Proxmark3 community

zhuminggang

Contributor

Registered: 2017-09-06

Posts: 46

report a interesting thing

proxmark3> lf t55 wipe

proxmark3> lf t5 br 00000000 00000003
Search password range [00000000 -> 00000003]
..Chip Type  : T55x7
Modulation : DIRECT/NRZ
Bit Rate   : 1 - RF/16
Inverted   : No
Offset     : 34
Seq. Term. : No
Block0     : 0x00040004

Found valid password: [00000001]

proxmark3> lf t5 de
Chip Type  : T55x7
Modulation : DIRECT/NRZ
Bit Rate   : 1 - RF/16
Inverted   : No
Offset     : 30
Seq. Term. : No
Block0     : 0x00040004

proxmark3> lf t5 du
Reading Page 0:
blk | hex data | binary
----+----------+---------------------------------
  0 | 00040004 | 00000000000001000000000000000100
Reading Page 1:
blk | hex data | binary
----+----------+---------------------------------
  0 | 00040004 | 00000000000001000000000000000100

once wipe run brute force, find a password and change block 0 to 00040004.

just for fun!

Last edited by zhuminggang (2017-10-26 09:38:12)

zhuminggang

Contributor

Registered: 2017-09-06

Posts: 46

Re: report a interesting thing

ask a question:

proxmark3> lf t5 wr b 1 d 00000000
Writing page 0  block: 01  data: 0x00000000
proxmark3> lf t5 read b 1
Reading Page 0:
blk | hex data | binary
----+----------+---------------------------------
  1 | FFFFFFFF | 11111111111111111111111111111111
proxmark3> lf t5 wr b 1 d ffffffff
Writing page 0  block: 01  data: 0xFFFFFFFF
proxmark3> lf t5 read b 1
Reading Page 0:
blk | hex data | binary
----+----------+---------------------------------
  1 | 00000000 | 00000000000000000000000000000000

why t55 read write 00000000 ffffffff opposite, other not?

Last edited by zhuminggang (2017-10-26 09:35:41)

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: report a interesting thing

Running a t55xx pwd command like bruteforce on a t55xx that isn't password protected is a good way to brick your t55xx.

And reading a trace full of zeros presents no changes that allows the system to determine the phase, so if the timing of your antenna powering your tag fluctuates a microsecond it will read data inverted (out of phase).

zhuminggang

Contributor

Registered: 2017-09-06

Posts: 46

Re: report a interesting thing

Running a t55xx pwd command like bruteforce on a t55xx that isn't password protected is a good way to brick your t55xx.

And reading a trace full of zeros presents no changes that allows the system to determine the phase, so if the timing of your antenna powering your tag fluctuates a microsecond it will read data inverted (out of phase).

haha,thanks!