Eurokey Tag

larson · 2019-03-24 13:27:01

Hi !

I'm trying to read Eurokey tag from comesterogroup, it seems to be a 125 khz transponder.

Any idea about command to begin, i can't find yet datasheet, don't know what is inside so.

Iso 14443 Type A ?

Thanks !

fazer · 2020-03-10 19:17:01

good evening Larson, I have this badge today at my washing station, actually lf search doesn't give me anything too. I did lf read, data save, data detect a, data raw am, data print x as Iceman explains in another post. I may have had some bits, otherwise I wanted to know if before I should not activate this badge before reading.
Good night.

Last edited by fazer (2020-03-10 19:30:12)

larson · 2020-03-11 09:28:48

Hi,
Mine is actived, with money on it, but no way to read it. Strange ..

fazer · 2020-03-11 10:25:29

Hello Larson, I work with a pm3 rdv4 I am attaching a reading this morning. I will wash my car this weekend to see if there is a difference after reading.
Have a good day.

"Created": "proxmark3",
"FileType": "hitag",
"Card": {
"UID": "C058XXXX"
},
"blocks": {
"0": "C058XXXX",
"1": "657F0000",
"2": "FFFFFFFF",
"3": "00000000",
"4": "F40BFD26",
"5": "3D560000",
"6": "00000000",
"7": "30000000",
"8": "F0FB3B66",
"9": "657F0000",
"10": "00000000",
"11": "00000000"
}
}
I tried with lf hitag better result.I masked UID.

Last edited by fazer (2020-03-11 10:35:44)

larson · 2020-03-11 11:05:04

I use pm3 too but not rdv4, old one .
Which firmware do you use ? I must try again with lf hitag if my pm3 want it.

fazer · 2020-03-11 12:22:25

Re Larson, I work with git clone https://github.com/RfidResearchGroup/proxmark3.git.
are you french?

Last edited by fazer (2020-03-11 12:23:13)

larson · 2020-03-11 20:46:44

Yes France !
For the lf, which command do you use ?
A simple lf search doesn’t work for me, no known tag ..

fazer · 2020-03-12 09:29:22

Hello Larson, the commands I use are lf conf L, lf read, lf hitag dump. What is crazy is that if I change lf config H, lf read, lf hitag dump I don't get the same UID? .
Have a good day.
Can you try if you have the same result.

fazer · 2020-03-12 09:43:21

Re, the problem is that I am all young with the proxmark3, there is so much to know in use with the pm3 that I lose my Latin. There are also scripts but it is necessary to know the utility in function of what we are looking for. Have a good day.

fazer · 2020-04-05 08:56:04

Hello Larson, do you have the same result with the command lf conf H & lf conf L because me uid changes according to the frequency.
Good confinement & good Sunday.

fazer · 2020-08-18 16:33:06

Hi Larson, so this key (eurokey) & an indala badge.
[usb] pm3 -> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags ...
[=]
[+] Indala - len 84, Raw: 80000000000001fefffffffefffffffaaaabfffffffff55557ffffff

[+] Valid Indala ID found!
In fact I put the key on the proxmark3, not good I present it at 2cm above the antenna best result. Here I am going to try to clone it with a badge (clone Indala tag to T55x7).
Good evening.

Rocket9 · 2020-12-16 13:53:18

Hello guys,
I'm a french guy too with this Eurokey badge and i am interested in your results. Did you managed to read it completely ? Is it indala or hitag ? I'll try myself but for the moment i need to update my proxmark. When doing lf search, and holding the key 2 cm above the antenna, i have "valid indala ID found !" but the ID is 0. If the tag is laid directly on the antenna, lf search return no result.

Rocket9 · 2020-12-18 14:36:38

Apparently there is two types of Eurokey : https://www.manualslib.com/manual/16239 … e=9#manual

One type is 125 khz and more recent ones are Mifare (see page 10 of the link above).

I still can't read my key with the proxmark after update. But no more false results saying it is Indala.

fazer · 2021-01-04 11:40:53

Hi Rocket9, many thanks for manual my key is eurokey not mifare.
[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 117) Raw: 80000000000000000000001555555555555500800000000000007fff

[+] Valid Indala ID found!

have a nice day.

Rocket9 · 2021-01-04 19:43:22

Hello fazer,

Thank you for your answer. I have the 125 khz version of the key like you. I still have nothing when doing lf search. I don't have a result saying it is indala. Which firmware are you using ?

fazer wrote:

"Created": "proxmark3",
"FileType": "hitag",
"Card": {
"UID": "C058XXXX"
},
"blocks": {
"0": "C058XXXX",
"1": "657F0000",
"2": "FFFFFFFF",
"3": "00000000",
"4": "F40BFD26",
"5": "3D560000",
"6": "00000000",
"7": "30000000",
"8": "F0FB3B66",
"9": "657F0000",
"10": "00000000",
"11": "00000000"
}
}
I tried with lf hitag better result.I masked UID.

How did you get these data ?

