SecuraKey Cards

atyppo · 2018-04-29 13:52:10

I have 60 SecuraKey RKCM-02 cards. There's ~50 with one FC, and another ~10 with a different FC. Can take PayPal or LTC. Shipped for free via Priority Mail. Make me an offer. Also willing to donate these if someone can get some research done on them in order to make them fully implemented in Proxmark's firmware.

Last edited by atyppo (2018-04-29 22:38:22)

iceman · 2018-05-03 07:16:33

Don't I need the cards itself, just trace dumps from them will do.

lf read
data save xxx.pm3

iceman · 2018-05-06 17:20:01

http://proxmark.org/forum/viewtopic.php?id=4683

How did you go at this? Since you are now selling your cards...

atyppo · 2018-05-08 07:23:21

iceman wrote:

Don't I need the cards itself, just trace dumps from them will do.
lf read
data save xxx.pm3

proxmark3> lf securakey read
#db# DownloadFPGA(len: 42096)          
Securakey Tag Found--BitLen: 26, Card ID: 33629, FC: 0xB, Raw: 7FCB4000005C0CBA0C180000          
Wiegand: 001706BA, Parity: Passed          
 
How the FC translates to printed FC is unknown          
How the checksum is calculated is unknown          
Help the community identify this format further
 by sharing your tag on the pm3 forum or with forum members          
proxmark3> lf securakey read
Securakey Tag Found--BitLen: 26, Card ID: 33850, FC: 0xB, Raw: 7FCB4000005C107430A80000          
Wiegand: 00170874, Parity: Passed          
 
How the FC translates to printed FC is unknown          
How the checksum is calculated is unknown          
Help the community identify this format further
 by sharing your tag on the pm3 forum or with forum members          
proxmark3> lf securakey read
Securakey Tag Found--BitLen: 26, Card ID: 57432, FC: 0xA, Raw: 7FCB4000105580B066A80000          
Wiegand: 0215C0B0, Parity: Passed          
 
How the FC translates to printed FC is unknown          
How the checksum is calculated is unknown          
Help the community identify this format further
 by sharing your tag on the pm3 forum or with forum members

33629 and 33850 are FC 11. 57432 is FC 10. I also have the RCKM cards with FC F3 if posting more traces of those would be helpful.

atyppo · 2018-05-09 05:46:04

iceman wrote:

http://proxmark.org/forum/viewtopic.php?id=4683
How did you go at this? Since you are now selling your cards...

And I wasn't able to end up getting them cloned unfortunately. Unless someone can now offer a solution.

marshmellow · 2018-05-09 17:08:03

when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?

iceman · 2018-05-09 17:25:47

I'm guessing but to me 0xB, 0xA would be FC 11, 10...

Securakey Tag Found--BitLen: 26, Card ID: 33850,   --> FC: 0xB, <-- Raw: 7FCB4000005C107430A80000          
Securakey Tag Found--BitLen: 26, Card ID: 57432,   --> FC: 0xA, <-- Raw: 7FCB4000105580B066A80000

marshmellow · 2018-05-09 17:30:36

yes but normally the external codes don't match the internal one. (At least on all previous samples) plus the external code historically is always hexadecimal.

iceman · 2018-05-09 17:42:57

yup, true, @atyppo has not posted any info on printed details. That would be nice to have a list of read data, tracesample file and printed information in a nice clean neat list. One could wish for less but why?

atyppo · 2018-05-10 00:31:50

marshmellow wrote:

when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?

It is what is read by a Linear AM-DPR card reader (manufacturered by SecuraKey I believe) using Linear AccessBase software. These are embedded tags in a gate opener.

atyppo · 2018-05-10 00:32:52

iceman wrote:

yup, true, @atyppo has not posted any info on printed details. That would be nice to have a list of read data, tracesample file and printed information in a nice clean neat list. One could wish for less but why?

If I knew how, I'd be happy to

marshmellow · 2018-05-10 05:30:20

atyppo wrote:

marshmellow wrote:
when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?
It is what is read by a Linear AM-DPR card reader (manufacturered by SecuraKey I believe) using Linear AccessBase software. These are embedded tags in a gate opener.

i assume you don't have these physical tags or don't know what was printed on them then?

i'm still not sure how the "Code" or Facility code printed on the card is related to the internal FC (if it is at all).

atyppo · 2018-05-10 06:55:58

marshmellow wrote:

atyppo wrote:
marshmellow wrote:
when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?
It is what is read by a Linear AM-DPR card reader (manufacturered by SecuraKey I believe) using Linear AccessBase software. These are embedded tags in a gate opener.
i assume you don't have these physical tags or don't know what was printed on them then?
i'm still not sure how the "Code" or Facility code printed on the card is related to the internal FC (if it is at all).

