[waste of time infos] Proxmark3 Can't read a bullet form fob

ntk · 2015-09-19 03:02:05

A few weeks ago a friend has loaned to me a little toys: a longly fob. Guaranteed working.

I found a lot of information about marketing, advertisement ... somewhere it states that PX work with a 26bit wiegand devices. but i could not get a product data sheet about frequency, modulation, etc

http://www.qsresolve.com/tube/lS4XJpdcZcw/a-detailed-guide-about-PX-net2-fobs-cards-and-tokens

Looking at the voltage drop it is 125KHz BUT trying to read with the proxmark3, it shows only noise!

Either our tool can not understand this paxton technology or it needs a wake up or something else. How can I construct the wake up call and send to the device

Someone has advised me "This is a HID" I look in HID sector I did not come further. There are
HID fsk demodulate
HID SIm
HID Clone
when I try to read there is only noise, I have tried with a distant reading, turned, angled the tag etc Nothing but noise. How can I demodulate, sim or clone if I can not read the fob?

If you have information how to work or have done worked with this type of fob with the proxmarks or with any other device please help me

Last edited by ntk (2016-08-08 08:37:13)

marshmellow · 2015-09-21 21:05:27

post a lf search - data plot

ntk · 2015-09-21 22:30:12

Thanks Marshmellow.

Here are the records.

proxmark3> hw version
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-07-11 19:20:06
os: /-suspect 2015-07-11 19:20:17
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/06/22 at 21:47:54
uC: AT91SAM7S512 Rev B
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 512K bytes. Used: 160828 bytes (31%). Free: 363460 bytes (69%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory

proxmark3> hw tune (Tune without a tag)
Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)
.....#db# DownloadFPGA(len: 42096)
.
# LF antenna: 13.47 V @ 125.00 kHz
# LF antenna: 28.88 V @ 134.00 kHz
# LF optimal: 28.88 V @ 133.33 kHz
# HF antenna: 0.67 V @ 13.56 MHz
# Your HF antenna is unusable.
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

proxmark3> hw tune (tune with the paxton tag)
Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)
....#db# DownloadFPGA(len: 42096)
.
# LF antenna: 13.47 V @ 125.00 kHz
# LF antenna: 27.50 V @ 134.00 kHz
# LF optimal: 27.50 V @ 133.33 kHz
# HF antenna: 0.64 V @ 13.56 MHz

proxmark3> lf search u
#db# DownloadFPGA(len: 42096)
Reading 30000 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
No Known Tags Found!
Checking for Unknown tags:
No Data Found!

marshmellow · 2015-09-21 22:31:47

Where is the plot?

marshmellow · 2015-09-21 22:37:03

The graph
data plot Cmd

ntk · 2015-09-21 22:38:50

lf read

then data samples 20000

then plot graph

Last edited by ntk (2016-08-08 08:01:15)

ntk · 2015-09-21 22:43:00

i forgot how to post an pm3 file. Do you need it Marshmellow?

here is pm3 file

http://pastebin.com/6LMyZZCH

Last edited by ntk (2015-09-21 22:52:27)

marshmellow · 2015-09-21 22:44:59

Whoa ugly.... Try a 134mhz read (use lf config) and post another plot

marshmellow · 2015-09-21 22:50:35

A trace file will only be useful if we can clean that up a bit.

marshmellow · 2015-09-21 22:54:27

And easiest way to post a trace is a file share and post a link. (Like pastebin, send space or other...)

ntk · 2015-09-21 23:03:26

this is after config ; read and sample

Last edited by ntk (2016-08-08 08:01:50)

marshmellow · 2015-09-21 23:05:04

How small is the fob. And how big is your antenna?

ntk · 2015-09-21 23:12:04

I am not sure. I just save the data perhaps we need it later.
PX_134_noise

Last edited by ntk (2016-08-08 08:02:10)

ntk · 2015-09-21 23:17:49

the fob is like a bullet or the end of a child little finger, it is 5cm long.

