Skidata tickets (iso 15693)

buka · 2013-02-04 06:55:44

Hi all,

After reading the forum I haven't realized is it possible to hack skidata dual ticket (FlexSpace technology ISO 15693).

So my questions are:

1. Is it possible to read/copy skidata tickets to use on turnstils. And what reader/writer to use.
2. Will proxmark 3 be able to fully emulate/clone skidata keycard (with the card ID)

C0Y0-Ck3r · 2013-02-04 09:20:44

Hey, I'm too stuggling on the skidata card, if you want we can change infos about it !!

buka · 2013-02-05 09:54:18

So what I know, is
The card has unique ID which can't be copied (well can't be written actually). Only proxmark3 can emulate it.
The card works on ISO 15693 uses proprietary anti-clone technology (FlexSpace). 2 permits in Secure FlexSpace +704 bits unsecured FlexSpace;

The idea is to or make copies (clone) or an image of the card and then to restore it certain times. But as I found Omnikey cardman 5321 won't help in writing this image.
Another issue, are the turnstiles connected to database. According to the SkiData turnstiles can work online and offline (to count the number of visitors for example). In this case will the card which has became empty and restored give you permissions to enter turnstile (as it's already been marked as empty on DB if the system works online).

C0Y0-Ck3r · 2013-02-06 10:53:44

buka wrote:

So what I know, is
The card has unique ID which can't be copied (well can't be written actually). Only proxmark3 can emulate it.
The card works on ISO 15693 uses proprietary anti-clone technology (FlexSpace). 2 permits in Secure FlexSpace +704 bits unsecured FlexSpace;
The idea is to or make copies (clone) or an image of the card and then to restore it certain times. But as I found Omnikey cardman 5321 won't help in writing this image.
Another issue, are the turnstiles connected to database. According to the SkiData turnstiles can work online and offline (to count the number of visitors for example). In this case will the card which has became empty and restored give you permissions to enter turnstile (as it's already been marked as empty on DB if the system works online).

Ok, I see I was thinking too that probably it is linked to a database, so I don't think there is a way to bypass that unless the whole information is on the card.
That's a snapshot of 'hf 15 dumpmemory' command:
command snapshot
do you have the same thing here ?

vivat · 2013-02-06 14:57:26

Hi
ISO15693 tag simulator is not working because modulation is not implemented yet in FPGA. See
http://www.proxmark.org/forum/viewtopic.php?id=1164
At this moment your proxmark can only act like reader.
About Flexpass (Ukrainian language):
http://forum.bukovel.com/viewtopic.php?id=1994&p=45

asper · 2013-02-08 14:38:24

Those kind of tags usually use I-CODE tags (ISO15693) and the most recent uses 3DES encryption to store data (that are probably linked to a database); at each pass data usually doesn't change so all the info seems to be stored in the tag and probably can be cloned (maybe something can be encrypted using the tag-id to avoid "brute-cloning"); your example seems not to be encrypted, try to "decode" some data to obtain for example an expiry date

C0Y0-Ck3r · 2013-02-08 15:04:25

yeah but what to decode ? the some bytes I got here ?

MagMeister · 2013-02-08 15:47:43

I don't think the date (or any useful data) is stored on the card.

I think SKIDATA's system only uses the UID of the cards and checks this in their database if the card is valid.
SKIDATA uses cards from multiple manufacturers like NXP Semiconductors (I-Code SLI), EM Microelectronic-Marin SA, .... So the SKIDATA system should support all proprietary encryption options of every card type. I don't think this is the case.

I suppose that emulating a UID would do the job (emulating a UID that is considered valid in the database of SKIDATA for a specific period).
Like already mentioned, the threat is here: http://www.proxmark.org/forum/viewtopic.php?id=1164

asper · 2013-02-09 22:20:31

@C0Y0-Ck3r: yes I mean the bytes you see there.
If the ticket is disposable (you buy it, you use it and you trash it), as happens in other ski centers, I don't think it's UID-only based; something must be written and then read on the card, usually the same data that are showed in the card itself - it will be a database wasting collct lot of IDs that are trashed at the end of the service.
In my experience I saw i-code with encrypted data on it but the encryption is made by the turnstile not by the tag (that does not contain any encryption function); datasheet says it's 3des but it can be more difficult adding also an UID encryption; anyway it seems not be the C0Y0-Cker case.

C0Y0-Ck3r · 2013-02-09 23:47:20

Ok I see well asper, then I'll get another card to see the difference and let you know

gaucho · 2013-03-24 12:21:32

Hi everybody,
I find this thread very interesting. Could I have some updates about this? I have another rf-id reader (stronglink SL500F-USB) and skidata rf-id tags. But I could be interested in this Proxmark..

asper · 2013-03-24 12:30:35

SL500F is enough to read/write I-CODE tags (ISO15693), no need for PM3.

