Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
You are not logged in.
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
Pages: 1
#1 2018-10-31 18:34:38
- burma
- Contributor
- Registered: 2018-07-28
- Posts: 13
Unknown LF (Farpointe)
Hi,
I'm trying to read a LF tag labeled 2329 1540, that presumably should be Pyramid, but I can't get any meaningful readings. Any ideas on how can it be approached?
Thank you!
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
[+] LF antenna: 33.71 V - 125.00 kHz
[+] LF antenna: 28.18 V - 134.00 kHz
[+] LF optimal: 33.71 V - 125.00 kHz
[+] LF antenna is OK
[+] HF antenna: 31.36 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
pm3 --> hw tune
[=] measuring antenna characteristics, please wait...
[+] LF antenna: 15.30 V - 125.00 kHz
[+] LF antenna: 18.27 V - 134.00 kHz
[+] LF optimal: 23.23 V - 151.90 kHz
[+] LF antenna is OK
[+] HF antenna: 31.03 V - 13.56 MHz
[+] HF antenna is OK
[+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
pm3 --> lf search u
#db# [q] divisor.............88 (134 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
[-] No known 125/134 KHz tags Found!
[=] Checking for Unknown tags:
[-] no repeating pattern found
[=] Possible Auto Correlation of 25600 repeating samples
[=] Possible 3200 bytes
[-] No Data Found!
pm3 --> lf config L
#db# LF Sampling config
pm3 --> lf read
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 47 2d 16 02 1d 54 4a 31 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 54 4a 31 0a 69 4a 30 19 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> lf search 1 u
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
[-] No known 125/134 KHz tags Found!
[=] Checking for Unknown tags:
[-] no repeating pattern found
ASK/Manchester - Clock: 8 - Decoded bitstream:
0101001010000000
0101001010010000
0000000000101101
0000000000111111
1111011110000110
1111111111111011
1111111111111111
1111111111111111
1111111111111001
1010000000000000
0000000000000000
0000000000000000
1010000000000000
0000000000000000
0000000000000000
0101001000000000
0000000000000000
0000000000000000
0000101101000000
0101111111111111
1111111111111111
1111100110100000
0000000000000000
0000000000000000
0000000010100000
0000000000000000
0000000000000000
0000000001010010
0000000000000000
0000000000000000
00
Unknown ASK Modulated and Manchester encoded Tag Found!
if it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 45 2b 06 64 47 2d 16 02 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 55 4a 30 0a 68 4b 30 19 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 4a 30 0a 68 4a 30 19 04 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 54 4a 30 0a 68 4b 30 19 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 1e 55 4a 30 0a 68 4a 30 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 1e 55 49 30 0a 68 4a 30 ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> data plot
pm3 --> data plot
pm3 --> lf read
#db# LF Sampling config
#db# [q] divisor.............95 (125 KHz)
#db# bps.................8
#db# [d] decimation..........1
#db# [a] averaging...........Yes
#db# [t] trigger threshold...0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 2c 06 65 47 2d 16 02 1d ...
Reading 39999 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
pm3 --> data plot
pm3 --> data save m4
saved to 'm4'
Last edited by burma (2018-10-31 18:39:32)
Offline
#2 2018-11-01 05:45:08
- yukihama
- Contributor
- Registered: 2018-05-13
- Posts: 133
Re: Unknown LF (Farpointe)
I have same problem but dont know how to tell from the saved pm3 file
Offline
#3 2018-11-01 22:28:29
- burma
- Contributor
- Registered: 2018-07-28
- Posts: 13
Re: Unknown LF (Farpointe)
You have the same regular blank card?
I'm also not sure about the output of hw tune when the tag is on it ([+] LF optimal: 23.23 V - 151.90 kHz). Could it be that the tag is actually 150 kHz and all I see is an unrecognizable image of a signal picked up at lower frequencies
Offline
#4 2018-11-14 16:24:11
- duckwc
- Contributor
- Registered: 2018-10-12
- Posts: 8
Re: Unknown LF (Farpointe)
I looked at your trace a bit and cleaned it up.
Basically it looks like the only thing your tag is doing is repeating a sequence of something that looks like an ID separated by ticks
the ID:
the ID and the ticks:
the complete sequence delimited by the bars in the second picture is repeated over time
the ID I'm able to get is something like 59FF677793 or could also be A60098886C by flipping the bits
Offline
Pages: 1