Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.

"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2019-01-18 16:00:53

Registered: 2018-02-07
Posts: 15

Skidoo / Seadoo (BRP) RF D.E.S.S Key

Looking at Bombardier's new RF "Digitally Encoded Security System" for Skidoo, Seadoo, ATV and other products.

LF @ 125kHz, seems to be Hitag2 but I can't confirm it. FCC docs are NDA and I can't physically break this key to read the board.

pm3 --> lf search u
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

[=] Signal looks just like noise. Looking for Hitag signal now.
Valid Hitag2 tag found - UID: 01080100

[+] Valid Hitag Found!

but I'm unable to get any more information out of it with the hitag subcommands.  Can anyone clarify what check_challenges does and WHERE does the output of reader 0* functions get saved to? It's not spit out to console.

Any help would be appreciated!


Board footer

Powered by FluxBB