You can try this small software I made for SL500F to read/write I-CODE (.dlls included)

Last edited by asper (2013-03-24 12:32:47)

gaucho · 2013-03-24 13:13:13

dear Asper, could we speak in private, since this thread is related to proxmark and I don't wanto to go Offtopic? I would like to know what kind of experiments you did with SL500 and SKIDATA and what kind of experiments you made writing SKIDATA tag. Thank you. Gaucho

Last edited by gaucho (2013-04-25 20:07:47)

asper · 2013-03-24 13:26:09

No experiment; there is an algo behind the tag written data (the tag doesn't have security measures on it's own) so you must read different cards and try to find out what it is; I still doesn't manage to find the algo on the cards I found (I suppose it's 3DES but I am not sure).

gaucho · 2013-03-24 19:29:14

hi Asper,
thank you for your fast reply.
Ok, you wrote there is no security measure to avoid the reading of the data. On monday I'll try it by myself.
You wrote "at each pass data usually doesn't change so all the info seems to be stored in the tag". This means you did this test. ok. But: Don't you think that most likely the data doesn't change cause the relevant info is stored on the server database? Don't you think that most likely the tag is used just for identify the user?
I wish to know your experience and, I hope, add my contribute.

gaucho · 2013-03-24 19:38:04

Sorry Asper, when you wrote "at each pass data usually doesn't change so all the info seems to be stored in the tag", do you mean that you read the tag, then passed near the turnstile, then read again the tag?

asper · 2013-03-24 23:47:44

gaucho wrote:

Sorry Asper, when you wrote "at each pass data usually doesn't change so all the info seems to be stored in the tag", do you mean that you read the tag, then passed near the turnstile, then read again the tag?

Yes, this is what I mean; also data can be on the server side or where ever engineers decide to put them, we will never know that and there is no way to obtain this information unless you know someone "inside", speculation is not a thing I like to pursue... I also cannot ensure you that data are "fixed"... maybe they change after a turnstile pass, the only way to know is to test.

Last edited by asper (2013-03-24 23:49:22)

gaucho · 2013-03-25 19:20:20

asper wrote:

Yes, this is what I mean; also data can be on the server side or where ever engineers decide to put them, we will never know that and there is no way to obtain this information unless you know someone "inside", speculation is not a thing I like to pursue... I also cannot ensure you that data are "fixed"... maybe they change after a turnstile pass, the only way to know is to test.

Since i suppose you made many tests, I was only tring to understand if you successful found a working "method".

I want check if skipass with points (not the daily one) changes its data when you use points.
If it changes, data is stored on the key, and a recharge is possible.
Otherwise, if the tag is only a identifier on the database, we must suppose that each turnstyle is connected in a network and there is no possible attack. Cause they know when and where that tag was used last time and they make many filter rules to avoid the use of a cloned skipass.

Do you have, in your experience, some confirmation about this?

I think this discussion should be secured..

asper · 2013-03-25 19:51:57

There are changes from day to day so probably there will be changes from "points" to "less points" but the encryption scheme (proprietary and unknown) prevent you to tamper it. Tags ID can be cloned so a server-side security mechanism can be circumvented.

gaucho · 2013-03-25 20:01:42

em... no!. I think you can not elude the security mechanism if each data is on the server..
Let suppose you clone the tag X.
The original tag X passes on the turnstile A.
One second later the cloned tag X tries to pass on the turnstile B. The server-side security mechanism can block, with an alarm, the cloned tag X cause he know that you can not move in one second from point A to point B.
So why you speak about elusion?

I didn't understand if you abandoned this project cause you understood there is no solution or if you are still looking for a solution or if you found a solution but won't to share it.

Thank you for your contribute.
BR

Last edited by gaucho (2013-03-25 20:49:53)

gaucho · 2013-03-27 15:54:19

@Asper: I can read the tag using the default application supplied with the reader,selecting the tag type: SRF55V01P.
The content of the blocks is:
82 08 D3 DE
82 18 40 20
00 38 00 00
1C 48 33 00
1B 00 00 00
..the rest is filled with zeros..
I see that the default application can read but it can't write on the tag.
I even noted that on the application i can see:
UID: 6C4E1C06662416E0
DSFID: 02
AFI: 00

asper · 2013-03-27 18:19:40

It is for sure an ISO15693 tag produced by EM Microelectronic-Marin SA; maybe it is an EM4035 or EM4135.

