Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2019-03-24 13:27:01

larson
Contributor
Registered: 2017-10-23
Posts: 27

Eurokey Tag

Hi !

I'm trying to read Eurokey tag from comesterogroup, it seems to be a 125 khz transponder.

Any idea about command to begin, i can't find yet datasheet, don't know what is inside so.

Iso 14443 Type A ?

Thanks !

Offline

#2 2020-03-10 19:17:01

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

good evening Larson, I have this badge today at my washing station, actually lf search doesn't give me anything too. I did lf read, data save, data detect a, data raw am, data print x as Iceman explains in another post. I may have had some bits, otherwise I wanted to know if before I should not activate this badge before reading.
Good night.

Last edited by fazer (2020-03-10 19:30:12)

Offline

#3 2020-03-11 09:28:48

larson
Contributor
Registered: 2017-10-23
Posts: 27

Re: Eurokey Tag

Hi,
Mine is actived, with money on it, but no way to read it. Strange ..

Offline

#4 2020-03-11 10:25:29

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Hello Larson, I work with a pm3 rdv4 I am attaching a reading this morning. I will wash my car this weekend to see if there is a difference after reading.
Have a good day.


  "Created": "proxmark3",
  "FileType": "hitag",
  "Card": {
    "UID": "C058XXXX"
  },
  "blocks": {
    "0": "C058XXXX",
    "1": "657F0000",
    "2": "FFFFFFFF",
    "3": "00000000",
    "4": "F40BFD26",
    "5": "3D560000",
    "6": "00000000",
    "7": "30000000",
    "8": "F0FB3B66",
    "9": "657F0000",
    "10": "00000000",
    "11": "00000000"
  }
}
I tried with lf hitag better result.I masked UID.

Last edited by fazer (2020-03-11 10:35:44)

Offline

#5 2020-03-11 11:05:04

larson
Contributor
Registered: 2017-10-23
Posts: 27

Re: Eurokey Tag

I use pm3 too but not rdv4, old one .
Which firmware do you use ?  I must try again with lf hitag if my pm3 want it.

Offline

#6 2020-03-11 12:22:25

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Re Larson, I work with git clone https://github.com/RfidResearchGroup/proxmark3.git.
are you french?

Last edited by fazer (2020-03-11 12:23:13)

Offline

#7 2020-03-11 20:46:44

larson
Contributor
Registered: 2017-10-23
Posts: 27

Re: Eurokey Tag

Yes France !
For the lf, which command do you use ?
A simple lf search doesn’t work for me, no known tag ..

Offline

#8 2020-03-12 09:29:22

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Hello Larson, the commands I use are lf conf L, lf read, lf hitag dump. What is crazy is that if I change lf config H, lf read, lf hitag dump I don't get the same UID? .
Have a good day.
Can you try if you have the same result.

Offline

#9 2020-03-12 09:43:21

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Re, the problem is that I am all young with the proxmark3, there is so much to know in use with the pm3 that I lose my Latin. There are also scripts but it is necessary to know the utility in function of what we are looking for. Have a good day.

Offline

#10 2020-04-05 08:56:04

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Hello Larson, do you have the same result with the command lf conf H & lf conf L because me uid changes according to the frequency.
Good confinement & good Sunday.

Offline

#11 2020-08-18 16:33:06

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Hi Larson, so this key (eurokey) & an indala badge.
[usb] pm3 -> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags ...
[=]
[+] Indala - len 84, Raw: 80000000000001fefffffffefffffffaaaabfffffffff55557ffffff

[+] Valid Indala ID found!
In fact I put the key on the proxmark3, not good I present it at 2cm above the antenna best result. Here I am going to try to clone it with a badge (clone Indala tag to T55x7).
Good evening.

Offline

#12 2020-12-16 13:53:18

Rocket9
Contributor
Registered: 2014-02-13
Posts: 9

Re: Eurokey Tag

Hello guys,
I'm a french guy too with this Eurokey badge and i am interested in your results. Did you managed to read it completely ? Is it indala or hitag ? I'll try myself but for the moment i need to update my proxmark. When doing lf search, and holding the key 2 cm above the antenna, i have "valid indala ID found !" but the ID is 0. If the tag is laid directly on the antenna, lf search return no result.

Offline

#13 2020-12-18 14:36:38

Rocket9
Contributor
Registered: 2014-02-13
Posts: 9

Re: Eurokey Tag

Apparently there is two types of Eurokey : https://www.manualslib.com/manual/16239 … e=9#manual

One type is 125 khz and more recent ones are Mifare (see page 10 of the link above).

