Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2017-08-22 08:58:09

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

[Solved] Cloned Indala card (T5577) is not recognized

Hey all

Has anyone ever experienced this? I cloned a basic clamshell indala card to a t5577 card with the following commands on the proxmark3:

lf read
data sample 4000
lf indalademod

lf indalaclone <tag_id>

The T5577 card is read on my company printer reader successfully however when I put it to the HID multiclass SE Reader it does not read at all. No beeps, No nothing. The original indala card will atleast get a beep from the multiclass SE reader but the cloned t5577 will not.

Strangely I simulated the indala card and placed the proxmark3 antenna to both the printer and multiclass SE Readers and they both recognized successfully.

Anyone have an ideas?

Last edited by Dmanufacturer (2017-08-23 02:50:07)

Offline

#2 2017-08-22 17:06:40

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

on your t5577 try:
lf t55xx write b 1 A0000000
lf t55xx write b 2 800130a1
lf t55xx write b 0 903E1042

test on readers

then try
lf t55xx write b 0 00081040

let me know if the reader beeps after either (or both) the write b 0 cmds.

Offline

#3 2017-08-23 02:49:28

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

marshmellow wrote:

on your t5577 try:
lf t55xx write b 1 A0000000
lf t55xx write b 2 800130a1
lf t55xx write b 0 903E1042

test on readers

then try
lf t55xx write b 0 00081040

let me know if the reader beeps after either (or both) the write b 0 cmds.

Thanks marshmellow, writing blocks 1,2,0 worked. It is now being recognised by all readers.

I had done a lf t55 wipe and obviously cleared all the blocks, Where did you get those values from?

I ran these and found it interesting

proxmark3> lf t55 config
Modulation : ASK         
Bit Rate   : 0 - RF/8         
Inverted   : No         
Offset     : 0         
Block0     : 0x00000000         

proxmark3> lf t55 detect
Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'

Offline

#4 2017-08-23 05:31:26

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

Did you try the same blocks 1 and 2 with the second block 0?

I'm not sure you understand the use of lf t55xx config, and the detect failed indicating either your antenna is not quite strong enough for psk t55xx detection or you are running an older firmware.

I believe this reader problem has been discussed before.  I'll see if I can find it.

Edit...  Found it http://www.proxmark.org/forum/viewtopic.php?id=2907

Offline

#5 2017-08-23 08:03:14

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

marshmellow wrote:

Did you try the same blocks 1 and 2 with the second block 0?

I'm not sure you understand the use of lf t55xx config, and the detect failed indicating either your antenna is not quite strong enough for psk t55xx detection or you are running an older firmware.

I believe this reader problem has been discussed before.  I'll see if I can find it.

Edit...  Found it http://www.proxmark.org/forum/viewtopic.php?id=2907

I'm not sure what you mean by did you try the same blocks 1 and 2 with the second block 0?
I literrally ran the 3 commands as you descrbied (tweaked for newer version syntax)..then tested on readers and it was recognised.

You're right for the lf t55 detect failure, I guess I didn't hold the tag close enough.. I just re-ran it and it gave the following

proxmark3> lf t55 detect
Chip Type  : T55x7         
Modulation : PSK1         
Bit Rate   : 15 - RF/32         
Inverted   : No         
Offset     : 57         
Seq. Term. : No         
Block0     : 0x903E1042

Unrelated, do you know if it's possible to dump indala cards for offline cloning/simulating later?

Appreciate the help

Offline

#6 2017-08-23 13:11:21

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

The part where I said "then try...."

For indala, all you need is the id number.  But if you'd like you can save a trace with

data save filename

after reading the tag of course.

Offline

#7 2017-08-24 03:41:06

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

marshmellow wrote:

The part where I said "then try...."

For indala, all you need is the id number.  But if you'd like you can save a trace with

data save filename

after reading the tag of course.

Oh I undertand now.

Test1
----------------------------------------------------------------------
lf t55xx wr b 1 d A0000000
lf t55xx wr b 2 d 800130a1
lf t55xx wr b 0 d 903E1042
----------------------------------------------------------------------

Test2
----------------------------------------------------------------------
lf t55xx wr b 1 d A0000000
lf t55xx wr b 2 d 800130a1
lf t55xx wr b 0 d 00081040
----------------------------------------------------------------------

They were both read successfully by the printer reader and multiclass reader.


Interesting you say you only need the card number for indala as I've tried just running the indala clone command with the demodulated id and doesn't work. The proxmark will recognize the card with the id I just set but the printer reader and multiclass reader will not even beep.