Data seems not to be so "crypted", you need to see what changes after each session and you need to get another tag; you can try to read and write it with my software and also with original reader using I.CODE SLI; if you are not so this is a protected-password tag (ex. EM4133 but it should not be analyzing the UID) and SL500F cannot support it unless you use direct (passtrough) commands (not sure if it will work for that kind of tag).

Last edited by asper (2013-03-27 18:22:04)

gaucho · 2013-03-27 18:59:30

thank you Asper. Since i wish to rewrite the code for my program, it could be nice to see your code and to use part of it as a starting point.
I want to try to write the tag using your program. Today I downloaded it, Tomorrow I'll have a try.
Anyway, could you upload your project sources just to do mine faster?
Thank you even for the name of the tags, I'll take a look at the datasheets.

It seems we are in a big empty room.. I'm a little bit scared..
If some moderator reads this, could you please secure this discussion.. Like make it private for search engines. tks.

gaucho · 2013-03-28 08:47:56

Asper, I've seen the datasheets. How can you identify the producer and model of the tag? Have you read this? http://www.emmicroelectronic.com/webfiles/product/rfid/ds/EMDB410_FS.pdf
With it you can dechipher the 3DES cryptograpy, but I suppose that it will decrypt the reading of the data, not the data. I think that the data we are reading is crypted with a skidata custom algorithm. This should be the best solution.

gaucho · 2013-03-28 10:21:33

Dear comunity,
i read another tag, from a different site than the previous:
reading it with my reader (SRF55V01P mode) i get the following bytes:
41 4C 46 49
00 00 00 00
EA E4 D2 21
80 E4 52 57
00 00 00 00
01 00 6B 03
E3 7D 1E 57
94 E4 51 6A
68 F9 53 A7
FA E8 63 A6
6E 6D 18 A7
6E 6D D2 3A
6E 6D 52 A7
6E 6D 52 A7
6E 6D 52 A7
00 00 00 00
00 00 00 00
00 00 E7 FF

with asper tool i get the following bytes:
414C4649
00000000
EAE4D221
80E45257
00000000
01006B03
E37D1E57
94E4516A
68F953A7
FAE863A6
6E6D18A7
6E6DD23A
6E6D52A7
6E6D52A7
6E6D52A7
6E6D5242
00000000
0000E7FF
80E45257
80E453CA
6E6D52A7
6E6D52A7
6E6D52A7
6E6D5242
6E6D52A7
6E6D52A7
6E6D52A7
6E6D5242

why this difference?
..

Last edited by gaucho (2013-03-28 10:47:37)

asper · 2013-03-28 21:12:35

why this difference?

Because SRF55V01P is not I-CODE, different memory sizes (SRF55V01P is 576 bit only)
You have to identify your tag chip to know the exact size.

Asper, I've seen the datasheets. How can you identify the producer and model of the tag?

If you really read datasheets you will find the answer to the questions you made in really few minutes; you need to analyze UID.

With it you can dechipher the 3DES cryptograpy, but I suppose that it will decrypt the reading of the data, not the data. I think that the data we are reading is crypted with a skidata custom algorithm. This should be the best solution.

Speculations, can be correct 50% and incorrect 50%

Anyway, could you upload your project sources just to do mine faster?

No, I am sorry.

gaucho · 2013-03-29 15:29:52

No, I am sorry.

So I can not be sure of the quality of your code and of the output of your program.
I'll do it by my self and I'll let you know, but I'm a little bit surprised.

Because SRF55V01P is not I-CODE, different memory sizes (SRF55V01P is 576 bit only)
You have to identify your tag chip to know the exact size.

yes but did you see the different block content? There is not only a difference in the size, but even in the content of a block..

If you really read datasheets you will find the answer to the questions you made in really few minutes; you need to analyze UID

I found this datasheet for the first mentioned tag ( http://www.alldatasheet.com/datasheet-pdf/pdf/154634/EMMICRO/EM4035.html ) , but i can't find info about how to relate UID and producer, or about how to find the Producer starting from the UID. Could you point me to some documentation, just to better understand this point? As you can see I'm a beginner on rfid. I couldn't find any reference documentation about it on google. may be i used wrong keyworlds.

Last edited by gaucho (2013-03-29 15:41:21)

vivat · 2013-03-30 14:20:47

gaucho
Have you read the ISO 15693 part 3?

