Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2018-10-31 18:34:38

burma
Contributor
Registered: 2018-07-28
Posts: 13

Unknown LF (Farpointe)

Hi,

I'm trying to read a LF tag labeled 2329 1540, that presumably should be Pyramid, but I can't get any meaningful readings. Any ideas on how can it be approached?

Thank you!

pm3 --> hw tune

[=] measuring antenna characteristics, please wait...



[+] LF antenna: 33.71 V - 125.00 kHz
[+] LF antenna: 28.18 V - 134.00 kHz
[+] LF optimal: 33.71 V - 125.00 kHz
[+] LF antenna is OK 

[+] HF antenna: 31.36 V - 13.56 MHz
[+] HF antenna is OK

[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

pm3 --> hw tune

[=] measuring antenna characteristics, please wait...



[+] LF antenna: 15.30 V - 125.00 kHz
[+] LF antenna: 18.27 V - 134.00 kHz
[+] LF optimal: 23.23 V - 151.90 kHz
[+] LF antenna is OK 

[+] HF antenna: 31.03 V - 13.56 MHz
[+] HF antenna is OK

[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

pm3 --> lf search u
#db#   [q] divisor.............88 (134 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


[-] No known 125/134 KHz tags Found!


[=] Checking for Unknown tags:

[-] no repeating pattern found
[=] Possible Auto Correlation of 25600 repeating samples
[=] Possible 3200 bytes

[-] No Data Found!
pm3 --> lf config L
#db# LF Sampling config
pm3 --> lf read
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 47 2d 16 02 1d 54 4a 31 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 54 4a 31 0a 69 4a 30 19 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 

pm3 --> lf search 1 u
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


[-] No known 125/134 KHz tags Found!


[=] Checking for Unknown tags:

[-] no repeating pattern found
ASK/Manchester - Clock: 8 - Decoded bitstream:
0101001010000000
0101001010010000
0000000000101101
0000000000111111
1111011110000110
1111111111111011
1111111111111111
1111111111111111
1111111111111001
1010000000000000
0000000000000000
0000000000000000
1010000000000000
0000000000000000
0000000000000000
0101001000000000
0000000000000000
0000000000000000
0000101101000000
0101111111111111
1111111111111111
1111100110100000
0000000000000000
0000000000000000
0000000010100000
0000000000000000
0000000000000000
0000000001010010
0000000000000000
0000000000000000
00

Unknown ASK Modulated and Manchester encoded Tag Found!

if it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 45 2b 06 64 47 2d 16 02 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 55 4a 30 0a 68 4b 30 19 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 4a 30 0a 68 4a 30 19 04 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 54 4a 30 0a 68 4b 30 19 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 1e 55 4a 30 0a 68 4a 30 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 1e 55 49 30 0a 68 4a 30 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> data plot
pm3 --> data plot
pm3 --> lf read
#db# LF Sampling config
#db#   [q] divisor.............95 (125 KHz)
#db#    bps.................8
#db#   [d] decimation..........1
#db#   [a] averaging...........Yes
#db#   [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 2c 06 65 47 2d 16 02 1d ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
pm3 --> data plot
pm3 --> data save m4
saved to 'm4'

pm31.png
saved data (m4.pm3)

Last edited by burma (2018-10-31 18:39:32)

Offline

#2 2018-11-01 05:45:08

yukihama
Contributor
Registered: 2018-05-13
Posts: 102

Re: Unknown LF (Farpointe)

I have same problem but dont know how to tell from the saved pm3 file

Offline

#3 2018-11-01 22:28:29

burma
Contributor
Registered: 2018-07-28
Posts: 13

Re: Unknown LF (Farpointe)

You have the same regular blank card?


I'm also not sure about the output of hw tune when the tag is on it ([+] LF optimal: 23.23 V - 151.90 kHz). Could it be that the tag is actually 150 kHz and all I see is an unrecognizable image of a signal picked up at lower frequencies

Offline

#4 2018-11-14 16:24:11

duckwc
Contributor
Registered: 2018-10-12
Posts: 8

Re: Unknown LF (Farpointe)

I looked at your trace a bit and cleaned it up.
Basically it looks like the only thing your tag is doing is repeating a sequence of something that looks like an ID separated by ticks

the ID:
2018-11-14-16-14-45-proxmark3.png
the ID and the ticks:
2018-11-14-16-18-00-proxmark3.png
the complete sequence delimited by the bars in the second picture is repeated over time

the ID I'm able to get is something like 59FF677793 or could also be A60098886C by flipping the bits

Offline

Board footer

Powered by FluxBB