I use the standard LF antenna. But as I said I tried with rotation, with leaning angle; with distance reading 0.25cm, 0.5cm, 1cm all consistent behaviour. Only noise.

ntk · 2015-09-21 23:37:17

I found a send raw command, once I had conversation with Asper about its usage. Asper had pointed out for me that "send raw command" is useful if we have not got coding for a certain new device/tag; and had given me example on mifare trace.

I forgot to add at that time that there is a "send raw command" in LF sector too.

it that the bridge to convey the wake up call to this type of device? I read in the thread
http://www.proxmark.org/forum/viewtopic.php?id=251 adam@algroup.co.uk seemed to perform on hardware this wake up call in 2009 for hitag2 tag in the form
"locomread 80 100 200 11000 "
so sleeping gap 80
100 microsecs represent a 0
200 microsecs represent a 1
LF command 11000

I could not find any document describing LF command "11000" or "01010101"

Last edited by ntk (2015-09-21 23:54:15)

marshmellow · 2015-09-21 23:42:19

I don't think what you have is just noise. I think your antenna is too large and unfocused to read that small of a tag well. That or you have a lot of external interference. At least my thoughts. There is a post in lf antenna section about small antenna for a small tag.

ntk · 2015-09-22 02:23:28

I will look into 125KHz LF antenna, Marshmellow.

Could you tell me something regarding Adam reading there with the hitag2 tag, What do you think of it?

i could not find the meaning of lf command "11000" or "01010101" where are standards can we find information regardings those commands

ntk · 2015-09-23 04:17:18

edit because confusing not useful

Last edited by ntk (2016-07-30 02:21:55)

marshmellow · 2015-09-23 06:42:34

I have indications that one tag I have seen was a Paxton and it is actually a simple Manchester encoded lf tag. Not hitag. Now that doesn't mean there couldn't be a Paxton hitag implementation, but if your trace is more than noise as I suspect then it is not a hitag, as the hitag should wait to transmit until it is called...

marshmellow · 2015-09-23 06:44:35

If you think it is hitag try the hitag reader...
lf hitag reader

ntk · 2015-09-23 10:35:42

Thanks Marshmellow

Last edited by ntk (2016-07-30 02:23:03)

ntk · 2015-09-23 10:55:56

edit because confusing not useful

Last edited by ntk (2016-07-30 02:23:36)

marshmellow · 2015-09-23 13:42:13

That and http://www.proxmark.org/forum/viewtopic … 317#p11317 I've seen first hand the difference in reading small tags with large antennas vs small antennas and smaller gives better results. The smaller the tag the more it is affected.

marshmellow · 2015-09-23 15:06:52

my understanding of the hitag commands is they can be tested with no pwd and then do a lf hitag list to see if there were any tag responses. (probably have to run command wait a couple seconds and then hit the pm3 button to cancel the reader operation.)

also, in case you were wondering, the old lf raw command is now lf cmdread

Last edited by marshmellow (2015-09-23 15:08:16)

ntk · 2015-09-25 00:38:53

Thank you very much for your help and support, Marshmellow.
I did realise that command "lf cmdread" but saw nothing. Perhaps antenna problem.

I am going to make small antenna. When I succeed, I will report back.

ntk · 2015-09-28 00:20:08

sorry. still not succeed to get small 125 kHZ antenna working

edit: move message to 125 kHz antenna thread.