The UID comprises
· The 8 MSB bits shall be 'E0',
· The IC manufacturer code, on 8 bits according to ISO/IEC 7816-6/AM1,
· A unique serial number on 48 bits assigned by the IC manufacturer.

asper · 2013-03-30 14:30:28

... and usually, inside the 48bit serial, you can find the exact product code (it's an hex number but exact correspondance with real product/chip is not always public).

gaucho · 2013-03-30 18:38:13

thank you Vivat,
I found the standard on http://www.waazaa.org/download/fcd-15693-3.pdf

I suppose the tag is read by the reader starting from the LSB, so, this UID 6C4E1C06662416E0 i think is decoded this way:
E0 = every tag starts with it
16 = Electronic marine producer code (on http://en.wikipedia.org/wiki/ISO/IEC_15693 there is a manufacturers code table)
2466061c4e6c=serial number

this table compares EM tags: http://www.emmicroelectronic.com/webfiles/product/RFID/RFIDprodtab.pdf but i think these are only new models of tags, infact tags mentioned by asper are not present.
I couldn't find a way to understand the model from the serial number. I could try to make a filter on available models selecting those who have the same number of readable blocks..

gaucho · 2013-04-04 11:07:02

I made the Asper tool for stronklink SL500 by myself. If someone want source code (.net) just ask.
the button "read all" on Asper tool doesnt read all blocks in the tag maybe he use fixed size or there is an error.
About my previous post, where i wrote that i found differences in blocks content between default application supplied with the device and Asper tool, i can confirm that with my custom application I obtain the same blocks content as Asper tool.

Dear Asper i read the skidata tag UID 6C4E1C06662416E0 and i found that its size is 52 blocks (with get_system_information).
I found that, starting from block0, only blocks from 4 to 27 are writable.
This is the content:
8208D3DE
82184020
00380000
1C483300
1B000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
2A805342
1F905342
33000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
00000000
A40BA01A
C0051B01
000B2D87
8047000F
60A7DE2D
1C00E80C
00004014
00109427
00000000
00000000

Now, from size and write-protected blocks can you understand the model of this Electronic Marines tag?
Do we need to write protected blocks for our scope? If yes, how to do it? I can't find functions inside the DLL to do it..

p.s.:as you can see in the list, the only filled (not empty) block that it is not write-protected is the block 4 (1B000000) but i don't think this is a important information. It could be the number of times i used this tag. just a counter..

Last edited by gaucho (2013-04-04 15:33:48)

asper · 2013-04-04 17:55:42

Quoting directly form EM4133 datasheet (page 9):

64 bit UID is stored in EEPROM. EM IC manufacturer code is programmed with the 0x16 value.
48 bits of IC manufacturer serial number are composed of 1 bit capacitor value, 5 bit IC code
(different for each member of EM ISO 15693 family), 10 bit Customer Id and 32 bit unique serial number.
IC Id: “0x07” corresponds to EM4133.
CAP value bit:
? ’0’ corresponds to a Cres of 23.5pF
? ‘1’ corresponds to a Cres of 97pF

So you have to "decode" the "5 bits IC code" to determine the exact product code but EM is not giving this information out (no list available); you can find this "code" inside each full datasheet of a specific product but yours seems not to be one of the publicly available, maybe it is a really old one or a custom chip (EM makes custom chips). You can also find the customer ID in that way but you will obtain a hex number without a "real-life" correspondance. If you need you can also read the capacitor code but without the proper datasheet you will not be able to identify the capacitor value.

It will be useful to have a software that is able to decode an ISO15693 UID giving out manufacturer name and product name (or code id name is not available), if you want i can help you with this and also to have the correct size of a tag like in your case.

Sorry for me not giving the source code away but I really cannot because I use the code for work purposes; also my code is ONLY for I-CODE, not for EM tags, this is why the dump you obtain is not "full".

About your other questions I cannot answer because we do not know the exact chip inside the tag; probably there is a "lock block" or a "write password" (I think the latter) as in other EM products.

Last edited by asper (2013-04-04 18:08:17)

gaucho · 2013-04-05 07:30:33

Thank you for information Asper, I didn't read complete datasheet, may be i read only a brochure cause these info were not available on my pdf.
If we need to use a write password, may be we need to use "pass through" modality but up to now I never used this modality and, most important, we don't know the password, and I don't think a bruteforce is possible since the password length should be long enough.
Anyway, let's continue to study.. never say never..

vivat · 2013-04-05 14:35:53

Hey asper
Can you re-upload EM datasheets that you found again? The link you have posted don't work.