After running the commands above, I ran the following:

lf indalaclone 61a313172

No luck.. what am I doing wrong?

Offline

#8 2017-08-24 03:51:36

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

That id doesn't look like a valid indala id

Save a trace, it gives you more options. 

Until someone adjusts the indala cmds to get the correct starting point you can read your tag (or load your trace) and then do

data rawdemod p1 32
data printdemod x o 1
data printdemod x o 2
data printdemod x o 3
data printdemod x o 4

Note that sometimes you will need a " 1" after the 32 to invert the bits to get the correct look.  (Should have a long string of 0s in the binary not 1s)

One of the printouts with different offsets should have in the data an A0000000 in it - that is the correct block 1.  Block 2 will follow.

Offline

#9 2017-08-24 04:07:06

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

Here is the command dump I ran:

https://pastebin.com/JTfgy3cu

If I understand correctly, block 1 and 2 are in this line?
proxmark3> data printdemod x o 1
DemodBuffer: C1A0000000C2C436C1A0000000C2C436C1A0000000C2C436C1A0000000C2C436C1A0000000C2C436C1A0000000C2C436C1A0000000C2C436C1A0000000C2C436

Offline

#10 2017-08-24 05:17:22

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

Correct.

Offline

#11 2017-08-24 12:44:54

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

Is the point to get these numbers and write to the t5577? I guess I'm not fully grasping what's going on here.

lf t55xx wr b 1 d A0000000
lf t55xx wr b 2 d C2C436C1

Am I on the right track there?

I also found that loading the card dump will only work on the printer reader and not the multiclass reader for whatever reason. I ran the following commands

Test
----------------------------------------------------------------------
lf read
data samples 16000
data save filename
data load filename
-> loaded 16000 samples
lf indala demod
-> Bitlen: 64
-> Indala UID=000000000000000
-> XXXXXXXXXXXXXX
-> XXXXXXXXXXXXXX
-> XXXXXXXXXXXXXX
->  (67d64f905)
lf indala clone 67d64f905
-> Cloning 64bit  tag with UID 67d64f905
-> #db# DONE!
----------------------------------------------------------------------

After running those commands the printer reader is able to read the card but the multiclass reader is NOT able to read it at all (no beeps).

Suggestions?

Offline

#12 2017-08-24 13:15:28

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

Dmanufacturer wrote:

Is the point to get these numbers and write to the t5577? I guess I'm not fully grasping what's going on here.

lf t55xx wr b 1 d A0000000
lf t55xx wr b 2 d C2C436C1

Am I on the right track there?

Yes.  As the current indala implementation doesn't use this bit order but your multicast reader needs it.  So use those blocks instead of the indala clone cmd.

Offline

#13 2017-08-24 13:23:32

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

marshmellow wrote:
Dmanufacturer wrote:

Is the point to get these numbers and write to the t5577? I guess I'm not fully grasping what's going on here.

lf t55xx wr b 1 d A0000000
lf t55xx wr b 2 d C2C436C1

Am I on the right track there?

Yes.  As the current indala implementation doesn't use this bit order but your multicast reader needs it.  So use those blocks instead of the indala clone cmd.

Great, how many blocks are needed to write to? Just blocks 1 and 2? what would block 0 be?

Offline

#14 2017-08-24 13:40:02

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

Block 0 would be either of the earlier block zero (sets config of the tag)
Other blocks don't matter (aren't used)

Offline

#15 2017-08-24 13:44:40

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

I'll try it out tomorrow and report. Thanks mate

Offline

#16 2017-08-25 08:10:14

ntk
Contributor
Registered: 2015-05-24
Posts: 701

Re: [Solved] Cloned Indala card (T5577) is not recognized

just saw this thread:

"the printer reader is able to read the card" is that a mistake?


modhex(ichbifhkhghuhehghkiehbihhkidifighgebecedfchihthbhkhrduhehvht)

Offline

#17 2017-08-25 13:17:00

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

marshmellow wrote:

Block 0 would be either of the earlier block zero (sets config of the tag)
Other blocks don't matter (aren't used)

Ok so I tested this method and it worked but noticed something odd.

Test1
----------------------------------------------------------------------
load a dumped indala card -> run rawdemod inverse -> run printdemod -> write block 1,2,0 to t5577.
----------------------------------------------------------------------

I tried the card on the elevator and multiple multiclass SE readers, It managed to open the door for everything except a single multiclass SE reader. Have you ever heard of this before? There are 2 doors on opposite sides when you step out of the elevator to get into the office, 1 worked and 1 didn't. Found that interesting.