Last edited by ntk (2015-09-28 10:32:54)

iceman · 2015-09-28 04:28:15

Sounds like a very bad antenna. You should have from 20v up to 45v.
However that is not the subject for this thread. There is a lot of threads on how to build your antenna under the "125 khz Antenna" at main page. http://www.proxmark.org/forum/viewforum.php?id=11

ntk · 2015-09-28 10:31:56

sorry. still not succeed to get small 125 kHZ antenna working

ntk · 2015-10-04 06:00:00

Now I have a small antenna enamel copper 0.2mm;180 turns;diameter 2.75cm max;tag positioned 90degree to antenna surface or hold at distance 0,5cm lf search still find nothing.

proxmark3> hw version
Prox/RFID mark3 RFID instrument
bootrom: /-suspect 2015-07-11 19:20:06
os: /-suspect 2015-07-11 19:20:17
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/06/22 at 21:47:54
uC: AT91SAM7S512 Rev B
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 512K bytes. Used: 160828 bytes (31%). Free: 363460 bytes (69%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
proxmark3>

proxmark3> hw tune
Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)
....#db# DownloadFPGA(len: 42096)
.
# LF antenna: 30.39 V @ 125.00 kHz
# LF antenna: 47.71 V @ 134.00 kHz
# LF optimal: 47.71 V @ 129.03 kHz
# HF antenna: 0.07 V @ 13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
proxmark3> lf search u
Reading 30000 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible
Checking for known tags:
No Known Tags Found!
Checking for Unknown tags:
Possible Auto Correlation of 1 repeating samples
no data found, clk: 16, invert: 0, numbits: 1, errCnt: 0
No Data Found!

Last edited by ntk (2015-10-04 06:04:26)

ntk · 2015-10-04 06:14:40

I test with a different 125 kHz tag I know it is working.
lf search can find the tag
reading is ok
but a "hw tune" with and without this knowingly working tag shows hardly a voltage drop, les than 1V... Or I read wrong?

(The reading of "HW tune" with the paxton tag show less than .5V change at 125 kHz

pm3 file)

Also trying to wake with a send raw command "11000" doesn't shown useful reading

[== Undefined ==]
proxmark3> lf cmdread 80 100 100 11000
proxmark3> 
proxmark3> #db# Sampling config:                  
proxmark3> #db#   [q] divisor:           95                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> #db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
proxmark3> #db# buffer samples: 67 66 68 67 67 67 67 66 ...                 
proxmark3> lf cmdread 120 100 100 11000
proxmark3> 
proxmark3> #db# Sampling config:                  
proxmark3> #db#   [q] divisor:           95                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> #db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
proxmark3> #db# buffer samples: 66 65 65 66 66 66 66 67 ...                 
proxmark3> lf cmdread 120 100 200 11000
proxmark3> 
#db# Sampling config:                  
#db#   [q] divisor:           95                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> #db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
proxmark3> #db# buffer samples: 66 66 66 66 66 66 66 66 ...

Last edited by ntk (2016-08-08 08:04:37)

ntk · 2015-10-04 06:19:43

[== Undefined ==]
proxmark3> hw tune (((( without tag))))
Measuring antenna characteristics, please wait......#db# DownloadFPGA(len: 42096)                 
.          
# LF antenna: 30.11 V @   125.00 kHz          
# LF antenna: 47.71 V @   134.00 kHz          
# LF optimal: 47.71 V @   129.03 kHz          
# HF antenna: 17.90 V @    13.56 MHz          
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
proxmark3> 
proxmark3> hw tune (((( with tag))))
Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)                 
....#db# DownloadFPGA(len: 42096)                 
.          
# LF antenna: 29.01 V @   125.00 kHz          
# LF antenna: 47.71 V @   134.00 kHz          
# LF optimal: 47.71 V @   130.43 kHz          
# HF antenna: 17.87 V @    13.56 MHz          
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
proxmark3> 
proxmark3> hw tune (((( with tag))))

Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)                 
....#db# DownloadFPGA(len: 42096)                 
.          
# LF antenna: 29.15 V @   125.00 kHz          
# LF antenna: 47.71 V @   134.00 kHz          
# LF optimal: 47.71 V @   130.43 kHz          
# HF antenna: 17.87 V @    13.56 MHz          
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
proxmark3> 
proxmark3> hw tune  (((( with tag))))

