Tag? [false positive]

JasZ · 2015-11-05 00:58:18

Hi Guys,

//hw tune without the tag

# LF antenna: 28.32 V @ 125.00 kHz
# LF antenna: 34.24 V @ 134.00 kHz
# LF optimal: 38.77 V @ 129.03 kHz
# HF antenna: 12.94 V @ 13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

//hw tune with the tag

# LF antenna: 23.65 V @ 125.00 kHz
# LF antenna: 33.83 V @ 134.00 kHz
# LF optimal: 35.48 V @ 130.43 kHz
# HF antenna: 12.69 V @ 13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

Last edited by JasZ (2015-11-21 04:01:16)

marshmellow · 2015-11-05 01:34:16

Hmmm. The crc failed. Is it an animal tag or a card/key fob?

JasZ · 2015-11-05 01:58:44

marshmellow wrote:

Hmmm. The crc failed. Is it an animal tag or a card/key fob?

ks

Last edited by JasZ (2015-11-21 03:59:25)

marshmellow · 2015-11-05 02:54:46

Then I expect your tag is not a fdx-b, but you see a false positive. Are you running a recent firmware build?

JasZ · 2015-11-05 03:08:06

marshmellow wrote:

Then I expect your tag is not a fdx-b, but you see a false positive. Are you running a recent firmware build?

not the latest one , it's 2.1.0 at the moment

do i need to update the firmware?

marshmellow · 2015-11-05 03:34:21

I think 2.1 had a bug in the fdx-b that caused many false positives. So that explains it. You should be able to 'data rawdemod ab' it and get a raw data stream. Are there any indications of what system or type of tag it is? Numbers on the tag?

Last edited by marshmellow (2015-11-05 04:56:56)

marshmellow · 2015-11-05 04:57:29

btw - lf search first then data rawdemod ab

Go_tus · 2015-11-05 10:45:29

Hi Does the tag come with 4 Hex number? Can u post lf read samples 2000.

JasZ · 2015-11-06 00:04:02

Thanks again~

Last edited by JasZ (2015-11-21 03:59:47)

JasZ · 2015-11-06 00:10:52

Cheers

Last edited by JasZ (2015-12-09 03:23:56)

JasZ · 2015-11-06 07:53:00

e

Last edited by JasZ (2015-11-21 04:00:03)

JasZ · 2015-11-06 07:59:44

.....

Last edited by JasZ (2015-11-08 22:55:54)

marshmellow · 2015-11-06 14:10:35

Hmmm. Try data rawdemod ab 1

Last edited by marshmellow (2015-11-06 14:12:51)

JasZ · 2015-11-06 23:06:00

a

Last edited by JasZ (2015-11-21 04:00:20)

marshmellow · 2015-11-06 23:46:32

actually i believe your tag to be the same as the one found here http://www.proxmark.org/forum/viewtopic.php?id=2541

so:
lf search
data rawdemod am

should get the raw binary of the tag
then
data printdemod x o 1 (can play with the offset - 0 1 or o 2 or o 3 etc. until you see your printed ID in the string somewhere.)

should get you the hex values of the blocks

Last edited by marshmellow (2015-11-06 23:47:26)

key · 2015-11-07 03:22:03

i got same tag before!!!!!!!!!!!!!!!!!!!!!!!!!!!
many people ask me to make this
i dont understand how to do exactly
can you make a command to make this one easy????????????????????

Go_tus · 2015-11-07 03:57:07

As far I can see, marshmellow has already guided u and with 4 digits of 0. I think u can find it.

Go_tus · 2015-11-07 03:59:30

Delete

Last edited by Go_tus (2015-11-07 04:00:14)

iceman · 2015-11-07 10:48:18

Is it this kind of Viking tag?

https://www.vikingelectronics.com/produ … hp?pid=321

Go_tus · 2015-11-08 07:46:56

I cannot comfirm the card but the reader looks like prx-1

Last edited by Go_tus (2015-11-08 07:47:24)

iceman · 2015-11-08 09:18:20

so the viking demod should be a 26bit Wiegand according to pdfs from site.

Using calc: http://www.brivo.com/support/card-calculator/

The post #10 looks ok, the #12 doesn't.

JazS post #12   Printed: 0000F46D 

Internal Card #  31286
Facility Code #  0

JazS post #10   Printed: 0708640B

Internal Card # 12805
Facility Code # 132

marshmellow · 2015-11-08 13:59:34

Doesn't make sense to have the raw printed tho. Plus there is a checksum?

JasZ · 2015-11-08 15:03:52

marshmellow wrote:

Doesn't make sense to have the raw printed tho. Plus there is a checksum?

both are the same with your link @ #15

iceman · 2015-11-08 15:34:40

@JasZ, can you publish the output of your tag running these commands together with the numbers printed on the tag.

lf search
data rawdemod am
data printdemod x

JasZ · 2015-11-08 23:32:17

as marshmellow mentioned, it's a false positives caused by v2.1

now i'm using a different windows compiled version and it doesn't say FDX-B anymore.