I have them in-hand

iceman · 2018-05-10 07:29:55

Its more a question of running the same commands over each cards, to gather the needed data and paste in the interesting data parts into a text file and putting the saved datatraces in a folder. No hi-tech.

lf securakey read
lf read

--replace UID with found fc/csn 
data save  UID.pm3

atyppo · 2018-05-10 08:19:18

iceman wrote:

Its more a question of running the same commands over each cards, to gather the needed data and paste in the interesting data parts into a text file and putting the saved datatraces in a folder. No hi-tech.
lf securakey read
lf read

--replace UID with found fc/csn 
data save  UID.pm3

Here's the traces: https://uploadfiles.io/wzul1 These tags are in Linear's ACT-31D transmitters.

I may be able to get access to another SecuraKey RCKM-02 tag with another facility code on it tomorrow. Also, I have several IDteck (Doorking branded) tags if any info from those would be of use.

iceman · 2018-05-10 09:05:32

Nice!

The general recommendation is to collect as much data you can. We never know when it might get in handy when trying to figure things out.

atyppo · 2018-05-10 09:51:08

iceman wrote:

Nice!
The general recommendation is to collect as much data you can. We never know when it might get in handy when trying to figure things out.

How many more samples would it take to get something implemented where tags can be written bassed on SN/FC?

atyppo · 2018-06-10 11:33:16

iceman wrote:

Nice!
The general recommendation is to collect as much data you can. We never know when it might get in handy when trying to figure things out.

What I meant by that post is how would I be able to write a given SN? FC isn't really needed as Linear's system doesn't check for FC unless it's been manually turned on.

atyppo · 2018-06-14 12:33:47

iceman wrote:

Nice!
The general recommendation is to collect as much data you can. We never know when it might get in handy when trying to figure things out.

Here's tag no. 13412 with FC A6. The FC is read as 006 when using the *82 function on the Doorking 1837 system it is attached to. Also, FC F3 shows up as 053 on this system. Given that current Proxmark firmware shows up with 0x35 as the FC, I believe the FC's digits need to be reversed? May be wrong on that. FC 10/11 still don't make sense. Perhaps I'll also take them to this system if I get a chance.

iceman · 2018-06-15 17:33:34

...0x35 is 53 in decimal...

atyppo · 2018-06-16 22:51:17

To me, it looks like it goes
A-00x
B-01x
C-02x
D-03x
E-04x
F-05x
...and so on with the number at the end of the FC listed by SecuraKey being the x in these numbers. I'll do my best to get what was read as FC 10 and 11 by a Linear reader to the Doorking reader ASAP and see what the output is on that. Is there any way to take, say card no. 42038 and FC 0xB, and copy it onto a T5577 card right now or do further samples need to be posted?

atyppo · 2018-08-11 11:40:34

I received several more Securakey tags today. SNs 25405 and 56496 are read as 0xD by the Proxmark and are read as 013 by a Doorking 1837 system with a Linear AM-PR reader attached (rebranded Securakey LF reader). SNs 28918 and 42571 are read as 0x6 by the Proxmark and as 006 by the Doorking system. SNs 21229 and 21512 are read as 0x7 by the Proxmark and are read as 007 by the Doorking system. Here's a link to the traces: https://ufile.io/u6p7q

Hopefully progress is finally getting close to being able to clone these? Any ETA on time to clone a specific SN w/o the card in-hand?

Proxmark3 community

Announcement

#1 2018-04-29 13:52:10

SecuraKey Cards

#2 2018-05-03 07:16:33

Re: SecuraKey Cards

#3 2018-05-06 17:20:01

Re: SecuraKey Cards

#4 2018-05-08 07:23:21

Re: SecuraKey Cards

#5 2018-05-09 05:46:04

Re: SecuraKey Cards

#6 2018-05-09 17:08:03

Re: SecuraKey Cards

#7 2018-05-09 17:25:47

Re: SecuraKey Cards

#8 2018-05-09 17:30:36

Re: SecuraKey Cards

#9 2018-05-09 17:42:57

Re: SecuraKey Cards

#10 2018-05-10 00:31:50

Re: SecuraKey Cards

#11 2018-05-10 00:32:52

Re: SecuraKey Cards

#12 2018-05-10 05:30:20

Re: SecuraKey Cards

#13 2018-05-10 06:55:58

Re: SecuraKey Cards

#14 2018-05-10 07:29:55

Re: SecuraKey Cards

#15 2018-05-10 08:19:18

Re: SecuraKey Cards

#16 2018-05-10 09:05:32

Re: SecuraKey Cards

#17 2018-05-10 09:51:08

Re: SecuraKey Cards

#18 2018-06-10 11:33:16

Re: SecuraKey Cards

#19 2018-06-14 12:33:47

Re: SecuraKey Cards

#20 2018-06-15 17:33:34

Re: SecuraKey Cards

#21 2018-06-16 22:51:17

Re: SecuraKey Cards

#22 2018-08-11 11:40:34

Re: SecuraKey Cards

Board footer