Measuring antenna characteristics, please wait...#db# DownloadFPGA(len: 42096)                 
....#db# DownloadFPGA(len: 42096)                 
.          
# LF antenna: 29.01 V @   125.00 kHz          
# LF antenna: 47.71 V @   134.00 kHz          
# LF optimal: 47.71 V @   130.43 kHz          
# HF antenna: 17.87 V @    13.56 MHz          
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.
proxmark3> 
proxmark3> lf read H 
#db# Sampling config:                  
#db#   [q] divisor:           95                  
#db#   [b] bps:               8                  
#db#   [d] decimation:        1                  
#db#   [a] averaging:         1                  
#db#   [t] trigger threshold: 0                  
#db# DownloadFPGA(len: 42096)                 
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
#db# buffer samples: d2 ea fa ff ff f6 ea d8 ...                 
proxmark3> 
proxmark3> data samples 20000
Reading 20000 bytes from device memory
Data fetched          
Samples @ 8 bits/smpl, decimation 1:1           
proxmark3> 
proxmark3> lf search  u
Reading 30000 bytes from device memory
Data fetched          
Samples @ 8 bits/smpl, decimation 1:1           
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
Checking for known tags:
No Known Tags Found!
Checking for Unknown tags:
Possible Auto Correlation of 1 repeating samples          
Using Clock:16, invert:0, Bits Found:255          
PSK1 demoded bitstream:          
1110101010101010
1010101010101010
1010101010101010
1010101001010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
0101010101010101
010101010101010          
Possible unknown PSK1 Modulated Tag Found above!
Could also be PSK2 - try 'data rawdemod p2'          
Could also be PSK3 - [currently not supported]          
Could also be NRZ - try 'data nrzrawdemod          
proxmark3>

iceman · 2015-10-04 12:40:37

Your new antenna has great voltage

Have you tried running your command with the high (134khz) setting?

  lf cmdread 80 100 100 11000 h

or

lf config H 
lf search u

ntk · 2015-10-04 12:45:56

No, I haven't. Thank for the Ideas @iceman. I will try

ntk · 2015-10-04 13:24:45

Experment1: Do a lf config h; then try lf search u

[== Undefined ==]
proxmark3> lf config H b 8 d 1 a 1 t 0
proxmark3> 
proxmark3> #db# Sampling config:                  
proxmark3> #db#   [q] divisor:           88                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> lf search  u
#db# DownloadFPGA(len: 42096)                 
Reading 30000 bytes from device memory
Data fetched          
Samples @ 8 bits/smpl, decimation 1:1           
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
Checking for known tags:
No Known Tags Found!
Checking for Unknown tags:
Possible Auto Correlation of 1 repeating samples          
Too many errors found, clk: 16, invert: 0, numbits: 2543, errCnt: 668          
No Data Found!

Also continued experiment1 try to read without changing the hardware configuration: Graph is not better, amplitude still from -1 to 20; only moved the central point

[== Undefined ==]
proxmark3> lf read  
#db# Sampling config:                  
#db#   [q] divisor:           88                  
#db#   [b] bps:               8                  
#db#   [d] decimation:        1                  
#db#   [a] averaging:         1                  
#db#   [t] trigger threshold: 0                  
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
#db# buffer samples: 84 86 8d 84 86 8f 87 83 ...                 
proxmark3> 
proxmark3> data samples 20000
Reading 20000 bytes from device memory
Data fetched          
Samples @ 8 bits/smpl, decimation 1:1           
proxmark3> 
proxmark3> lf read H 
#db# Sampling config:                  
#db#   [q] divisor:           88                  
#db#   [b] bps:               8                  
#db#   [d] decimation:        1                  
#db#   [a] averaging:         1                  
#db#   [t] trigger threshold: 0                  
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
#db# buffer samples: 84 82 87 84 88 90 8d 86 ...                 
proxmark3>

ntk · 2015-10-04 14:11:40

experiment2:
lf cmdread 80 100 100 11000 h

[== Undefined ==]
proxmark3>  lf cmdread 80 100 100 11000 h
proxmark3> 
proxmark3> #db# Sampling config:                  
proxmark3> #db#   [q] divisor:           95                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> #db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
proxmark3> #db# buffer samples: 66 66 67 67 68 68 68 68 ...

