Proxmark3 community

Heru

Contributor

Registered: 2017-10-08

Posts: 78

[SOLVED] Emergency help needed

Hi guys,

Today I was trying to clone my friend's apartment keycard and accidentally overwrote it.

Now I need to fork out 150$ to get him a replacement card, it really sucks.  Hopefully, the building manager gives him a new card.

Firstly, I have latest Proxmark3 and full iceman 3.0.1 version flashed. ( kali linux) 

The card is just basic one ( picture attached) some HEX code on it. Its some kind of 125Khz card, Since it was easy overwritten, I doubt there is no password or security set.   It could be an Indala card, but I'm not 100% sure,

Here is the output I got

pm3 --> lf search u
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
          
Checking for known tags:
          
Valid Indala ID Found!          

Valid T55xx Chip Found
Try `lf t55xx` commands
          
pm3 --> lf t5 read
Reading Page 0:          
blk | hex data | binary                           | ascii          
----+----------+----------------------------------+-------          

pm3 --> lf t5 detect
Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'          

pm3 --> lf t5 config
Chip Type  : T55x7          
Modulation : ASK          
Bit Rate   : 0 - RF/8          
Inverted   : No          
Offset     : 0          
Seq. Term. : No          
Block0     : 0x00000000          
          
pm3 --> lf t5 
pm3 --> lf t5 info
pm3 --> lf t5 dump 
Reading Page 0:          
blk | hex data | binary                           | ascii          
----+----------+----------------------------------+-------          
Reading Page 1:          
blk | hex data | binary                           | ascii          
----+----------+----------------------------------+-------          
pm3 --> lf t5 info
pm3 --> lf indala read

So there is not much info, and here is where I got it wrong, stupid me

pm3 --> lf indala clone
Cloning 64bit tag with UID 000000000          
pm3 --> lf t5 info
          
-- T55x7 Configuration & Tag Information --------------------          
-------------------------------------------------------------          
 Safer key                 : 11          
 reserved                  : 87          
 Data bit rate             : 7 - RF/16          
 eXtended mode             : Yes - Warning          
 Modulation                : 0x1F (Unknown)          
 PSK clock frequency       : 3          
 AOR - Answer on Request   : Yes          
 OTP - One Time Pad        : Yes - Warning          
 Max block                 : 7          
 Password mode             : Yes          
 Sequence Start Terminator : Yes          
 Fast Write                : Yes          
 Inverse data              : Yes          
 POR-Delay                 : No          
-------------------------------------------------------------          
 Raw Data - Page 0          
     Block 0  : 0xBAFFFFFE  10111010111111111111111111111110          
-------------------------------------------------------------          

So i "clone" it with wrong command, phew, I knew immediately the card is overwritten, I just checked it on the spot, yep, no response from the reader.

Now moving forward:

- What kind of card could this be?
- Is there a way to revive the card?
- How am I suppose to read and clone the card?

Please, someone, help me as this is a big issue for me and thanks guys.

Last edited by Heru (2017-11-01 12:37:41)

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: [SOLVED] Emergency help needed

...not very much information to go on. Are you sure "your friends" apartment key was a t5557 tag?   You haven't gotten any information out of the card in your logs. 
Save a trace and upload here  (lf read, data save xxxxxx.pm3)

btw, your image doesn't show.

side note
always use lf t55 detect   before doing anything else with t55xx commands.

Heru

Contributor

Registered: 2017-10-08

Posts: 78

Re: [SOLVED] Emergency help needed

Hi, iceman,

Yes, I believe its a 125Khz card based on "lf search u"

Unfortunately, the other reader commands does not yield any info.

Also, I overwrote the card with "lf indala clone". The card is gone,. unfortunately.

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: [SOLVED] Emergency help needed

data plot,  lf read,   if there is a signal ,  save it..

Heru

Contributor

Registered: 2017-10-08

Posts: 78

Re: [SOLVED] Emergency help needed

Hi Iceman,

Thanks for your help. It happened to be a viking card. One gentleman a senior forum member got it right and I was able to restore the card with a single line command which is awesome,

Last edited by Heru (2017-11-02 13:00:33)

Dot.Com

Contributor

From: Hong Kong

Registered: 2016-10-05

Posts: 180

Website

Re: [SOLVED] Emergency help needed

There was no need to guess.

Urmet system which uses FDI technology when they bought them over.

France based and they are widely used in Aussie.