Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
#1 2014-10-05 08:31:40
- Sentinel
- Contributor
- Registered: 2012-11-26
- Posts: 191
Card for Siemens access control system
my friend has 2 cards for access control system Siemens.
Its a conventional 64-bit card.
but the code is printed on the cards somehow encrypted.
I have not been able to understand exactly how.
Maybe some one knows?
0F00CD7CF1 => 0011000653 (printed)
0F00CD9C42 => 0010969444 (printed)
Offline
#2 2014-10-05 19:38:31
- asper
- Contributor
- Registered: 2008-08-24
- Posts: 1,409
Re: Card for Siemens access control system
In my very humble opinion the decimal value, converted in binary, is obtained taking specific bits of the hex value converted in bin; in practice there is a bit scrambling only, no encryption. I think I will be able to identify a correlation if I have 2 more examples, for now I seem to have located 8 bits only.
Offline
#3 2014-10-06 05:24:52
- marshmellow
- Contributor
- From: US
- Registered: 2013-06-10
- Posts: 2,302
Re: Card for Siemens access control system
I've seen this. I believe it to be just as asper said.. Pattern goes like this: convert hex ID to binary:
bit 18,20,17,19,23,21,24,22,26,28,25,27,35,37,40,34,31,29,39,38,36,30,32,33 no 0 bit in count, count from left(msb). (Make sure to pad leading zeros.)
Convert binary to decimal.
You said this is for a Siemens? Do you know the reader/models?
Last edited by marshmellow (2014-10-06 05:37:06)
Offline
#4 2014-10-06 06:00:24
- asper
- Contributor
- Registered: 2008-08-24
- Posts: 1,409
Re: Card for Siemens access control system
Wow! You were able to detect the scrambling pattern with 2 IDs only! Can you explain me how you did it?
@sentinel: what is the name of the system?
Last edited by asper (2014-10-06 06:01:10)
Offline
#5 2014-10-06 14:10:55
- marshmellow
- Contributor
- From: US
- Registered: 2013-06-10
- Posts: 2,302
Re: Card for Siemens access control system
As I mentioned, I've seen these tags before. 
Offline
#6 2014-10-06 14:15:46
- marshmellow
- Contributor
- From: US
- Registered: 2013-06-10
- Posts: 2,302
Re: Card for Siemens access control system
I Just don't know the system they were used for
Offline
#7 2014-10-06 14:44:28
- asper
- Contributor
- Registered: 2008-08-24
- Posts: 1,409
Re: Card for Siemens access control system
As I mentioned, I've seen these tags before.
Missed it, sorry 
Last edited by asper (2014-10-06 14:44:58)
Offline
#8 2014-10-06 15:51:06
- marshmellow
- Contributor
- From: US
- Registered: 2013-06-10
- Posts: 2,302
Re: Card for Siemens access control system
actually you've seen this format before as well asper.. it is already included in the [EM4100-Unique blocks calculator.xlsm], you made (or helped make?)...
Offline
#9 2014-10-06 15:55:26
- marshmellow
- Contributor
- From: US
- Registered: 2013-06-10
- Posts: 2,302
Re: Card for Siemens access control system
Offline
#10 2014-10-06 16:16:56
- asper
- Contributor
- Registered: 2008-08-24
- Posts: 1,409
Re: Card for Siemens access control system
You are right, I assumed it was a new format without checking the calculator... I would have saved time... 
Offline
#11 2014-10-06 19:45:16
- Sentinel
- Contributor
- Registered: 2012-11-26
- Posts: 191
Re: Card for Siemens access control system
The speed of solving the problem is fantastic)) thank you very much, Мarshmellow
Offline