asper · 2013-04-05 15:23:12

Datasheets were available in the proxmark file section but they were removed for some reasons (copyright?); if I will find them and roel tell me I can post the link be sure that i will

gaucho · 2013-04-25 21:19:19

dear Vivat,buka and C0Y0-Ck3r,
during this month me and asper worked together on iso15693 tags related to this "project".
we even made a tool that we uploaded on this forum in a dedicated discussion.
I would like to ask you in private some details on performed tests and logs..or on the ability to perform more tests.
If I write my mail here, would you write to me an email?
Thanks.
Regards.

vivat · 2013-04-26 15:58:06

gaucho wrote:

dear Vivat,buka and C0Y0-Ck3r,
during this month me and asper worked together on iso15693 tags related to this "project".
we even made a tool that we uploaded on this forum in a dedicated discussion.
I would like to ask you in private some details on performed tests and logs..or on the ability to perform more tests.
If I write my mail here, would you write to me an email?
Thanks.
Regards.

Yes, of course

gaucho · 2013-04-27 09:58:56

On my profile now you can find my msn contact. You can use it on msn , skype and e-mail.
I'll reply with my tests and my questions.
Regards.

Last edited by gaucho (2013-04-27 11:41:39)

vivat · 2013-04-27 14:51:06

gaucho
Check your email

Last edited by vivat (2013-04-29 13:40:15)

app_o1 · 2013-10-02 09:08:48

You did not setup your email in your profile.
And I am guessing asking people to contact about "how to clone" stuff is not the good way to go.

Do you have any skidata cards ? You can share here the content of your card(s)
Also, read previous posts in this topic. Lots have been said already.

fgo · 2013-12-03 22:58:14

Hi there,
I would be happy to help in this task. I have many skidata skipass from different French ski resorts... how can I be of any help with that?

vivat · 2013-12-04 03:54:57

You can share dumps of your skipasses(with tag info)

asper · 2013-12-04 10:49:27

Yes, tag UID and full tag data content is need to identify it and to try to interpret data.

gaucho · 2013-12-04 19:25:53

i understood that the best effort is to introduce full tag emulation for these tags. this means to learn to program the fpga.
the first step is to clone one of these tags. later we can study deeper the algorithms.
Of course it's just a didactical matter. knowledge first of all..

fgo · 2013-12-04 22:55:58

Here are some dump. there's an error after reading some blocks. Can I do something to bypass it?

I added the characteristics written on the skipass itself

Espace Killy Adulte 09-apr-12 (1-day)

Reading memory from tag UID=E004020003AE8F11
Tag Info: Philips
Block 0 B9 08 24 56 ..$V
Block 1 02 1E E0 A0 ....
Block 2 1E 80 53 42 ..SB
Block 3 14 20 53 42 . SB
Block 4 0A 90 53 42 ..SB
Block 5 27 00 00 00 '...
Block 6 00 00 00 00 ....
Block 7 00 00 00 00 ....
Block 8 00 00 00 00 ....
Block 9 00 00 00 00 ....
Block 10 00 00 00 00 ....
Block 11 00 00 00 00 ....
Block 12 00 00 00 00 ....
Block 13 00 00 00 00 ....
Block 14 00 00 00 00 ....
Block 15 00 00 00 00 ....
Block 16 00 00 00 00 ....
Block 17 00 00 00 00 ....
Block 18 00 00 00 00 ....
Block 19 00 00 00 00 ....
Block 20 00 00 00 00 ....
Block 21 00 00 00 00 ....
Block 22 00 00 00 00 ....
Block 23 00 00 00 00 ....
Block 24 00 00 00 00 ....
Block 25 00 00 00 00 ....
Block 26 00 00 00 00 ....
Block 27 00 00 00 00 ....
Block 28 00 00 00 00 ....
Block 29 00 00 00 00 ....
Block 30 0A 0C 69 18 ..i.
Block 31 C0 05 1B 13 ....
Block 32 2C E2 C1 03 ,...
Block 33 6E E1 36 37 n.67
Block 34 90 A9 D2 89 ....
Block 35 00 00 48 04 ..H.
Block 36 00 80 66 00 ..f.
Block 37 00 10 2C 28 ..,(
Block 38 00 00 00 00 ....
Block 39 00 00 00 00 ....
Tag returned Error 15: Unknown error.