Test2
----------------------------------------------------------------------
load a dumped indala card from another building -> run rawdemod inverse -> run printdemod -> write block 1,2,0 to t5577.
----------------------------------------------------------------------

I ran the same commands on another indala card that belongs to a different building. The multiclass readers didn't even beep.. Strange?


ntk wrote:

just saw this thread:

"the printer reader is able to read the card" is that a mistake?

Nope. There is a lf/hf reader on my company printer where employees can scan their pass to print.

Offline

#18 2017-08-25 13:35:05

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

What size tags are you programming?  Keyfobs have been known to be too weak for some readers sometimes.

Offline

#19 2017-08-25 13:37:37

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

Or that building only accepts iclass credentials and your original tag is a duel technology tag.

Offline

#20 2017-08-25 13:50:37

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

Indala Clamshell cloning to a T5577.

The building has a few tenants so it uses both the LF Indala clamshell and the HF Iclass.. hence the multiclass readers. which is why I was able to use the T5577 clone of the indala card to open the door.. It was just odd that only a single reader didn't accept the card (beeped but didn't open).

I placed the indala card belonging to another building onto my building reader and it beeped so there shouldn't be a reason why the cloned t5577 of the other building card couldn't be read.

Might make a lua script and upload, going to read the indala clone command and see how that works and why it doesn't work.

Last edited by Dmanufacturer (2017-08-25 13:52:44)

Offline

#21 2017-08-25 14:22:53

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,301

Re: [Solved] Cloned Indala card (T5577) is not recognized

there is a pull request open on github to fix the indala commands and their incorrect binary offset.  pull that or pull my fork to test the commands.

also t5577's come in many many shapes and sizes, so what size is it?

the multiclass readers can each be configured differently and can have technologies turned off.  normally upon deployment they are always configured the same, but depending on who did it... ...

Offline

#22 2017-08-25 15:09:30

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

marshmellow wrote:

there is a pull request open on github to fix the indala commands and their incorrect binary offset.  pull that or pull my fork to test the commands.

also t5577's come in many many shapes and sizes, so what size is it?

the multiclass readers can each be configured differently and can have technologies turned off.  normally upon deployment they are always configured the same, but depending on who did it... ...

Cool, I'll check it out.

The t5577 came from the ELECHOUSE Proxmark3 V2 kit.

You're probably right about the configuration, that's interesting.

Offline

#23 2017-08-28 04:08:06

Dmanufacturer
Contributor
Registered: 2017-08-15
Posts: 42

Re: [Solved] Cloned Indala card (T5577) is not recognized

marshmellow, your latest commit is confirmed working, it displays block 1 and 2 when doing the lf search.
Just a simple lf indala clone will now work as expected.

Great work, Cheers.

Offline

#24 2017-10-05 11:43:40

johnthewave
Contributor
Registered: 2014-10-10
Posts: 19

Re: [Solved] Cloned Indala card (T5577) is not recognized

Dear marshmellow,

In this thread, you indicated block zero is 0x903E1042. But I'm missing 'how to ' build B1/B2/B3 from the FC and UC of Indala.
I have developed my own prog bench for 26 bits/35/37 bits for HID emualtion, and need to add Indala for a new - but old -  facility my company has bought.
Could you please help ?
Thanks a lot.
John.

Offline

#25 2019-05-23 00:39:35

SH512
Contributor
Registered: 2019-05-11
Posts: 3

Re: [Solved] Cloned Indala card (T5577) is not recognized

johnthewave wrote:

Dear marshmellow,

In this thread, you indicated block zero is 0x903E1042. But I'm missing 'how to ' build B1/B2/B3 from the FC and UC of Indala.
I have developed my own prog bench for 26 bits/35/37 bits for HID emualtion, and need to add Indala for a new - but old -  facility my company has bought.
Could you please help ?
Thanks a lot.
John.

Hi John,

did you manage to find an encoding order for the bits ? I need to do the same, given a FC and UC, program a card to give those out. We are looking to do batches of 100 at a time to issue to new users, with T5577 as this is much cheaper for our door access system than getting the 'proper' Indala cards/fobs issued.

On other posts you mentioned having an excel spreadsheet, is this available ?

Many thanks for any help
Nigel

Offline

Board footer

Powered by FluxBB