Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2018-04-29 13:52:10

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

SecuraKey Cards

I have 60 SecuraKey RKCM-02 cards. There's ~50 with one FC, and another ~10 with a different FC. Can take PayPal or LTC. Shipped for free via Priority Mail. Make me an offer. Also willing to donate these if someone can get some research done on them in order to make them fully implemented in Proxmark's firmware.

Last edited by atyppo (2018-04-29 22:38:22)

Offline

#2 2018-05-03 07:16:33

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: SecuraKey Cards

Don't I need the cards itself,   just trace dumps from them will do.

lf read
data save xxx.pm3

Offline

#3 2018-05-06 17:20:01

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: SecuraKey Cards

http://proxmark.org/forum/viewtopic.php?id=4683

How did you go at this? Since you are now selling your cards...

Offline

#4 2018-05-08 07:23:21

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

iceman wrote:

Don't I need the cards itself,   just trace dumps from them will do.

lf read
data save xxx.pm3
proxmark3> lf securakey read
#db# DownloadFPGA(len: 42096)          
Securakey Tag Found--BitLen: 26, Card ID: 33629, FC: 0xB, Raw: 7FCB4000005C0CBA0C180000          
Wiegand: 001706BA, Parity: Passed          
 
How the FC translates to printed FC is unknown          
How the checksum is calculated is unknown          
Help the community identify this format further
 by sharing your tag on the pm3 forum or with forum members          
proxmark3> lf securakey read
Securakey Tag Found--BitLen: 26, Card ID: 33850, FC: 0xB, Raw: 7FCB4000005C107430A80000          
Wiegand: 00170874, Parity: Passed          
 
How the FC translates to printed FC is unknown          
How the checksum is calculated is unknown          
Help the community identify this format further
 by sharing your tag on the pm3 forum or with forum members          
proxmark3> lf securakey read
Securakey Tag Found--BitLen: 26, Card ID: 57432, FC: 0xA, Raw: 7FCB4000105580B066A80000          
Wiegand: 0215C0B0, Parity: Passed          
 
How the FC translates to printed FC is unknown          
How the checksum is calculated is unknown          
Help the community identify this format further
 by sharing your tag on the pm3 forum or with forum members

33629 and 33850 are FC 11. 57432 is FC 10. I also have the RCKM cards with FC F3 if posting more traces of those would be helpful.

Offline

#5 2018-05-09 05:46:04

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

iceman wrote:

http://proxmark.org/forum/viewtopic.php?id=4683

How did you go at this? Since you are now selling your cards...

And I wasn't able to end up getting them cloned unfortunately. Unless someone can now offer a solution.

Offline

#6 2018-05-09 17:08:03

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: SecuraKey Cards

when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?

Offline

#7 2018-05-09 17:25:47

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: SecuraKey Cards

I'm guessing but to me 0xB, 0xA would be FC 11, 10...

Securakey Tag Found--BitLen: 26, Card ID: 33850,   --> FC: 0xB, <-- Raw: 7FCB4000005C107430A80000          
Securakey Tag Found--BitLen: 26, Card ID: 57432,   --> FC: 0xA, <-- Raw: 7FCB4000105580B066A80000

Offline

#8 2018-05-09 17:30:36

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: SecuraKey Cards

yes but normally the external codes don't match the internal one.  (At least on all previous samples)  plus the external code historically is always hexadecimal.

Offline

#9 2018-05-09 17:42:57

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: SecuraKey Cards

yup,  true,  @atyppo has not posted any info on printed details.  That would be nice to have a list of read data,  tracesample file and printed information in a nice clean neat list.   One could wish for less but why?

Offline

#10 2018-05-10 00:31:50

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

marshmellow wrote:

when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?

It is what is read by a Linear AM-DPR card reader (manufacturered by SecuraKey I believe) using Linear AccessBase software. These are embedded tags in a gate opener.

Offline

#11 2018-05-10 00:32:52

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

iceman wrote:

yup,  true,  @atyppo has not posted any info on printed details.  That would be nice to have a list of read data,  tracesample file and printed information in a nice clean neat list.   One could wish for less but why?

If I knew how, I'd be happy to

Offline

#12 2018-05-10 05:30:20

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: SecuraKey Cards

atyppo wrote:
marshmellow wrote:

when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?