send raw command seems to stick with divisor 95!!

test I do config H then send "lf cmdread 80 100 100 11000 h" or "lf cmdread 80 100 100 11000". result: Send raw command seems to stick with divisor 95!!

[== Undefined ==]
proxmark3> lf config H b 8 d 1 a 1 t 0
proxmark3> 
proxmark3> #db# Sampling config:                  
proxmark3> #db#   [q] divisor:           88                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> lf cmdread 80 100 100 11000
proxmark3> 
proxmark3> #db# Sampling config:                  
proxmark3> #db#   [q] divisor:           95                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> #db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
proxmark3> #db# buffer samples: 64 66 65 66 65 66 66 66 ...                 
proxmark3> lf cmdread 80 100 100 11000 h
proxmark3> 
proxmark3> #db# Sampling config:                  
proxmark3> #db#   [q] divisor:           95                  
proxmark3> #db#   [b] bps:               8                  
proxmark3> #db#   [d] decimation:        1                  
proxmark3> #db#   [a] averaging:         1                  
proxmark3> #db#   [t] trigger threshold: 0                  
proxmark3> #db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample                 
proxmark3> #db# buffer samples: 65 64 64 64 65 65 66 65 ...

Last edited by ntk (2015-10-04 14:12:27)

iceman · 2015-10-04 15:38:09

Yes, that is most likey a bug.

it looks like the "h" parameter is not properly set in the client, the "dummy" variable is empty..

[== C++ ==]
/* send a command before reading */
int CmdLFCommandRead(const char *Cmd)
{
  static char dummy[3];

  dummy[0]= ' ';

  UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
  sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char*)(&c.d.asBytes),(char*)(&dummy+1));
  // in case they specified 'h'
  strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
  
  PrintAndLog("ICE: %s -- %s",dummy, c.d.asBytes);
  SendCommand(&c);
  return 0;
}

ntk · 2015-10-04 22:39:03

Thank you Iceman for clarification the bug.

I am not a SW developer. Is this fault difficult to fix. Otherwise, could you pls raise the issue in Github so someone can fix it for all of us?

ntk · 2015-10-05 04:28:37

removed because comment confuses not useful

Last edited by ntk (2016-07-30 02:25:34)

kanalia · 2016-07-13 15:31:50

Hi ntk
Did you manage to read Paxton Net2 fob at the end?
regards

hexa3e8 · 2016-07-15 20:52:16

I also have a paxton tag, and it looks like this:
https://www.accesscards.co.uk/cards-tag … ty-10.html
It says that: the Net2 Proximity tokens are programmed with an 8 digit number and each token is ready for use.
Unfortunately I have no reader to test the paxton.

paxton
with lf config H and the lf search u I get a little result. (but I guess it is rubbish).

I am also curious to know if someone has managed to read this tag?

Last edited by hexa3e8 (2016-07-15 21:25:14)

ntk · 2016-07-16 00:56:13

there are at least two types available

One similar to EM41xx type.

The other is more common and mysterious. I guess yours is one of this sec type,. PM3 suggests as NZ or PKS2 type. Some say it needs special focus antenna to be able to work with then. Some other say it is not a normal 125K tag, but a Hitag or Hitagg2.

