proxmark3> lf viking clone 06033ED5
Cloning - ID: 06033ED5, Raw: F2000000033ED5B4
proxmark3>
My tag
Checking for known tags:
Viking Tag Found: Card ID 05032B18, Checksum: 6F
Raw: F2000005032B186F
Valid Viking ID Found!
Using Clock:32, Invert:0, Bits Found:513
ASK/Manchester - Clock: 32 - Decoded bitstream:
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
1000110000110111
1111100100000000
0000000000000010
1000000110010101
Tried cloning and proxmark hang and if u notice the RAW is wrong as well during cloning..
converting binary 00100000000000000000000001010000001100101011000110000110 to hex is 2000005032B186 but proxmark show 2000000032B186.
proxmark3> lf viking clone 05032B18
Cloning - ID: 05032B18, Raw: F2000000032B186F
#db# unknown command:: 0x0223
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button
so if there is a software log of your card read in the access control system, and if it tells you the FC and Card# we might be able to figure out how the reader interprets the rawID.
or you could "listen" to the reader output and see what it "says" when a card is presented. (but that may be a little more difficult and require re-wiring)
]]>do you also have access to a reader / software?
Hey Marshmellow.
Any updates on this, and any hints on what the Block 0 of the T55x7 should be set to for a viking emulation?
Thanks!
]]>I've also got multiple proxmarks, so in theory could sniff the communication between a simulated card if necessary.
Access to the reader is a bit of a pain (~1 hour drive from here) - but I'll be happy to try whatever you need.
Thanks
]]>do you also have access to a reader / software?
Hey marshmellow.
I've got my PM3 running the latest commit from GH (so w. your viking mods)
I've also got a viking tag here, engraved with the ID: 070AAF4A
When I run lf search, I get:
proxmark3> lf search
Reading 30000 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
Viking Tag Found: Card ID 070AAF4A, Checksum: B2
Raw: F20000070AAF4AB2
Valid Viking ID Found!
When I attempt to clone it to a T5577 card:
proxmark3> lf viking clone 070AAF4A
proxmark3> lf search
Reading 30000 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
No Known Tags Found!
Is there prep that I have to do to the card before it accepts the card? (I've tried with multiple cards)
I am available to do whatever tests you may need
]]>the brivo calc will expect there to be the standard wiegand parities, and there aren't any in the raw data. if the reader outputs wiegand, then it generates the parities and tacks them onto "some" of the data read from the card.
but since 8 raw hex digits seem to be printed on the tags (32 bits) i'm not sure how a reader would split that raw data or why the raw data is printed instead of the 26 bit card id or facility code...
if someone has a reader and could share a printed id and what the id the reader sends/saves in the access control software we could put this to rest.
I have my hands on a viking tag, with number engraved. What tests can I do for you ?
]]>but since 8 raw hex digits seem to be printed on the tags (32 bits) i'm not sure how a reader would split that raw data or why the raw data is printed instead of the 26 bit card id or facility code...
if someone has a reader and could share a printed id and what the id the reader sends/saves in the access control software we could put this to rest.
]]>lf viking clone 00001cdd9bf20000
Running the latest demod from @Marshmellow, gives..
pm3 --> lf se
Reading 30000 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
Reading 30000 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
Viking Tag Found: Card ID 00001CDD, Checksum: 9B
Raw: F2000000001CDD9B
Valid Viking ID Found!
So the xorchecksum seems to be correct and the preamble seems to be correct.
But running cardid in the brivo calculator doesn't quite seem right.
FacilityCode and Internal Cardnumber would be nice to have for the clone command.
ref thread, http://www.proxmark.org/forum/viewtopic … 778#p18778
Using: 1CDD9BF2
Internal Card # 52729
Facility Code # 110
lf read
data samples 40000
data rawdemod am
data printdemodbuffer x