fgo · 2013-12-04 23:02:39

single travel ticket
keyticket light
evasion Montblanc

Reading memory from tag UID=E01624660A3A66D7
Tag Info: EM-Marin SA (Skidata)
Block 0 49 08 D1 BF I...
Block 1 82 18 22 00 ..".
Block 2 00 38 00 10 .8..
Block 3 1C 48 33 00 .H3.
Block 4 1B 00 00 00 ....
Block 5 00 00 00 00 ....
Block 6 00 00 00 00 ....
Block 7 00 00 00 00 ....
Block 8 00 00 00 00 ....
Block 9 00 00 00 00 ....
Block 10 00 00 00 00 ....
Block 11 00 00 00 00 ....
Block 12 00 00 00 00 ....
Block 13 00 00 00 00 ....
Block 14 00 00 00 00 ....
Block 15 00 00 00 00 ....
Block 16 00 00 00 00 ....
Block 17 00 00 00 00 ....
Block 18 00 00 00 00 ....
Block 19 00 00 00 00 ....
Block 20 00 00 00 00 ....
Block 21 00 00 00 00 ....
Block 22 00 00 00 00 ....
Block 23 00 00 00 00 ....
Block 24 00 00 00 00 ....
Block 25 00 00 00 00 ....
Block 26 00 00 00 00 ....
Block 27 00 00 00 00 ....
Block 28 2A 80 53 42 *.SB
Block 29 20 90 53 42 .SB
Block 30 33 00 00 00 3...
Block 31 00 00 00 00 ....
Block 32 00 00 00 00 ....
Block 33 00 00 00 00 ....
Block 34 00 00 00 00 ....
Block 35 00 00 00 00 ....
Block 36 00 00 00 00 ....
Block 37 00 00 00 00 ....
Block 38 00 00 00 00 ....
Block 39 00 00 00 00 ....
Block 40 00 00 00 00 ....
Block 41 00 00 00 00 ....
Block 42 D0 0A 7E 18 ..~.
Block 43 D0 05 1B 13 ....
Block 44 A8 B0 BA E2 ....
Block 45 8F B2 D5 20 ...
Block 46 80 E8 34 65 ..4e
Block 47 20 26 94 02 &..
Block 48 E9 07 00 00 ....
Block 49 00 00 00 00 ....
Block 50 00 00 00 00 ....
Block 51 00 00 00 00 ....
Tag returned Error 15: Unknown error.

fgo · 2013-12-04 23:04:58

tignes
adulte

Reading memory from tag UID=E004020003BC659E
Tag Info: Philips
Block 0 A0 08 00 14 ....
Block 1 82 1E E0 A0 ....
Block 2 1E 80 53 42 ..SB
Block 3 14 20 53 42 . SB
Block 4 0A 90 53 42 ..SB
Block 5 27 00 00 00 '...
Block 6 00 00 00 00 ....
Block 7 00 00 00 00 ....
Block 8 00 00 00 00 ....
Block 9 00 00 00 00 ....
Block 10 00 00 00 00 ....
Block 11 00 00 00 00 ....
Block 12 00 00 00 00 ....
Block 13 00 00 00 00 ....
Block 14 00 00 00 00 ....
Block 15 00 00 00 00 ....
Block 16 00 00 00 00 ....
Block 17 00 00 00 00 ....
Block 18 00 00 00 00 ....
Block 19 00 00 00 00 ....
Block 20 00 00 00 00 ....
Block 21 00 00 00 00 ....
Block 22 00 00 00 00 ....
Block 23 00 00 00 00 ....
Block 24 00 00 00 00 ....
Block 25 00 00 00 00 ....
Block 26 00 00 00 00 ....
Block 27 00 00 00 00 ....
Block 28 00 00 00 00 ....
Block 29 00 00 00 00 ....
Block 30 08 0C 7C 18 ..|.
Block 31 C0 05 1B 13 ....
Block 32 8A C8 51 10 ..Q.
Block 33 0F CE 34 D8 ..4.
Block 34 F0 32 21 89 .2!.
Block 35 00 00 E0 04 ....
Block 36 00 C0 1D 00 ....
Block 37 00 08 BC 14 ....
Block 38 00 00 00 00 ....
Block 39 00 00 00 00 ....
Tag returned Error 15: Unknown error.