I had made no progress.

willpoeirl · 2016-07-16 13:46:35

ntk wrote:

Adam had thought paxton is hitag2 so I have tried the command "hitag reader" actually "Test recorded authentication" (or "lf hitag reader 25") with the result
proxmark3> lf hitag reader 25
#db# Starting Hitag reader family
#db# Testing 338 authentication attempts
#db# Configured for hitag2 reader
Waiting for a response from the proxmark...
Don't forget to cancel its operation first by pressing on the button
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# auth: 060000ea140000ea Failed, removed entry!
#db# Uknown frame length: 1
#db# frame received: 4541
#db# All done
proxmark3>
Does this make any sense? I don't know what else to try

You are doing it wrong. Please search the forum, you will find the answers.

@hexa3e8, that is def a HT2 tag. Please post the trace's file rather than what is inside the file. But yes, it is rubbish anyway. HT2 tags need a wake up call...

And stop relying on the search command....

Last edited by willpoeirl (2016-07-16 13:47:26)

ntk · 2016-07-27 09:23:30

willpoeirl wrote:

You are doing it wrong. Please search the forum, you will find the answers.
@hexa3e8, that is def a HT2 tag. Please post the trace's file rather than what is inside the file. But yes, it is rubbish anyway. HT2 tags need a wake up call...
....

I have searched up and down for solution since a year , but could not solve it. Perhaps I must have missed somewhat very obvious to others. Would you mind give a little more hint on this mystery. Thanks for your advise

Did you refer to this
"01001101010010010100101101010010"...

hexa3e8 · 2016-07-27 20:47:57

@ntk I think I can help you a little bit. I have tested my paxton tag with the following command and I get a better response now. well I saw some nice data plots but after trying several times I looks like it is asleep again. (the wake up call doesn't work anymore....)

pm3 --> lf cmdread d 80 z 100 o 200 c 11000 H

If I change the H at the end into a L I get a little different result.
maybe you have some more luck. I also will continue to try to get it red and cloned. but first a good wake up command.

ntk · 2016-07-28 00:50:15

thank you hexa3e8.

This raw command "11000" I have also tried long time ago. According to the HT2 protocol, after reader sendig "11000" START_AUTH tag should respond with with a start sequence (5 bits „1“) followed by their 32 bit ID number.

From that description I check lf hitag list afterwards I could not see this sequence. So somehow it does not work right.

On the otherhand, with reader which can read PX I receive "1F 8B 0F AF" or "11 1C C1 EE" from an other PX tag those are undoubtly the 32 bit serial numbers the protocol talks about.

So I performed snoop and hope something else we can see.

I have here some snoop traces I am not sure someone can make any sense of it

https://www.dropbox.com/s/286fth1rfmj5ha2/%21snoop-PX_8.txt?dl=0
https://www.dropbox.com/s/oau1vnsqoa5ou1o/%21snoop-PX_6.txt?dl=0
https://www.dropbox.com/s/6nlbv86ax80fqnu/%21snoop-PX_5.txt?dl=0
https://www.dropbox.com/s/slp0xmr11nbd9ua/%21snoop-PX_4.txt?dl=0
https://www.dropbox.com/s/64dcgqeuoxby02y/%21snoop-2.txt?dl=0
https://www.dropbox.com/s/zs203bdnc5xb39i/%21snoop-PX_1.txt?dl=0

FYI:
with the reader I have tried also to read EM tag. The result is the 07001D491A , and when inspect with PM3 I receive "EM TAG ID : 07001D491A". So the 8 bytes ID from reading a PX tag equally is the tag ID, the 32 bits serial number of the tag.

Last edited by ntk (2016-08-08 08:11:23)

ntk · 2016-07-28 03:12:49

The last post was the result of an idea I have recently I was not sure it could work. At this state I have to experiment around and round for not losing the battle without a fight ...

The snoop traces I have got by using lf snoop and the sandwich tag/PM2s antenna/legitimate reader.

Today using the same sandwich layout, I tried the command "lf hitag snoop" and then "lf hitag list out.ht2" the result is something very extraordinary: It reminds very much of the Mifare protocol... At 125 kHz!

