Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2015-11-05 00:58:18

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Tag? [false positive]

Hi Guys,


//hw tune without the tag

# LF antenna: 28.32 V @   125.00 kHz
# LF antenna: 34.24 V @   134.00 kHz
# LF optimal: 38.77 V @   129.03 kHz
# HF antenna: 12.94 V @    13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

//hw tune with the tag

# LF antenna: 23.65 V @   125.00 kHz
# LF antenna: 33.83 V @   134.00 kHz
# LF optimal: 35.48 V @   130.43 kHz
# HF antenna: 12.69 V @    13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

Last edited by JasZ (2015-11-21 04:01:16)

Offline

#2 2015-11-05 01:34:16

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

Hmmm. The crc failed.  Is it an animal tag or a card/key fob?

Offline

#3 2015-11-05 01:58:44

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

marshmellow wrote:

Hmmm. The crc failed.  Is it an animal tag or a card/key fob?

ks

Last edited by JasZ (2015-11-21 03:59:25)

Offline

#4 2015-11-05 02:54:46

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

Then I expect your tag is not a fdx-b, but you see a false positive.  Are you running a recent firmware build?

Offline

#5 2015-11-05 03:08:06

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

marshmellow wrote:

Then I expect your tag is not a fdx-b, but you see a false positive.  Are you running a recent firmware build?

not the latest one , it's 2.1.0 at the moment

do i need to update the firmware?

Offline

#6 2015-11-05 03:34:21

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

I think 2.1 had a bug in the fdx-b that caused many false positives.  So that explains it.  You should be able to 'data rawdemod ab' it and get a raw data stream.  Are there any indications of what system or type of tag it is?  Numbers on the tag?

Last edited by marshmellow (2015-11-05 04:56:56)

Offline

#7 2015-11-05 04:57:29

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

btw - lf search first then data rawdemod ab

Offline

#8 2015-11-05 10:45:29

Go_tus
Contributor
Registered: 2015-06-03
Posts: 81

Re: Tag? [false positive]

Hi Does the tag come with 4 Hex number? Can u post lf read samples 2000.

Offline

#9 2015-11-06 00:04:02

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

Thanks again~

Last edited by JasZ (2015-11-21 03:59:47)

Offline

#10 2015-11-06 00:10:52

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

Cheers

Last edited by JasZ (2015-12-09 03:23:56)

Offline

#11 2015-11-06 07:53:00

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

e

Last edited by JasZ (2015-11-21 04:00:03)

Offline

#12 2015-11-06 07:59:44

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

.....

Last edited by JasZ (2015-11-08 22:55:54)

Offline

#13 2015-11-06 14:10:35

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

Hmmm. Try data rawdemod ab 1

Last edited by marshmellow (2015-11-06 14:12:51)

Offline

#14 2015-11-06 23:06:00

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

a

Last edited by JasZ (2015-11-21 04:00:20)

Offline

#15 2015-11-06 23:46:32

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

actually i believe your tag to be the same as the one found here http://www.proxmark.org/forum/viewtopic.php?id=2541

so:
lf search
data rawdemod am

should get the raw binary of the tag
then
data printdemod x o 1    (can play with the offset - 0 1 or o 2 or o 3 etc. until you see your printed ID in the string somewhere.)

should get you the hex values of the blocks

Last edited by marshmellow (2015-11-06 23:47:26)

Offline

#16 2015-11-07 03:22:03

key
Contributor
Registered: 2015-10-28
Posts: 20

Re: Tag? [false positive]

i got same tag before!!!!!!!!!!!!!!!!!!!!!!!!!!!
many people ask me to make this
i dont understand how to do exactly
can you make a command to make this one easy????????????????????

Offline

#17 2015-11-07 03:57:07

Go_tus
Contributor
Registered: 2015-06-03
Posts: 81

Re: Tag? [false positive]

As far I can see, marshmellow has already guided u and with 4 digits of 0. I think u can find it.

Offline

#18 2015-11-07 03:59:30

Go_tus
Contributor
Registered: 2015-06-03
Posts: 81

Re: Tag? [false positive]

Delete

Last edited by Go_tus (2015-11-07 04:00:14)

Offline

#19 2015-11-07 10:48:18

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Tag? [false positive]

Offline

#20 2015-11-08 07:46:56

Go_tus
Contributor
Registered: 2015-06-03
Posts: 81

Re: Tag? [false positive]

I cannot comfirm the card but the reader looks like  prx-1

Last edited by Go_tus (2015-11-08 07:47:24)

Offline

#21 2015-11-08 09:18:20

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Tag? [false positive]

so the viking demod should be a 26bit Wiegand according to pdfs from site.

