Xmagic and work door

Got my xmagic installed today (before you say it, i know im jumping the gun a bit here). My reader had no problems reading or writing, got my badge cloned, and the door does pick it up.

On to the door, we have to “charge” our badges every so often, seems to be a random interval as far as i can tell, not related to number of uses or timespan. The door will just give you a red light, hit it on the charger, then you have access. I still have no idea what that thing actually does. Originally i assumed it was rewriting the card, it takes a hot second to do whatever it does, but ive gotten identical dumps of my card over the course of a couple months. (Would love more info on this if anybody even has a keyword for me to look up, i havent been able to find anything)

I presented my chip not actually expecting anything to happen, but the door read it and gave me the code for needing a charge instead of bad key. Problem is the charger doesnt read it (yes swelling i know) so i dragged the keychain across it, and got the absolutely faintest possible light, and only in the bottom left corner, pretty inconsistently. Im a bit of a novice, but i assume that means its a pretty low power that its broadcasting. What are the odds my chip ever interacts properly with this thing? (Mostly rhetorical) and if it doesnt, is there anything i can do about it or have i hit a wall after coming this far?

1 Like

Never heard of this, and interested to hear more! In the mean time:

Is the system using the HF or LF side of the xMagic?

Any chance you can tell us more about the “charger” device or readers? Do they have logos or anything?

Personally I’d be really hesitant to present an implant to a reader that I didn’t know what the heck was doing, so I would probably start by examining the dumps before and after a “recharge” again

Also, a couple of theories:

I can only imagine two ways the charger might work, and both could be pretty easy to make work for you

  1. The “charger” just reads the card and updates the back-end, re-upping the credential in the access controller. If this is the case, and you can get an identical clone of your badge on your implant, you should be able to just scan your real badge on the charger every time your hand says it needs it, re-upping the credential on both

  2. The “charger” does write to the card somehow, which with more testing could be reverse-engineerable, and you could just do that same operation on your tag with something like the PM3. Or I suppose you could just re-clone your badge to your hand every time you “charged” it

But, frankly the whole concept of the “charger” is throwing me for loop, so I’m sure it could be something I’m not considering

Whoops, almost forgot:
Congrats on the new implant :wink:

2 Likes

Me too, because i did try charging the badge, then presenting it, green light. Chip gives red. Checked both, identical dumps. And i have a keychain that also has my badge on it, and now that i think about it there has to be something hidden. Because that charges independently from my badge, but they all show the same dump. The keychain works fine by the way, so it probably is just swelling now that i think about it, but i do want to know whats up with this “charger”. And thanks, ive been very impatiently waiting for it to arrive :joy:

2 Likes

If you could get a pm3 in there with you to sniff the traffic between the charger and the card, that could reveal some useful information.

You could also consider sharing some of the dumps here for others to take a look at, but obviously that presents risks

I can’t think of any way it could differentiate between identical cards without writing to them somehow or another

Honestly i might just have to buy one :joy:


This is the lock

And the white thing in front is the closest ive found so far, ours is grey and looks older

https://www.digital-key-world.com/en/SALTO-XS4-2.0-wall-reader-Proximity-modular/WRMM004W
I found it and im even more confused, its just another reader? Maybe you were right and its nothing more than a double check, like somebody who managed to grab your badge wouldnt know why the door wont open? Maybe it does just double check home. I really dont think its writing anything, because i used this reader to do some skylanders stuff and it shows me everything, but i guess i am still confused about how the card i cloned to the chip still let me in when i got to work, but the chip would not

2 Likes

I am not sure about the first part of your post, but I went the rounds with different brands of readers at my office. We use like 4 different brands, all with different power output and “sweetspots”. I have been able to badge into the HID readers with no difficulty at all, ever. We have another brand called CardKey, and they suck. I took one apart (with my boss’s permission) and this community (along with a multimeter) helped me determine that this brand steps the 13v coming into the reader down to 5v. I found it could read my implant with the cover off and my NExT presented directly to the copper coils. Really not much I could do with those. We also have Honeywell that is producing both a HF and a LF signal. I have no idea why we have that, because all of our badges are LF. It is difficult, but if I present my implant perfectly on one of the two sweetspots on the Honeywells, I get a good read and access granted. We also have turnstiles where the reader is buried under a fancy glass enclosure, so I can’t tell the brand. Like your experience, the field detector shows a very faint light on those readers. I can’t tell what brand they are, and I have resigned myself to not ever being able to access those with an xSeries. It’s one of the reasons I’m considering getting a flexEM.
Really nice work using all your tools to try to figure out what is happening!
Do you know what brand reader yours are?
I found my investigation fun even if I didn’t have 100% success in getting everywhere I needed to with my implant. :slight_smile:

2 Likes

Yeah im definitely entertained by it, the comment i left above has the brand and a link to the “charger” in question, would be quite frustrating if the door sees me but not the stupid double check :joy:

2 Likes

I doubt anyone still cares, but about 30 minutes ago i was finally able to get a read from my phone (still not with the case) and about 10 minutes ago i managed to actually get a read off the “charger” and the door opened for me. Yall dont even know how excited i am rn :joy:

7 Likes

Good news!

I take it there was no specific event that led to it working? Just randomly started working again? In any event, follow up here if it stops again.

1 Like

No it never worked (combination of swelling and the “charger” being extremely low power) the door read me fine, i was getting consistent reads on my acr122u, but we have to update on this stupidly low powered reader and that was my roadblock. If i feel it up long enough in juuuuust the right spot i can get a read now though

1 Like

I think with time this will become easier with time; further healing (Reduced swelling) combined with muscle memory finding the right spot everytime.

Did you work out the duty cycle of the stubborn reader?
ie. less frequent flashes means you’ll need to move your hand slower or hold position for longer to get that read.

1 Like

Not scientifically but my keychain flashes pretty slowly

2 Likes

Alright, so after a week of it working Ive discovered 2 things. 1, prox got here today and yall were not kidding about the learning curve, and there is a difference between the 2 creds. I cant figure out how to view a dump, i just have bins and jsons laying here. But the sak is different, along with prng whatever that means


My hand is 88, badge is 08

And 2. The one in my hand seems to not need to be charged, after that first time it hasnt given me any issues, however i cant get into the er, not sure whats missing there. There seems to be 2 “paths” badges here can take, one half of the hospital or the other. Patient access and vendor badges can get anywhere, er stays on that half and managment and nurse floor get the other half. I seem to have management access, but for some reason not the other half

Edit: tried to dump chip, gives this error

1 Like