Proxmark3 community

rauxon

Contributor

Registered: 2017-12-27

Posts: 2

Crescendo C1150 (Prox version)

I'm looking to program the prox version of these so that we can have a single card for PC Logon (contact based smartcard) and building access.  Therefore I need to be able to program these to match the facility code / card number of existing cards. 

The problem I have currently is that the card appears to be a 36bit one, and although I've found a couple of comments online none of them seem to help.

It's also get an EM4305 detected, and I'm not sure if I should be programming that - or if it's just a second feature.  The C1150 are claimed to be multiprotocol, and although the supplier didn't have the one we were originally looking at this could be prox + <something>

So - sorta working in the dark here, only just started playing, but can someone point me in the right direction?

proxmark3> lf sea
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:

HID Prox TAG ID: fffffffffff (65535) - Format Len: 36bit - FC: 0 - Card: 0

Valid HID Prox ID Found!

Valid EM4x05/EM4x69 Chip Found
Try lf em 4x05... commands

proxmark3> lf em 4x05info

 Chip Type:   9 | EM4305
  Cap Type:   3 | 330pF
 Cust Code: 512 | Default

  Serial #: 181A87F0

Config block read failed - might be password protected.

And then from another the info is the same except the Serial #

proxmark3> lf em 4x05info

 Chip Type:   9 | EM4305
  Cap Type:   3 | 330pF
 Cust Code: 512 | Default

  Serial #: 181A87F0

Config block read failed - might be password protected.

Which I guess is a good sign.

Attempting to program it (as a straight forward prox) says OK, but the ID doesn't change - which either means (from what I can read) I need a password, or the correct parity calculation.

Source card:

proxmark3> lf hid read 1
#db# TAG ID: 200638084b (1061) - Format Len: 26bit - FC: 28 - Card: 1061
#db# Stopped

Then try to clone

proxmark3> lf hid clone 200638084b
Cloning tag with ID 200638084b
#db# DONE!

proxmark3> lf hid read 1
#db# TAG ID: fffffffffff (65535) - Format Len: 36bit - FC: 0 - Card: 0
#db# Stopped

Didn't expect this to work since the destination card is a 'normal' card rather than an intentional blank - and the different format - but thought it was worth a try

Last edited by rauxon (2017-12-27 01:32:01)

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Crescendo C1150 (Prox version)

Your card appears to be an unprogrammed hid prox card.  These are a custom em4305 chip that is password protected.  Unless you have the password or a cp1000 hid programmer you are out of luck.

Also, The clone cmds only work with t55xx chips, not em chips.