Fermax EM fobs

Onisan · 2017-06-30 13:01:30

I have three Fermax fobs with numbers on them:
003019276 internal hex 01108B2411
002893668 internal hex 01108A8C4B
003496488 internal hex 010FAC3033

More for fun than anything else as I can copy these quite easily but I've been trying to work out how the numbers are derived from the Hex.
I've tried converting the hex to binary , reversing each byte, converting back to hex but no luck, I've even looked at seeing if the binary could be in a different order etc.

Any ideas?

marshmellow · 2017-06-30 13:04:28

What is the output of 'lf search'

Onisan · 2017-06-30 14:48:07

I bricked My Proxmark and haven't had time to reload it. I read the hex from my Smartcard Deluxe machine.

Heru · 2017-10-22 11:29:37

Onisan wrote:

I have three Fermax fobs with numbers on them:
003019276 internal hex 01108B2411
002893668 internal hex 01108A8C4B
003496488 internal hex 010FAC3033
More for fun than anything else as I can copy these quite easily but I've been trying to work out how the numbers are derived from the Hex.
I've tried converting the hex to binary , reversing each byte, converting back to hex but no luck, I've even looked at seeing if the binary could be in a different order etc.
Any ideas?

Is it possible to copy these Fermax fobs on Proxmark#3?
Can you help me how to clone one? thanks so much

iceman · 2017-10-22 12:30:13

without traces or a proper t55x7 configuration block it is not possible.

mnelson · 2017-10-25 00:24:49

Heru wrote:

Onisan wrote:
I have three Fermax fobs with numbers on them:
003019276 internal hex 01108B2411
002893668 internal hex 01108A8C4B
003496488 internal hex 010FAC3033
More for fun than anything else as I can copy these quite easily but I've been trying to work out how the numbers are derived from the Hex.
I've tried converting the hex to binary , reversing each byte, converting back to hex but no luck, I've even looked at seeing if the binary could be in a different order etc.
Any ideas?
Is it possible to copy these Fermax fobs on Proxmark#3?
Can you help me how to clone one? thanks so much

Yes, you can clone the Fermax FOBs on your PM3. Just present the FOB to the and use lf se u. If you've spent much time learning how to use the PM3, you should see what you need to be able to clone a FOB.

Heru · 2017-10-25 01:43:13

Thanks guys for the hints, my one is actually Chubb system and the copy I made does not seem to work, I ll do further reading ,

thanks again

iceman · 2017-10-25 11:21:07

ok, not to be a party pooper, but someone sent me what looks legit decode of this pattern.

I'm swamped with work and I maybe make a decode in a few months of it. Or you go-fund me to do it haha,

The reason for not publishing is that that someone belives ppl needs to learn by them self. Good exercise in problem solving.
I agree with it. So far I have not seen any attempts here on this thread to have a real go at it. No partial solutions, nada, and I don't want to spoil the fun.

Hint:
you can go from hex to internal number. Do what we always do, look at hex and binary.
The solution involves bit scrambling, I don't expect many to figure that part out but it is doable.

(well easy for me to say looking at the answer, I know)

To the someone who might read here, thank you so much! It was a great explaintion.
If you have more solutions, keep them coming

Onisan · 2017-10-25 13:30:38

Thank you Iceman,
I tried binary and bit shifting with little luck. I shall have to re-address it and see what I can come up with.
It's fun trying to work out these things but a shame that our full time jobs get in the way..

Proxmark3 community

Announcement

#1 2017-06-30 13:01:30

Fermax EM fobs

#2 2017-06-30 13:04:28

Re: Fermax EM fobs

#3 2017-06-30 14:48:07

Re: Fermax EM fobs

#4 2017-10-22 11:29:37

Re: Fermax EM fobs

#5 2017-10-22 12:30:13

Re: Fermax EM fobs

#6 2017-10-25 00:24:49

Re: Fermax EM fobs

#7 2017-10-25 01:43:13

Re: Fermax EM fobs

#8 2017-10-25 11:21:07

Re: Fermax EM fobs

#9 2017-10-25 13:30:38

Re: Fermax EM fobs

Board footer