0746e0d3

[== Undefined ==]
#db# Sampling config:        
#db#   [q] divisor:           95        
#db#   [b] bps:               8        
#db#   [d] decimation:        1        
#db#   [a] averaging:         1        
#db#   [t] trigger threshold: 0        
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample       
#db# buffer samples: 9a a5 ad b8 b5 b0 b3 aa ...       
Reading 20000 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


No Known Tags Found!

Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
#db# Sampling config:        
#db#   [q] divisor:           95        
#db#   [b] bps:               8        
#db#   [d] decimation:        1        
#db#   [a] averaging:         1        
#db#   [t] trigger threshold: 0        
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample       
#db# buffer samples: 7d 8a 8a 80 78 77 81 7d ...       
Reading 20000 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


Using Clock: 32 - Invert: 0 - Bits Found: 500

No Known Tags Found!

Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 

Using Clock: 32 - Invert: 0 - Bits Found: 500
ASK/Manchester decoded bitstream:
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110

Last edited by JasZ (2015-11-08 23:33:02)

Go_tus · 2015-11-09 05:06:36

It's viking. I agree with marshmellow, please refer to topic that he pointed out.

Last edited by Go_tus (2015-11-09 05:11:22)

iceman · 2015-11-09 09:30:59

if I take some of your repeating binarypatterns,
1000111100100000000000000000000001110100011011100000110100110010

0x8F200000746E0D32

which matches with your printed number.

marshmellow · 2015-11-09 17:56:27

but 0746e0d3 is at minimum 27 bits. so the thought of it being a 26 bit format is out.

Last edited by marshmellow (2015-11-09 17:57:14)

marshmellow · 2015-11-10 06:13:04

I've just pushed a viking demod to my fork. lf search should now identify this tag. I would like to identify the checksum at the end to be thorough and to reduce the false positives. To do that we need samples of valid tags and their checksum. (Or just saved traces)

Edit... the checksum is a simple xor. xor all bytes and A8 and you get the 1byte checksum.

Last edited by marshmellow (2015-11-10 06:24:46)

Go_tus · 2015-11-10 07:04:35

I do have animal tag, if u need me to post it's data. I will.

marshmellow · 2015-11-10 07:15:04

@Go_tus, out of curiosity, does lf search correctly identify and demodulate it?

Go_tus · 2015-11-10 07:31:38

lf search work well, but for this viking tag, 8 bytes uid must be known before tag can be demod. I don't think it has to be included in lf search. For animal tag, I will run the test and post it, will test on 3 animal tags on lf search command.

iceman · 2015-11-10 09:54:02

In @marshmellows viking demod, you don't need the uid as in your addon for viking. His solution actually demods it.

marshmellow · 2015-11-10 18:55:50

i just fixed a small bug in my code for the viking demod, it now functions as it should.

Proxmark3 community

Announcement

#1 2015-11-05 00:58:18

Tag? [false positive]

#2 2015-11-05 01:34:16

Re: Tag? [false positive]

#3 2015-11-05 01:58:44

Re: Tag? [false positive]

#4 2015-11-05 02:54:46

Re: Tag? [false positive]

#5 2015-11-05 03:08:06

Re: Tag? [false positive]

#6 2015-11-05 03:34:21

Re: Tag? [false positive]

#7 2015-11-05 04:57:29

Re: Tag? [false positive]

#8 2015-11-05 10:45:29

Re: Tag? [false positive]

#9 2015-11-06 00:04:02

Re: Tag? [false positive]

#10 2015-11-06 00:10:52

Re: Tag? [false positive]

#11 2015-11-06 07:53:00

Re: Tag? [false positive]

#12 2015-11-06 07:59:44

Re: Tag? [false positive]

#13 2015-11-06 14:10:35

Re: Tag? [false positive]

#14 2015-11-06 23:06:00

Re: Tag? [false positive]

#15 2015-11-06 23:46:32

Re: Tag? [false positive]

#16 2015-11-07 03:22:03

Re: Tag? [false positive]

#17 2015-11-07 03:57:07

Re: Tag? [false positive]

#18 2015-11-07 03:59:30

Re: Tag? [false positive]

#19 2015-11-07 10:48:18

Re: Tag? [false positive]

#20 2015-11-08 07:46:56

Re: Tag? [false positive]

#21 2015-11-08 09:18:20

Re: Tag? [false positive]

#22 2015-11-08 13:59:34

Re: Tag? [false positive]

#23 2015-11-08 15:03:52

Re: Tag? [false positive]

#24 2015-11-08 15:34:40

Re: Tag? [false positive]

#25 2015-11-08 23:32:17

Re: Tag? [false positive]

#26 2015-11-09 05:06:36

Re: Tag? [false positive]

#27 2015-11-09 09:30:59

Re: Tag? [false positive]

#28 2015-11-09 17:56:27

Re: Tag? [false positive]

#29 2015-11-10 06:13:04

Re: Tag? [false positive]

#30 2015-11-10 07:04:35

Re: Tag? [false positive]

#31 2015-11-10 07:15:04

Re: Tag? [false positive]

#32 2015-11-10 07:31:38

Re: Tag? [false positive]

#33 2015-11-10 09:54:02

Re: Tag? [false positive]

#34 2015-11-10 18:55:50

Re: Tag? [false positive]

Board footer