Proxmark3 community

Go_tus

Contributor

Registered: 2015-06-03

Posts: 81

Re: need help with the tag

Looking good 

kwx

Contributor

Registered: 2013-11-26

Posts: 46

Re: need help with the tag

the brivo calc will expect there to be the standard wiegand parities, and there aren't any in the raw data.  if the reader outputs wiegand, then it generates the parities and tacks them onto "some" of the data read from the card.

but since 8 raw hex digits seem to be printed on the tags (32 bits) i'm not sure how a reader would split that raw data or why the raw data is printed instead of the 26 bit card id or facility code...

if someone has a reader and could share a printed id and what the id the reader sends/saves in the access control software we could put this to rest.

I have my hands on a viking tag, with number engraved. What tests can I do for you ?

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: need help with the tag

do you also have access to a reader / software?

kwx

Contributor

Registered: 2013-11-26

Posts: 46

Re: need help with the tag

Edit: I see you're referring to the reader itself (not the PM).
I called the supplier of the system I am using - the reader is 1k EU.
I will try to see if I can get access to another reader, if possible.

do you also have access to a reader / software?

Hey marshmellow.
I've got my PM3 running the latest commit from GH (so w. your viking mods)

I've also got a viking tag here, engraved with the ID: 070AAF4A

When I run lf search, I get:

proxmark3> lf search
Reading 30000 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:

Viking Tag Found: Card ID 070AAF4A, Checksum: B2
Raw: F20000070AAF4AB2

Valid Viking ID Found!

When I attempt to clone it to a T5577 card:

proxmark3> lf viking clone 070AAF4A
proxmark3> lf search

Reading 30000 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible


Checking for known tags:


No Known Tags Found!

Is there prep that I have to do to the card before it accepts the card? (I've tried with multiple cards)

I am available to do whatever tests you may need

Last edited by kwx (2016-02-03 12:05:46)

kwx

Contributor

Registered: 2013-11-26

Posts: 46

Re: need help with the tag

OK, I can get access to a reader. (They are used for access control here)
I've got a badge that is in the system, and a badge that isn't in the system.

I've also got multiple proxmarks, so in theory could sniff the communication between a simulated card if necessary.

Access to the reader is a bit of a pain (~1 hour drive from here) - but I'll be happy to try whatever you need.

Thanks

kwx

Contributor

Registered: 2013-11-26

Posts: 46

Re: need help with the tag

do you also have access to a reader / software?

Hey Marshmellow.
Any updates on this, and any hints on what the Block 0 of the T55x7 should be set to for a viking emulation?

Thanks!

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: need help with the tag

what is still not known is how the reader interprets the raw tag ID.  so we'd need to know what the reader reads your tag as, along with your tag's raw ID.

so if there is a software log of your card read in the access control system, and if it tells you the FC and Card# we might be able to figure out how the reader interprets the rawID.

or you could "listen" to the reader output and see what it "says" when a card is presented.  (but that may be a little more difficult and require re-wiring)

lohcm88

Contributor

Registered: 2016-02-05

Posts: 59

Re: need help with the tag

I have tried cloning a Viking tag as well but fail..

My tag

Checking for known tags:

Viking Tag Found: Card ID 05032B18, Checksum: 6F
Raw: F2000005032B186F

Valid Viking ID Found!

Using Clock:32, Invert:0, Bits Found:513
ASK/Manchester - Clock: 32 - Decoded bitstream:
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101

Tried cloning and proxmark hang and if u notice the RAW is wrong as well during cloning..

converting binary 00100000000000000000000001010000001100101011000110000110 to hex is 2000005032B186 but proxmark show 2000000032B186.

proxmark3> lf viking clone 05032B18
Cloning - ID: 05032B18, Raw: F2000000032B186F
#db# unknown command:: 0x0223
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button

Aliendennis

Contributor

Registered: 2016-04-04

Posts: 29

Re: need help with the tag

lohcm88 i guess your enviro compiling went run somewhere. I just patched all the files. seems find on my side.

proxmark3> lf viking clone 06033ED5
Cloning - ID: 06033ED5, Raw: F2000000033ED5B4
proxmark3>

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: need help with the tag

Solved  http://www.proxmark.org/forum/viewtopic … 155#p21155