E.g. with START_AUTH, then 40 for SELECT, then the TAG ID in revers ... I don't study much Mifare protocol but if you do, have a look in this trace out.ht2 there are much more information something is happening in there

That is no coincident, I have restarted PM3, run data buffclear ... Look at the result ... look at the lines
"
+ 111: 32: TAG ee! c1 1c 11!
+ 24684: 2: 40
"

Here,do recall that the Tag ID of this tag was: 11 1C C1 EE

What would you think ...

Edited: here is the full out.ht2 file

Last edited by ntk (2016-07-28 03:41:25)

marshmellow · 2016-07-28 03:59:30

AF 0F 8B 1F is in your trace paxton 1. tag response is ask/manchester rf/32 with a leading 11111
swap endians and you have 1F 8B 0F AF

Last edited by marshmellow (2016-07-28 04:24:41)

ntk · 2016-07-28 12:41:04

You means that snoop with the weird saw-alike graph. Looks very alien to me... Or is it normal for a snoop? (not possible to done much snoop until now)

I have tried to raw demod all types i did not give me anything meaningful, eg. "001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFF";
"001555555555555555555555555555555552AAAAAAAA";etc
Could you pls explain how could you see that data

Does that mean we step in the right direction and have made a small good progress?

Last edited by ntk (2016-07-28 13:02:18)

ntk · 2016-07-28 13:05:47

if someone could look at out.ht2 file and see it does have meanings, then I will sit down with the Hitag2 protocol and decode all information in that file seems to be quite some bits exchanges in there

another command in hitag sector is key authentication usign nr and ar (sound very much like Mifare classic crack) do you know anything about that. Should I try something in that direction or no need to as we pass that point already

iceman · 2016-07-28 16:20:02

@NTK, You need to ltrim and rtrim the parts in the snoop traces. So you have the "weaker" modulated signal only. The strong part is the reader signal.

Then I tried the "data askedgedetect" to make it clear, from there the "lf se 1 u" will find a hex.. adjust the binary pattern till you see the correct UID..

Proxmark3 community

Announcement

#1 2015-09-19 03:02:05

[waste of time infos] Proxmark3 Can't read a bullet form fob

#2 2015-09-21 21:05:27

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#3 2015-09-21 22:30:12

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#4 2015-09-21 22:31:47

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#5 2015-09-21 22:37:03

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#6 2015-09-21 22:38:50

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#7 2015-09-21 22:43:00

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#8 2015-09-21 22:44:59

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#9 2015-09-21 22:50:35

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#10 2015-09-21 22:54:27

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#11 2015-09-21 23:03:26

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#12 2015-09-21 23:05:04

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#13 2015-09-21 23:12:04

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#14 2015-09-21 23:17:49

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#15 2015-09-21 23:37:17

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#16 2015-09-21 23:42:19

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#17 2015-09-22 02:23:28

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#18 2015-09-23 04:17:18

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#19 2015-09-23 06:42:34

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#20 2015-09-23 06:44:35

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#21 2015-09-23 10:35:42

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#22 2015-09-23 10:55:56

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#23 2015-09-23 13:42:13

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#24 2015-09-23 15:06:52

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#25 2015-09-25 00:38:53

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#26 2015-09-28 00:20:08

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#27 2015-09-28 04:28:15

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#28 2015-09-28 10:31:56

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#29 2015-10-04 06:00:00

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#30 2015-10-04 06:14:40

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#31 2015-10-04 06:19:43

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#32 2015-10-04 12:40:37

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#33 2015-10-04 12:45:56

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#34 2015-10-04 13:24:45

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#35 2015-10-04 14:11:40

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#36 2015-10-04 15:38:09

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#37 2015-10-04 22:39:03

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#38 2015-10-05 04:28:37

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob

#39 2016-07-13 15:31:50

Re: [waste of time infos] Proxmark3 Can't read a bullet form fob