Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#151 2017-02-09 14:13:13

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Decode LF tag NORALSY (KCP3000)

Often the twn4 will output a translated output not a raw output.  But some information is often better than none.

Offline

#152 2017-04-04 13:05:24

Onisan
Contributor
From: London
Registered: 2016-07-18
Posts: 88

Re: Decode LF tag NORALSY (KCP3000)

Next time I copy a Noralsy tag I'll take the raw number from the tag and the hex data, the newer KP3000 Has a ten digit code on them the first three digits are the site code and then the next 7 are the incremental numbers.
my reader will give me 3 hex blocks of data, 8 hex chars in length each which should help.
It would be great if we had a way of getting the hex directly from the number.

Offline

#153 2017-04-04 14:53:28

ntk
Contributor
Registered: 2015-05-24
Posts: 701

Re: Decode LF tag NORALSY (KCP3000)

Hope it will help @Marshmellow. I have two NORALSYS traces with number on the back ( i kept together in the file name)

Last edited by ntk (2017-04-04 15:08:29)

Offline

#154 2017-04-04 16:38:25

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Decode LF tag NORALSY (KCP3000)

Share the noralsy tags w hex and printed numbers here?

Offline

#155 2017-04-07 16:47:39

Onisan
Contributor
From: London
Registered: 2016-07-18
Posts: 88

Re: Decode LF tag NORALSY (KCP3000)

I have a guy coming to see me to clone his Noralsy Tag next Friday.
It's a 10 digit one where the first three digits are the site code.

I will take a hex dump of the tag and will write down the number to share with you so you can test.
he has sent the number that was on the one he lost so hopefully the facility codes match then I can try to duplicate the actual lost one when I've checked the raw data of the one he is bringing.

Last edited by Onisan (2017-04-13 15:02:12)

Offline

#156 2017-04-14 12:08:32

Onisan
Contributor
From: London
Registered: 2016-07-18
Posts: 88

Re: Decode LF tag NORALSY (KCP3000)

OK I can now share the following
10 Digit KCP3000 decodes to the following

BB0314FF
78611000
55960000

786 is the site code as Per Noralsy Specs
1100055 is the Serial Number
9 is the XoR of Site code and Serial Number "7861100055" which is also printed on the tag

No idea what the 6 relates to (why did I get a 6 and all others had a 7?)
this customer had sequentially numbered tags so it was easy to test.

Last edited by Onisan (2017-04-14 12:15:39)

Offline

#157 2017-04-15 01:57:50

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Decode LF tag NORALSY (KCP3000)

look at page three in this thread,  I've written down what I know of the data mapping.
it indicates that your tag is a bit newer than I thought of this old system

Offline

#158 2018-02-15 15:56:57

martinlbb
Contributor
Registered: 2016-12-13
Posts: 7

Re: Decode LF tag NORALSY (KCP3000)

Hi there.

Another dump for finding the secret of KCP3000:

00088C6A bb0214ff 29797000 04670000

ID is 2970004.

Offline

#159 2018-02-15 16:25:43

martinlbb
Contributor
Registered: 2016-12-13
Posts: 7

Re: Decode LF tag NORALSY (KCP3000)

Hi there.

I think I got the final answer and the last byte!

Tag ID is 2970004
Raw tag is:
00088C6A bb0214ff 29797000 04670000

00088C6A is the specific T55 header for such tags
297 is the site code as Per Noralsy Specs
97000 004is the Serial Number
6 is the XoR of Site code and Serial Number "2979700004" which is also printed on the tag
7 is the Xor of the first block (BB214FF).

This match followings dumps:
00088C6A    BB0214FF    10298001    87C70000
00088C6A    BB0214FF    20000101    91A70000
00088C6A    BB0214FF    31801002    23870000
00088C6A    BB0214FF    53999000    03C70000
00088C6A    BB0214FF    31801002    23870000
00088C6A    BB0214FF    68102013    16870000
00088C6A    BB0214FF    64202001    57170000
00088C6A    BB0214FF    24205002    13170000
00088C6A    BB0214FF    39402007    54A70000
00088C6A    BB0314FF    85700001    52C60000
00088C6A    BB0314FF    25299001    16360000
00088C6A    BB0314FF    56897019    19560000
00088C6A    BB0314FF    31801004    82560000
00088C6A    BB0314FF    04099001    45460000
00088C6A    BB0314FF    78611000    55960000

Offline

#160 2018-02-15 16:26:45

martinlbb
Contributor
Registered: 2016-12-13
Posts: 7

Re: Decode LF tag NORALSY (KCP3000)

That the reason why the second number does not change so much.
It is either:
* 7 for BB214FF
* 6 for BB314FF

Offline

#161 2018-02-15 19:47:07

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Decode LF tag NORALSY (KCP3000)

thanks for the dump summary.
but your conclusions are the same as was found a while ago on page 3 of this thread:
http://www.proxmark.org/forum/viewtopic … 225#p25225

what we don't know is why BB02 sometimes is BB03, or what the 3 nibbles in the middle of the serial number represent (why they change)..

do the readers / access control software care about these nibbles?  (are there invalid values?)

Offline

#162 2018-02-15 20:10:29

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Decode LF tag NORALSY (KCP3000)

The BB2/BB3 is the one thing left unknown.

The other three nibbles, two of them are year, and the last one should be production quarter according to some product pdf I read.

Offline

#163 2018-02-19 12:12:01

martinlbb
Contributor
Registered: 2016-12-13
Posts: 7

Re: Decode LF tag NORALSY (KCP3000)

Oh sorry, you cleared the point for me.

About the mysterious BB2/BB3, I may change a BB2 in BB3 an test it over a reader. I'll let you know.

Offline

Board footer

Powered by FluxBB