Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2021-10-21 16:06:25

Wolftech
Contributor
Registered: 2021-10-04
Posts: 3

The Zonsin ZX-300CD writer passwords

Running a brand new PM3 Easy w. release v4.14434 on macOS via Homebrew i started sniffing passwords set by some of my other writers.

First was the handheld Zonsin ZX-300CD "Invincible King" Ver: OB-03026-04-01-191106 that looks like this: https://www.google.com/search?q=Zonsin+ … D&tbm=isch

This particular unit uses static passwords instead of the calculated ones mentioned here: http://www.proxmark.org/forum/viewtopic.php?id=6482

---

For the T55xx it uses 19920427

For the EM4x05 it uses 84AC15E2

---

As it turns out, they are in fact the same as the passwords set by the unit mentioned here: http://www.proxmark.org/forum/viewtopic.php?id=8451

The Zonsin ZX-300CD also has the "scrambling bug" pertaining to the read back of the card numbers. Copying cards as well as entering card numbers manually when writing works as expected, however when reading back the card numbers this unit only uses 3 of the 4 bytes necessary to form the 10 digit decimal card number in the display: 12345678 (0xBC614E) will be presented as 0012345678 but 1234567890 (0x499602D2) will be presented as 0009831122 (0x9602D2).

Offline

Board footer

Powered by FluxBB