Using calc:  http://www.brivo.com/support/card-calculator/

The post #10 looks ok,   the #12 doesn't.



JazS post #12   Printed: 0000F46D 

Internal Card #  31286
Facility Code #  0
JazS post #10   Printed: 0708640B

Internal Card # 12805
Facility Code # 132

Offline

#22 2015-11-08 13:59:34

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

Doesn't make sense to have the raw printed tho.  Plus there is a checksum?

Offline

#23 2015-11-08 15:03:52

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

marshmellow wrote:

Doesn't make sense to have the raw printed tho.  Plus there is a checksum?

both are the same with your link @ #15

Offline

#24 2015-11-08 15:34:40

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Tag? [false positive]

@JasZ,   can you publish the output of your tag running these commands together with the numbers printed on the tag.

lf search
data rawdemod am
data printdemod x

Offline

#25 2015-11-08 23:32:17

JasZ
Contributor
Registered: 2015-11-05
Posts: 15

Re: Tag? [false positive]

as marshmellow mentioned, it's a false positives caused by v2.1

now i'm using a different windows compiled version and it doesn't say FDX-B anymore.

0746e0d3

[== Undefined ==]
#db# Sampling config:        
#db#   [q] divisor:           95        
#db#   [b] bps:               8        
#db#   [d] decimation:        1        
#db#   [a] averaging:         1        
#db#   [t] trigger threshold: 0        
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample       
#db# buffer samples: 9a a5 ad b8 b5 b0 b3 aa ...       
Reading 20000 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


No Known Tags Found!

Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
#db# Sampling config:        
#db#   [q] divisor:           95        
#db#   [b] bps:               8        
#db#   [d] decimation:        1        
#db#   [a] averaging:         1        
#db#   [t] trigger threshold: 0        
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample       
#db# buffer samples: 7d 8a 8a 80 78 77 81 7d ...       
Reading 20000 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


Using Clock: 32 - Invert: 0 - Bits Found: 500

No Known Tags Found!

Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1 

Using Clock: 32 - Invert: 0 - Bits Found: 500
ASK/Manchester decoded bitstream:
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110
0000110100110010
1000111100100000
0000000000000000
0111010001101110

Last edited by JasZ (2015-11-08 23:33:02)

Offline

#26 2015-11-09 05:06:36

Go_tus
Contributor
Registered: 2015-06-03
Posts: 81

Re: Tag? [false positive]

It's viking. I agree with marshmellow, please refer to topic that he pointed out.

Last edited by Go_tus (2015-11-09 05:11:22)

Offline

#27 2015-11-09 09:30:59

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Tag? [false positive]

if I take some of your repeating binarypatterns,
1000111100100000000000000000000001110100011011100000110100110010

0x8F200000746E0D32

which matches with your printed number.

Offline

#28 2015-11-09 17:56:27

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

but 0746e0d3 is at minimum 27 bits.  so the thought of it being a 26 bit format is out.

Last edited by marshmellow (2015-11-09 17:57:14)

Offline

#29 2015-11-10 06:13:04

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

I've just pushed a viking demod to my fork.  lf search should now identify this tag.  I would like to identify the checksum at the end to be thorough and to reduce the false positives.  To do that we need samples of valid tags and their checksum. (Or just saved traces)


Edit...  the checksum is a simple xor.  xor all bytes and A8 and you get the 1byte checksum.

Last edited by marshmellow (2015-11-10 06:24:46)

Offline

#30 2015-11-10 07:04:35

Go_tus
Contributor
Registered: 2015-06-03
Posts: 81

Re: Tag? [false positive]

I do have animal tag, if u need me to post it's data. I will. smile

Offline

#31 2015-11-10 07:15:04

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

@Go_tus, out of curiosity, does lf search correctly identify and demodulate it?

Offline

#32 2015-11-10 07:31:38

Go_tus
Contributor
Registered: 2015-06-03
Posts: 81

Re: Tag? [false positive]

lf search work well, but for this viking tag, 8 bytes uid must be known before tag can be demod. I don't think it has to be included in lf search. For animal tag, I will run the test and post it, will test on 3 animal tags on lf search command.  smile

Offline

#33 2015-11-10 09:54:02

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Tag? [false positive]

In @marshmellows  viking demod, you don't need the uid as in your addon for viking.   His solution actually demods it. smile

Offline

#34 2015-11-10 18:55:50

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Tag? [false positive]

i just fixed a small bug in my code for the viking demod, it now functions as it should.

Offline

Board footer

Powered by FluxBB