The more I look into this tag, and the more I think there is only an ID in it, no balance. The reader at the car wash reads the ID in the tag, asks for the balance in a computer somewhere in the station and that's all. Maybe I am wrong but I am sceptic that this tag holds more data.

fazer · 2021-01-05 12:32:33

Hello Rocket9, here is my last lf search the key is an indala. I have a rdv4 with the last update.

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 64) Raw: 8000000005555555
[+] Fmt 26 FC: 214 Card: 24869 checksum: 01
[+] Possible de-scramble patterns
[+] Printed | __0142__ [0x8E]
[+] Internal ID | 89478485
[+] Heden-2L | 6711

[+] Valid Indala ID found!

It is necessary to put the key on the antenna lf seeks the good position because very sensitive in reading, the data which I had put are not good because the key & an indala. not hitag
Have a good day.

Last edited by fazer (2021-01-05 12:34:15)

fazer · 2021-01-05 14:39:35

Re Rocket9, my firmware is the last today.
[ CLIENT ]
client: RRG/Iceman/master/v4.9237-2802-gc13ad9dcc-dirt...-unclean 2021-01-05 11:37:39
rfidresearchgroup/proxmark3/.
have a good day

fazer · 2021-01-06 12:16:59

Hello rocket9, I have removed the transponder from the key brand nxp pcf 7935aa, it gives a hitag2 pouff I can no longer understand anything with this transponder very sensitive to reading.
Have a good day.

Rocket9 · 2021-01-06 21:57:50

Hello fazer,
Thank you for destroying your key ^^ just to get the brand of the transponder. I will make research on that. I am using an old proxmark from 2014, basically just a circuit board and not your fancy rdv4 box but I hope fonctionalities are the same. Though I am not sure I can use the same repo as you, because I don't find the "client" folder in this repo and don't know how to launch the proxmark without that folder.
I found that there is a box called "lecteur de table" which is used to add credit on the eurokey ; this box doesn't need to be connected to some server or computer, so it means the key is effectively hosting a balance, contrarily to what I thought and wrote in a previous post.
Good evening mate.

Rocket9 · 2021-01-11 15:29:14

Hello guys,
I found out that this transponder (PCF7935AA) is often used in car keys as an anti-theft measure (it helps the car identifiying the key and authorizing starting or not). It is difficult to read with a flat antenna and even more difficult (or impossible) to write. It looks like the proxmark will not be the best tool to read and write this tag, unless you want to modify your antenna.
If you really want to read and write this tag, there's a tool called "zed bull" coming with a software, in order to duplicate a car key transponder in a blank PCF7935AA when you make a copy of your car key. Maybe it could help with our "eurokeys" but not sure. Maybe i will consider buying this tool if cheap, just for fun.
Have a good day.

fazer · 2021-01-17 17:18:50

Good evening Rocket9, thank you for the info yes I had seen that car manufacturers use this transponder, otherwise I will wait because the owner of the car wash changes badge he passes (mifare card) because the keys cost him too much. Thank you good night.

carpi · 2021-03-26 15:06:44

Sorry to bump this topic, but did you guys manage to read this tag with proxmark? Any progress?

fazer · 2021-04-02 14:58:14

Hello Carpi, for my part no news on this key, otherwise I know someone who bought "Zed Bull", he can read but not write.
Have a nice week end.

fazer · 2023-03-26 17:35:59

Hi Larson, I have some news on this post which dates from Eurokey, for my part I have made good progress & managed to release this 56-bit key for fun, I did not manage to write with the proxmark3, too bad but good. Well, I hope you have made more progress on this project as well.
Good evening.

Proxmark3 community

Announcement

#1 2019-03-24 13:27:01

Eurokey Tag

#2 2020-03-10 19:17:01

Re: Eurokey Tag

#3 2020-03-11 09:28:48

Re: Eurokey Tag

#4 2020-03-11 10:25:29

Re: Eurokey Tag

#5 2020-03-11 11:05:04

Re: Eurokey Tag

#6 2020-03-11 12:22:25

Re: Eurokey Tag

#7 2020-03-11 20:46:44

Re: Eurokey Tag

#8 2020-03-12 09:29:22

Re: Eurokey Tag

#9 2020-03-12 09:43:21

Re: Eurokey Tag

#10 2020-04-05 08:56:04

Re: Eurokey Tag

#11 2020-08-18 16:33:06

Re: Eurokey Tag

#12 2020-12-16 13:53:18

Re: Eurokey Tag

#13 2020-12-18 14:36:38

Re: Eurokey Tag

#14 2021-01-04 11:40:53

Re: Eurokey Tag

#15 2021-01-04 19:43:22

Re: Eurokey Tag

#16 2021-01-05 12:32:33

Re: Eurokey Tag

#17 2021-01-05 14:39:35

Re: Eurokey Tag

#18 2021-01-06 12:16:59

Re: Eurokey Tag

#19 2021-01-06 21:57:50

Re: Eurokey Tag

#20 2021-01-11 15:29:14

Re: Eurokey Tag

#21 2021-01-17 17:18:50

Re: Eurokey Tag

#22 2021-03-26 15:06:44

Re: Eurokey Tag

#23 2021-04-02 14:58:14

Re: Eurokey Tag

#24 2023-03-26 17:35:59

Re: Eurokey Tag

Board footer