Copy 41xx to 4305

Henno · 2021-02-02 21:53:03

Hi,

I have an implant 4305
I can read write by the white multi frequency china cloner.

I need to change the uid by proxmark3

I can read the implant by lf read and get valid data.
I tried to write uni by:
lf em 410xwrite abffcc2021 1
Also tried with p 19920427 (the cloner uses this pass on t55xx)

But it doesn't write
I tried also lf em 4x05write a 1 d abffcc2021
Also no success

Anyone know how to clone the uid to 4305?

jof · 2021-02-02 23:01:26

I have the impression that EM4305 only supports the factory-set unique ID. Despite the name, I think those commands are for cloning EM tags onto T5577 target tags.

Henno · 2021-02-03 05:25:07

But i can write the uid by china cloner...

I don't know what block number die uid is

iceman · 2021-02-03 14:21:33

We have started to add supporting "clone" to EM4305/4469/ but only a few card tech / formats is available and Work-in-progress

Henno · 2021-02-03 17:48:34

what fork exactly?
What is the command for it?

iceman · 2021-02-03 20:30:29

RRG/Iceman repo https://github.com/rfidresearchgroup/proxmark3

Henno · 2021-02-04 21:07:01

That's what I use, but i cannot find a command for clone to 4x05

Can you please give me a hint?

iceman · 2021-02-04 22:03:45

Start with reading the helptext for the clone command. However its WIP, so don't consider it all to work. Massive pain in the butt to add all the different configurations and detecting the correct EM card type...

Henno · 2021-02-05 19:51:49

Seems like my white china cloner set a pass to my implant.
Seems to be non of the pass listet in the pass lists.

I wrote a 5577 card, copied it with the white cloner to my implan, OK
read back the implant, copy to a new 5577 card, cannot read it and chk also cannot find pass.
If i clone the first 5577 to a 3th new 5577 i can read it with pm3 and pass 19920427
Any idea how i can get my 4305 implant to be read/write by PM3?

Unfortunately it seems there is almost no infos about the 4305 on the internet.

iceman · 2021-02-06 12:09:36

if you know the EM-4100 ID used, you can use

lf t55 chk -h

to find a specific solution for the white cloner.

Henno · 2021-02-06 16:01:11

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID ABFFCC2021
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID : D5FF330484
[=] HoneyWell IdentKey
[+] DEZ 8 : 13377569
[+] DEZ 10 : 4291567649
[+] DEZ 5.5 : 65484.08225
[+] DEZ 3.5A : 171.08225
[+] DEZ 3.5B : 255.08225
[+] DEZ 3.5C : 204.08225
[+] DEZ 14/IK2 : 00738730975265
[+] DEZ 15/IK3 : 000919109567620
[+] DEZ 20/ZK : 13051515030300040804
[=]
[+] Other : 08225_204_13377569
[+] Pattern Paxton : 2883608097 [0xABE05E21]
[+] Pattern 1 : 10820096 [0xA51A00]
[+] Pattern Sebury : 8225 76 4988961 [0x2021 0x4C 0x4C2021]
[=] ------------------------------------------------

[+] Valid EM410x ID found!

Couldn't identify a chipset

[usb] pm3 --> lf t5 chk --em ABFFCC2021
[=] press 'enter' to cancel the command

[=] testing 86CDA923 generated
[=] Chip Type : T55x7
[=] Modulation : ASK
[=] Bit Rate : 5 - RF/64
[=] Inverted : Yes
[=] Offset : 63
[=] Seq. Term. : Yes
[=] Block0 : 0x80168084 (Auto detect)
[=] Downlink Mode : default/fixed bit length
[=] Password Set : Yes
[=] Password : 86CDA923

[+] found valid password : [ 86CDA923 ]

[+] time in check pwd 0 seconds

[usb] pm3 --> lf em 4x05 write --addr 3 --pwd 86CDA923 --data 11223344
[=] Writing address 3 data 11223344 using password 86CDA923
[!!] Tag denied Write operation
[?] Hint: try `lf em 4x05 read` to verify

lf em 4x05 dump and lf em 5x05 info just do nothing

Henno · 2021-02-06 17:02:17

with another antenna i cn at least use the 4x05 commands

[usb] pm3 --> lf em 4x05 dump -p 11223344
[=] Found a EM4305 tag
[!] Password is incorrect, will try without password

Henno · 2021-02-16 14:50:29

Anyone have more information about the lf em 4x05 unlock command?

I found this side, https://blog.quarkslab.com/rfid-new-pro … dings.html
But it is not helping me.

when i run lf em 4x05 unlock

it fails almost immediately.

[usb] pm3 --> lf em 4x05 unlock
[=] --------------- EM4x05 tear-off : target PROTECT -----------------------

[=] initial prot 14&15 [ 11B7B3DF, 00000000 ]
[=] automatic mode [ enabled ]
[=] target stepping [ 2000 ]
[=] target delay range [ 2000 ... 6000 ]
[=] search value [ 11B7B3DF ]
[=] write value [ 00000000 ]
[=] ----------------------------------------------------------------------------

[=] press 'enter' to cancel the command

[=] --------------- start -----------------------

[#] Tear-off triggered!
[!] failed unlock write
[usb] pm3 -->

Proxmark3 community

Announcement

#1 2021-02-02 21:53:03

Copy 41xx to 4305

#2 2021-02-02 23:01:26

Re: Copy 41xx to 4305

#3 2021-02-03 05:25:07

Re: Copy 41xx to 4305

#4 2021-02-03 14:21:33

Re: Copy 41xx to 4305

#5 2021-02-03 17:48:34

Re: Copy 41xx to 4305

#6 2021-02-03 20:30:29

Re: Copy 41xx to 4305

#7 2021-02-04 21:07:01

Re: Copy 41xx to 4305

#8 2021-02-04 22:03:45

Re: Copy 41xx to 4305

#9 2021-02-05 19:51:49

Re: Copy 41xx to 4305

#10 2021-02-06 12:09:36

Re: Copy 41xx to 4305

#11 2021-02-06 16:01:11

Re: Copy 41xx to 4305

#12 2021-02-06 17:02:17

Re: Copy 41xx to 4305

#13 2021-02-16 14:50:29

Re: Copy 41xx to 4305

Board footer