fgo · 2013-12-04 23:06:08

another adulte
Tignes

Reading memory from tag UID=E004020003BC6694
Tag Info: Philips
Block 0 F1 08 AD 4D ...M
Block 1 82 1E E0 A0 ....
Block 2 1E 80 53 42 ..SB
Block 3 14 20 53 42 . SB
Block 4 0A 90 53 42 ..SB
Block 5 27 00 00 00 '...
Block 6 00 00 00 00 ....
Block 7 00 00 00 00 ....
Block 8 00 00 00 00 ....
Block 9 00 00 00 00 ....
Block 10 00 00 00 00 ....
Block 11 00 00 00 00 ....
Block 12 00 00 00 00 ....
Block 13 00 00 00 00 ....
Block 14 00 00 00 00 ....
Block 15 00 00 00 00 ....
Block 16 00 00 00 00 ....
Block 17 00 00 00 00 ....
Block 18 00 00 00 00 ....
Block 19 00 00 00 00 ....
Block 20 00 00 00 00 ....
Block 21 00 00 00 00 ....
Block 22 00 00 00 00 ....
Block 23 00 00 00 00 ....
Block 24 00 00 00 00 ....
Block 25 00 00 00 00 ....
Block 26 00 00 00 00 ....
Block 27 00 00 00 00 ....
Block 28 00 00 00 00 ....
Block 29 00 00 00 00 ....
Block 30 08 0C 7C 18 ..|.
Block 31 C0 05 1B 13 ....
Block 32 5E 8E 2A 8A ^.*.
Block 33 E3 91 17 6C ...l
Block 34 F0 77 BD D1 .w..
Block 35 00 00 E0 04 ....
Block 36 00 C0 1D 00 ....
Block 37 00 08 BC 14 ....
Block 38 00 00 00 00 ....
Block 39 00 00 00 00 ....
Tag returned Error 15: Unknown error.

fgo · 2013-12-04 23:09:59

Les contamines
Adultes O
Reading memory from tag UID=E016246608636358
Tag Info: EM-Marin SA (Skidata)
Block 0 5D 08 6D 57 ].mW
Block 1 42 18 60 20 B.`
Block 2 00 38 00 F0 .8..
Block 3 1C 48 33 00 .H3.
Block 4 1B 00 00 00 ....
Block 5 00 00 00 00 ....
Block 6 00 00 00 00 ....
Block 7 00 00 00 00 ....
Block 8 00 00 00 00 ....
Block 9 00 00 00 00 ....
Block 10 00 00 00 00 ....
Block 11 00 00 00 00 ....
Block 12 00 00 00 00 ....
Block 13 00 00 00 00 ....
Block 14 00 00 00 00 ....
Block 15 00 00 00 00 ....
Block 16 00 00 00 00 ....
Block 17 00 00 00 00 ....
Block 18 00 00 00 00 ....
Block 19 00 00 00 00 ....
Block 20 00 00 00 00 ....
Block 21 00 00 00 00 ....
Block 22 00 00 00 00 ....
Block 23 00 00 00 00 ....
Block 24 00 00 00 00 ....
Block 25 00 00 00 00 ....
Block 26 00 00 00 00 ....
Block 27 00 00 00 00 ....
Block 28 2A 80 53 42 *.SB
Block 29 20 90 53 42 .SB
Block 30 33 00 00 00 3...
Block 31 00 00 00 00 ....
Block 32 00 00 00 00 ....
Block 33 00 00 00 00 ....
Block 34 00 00 00 00 ....
Block 35 00 00 00 00 ....
Block 36 00 00 00 00 ....
Block 37 00 00 00 00 ....
Block 38 00 00 00 00 ....
Block 39 00 00 00 00 ....
Block 40 00 00 00 00 ....
Block 41 00 00 00 00 ....
Block 42 D0 0A C8 19 ....
Block 43 C0 05 1B 13 ....
Block 44 E4 AD 40 02 ..@.
Block 45 69 8F 97 A2 i...
Block 46 40 53 5A F5 @SZ.
Block 47 1A 00 00 00 ....
Block 48 00 00 80 3B ...;
Block 49 00 38 AC 27 .8.'
Block 50 00 00 00 00 ....
Block 51 00 00 00 00 ....
Tag returned Error 15: Unknown error.

