[+] loaded from JSON file C:\ProxFiles\ProxSpace\pm3/.proxmark3/preferences.json [=] Using UART port COM7 [=] Communicating with PM3 over USB-CDC [ Proxmark3 RFID instrument ] MCU....... AT91SAM7S512 Rev B Memory.... 512 Kb ( 58% used ) Client.... Iceman/master/v4.14831-570-g00a13f816 2022-05-02 12:15:13 Bootrom... Iceman/master/v4.14831-570-g00a13f816 2022-05-02 12:13:47 OS........ Iceman/master/v4.14831-570-g00a13f816 2022-05-02 12:14:11 Target.... PM3 GENERIC [usb|script] pm3 --> hw tune [=] ---------- Reminder ------------------------ [=] `hw tune` doesn't actively tune your antennas, [=] it's only informative. [=] Measuring antenna characteristics, please wait... [=] ---------- LF Antenna ---------- [+] LF antenna: 24.93 V - 125.00 kHz [+] LF antenna: 23.75 V - 134.83 kHz [+] LF optimal: 27.23 V - 127.66 kHz [+] Approx. Q factor (*): 6.9 by frequency bandwidth measurement [+] Approx. Q factor (*): 7.9 by peak voltage measurement [+] LF antenna is OK [=] ---------- HF Antenna ---------- [+] HF antenna: 15.10 V - 13.56 MHz [+] Approx. Q factor (*): 4.4 by peak voltage measurement [+] HF antenna is OK (*) Q factor must be measured without tag on the antenna [+] Displaying LF tuning graph. Divisor 88 (blue) is 134.83 kHz, 95 (red) is 125.00 kHz. [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [+] Valid HID Prox ID found! [=] Couldn't identify a chipset [usb|script] pm3 --> lf t5 info [=] --- T55x7 Configuration & Information --------- [=] Safer key : 15 [=] reserved : 15 [=] Data bit rate : 63 - RF/128 [=] eXtended mode : Yes - Warning [=] Modulation : 0x1F (Unknown) [=] PSK clock frequency : 3 - (Unknown) [=] AOR - Answer on Request : Yes [=] OTP - One Time Pad : Yes - Warning [=] Max block : 7 [=] Password mode : Yes [=] Sequence Start Marker : Yes [=] Fast Write : Yes [=] Inverse data : Yes [=] POR-Delay : Yes [=] ------------------------------------------------------------- [=] Raw Data - Page 0, block 0 [=] FFFFFFFF - 11111111111111111111111111111111 [=] --- Fingerprint ------------ [usb|script] pm3 --> lf t5 detect [!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config' [usb|script] pm3 --> lf t5 detect --pwd 51243648 [=] Chip type......... T55x7 [=] Modulation........ FSK2a [=] Bit rate.......... 4 - RF/50 [=] Inverted.......... Yes [=] Offset............ 33 [=] Seq. terminator... No [=] Block0............ 00107070 (auto detect) [=] Downlink mode..... default/fixed bit length [=] Password set...... Yes [=] Password.......... 51243648 [usb|script] pm3 --> lf hid reader [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [usb|script] pm3 --> lf t5 dump [+] Reading Page 0: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [+] 00 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 01 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 02 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 03 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 04 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 05 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 06 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 07 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] Reading Page 1: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [+] 00 | 00000000 | 00000000000000000000000000000000 | .... [+] 01 | 00000000 | 00000000000000000000000000000000 | .... [+] 02 | 00000000 | 00000000000000000000000000000000 | .... [+] 03 | 00000000 | 00000000000000000000000000000000 | .... [+] saved to json file lf-t55xx-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-dump.json [+] saved 12 blocks to text file lf-t55xx-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-dump.eml [+] saved 48 bytes to binary file lf-t55xx-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-55666AA6-dump.bin [usb|script] pm3 --> lf t5 dump --pwd 51243648 [+] Reading Page 0: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [+] Reading Page 1: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [!] Safety check: Could not detect if PWD bit is set in config block. Exits. [?] Consider using the override parameter to force read. [usb|script] pm3 --> lf t5 