It is what is read by a Linear AM-DPR card reader (manufacturered by SecuraKey I believe) using Linear AccessBase software. These are embedded tags in a gate opener.

i assume you don't have these physical tags or don't know what was printed on them then?

i'm still not sure how the "Code" or Facility code printed on the card is related to the internal FC (if it is at all).

Offline

#13 2018-05-10 06:55:58

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

marshmellow wrote:
atyppo wrote:
marshmellow wrote:

when you say FC is 11 and FC is 10, is that what is printed on the card or what is read by the access control system?

It is what is read by a Linear AM-DPR card reader (manufacturered by SecuraKey I believe) using Linear AccessBase software. These are embedded tags in a gate opener.

i assume you don't have these physical tags or don't know what was printed on them then?

i'm still not sure how the "Code" or Facility code printed on the card is related to the internal FC (if it is at all).

I have them in-hand

Offline

#14 2018-05-10 07:29:55

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: SecuraKey Cards

Its more a question of running the same commands over each cards,  to gather the needed data and paste in the interesting data parts into a text file and putting the saved datatraces in a folder.   No hi-tech.

lf securakey read
lf read

--replace UID with found fc/csn 
data save  UID.pm3

Offline

#15 2018-05-10 08:19:18

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

iceman wrote:

Its more a question of running the same commands over each cards,  to gather the needed data and paste in the interesting data parts into a text file and putting the saved datatraces in a folder.   No hi-tech.

lf securakey read
lf read

--replace UID with found fc/csn 
data save  UID.pm3

Here's the traces: https://uploadfiles.io/wzul1 These tags are in Linear's ACT-31D transmitters.

I may be able to get access to another SecuraKey RCKM-02 tag with another facility code on it tomorrow. Also, I have several IDteck (Doorking branded) tags if any info from those would be of use.

Offline

#16 2018-05-10 09:05:32

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: SecuraKey Cards

Nice!

The general recommendation is to collect as much data you can.  We never know when it might get in handy when trying to figure things out.

Offline

#17 2018-05-10 09:51:08

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

iceman wrote:

Nice!

The general recommendation is to collect as much data you can.  We never know when it might get in handy when trying to figure things out.

How many more samples would it take to get something implemented where tags can be written bassed on SN/FC?

Offline

#18 2018-06-10 11:33:16

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

iceman wrote:

Nice!

The general recommendation is to collect as much data you can.  We never know when it might get in handy when trying to figure things out.

What I meant by that post is how would I be able to write a given SN? FC isn't really needed as Linear's system doesn't check for FC unless it's been manually turned on.

Offline

#19 2018-06-14 12:33:47

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

iceman wrote:

Nice!

The general recommendation is to collect as much data you can.  We never know when it might get in handy when trying to figure things out.

Here's tag no. 13412 with FC A6.  The FC is read as 006 when using the *82 function on the Doorking 1837 system it is attached to. Also, FC F3 shows up as 053 on this system. Given that current Proxmark firmware shows up with 0x35 as the FC, I believe the FC's digits need to be reversed? May be wrong on that. FC 10/11 still don't make sense. Perhaps I'll also take them to this system if I get a chance.

Offline

#20 2018-06-15 17:33:34

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: SecuraKey Cards

...0x35 is 53 in decimal...

Offline

#21 2018-06-16 22:51:17

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

To me, it looks like it goes
A-00x
B-01x
C-02x
D-03x
E-04x
F-05x
...and so on with the number at the end of the FC listed by SecuraKey being the x in these numbers. I'll do my best to get what was read as FC 10 and 11 by a Linear reader to the Doorking reader ASAP and see what the output is on that. Is there any way to take, say card no. 42038 and FC 0xB, and copy it onto a T5577 card right now or do further samples need to be posted?

Offline

#22 2018-08-11 11:40:34

atyppo
Contributor
Registered: 2017-03-12
Posts: 36

Re: SecuraKey Cards

I received several more Securakey tags today. SNs 25405 and 56496 are read as 0xD by the Proxmark and are read as 013 by a Doorking 1837 system with a Linear AM-PR reader attached (rebranded Securakey LF reader). SNs 28918 and 42571 are read as 0x6 by the Proxmark and as 006 by the Doorking system. SNs 21229 and 21512 are read as 0x7 by the Proxmark and are read as 007 by the Doorking system. Here's a link to the traces: https://ufile.io/u6p7q

Hopefully progress is finally getting close to being able to clone these? Any ETA on time to clone a specific SN w/o the card in-hand?

Offline

Board footer

Powered by FluxBB