Possibly password protected HID Prox II tag

Heru · 2018-02-28 10:59:40

Hello guys,

I got some HID prox II fobs off ebay recently and l cannot seem to write on them.

They are 26bit basic Prox II fobs, Look unused but, they are sequentially numbered.

When I write "lf hid clone ABACDEEA" , it seems it takes it, However, when I re-read , nothing changed.

If its indeed password protected, is there a way to reset the password and re-format these fobs anyhow?

Thanks for your valuable input.

Last edited by Heru (2018-02-28 12:11:18)

Heru · 2018-02-28 11:00:45

For the record, I've tried the bruteforce command with the default_pwd.dic. No luck,

iceman · 2018-02-28 11:03:40

Are you sure they are T55x7 tags?? Could be EM4x05 / 4x50 ...

Heru · 2018-02-28 11:08:51

"lf hid demod" reads it and shows the corresponding ID number on proxmark, TIA

iceman · 2018-02-28 11:32:34

still doesn't answer my question...

Heru · 2018-02-28 11:37:24

Hello, Iceman

"lf search" returns with "Valid HID Prox ID found!
"lf hid demod" confirms it and shows its ID,

iceman · 2018-02-28 11:44:14

yes, I get that the tag gets identifed as a HID encoded tag. but that is not what I asked.

Heru · 2018-02-28 11:46:31

Ok, not sure how do I find out that,

I've just tried "lf em 4x50read". It does not yield any output

Heru · 2018-02-28 11:49:24

lf em 4x05dump

Read Address 00 | failed
Read Address 01 | failed
PWD Address 02 | cannot read

iceman · 2018-02-28 11:54:31

t55x7

lf t55 detect

-- if ok,  try
lf t55 info

EM, there is also the 4x50 to try

Heru · 2018-02-28 12:05:34

iceman wrote:

t55x7
lf t55 detect

-- if ok,  try
lf t55 info
EM, there is also the 4x50 to try

Iceman, thanks ,tried them all. they're all no use,unfortunately

Now my question is, Is it even possible to re-program these fobs at all on proxmark?, for example, to change its TAG ID numbers and Facility Code ect? Even if we had the password

HID Prox TAG ID: 2004da883a ( 09211) - Format Len:26bit - FC:109 - Card 09211

TIA

Last edited by Heru (2018-02-28 12:09:39)

iceman · 2018-02-28 12:10:04

Not until the chipset is used for this tag is identified. If they are based on t55x7 / t5555 / em4x50 / em 4x05 without password, you could .. As it looks now, its unknown.

marshmellow · 2018-02-28 14:05:32

Those tags will be password protected. There is no crack. Brute Force might take 3 years or you might get lucky.

Also iirc they are t55x7 chips.

iceman · 2018-02-28 14:08:16

t55x7 and no respond. Configured with wakeup?

marshmellow · 2018-02-28 14:09:33

Likely the tag won't have the "correct" traceability values as hid often changed them. (Which is what is read to ID the chip.)

iceman · 2018-02-28 14:20:19

cool, I learn something new everyday

marshmellow · 2018-02-28 14:28:16

The other problem with those tags is the Chip's antenna is incredibly small and weak. (The reason hid discontinued that line). iirc about the only way to talk to them with the pm3 is to have the tip of the tag inside the pm3 antenna winding.
Obviously depends on your antenna

So even if the traceability values were "Correct" the tag likely didn't even "hear" the readblk cmd.

Heru · 2018-03-01 01:11:06

marshmellow wrote:

Those tags will be password protected. There is no crack. Brute Force might take 3 years or you might get lucky.
Also iirc they are t55x7 chips.

HI marsh, thanks for confirming,

Last edited by Heru (2018-03-01 01:11:28)

Proxmark3 community

Announcement

#1 2018-02-28 10:59:40

Possibly password protected HID Prox II tag

#2 2018-02-28 11:00:45

Re: Possibly password protected HID Prox II tag

#3 2018-02-28 11:03:40

Re: Possibly password protected HID Prox II tag

#4 2018-02-28 11:08:51

Re: Possibly password protected HID Prox II tag

#5 2018-02-28 11:32:34

Re: Possibly password protected HID Prox II tag

#6 2018-02-28 11:37:24

Re: Possibly password protected HID Prox II tag

#7 2018-02-28 11:44:14

Re: Possibly password protected HID Prox II tag

#8 2018-02-28 11:46:31

Re: Possibly password protected HID Prox II tag

#9 2018-02-28 11:49:24

Re: Possibly password protected HID Prox II tag

#10 2018-02-28 11:54:31

Re: Possibly password protected HID Prox II tag

#11 2018-02-28 12:05:34

Re: Possibly password protected HID Prox II tag

#12 2018-02-28 12:10:04

Re: Possibly password protected HID Prox II tag

#13 2018-02-28 14:05:32

Re: Possibly password protected HID Prox II tag

#14 2018-02-28 14:08:16

Re: Possibly password protected HID Prox II tag

#15 2018-02-28 14:09:33

Re: Possibly password protected HID Prox II tag

#16 2018-02-28 14:20:19

Re: Possibly password protected HID Prox II tag

#17 2018-02-28 14:28:16

Re: Possibly password protected HID Prox II tag

#18 2018-03-01 01:11:06

Re: Possibly password protected HID Prox II tag

Board footer