dump [+] Reading Page 0: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [+] 00 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 01 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 02 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 03 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 04 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 05 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 06 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] 07 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [+] Reading Page 1: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [+] 00 | 00000000 | 00000000000000000000000000000000 | .... [+] 01 | 00000000 | 00000000000000000000000000000000 | .... [+] 02 | 00000000 | 00000000000000000000000000000000 | .... [+] 03 | 00000000 | 00000000000000000000000000000000 | .... [usb|script] pm3 --> lf t55xx trace [-] The modulation is most likely wrong since the ACL is not 0xE0. [usb|script] pm3 --> lf hid read [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [usb|script] pm3 --> lf t5 info [=] --- T55x7 Configuration & Information --------- [=] Safer key : 5 [=] reserved : 5 [=] Data bit rate : 25 - RF/52 [=] eXtended mode : Yes - Warning [=] Modulation : 6 - FSK 1a RF/5 RF/8 [=] PSK clock frequency : 2 - RF/8 [=] AOR - Answer on Request : Yes [=] OTP - One Time Pad : No [=] Max block : 5 [=] Password mode : No [=] Sequence Start Marker : No [=] Fast Write : Yes [=] Inverse data : Yes [=] POR-Delay : No [=] ------------------------------------------------------------- [=] Raw Data - Page 0, block 0 [=] 55666AA6 - 01010101011001100110101010100110 [=] --- Fingerprint ------------ [usb|script] pm3 --> lf t55xx info [=] --- T55x7 Configuration & Information --------- [=] Safer key : 5 [=] reserved : 5 [=] Data bit rate : 25 - RF/52 [=] eXtended mode : Yes - Warning [=] Modulation : 6 - FSK 1a RF/5 RF/8 [=] PSK clock frequency : 2 - RF/8 [=] AOR - Answer on Request : Yes [=] OTP - One Time Pad : No [=] Max block : 5 [=] Password mode : No [=] Sequence Start Marker : No [=] Fast Write : Yes [=] Inverse data : Yes [=] POR-Delay : No [=] ------------------------------------------------------------- [=] Raw Data - Page 0, block 0 [=] 55666AA6 - 01010101011001100110101010100110 [=] --- Fingerprint ------------ [usb|script] pm3 --> lf t5 read [!] Try 'lf t55xx read --help' for more information. [usb|script] pm3 --> lf t5 read -b 0 [+] Reading Page 0: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [+] 00 | 55666AA6 | 01010101011001100110101010100110 | Ufj. [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [+] Valid HID Prox ID found! [=] Couldn't identify a chipset [usb|script] pm3 --> lf t5 detect [!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config' [usb|script] pm3 --> lf t5 detect -p 51243648 [=] Chip type......... T55x7 [=] Modulation........ FSK2a [=] Bit rate.......... 4 - RF/50 [=] Inverted.......... Yes [=] Offset............ 33 [=] Seq. terminator... No [=] Block0............ 00107070 (auto detect) [=] Downlink mode..... default/fixed bit length [=] Password set...... Yes [=] Password.......... 51243648 [+] loaded from JSON file C:\ProxFiles\ProxSpace\pm3/.proxmark3/preferences.json [=] Using UART port COM7 [=] Communicating with PM3 over USB-CDC [ Proxmark3 RFID instrument ] MCU....... AT91SAM7S512 Rev B Memory.... 512 Kb ( 58% used ) Client.... Iceman/master/v4.14831-570-g00a13f816 2022-05-02 12:15:13 Bootrom... Iceman/master/v4.14831-570-g00a13f816 2022-05-02 12:13:47 OS........ Iceman/master/v4.14831-570-g00a13f816 2022-05-02 12:14:11 Target.... PM3 GENERIC [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [-] No known 125/134 kHz tags found! [=] Couldn't identify a chipset [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [+] Valid HID Prox ID found! [+] Chipset detection: T55xx [?] Hint: try `lf t55xx` commands [usb|script] pm3 --> lf t55xx info [=] --- T55x7 Configuration & Information --------- [=] Safer key : 8 [=] reserved : 0 [=] Data bit rate : 0 - RF/8 [=] eXtended mode : No [=] Modulation : 0 - DIRECT (ASK/NRZ) [=] PSK clock frequency : 0 - RF/2 [=] AOR - Answer on Request : No [=] OTP - One Time Pad : No [=] Max block : 0 [=] Password mode : No [=] Sequence Terminator : No [=] Fast Write : No [=] Inverse data : No [=] POR-Delay : No [=] ------------------------------------------------------------- [=] Raw Data - Page 0, block 0 [=] 80000000 - .0000000000000000000000000000000 [=] --- Fingerprint ------------ [usb|script] pm3 --> lf t5 info [=] --- T55x7 Configuration & Information --------- [=] Safer key : 14 [=] reserved : 0 [=] Data bit rate : 0 - RF/8 [=] eXtended mode : No [=] Modulation : 0 - DIRECT (ASK/NRZ) [=] PSK clock frequency : 0 - RF/2 [=] AOR - Answer on Request : No [=] OTP - One Time Pad : No [=] Max block : 0 [=] Password mode : No [=] Sequence Terminator : No [=] Fast Write : No [=] Inverse data : No [=] POR-Delay : No [=] ------------------------------------------------------------- [=] Raw Data - Page 0, block 0 [=] E0000000 - .0.00000000000000000000000000000 [=] --- Fingerprint ------------ [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [+] Valid HID Prox ID found! [+] Chipset detection: T55xx [?] Hint: try `lf t55xx` commands [usb|script] pm3 --> lf tune [=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit [2K [=] Done. [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [=] Odd size, false positive? [+] Indala (len 144) Raw: 80000000011040000020004200002013040000000882000001000210 [+] Valid Indala ID found! [=] Couldn't identify a chipset [usb|script] pm3 --> lf t5 detect [!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config' [usb|script] pm3 --> lf t5 info [usb|script] pm3 --> lf t55xx info [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [+] Valid HID Prox ID found! [+] Chipset detection: T55xx [?] Hint: try `lf t55xx` commands [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [+] Valid HID Prox ID found! [+] Chipset detection: T55xx [?] Hint: try `lf t55xx` commands [usb|script] pm3 --> lf tune [=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit [2K [=] Done. [usb|script] pm3 --> lf t5 det -p 51243648 [!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config' [usb|script] pm3 --> lf hid reader [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [usb|script] pm3 --> lf hid clone -r 2005fd772a -p 51243648 [!] Try 'lf hid clone --help' for more information. [usb|script] pm3 --> lf t55xx dump [+] Reading Page 0: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [+] Reading Page 1: [+] blk | hex data | binary | ascii [+] ----+----------+----------------------------------+------- [usb|script] pm3 --> lf t55xx det [!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config' [usb|script] pm3 --> lf t55xx read [!] Try 'lf t55xx read --help' for more information. [usb|script] pm3 --> lf t5 config [=] --- current t55xx config -------------------------- [=] Chip type......... T55x7 [=] Modulation........ ASK [=] Bit rate.......... 0 - RF/8 [=] Inverted.......... No [=] Offset............ 0 [=] Seq. terminator... No [=] Block0............ 00000000 (n/a) [=] Downlink mode..... default/fixed bit length [=] Password set...... No [usb|script] pm3 --> lf t5 wipe [=] Target T55x7 tag [=] Default configuration block 000880E0 [=] Begin wiping... [=] Writing page 0 block: 00 data: 0x000880E0 [=] Writing page 0 block: 01 data: 0x00000000 [=] Writing page 0 block: 02 data: 0x00000000 [=] Writing page 0 block: 03 data: 0x00000000 [=] Writing page 0 block: 04 data: 0x00000000 [=] Writing page 0 block: 05 data: 0x00000000 [=] Writing page 0 block: 06 data: 0x00000000 [=] Writing page 0 block: 07 data: 0x00000000 [usb|script] pm3 --> lf search [=] NOTE: some demods output possible binary [=] if it finds something that looks like a tag [=] False Positives ARE possible [=] [=] Checking for known tags... [=] [+] [H10301 ] HID H10301 26-bit FC: 190 CN: 39104 parity ( ok ) [+] [ind26 ] Indala 26-bit FC: 3049 CN: 2240 parity ( ok ) [=] found 2 matching formats [+] DemodBuffer: [+] 1D55595555666AA65A569555 [=] raw: 0000000000000020057d3180 [+] Valid HID Prox ID found! [+] Chipset detection: T55xx [?] Hint: try `lf t55xx` commands [usb|script] pm3 --> exiexit