fgo · 2013-12-04 23:11:41

Les contamines
kid 0

Reading memory from tag UID=E01624660857D214
Tag Info: EM-Marin SA (Skidata)
Block 0 77 08 F6 16 w...
Block 1 42 18 60 20 B.`
Block 2 00 38 00 80 .8..
Block 3 1C 48 33 00 .H3.
Block 4 1B 00 00 00 ....
Block 5 00 00 00 00 ....
Block 6 00 00 00 00 ....
Block 7 00 00 00 00 ....
Block 8 00 00 00 00 ....
Block 9 00 00 00 00 ....
Block 10 00 00 00 00 ....
Block 11 00 00 00 00 ....
Block 12 00 00 00 00 ....
Block 13 00 00 00 00 ....
Block 14 00 00 00 00 ....
Block 15 00 00 00 00 ....
Block 16 00 00 00 00 ....
Block 17 00 00 00 00 ....
Block 18 00 00 00 00 ....
Block 19 00 00 00 00 ....
Block 20 00 00 00 00 ....
Block 21 00 00 00 00 ....
Block 22 00 00 00 00 ....
Block 23 00 00 00 00 ....
Block 24 00 00 00 00 ....
Block 25 00 00 00 00 ....
Block 26 00 00 00 00 ....
Block 27 00 00 00 00 ....
Block 28 2A 80 53 42 *.SB
Block 29 20 90 53 42 .SB
Block 30 33 00 00 00 3...
Block 31 00 00 00 00 ....
Block 32 00 00 00 00 ....
Block 33 00 00 00 00 ....
Block 34 00 00 00 00 ....
Block 35 00 00 00 00 ....
Block 36 00 00 00 00 ....
Block 37 00 00 00 00 ....
Block 38 00 00 00 00 ....
Block 39 00 00 00 00 ....
Block 40 00 00 00 00 ....
Block 41 00 00 00 00 ....
Block 42 D0 0A C8 19 ....
Block 43 C0 05 1B 13 ....
Block 44 59 A3 D5 BA Y...
Block 45 7C F4 BA 8D |...
Block 46 50 D5 D4 C3 P...
Block 47 1A 00 00 00 ....
Block 48 00 00 80 3B ...;
Block 49 00 38 D0 24 .8.$
Block 50 00 00 00 00 ....
Block 51 00 00 00 00 ....
Tag returned Error 15: Unknown error.

Proxmark3 community

Announcement

#1 2013-02-04 06:55:44

Skidata tickets (iso 15693)

#2 2013-02-04 09:20:44

Re: Skidata tickets (iso 15693)

#3 2013-02-05 09:54:18

Re: Skidata tickets (iso 15693)

#4 2013-02-06 10:53:44

Re: Skidata tickets (iso 15693)

#5 2013-02-06 14:57:26

Re: Skidata tickets (iso 15693)

#6 2013-02-08 14:38:24

Re: Skidata tickets (iso 15693)

#7 2013-02-08 15:04:25

Re: Skidata tickets (iso 15693)

#8 2013-02-08 15:47:43

Re: Skidata tickets (iso 15693)

#9 2013-02-09 22:20:31

Re: Skidata tickets (iso 15693)

#10 2013-02-09 23:47:20

Re: Skidata tickets (iso 15693)

#11 2013-03-24 12:21:32

Re: Skidata tickets (iso 15693)

#12 2013-03-24 12:30:35

Re: Skidata tickets (iso 15693)

#13 2013-03-24 13:13:13

Re: Skidata tickets (iso 15693)

#14 2013-03-24 13:26:09

Re: Skidata tickets (iso 15693)

#15 2013-03-24 19:29:14

Re: Skidata tickets (iso 15693)

#16 2013-03-24 19:38:04

Re: Skidata tickets (iso 15693)

#17 2013-03-24 23:47:44

Re: Skidata tickets (iso 15693)

#18 2013-03-25 19:20:20

Re: Skidata tickets (iso 15693)

#19 2013-03-25 19:51:57

Re: Skidata tickets (iso 15693)

#20 2013-03-25 20:01:42

Re: Skidata tickets (iso 15693)

#21 2013-03-27 15:54:19

Re: Skidata tickets (iso 15693)

#22 2013-03-27 18:19:40

Re: Skidata tickets (iso 15693)

#23 2013-03-27 18:59:30

Re: Skidata tickets (iso 15693)

#24 2013-03-28 08:47:56

Re: Skidata tickets (iso 15693)

#25 2013-03-28 10:21:33

Re: Skidata tickets (iso 15693)

#26 2013-03-28 21:12:35

Re: Skidata tickets (iso 15693)

#27 2013-03-29 15:29:52

Re: Skidata tickets (iso 15693)

#28 2013-03-30 14:20:47

Re: Skidata tickets (iso 15693)

#29 2013-03-30 14:30:28

Re: Skidata tickets (iso 15693)

#30 2013-03-30 18:38:13

Re: Skidata tickets (iso 15693)

#31 2013-04-04 11:07:02

Re: Skidata tickets (iso 15693)

#32 2013-04-04 17:55:42

Re: Skidata tickets (iso 15693)

#33 2013-04-05 07:30:33

Re: Skidata tickets (iso 15693)

#34 2013-04-05 14:35:53

Re: Skidata tickets (iso 15693)

#35 2013-04-05 15:23:12

Re: Skidata tickets (iso 15693)

#36 2013-04-25 21:19:19

Re: Skidata tickets (iso 15693)

#37 2013-04-26 15:58:06

Re: Skidata tickets (iso 15693)

#38 2013-04-27 09:58:56

Re: Skidata tickets (iso 15693)

#39 2013-04-27 14:51:06

Re: Skidata tickets (iso 15693)