ERR:READ:000c8040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:51Z remark: [ERR:READ:000c8040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:51Z remark: [SUMMARY:000c8040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00108040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:51Z remark: [ERR:READ:00108040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:52Z remark: [ERR:READ:00108040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:52Z remark: [ERR:READ:00108040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:52Z remark: [ERR:READ:00108040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:52Z remark: [SUMMARY:00108040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00148040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:53Z remark: [ERR:READ:00148040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:53Z remark: [ERR:READ:00148040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:53Z remark: [ERR:READ:00148040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:54Z remark: [ERR:READ:00148040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:54Z remark: [SUMMARY:00148040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 00188040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:54Z remark: [ERR:READ:00188040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:54Z remark: [ERR:READ:00188040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 8365D3C0 Failed
> 2019-08-02T23:55:55Z remark: [ERR:READ:00188040:3] block 3: read 8365D3C0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:55Z remark: [ERR:READ:00188040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:55Z remark: [SUMMARY:00188040] FAIL 4 tests          
> ###	lf t55xx write b 0 d 001c8040
> Chip Type  : T55x7          
> Modulation : BIPHASEa - (CDP)          
> Bit Rate   : 5 - RF/64          
> Inverted   : Yes           
> Offset     : 58          
> Seq. Term. : No          
> Block0     : 0xE0178093          
>       
> Test 00000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:1] block 1: read 41B2E9E0 instead of 00000000          
> Test ffffffff == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:2] block 2: read 41B2E9E0 instead of ffffffff          
> Test 80000000 == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:3] block 3: read 41B2E9E0 instead of 80000000          
> Test 00000001 == 41B2E9E0 Failed
> 2019-08-02T23:55:56Z remark: [ERR:READ:001c8040:4] block 4: read 41B2E9E0 instead of 00000001          
> 2019-08-02T23:55:56Z remark: [SUMMARY:001c8040] FAIL 4 tests          
> ----------------------------------------
> ----------------------------------------
> Tests finished
> 
> 2019-08-02T23:55:56Z remark: [SUMMARY] Success rate: 0/32 tests passed, help me improving that number!          
          
[+] Finished