xEM Wont Clone or Wipe

Support
21

[usb] pm3 → lf t5 write -b 3 -d 00110011 --verify
[=] Writing page 0 block: 03 data: 0x00110011
[!] Write could not validate the written data

22

ok - after several attempts I got this:
pm3 → lf t5 write -b 3 -d 00110011 --verify
[=] Writing page 0 block: 03 data: 0x00110011
[+] Write OK, validation successful

But I still can’t write to 0 through 2.

23

Ok let’s start with the basics…

  • have you attempted to write to the chip using any other tool?

  • can you confirm the proxmark3 client startup screen that shows the firmware version etc (post screen shot)

  • can you take a photo of how you are placing the xem on the proxmark3 when writing?

24

Haven’t used any other tools - only ProxMark.

[=] Session log C:\Software\pm3\client/.proxmark3/logs/log_20240521111432.txt
[+] loaded C:\Software\pm3\client\/.proxmark3/preferences.json
[+] Using UART port COM12
[+] Communicating with PM3 over USB-CDC

8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 “Y8888P” [ ]

[ Fuel open source revolution! ]
Patreon - https://www.patreon.com/iceman1001/
Paypal - PayPal.Me

[ Proxmark3 RFID instrument ]

MCU....... AT91SAM7S512 Rev A
Memory.... 512 KB ( 63% used )

Client.... Iceman/master/v4.18341-224-gd2003b7b6 2024-05-18 12:48:35
Bootrom... Iceman/master/v4.18341-222-g676c91baa-suspect 2024-05-17 08:25:13
OS........ Iceman/master/v4.18341-222-g676c91baa-suspect 2024-05-17 08:25:24
Target.... PM3 GENERIC

Placing it across the coil (antenna) perpendicular. (I have a masters in Electrical Engineering, so I know the proper way to place the device…)

25

It seems you have a client and firmware mismatch. Try to push new firmware to the proxmark3 using pm3-flash-all

26

[=] Session log C:\Software\pm3\client/.proxmark3/logs/log_20240521131623.txt
[+] loaded C:\Software\pm3\client\/.proxmark3/preferences.json
[+] Using UART port COM12
[+] Communicating with PM3 over USB-CDC

8888888b. 888b d888 .d8888b.
888 Y88b 8888b d8888 d88P Y88b
888 888 88888b.d88888 .d88P
888 d88P 888Y88888P888 8888"
8888888P" 888 Y888P 888 "Y8b.
888 888 Y8P 888 888 888
888 888 " 888 Y88b d88P
888 888 888 “Y8888P” [ ]

[ Back global innovation today! ]
Patreon - https://www.patreon.com/iceman1001/
Paypal - PayPal.Me

[ Proxmark3 RFID instrument ]

MCU....... AT91SAM7S512 Rev A
Memory.... 512 KB ( 63% used )

Client.... Iceman/master/v4.18341-224-gd2003b7b6 2024-05-18 12:48:35
Bootrom... Iceman/master/v4.18341-224-gd2003b7b6-suspect 2024-05-18 12:48:13
OS........ Iceman/master/v4.18341-224-gd2003b7b6-suspect 2024-05-18 12:48:24
Target.... PM3 GENERIC
27

Now try the recovery steps

28

I have - no difference. When I initially went through everything the version info matched… It just didn’t match when I pasted that information because I’m at the office now and had to re-download the client software.

29

Tried writing to block 0:
[usb] pm3 → lf t55xx write -b 0 -d 00147040 --verify
[=] Writing page 0 block: 00 data: 0x00147040
[=] Block0 write detected, running detect to see if validation is possible
[!] Write could not validate the written data

Tried cloning an EM:
[usb] pm3 → lf em 410x clone --id 0F036856BB
[+] Preparing to clone EM4102 to T55x7 tag with EM Tag ID 0F036856BB (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a65ee2
[+] Done
[?] Hint: try lf em 410x reader to verify
[usb] pm3 → lf em 410x reader
[+] EM 410x ID 01A8FB613E

30

Looks like we got a bonafide mystery on our hands. I’ll reply to your ticket.

31

Should I get an email saying you replied to my ticket? I’m not seeing anything on my end…?

32

How long ago did you submit your ticket (through the help button on the webpage?)

As you would have seen @amal and @tac0s are on the forum every day, so they will see this and you’ll get taken care of.

33

5/20/2024

34

Sorry for the delay, I replied to your ticket.