Yet another newbie!

I have an access card that I have done LF SEARCH and got this info-

I am trying to copy/clone to a T5577 ring.

Need some help, as I am not getting anywhere on my own. I thought it would be easy to search the forum and find solutions, but I wasn’t coming up with the same situation :confused:

Thanks much!

I might be mistaken but:

“lf hid clone -w H10301 --fc 7848 --cn 4373”

should work fine when used on the “new cerd”. Try different pairs of facility code + card number if that does not work.

(A bit in a rush, I hope this helps! I’ll be back later.)

1 Like

Ty, I’ll give it a try.
Update- nope :frowning: getting this error)-
[!] The card data could not be encoded in the selected format.

I tried these combos
lf hid clone -w H10301 --fc 7848 --cn 4373

lf hid clone -w H10301 --fc 4997 --cn 14872

lf hid clone -w H10301 --fc 359 --cn 52241

lf hid clone -w H10301 --fc 359 --cn 14872

lf hid clone -w H10301 --fc 359 --cn 4373

I’ll be going out of town for a bit but I will be able to check this thread, I appreciate all the help, you definitely taught me what FC and CN meant!!! I’m learning :wink:

Looks like it’s a t5577.

lf t55 dump

lf t55 restore -f <filename from the dump>
1 Like

lf hid clone -r 2007aa11105

this will work

fwiw @Not h10301 is specifically the HID 26bit pacs format which isn’t listed on their output, if OP doesn’t want to go the raw route they’d want to do

lf hid clone -w ind27 --fc 7848 --cn 4373

where ind27 is the wiegand format marker for the PACs info they got

:slight_smile:

3 Likes

just a note on cloning T5577T5577 (yes i will wiki this too) this from a short guide i made for that canadian guy you sent me a few months back

Cloning a T5577 to another T5577

So, if we are starting with a T5577 that we want to clone, first we need to detect it before we can do anything else

  1. lf t5 detect ← this primes the proxmark’s configuration to know how to communicate with this specific t5577 that you have infront of you.

  2. Once we have done the detection we can now dump it to obtain a file of its memory.

    lf t5 dump ← running this command as-is will generate a file with a super long name, we can choose the name we want the file to be by adding -f to the dump command.

    lf t5 dump -f example will create a file called example, this is easier to have on hand for later when we do a restore.

onto the second T5577, The one we want to turn into a copy of the first

  1. Again we do lf t5 detect to prime the proxmark to be able to talk to it.

  2. Once we have the detection output we then do lf t5 restore -f example this will load the example file we made earlier onto the new t5577.

  3. Repeat lf t5 detect and lf t5 dump to compare the two to make sure theyre now identical.

  4. The output of lf search on both the original and new t5577 should also be the same to show they carry the same emulated chip information.

5 Likes

Yeah, I was in a bit of a rush and was trying to do it from memory haha… But thanks for correcting my mistake :slight_smile:

2 Likes

Great info, I’ll attack this the 1st week of February, when I return! I appreciate everything so far; definitely smoothing out my learning curve!!!

I’ll post an update after…

1 Like

I am unable to get any of this to take… I am thinking that the original card is in Indala format and it is not copying correctly? I have modified the coding using lf indala and lf t55xx when trying to dump and restore.

Same results with these strings-
lf t55xx restore -f C:\proxspace\ProxSpace\pm3/lf-t55xx-dump.json
lf hid clone -w ind27 --fc 7848 --cn 4373
lf hid clone -w indasc27 --fc 4997 --cn 14872
lf hid clone -w tecom27 --fc 359 --cn 52241
lf hid clone -r 000000000000002007aa1115

But none of it seems to be cloning correctly… When I go to check reader, info or search I get nada

Any ideas on what I am messing up?

don’t do the t55 cloning nonsense just do

lf t55 detect
then
lf hid clone -w ind27 --fc 7848 --cn 4373

on a fresh t5577

2 Likes

UPDATE and close (for now)

So I ended up just using
lf hid clone -r (and inserting the raw string info)
This cloned all the data perfectly onto new t5577 cards, fob keychains and even a bracelet. The ring- not so much; I think its an antenna issue. When I lf tune, I can never get under 23v out of 24v. and this command is the only time I think it is even reading anything at all:
[usb] pm3 → lf search

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-]Searching for COTAG tag…

[-] No data found!
[?] Maybe not an LF tag?

[usb] pm3 → lf t55xx config
[=] — current t55xx config --------------------------
[=] Chip type… T55x7
[=] Modulation… ASK
[=] Bit rate… 2 - RF/32
[=] Inverted… No
[=] Offset… 32
[=] Seq. terminator… Yes
[=] Block0… 000880E8 (auto detect)
[=] Downlink mode… default/fixed bit length
[=] Password set… No

1 Like

lf t55 config isn’t doing any reading. it is the confirmation for the proxmark client for reading tags, not info from a tag.

is what you’re using a fresh t5577? do lf t55 detect on them

1 Like

Ahhh, then I’m getting nothing from that t5577 ring at all… no issues with other cards and tags! Learning curve but THANKS for making me figure out out!

Do you have a recommendations on “classes” or other ways to learn about becoming more proficient in the proxmark3 process?? Or just keep trolling the forums for self teaching?

1 Like

there’s nothing in the way of classes but this forum, the rfid hacking discord and the datasheets are the best way to learn

you’re more than welcome to inbox me on here or discord (equip) if you want some help with figuring anything out

2 Likes

I’ll check out the Discord tomorrow, make sure I have you saved:-)