Proxmark developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.

"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2017-12-03 22:41:36

Registered: 2015-10-10
Posts: 19

Stanley PAC 125 kHZ / KeyPAC + Readykey 153 kHZ

Attempting to duplicate a new type of fob we ran into in the wild.
According to google searches the fob operates on two frequencies leading me to believe two rfid chips or coils.

I did search PAC on these forums and read through the " KeyFOB at 153mHz" post with Asper and Marshmallow.

Any education, insight on this system is greatly appreciated.
I will edit in some of the data sheet pdfs when I get home.

Here is a photo of the proximity fob.

Here are the traces from the pm3

-I tuned my radio.
hw tune

-I took four traces.
lf read
data samples 20000 - [PAC1]

data samples 20000 - [PAC2]

data samples 20000 - [PAC3]

data samples 16000 - [PAC16]

edit1: added images
edit2: make links clickable

Last edited by lockakey (2017-12-03 22:42:42)

" There is an unarguable downside to unbreakable encryption " - Michael Hayden


#2 2017-12-04 10:10:00

From: London
Registered: 2016-07-18
Posts: 62

Re: Stanley PAC 125 kHZ / KeyPAC + Readykey 153 kHZ

That's a standard Stanley Pac fob, it's one of the most popular fobs on the market,
It doesn't run at 153Mhz but at 134Mhz 64RF ASK but can be copied with a 125Mhz Coil and can be copied to a standard 5577 tag.

You should get back 4 Blocks of 8 Hex characters with the first block (most of the time) coming in as FFC81264

Hardware: Proxmark,  Elatec TWN4 dev kit / ACS ACR122U / IDTronic LF Reader / OmniKey 5321 / HT108 RW / Custom Read Write 125khz RW and a couple of other RW bits.


#3 2017-12-04 13:48:51

From: US
Registered: 2013-06-10
Posts: 2,100

Re: Stanley PAC 125 kHZ / KeyPAC + Readykey 153 kHZ

There are two varieties of PAC fobs.  One runs at 153khz and the other at 125khz.  There is no substitute for the 153 version at this time.  But as was mentioned the 125khz version can be cloned.

I have not had time to pull up the traces to id yours.


Board footer

Powered by FluxBB