I still can't read my key with the proxmark after update. But no more false results saying it is Indala.

Offline

#14 2021-01-04 11:40:53

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Hi Rocket9, many thanks for manual my key is eurokey not mifare.
[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 117)  Raw: 80000000000000000000001555555555555500800000000000007fff

[+] Valid Indala ID found!

have a nice day.

Offline

#15 2021-01-04 19:43:22

Rocket9
Contributor
Registered: 2014-02-13
Posts: 9

Re: Eurokey Tag

Hello fazer,

Thank you for your answer. I have the 125 khz version of the key like you. I still have nothing when doing lf search. I don't have a result saying it is indala. Which firmware are you using ?

fazer wrote:

  "Created": "proxmark3",
  "FileType": "hitag",
  "Card": {
    "UID": "C058XXXX"
  },
  "blocks": {
    "0": "C058XXXX",
    "1": "657F0000",
    "2": "FFFFFFFF",
    "3": "00000000",
    "4": "F40BFD26",
    "5": "3D560000",
    "6": "00000000",
    "7": "30000000",
    "8": "F0FB3B66",
    "9": "657F0000",
    "10": "00000000",
    "11": "00000000"
  }
}
I tried with lf hitag better result.I masked UID.

How did you get these data ?

The more I look into this tag, and the more I think there is only an ID in it, no balance. The reader at the car wash reads the ID in the tag, asks for the balance in a computer somewhere in the station and that's all. Maybe I am wrong but I am sceptic that this tag holds more data.

Offline

#16 2021-01-05 12:32:33

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Hello Rocket9, here is my last lf search the key is an indala. I have a rdv4 with the last update.

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 64)  Raw: 8000000005555555
[+] Fmt 26 FC: 214 Card: 24869 checksum: 01
[+] Possible de-scramble patterns
[+]     Printed     | __0142__ [0x8E]
[+]     Internal ID | 89478485
[+]     Heden-2L    | 6711

[+] Valid Indala ID found!

It is necessary to put the key on the antenna lf seeks the good position because very sensitive in reading, the data which I had put are not good because the key & an indala. not hitag
Have a good day.

Last edited by fazer (2021-01-05 12:34:15)

Offline

#17 2021-01-05 14:39:35

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Re Rocket9, my firmware is the last today.
[ CLIENT ]
  client: RRG/Iceman/master/v4.9237-2802-gc13ad9dcc-dirt...-unclean 2021-01-05 11:37:39
rfidresearchgroup/proxmark3/.
have a good day

Offline

#18 2021-01-06 12:16:59

fazer
Contributor
Registered: 2019-03-02
Posts: 78

Re: Eurokey Tag

Hello rocket9, I have removed the transponder from the key brand nxp pcf 7935aa, it gives a hitag2 pouff I can no longer understand anything with this transponder very sensitive to reading.
Have a good day.

Offline

#19 2021-01-06 21:57:50

Rocket9
Contributor
Registered: 2014-02-13
Posts: 9

Re: Eurokey Tag

Hello fazer,
Thank you for destroying your key ^^ just to get the brand of the transponder. I will make research on that. I am using an old proxmark from 2014, basically just a circuit board and not your fancy rdv4 box but I hope fonctionalities are the same. Though I am not sure I can use the same repo as you, because I don't find the "client" folder in this repo and don't know how to launch the proxmark without that folder.
I found that there is a box called "lecteur de table" which is used to add credit on the eurokey ; this box doesn't need to be connected to some server or computer, so it means the key is effectively hosting a balance, contrarily to what I thought and wrote in a previous post.
Good evening mate.

Offline

#20 2021-01-11 15:29:14

Rocket9
Contributor
Registered: 2014-02-13
Posts: 9

Re: Eurokey Tag

Hello guys,
I found out that this transponder (PCF7935AA) is often used in car keys as an anti-theft measure (it helps the car identifiying the key and authorizing starting or not). It is difficult to read with a flat antenna and even more difficult (or impossible) to write. It looks like the proxmark will not be the best tool to read and write this tag, unless you want to modify your antenna.
If you really want to read and write this tag, there's a tool called "zed bull" coming with a software, in order to duplicate a car key transponder in a blank PCF7935AA when you make a copy of your car key. Maybe it could help with our "eurokeys" but not sure. Maybe i will consider buying this tool if cheap, just for fun.
Have a good day.

Offline

Board footer

Powered by FluxBB