Yale Doorman V2N cracking by iceman

Projects
61

yeah, that sounds awkward… wait… is this the fob from my front door or my back door?

63

Hi PaulT

You can have up to 6 Yale doorman on one tag. But you have to pair/read the tag 3 times in a row on the lock, on each lock. This is because the floating id on the tag.

//Frits

1 Like
64

Great info :+1:
Thanks @Frits

65

Im new to the forum but im trying to get a hold of @anon3825968 as i understood you are from Finland? I have few questions concerning the chip type i would need for the yale doorman and also on other things. Thanks!

66

Dropping the @anon3825968 like you did is probably the best way.

You could maybe try a DM to him also, If he has it set up, he might get your message

1 Like
67

Yes i already sent him a message, now i just hope he answers, fingers crossed :rofl: thanks!

1 Like
68

Hello guys,

I have DT’ magic ring and would like to clone a tag to it, i have two questions

1-which is the right way?

Option A: pair the tag to the lock first and then clone it to the ring?

Option B: clone the tag to the ring without pairing to the lock and then pair the ring to the lock?

2-what codes in DT’s proxmark3 should I use?

Sorry that I am noob (still new to this)

69

Firstly, I don’t have a yale doorman, so I can’t test this myself

There is no real “right way”
But if you go Option A:
That way you can test that it is working.
Then write to your Magic Ring
I believe, once you have written to your Ring, The first time you open your lock with the ring, the original fob will stop working.
So you probably want a backup or 2.

How many fobs do you have?
I think there are some yale dumps in the forum you can use as backups.

Regarding the commands, you have a couple of options, Im guessing autopwn is probably the easiest.

Do you know how to do that?

71

Thank!

-I started with a tag that already work on the lock

  • I ran hf mf autopwn
  • I got 1 dump file & 1 Json file & 1 key file (no eml file)
  • I then tried Cload it did not work
  • I tried the MCT app as in this video and still it did not work!

But now when I look I see that all keys are identical but the UID is different and it won’t change in MCT or by using:

hf mf csetuid -u -a -s
P.s: -A and -S changed already

Any idea?