Proxmark3 community

victorhooi

Contributor

Registered: 2019-01-22

Posts: 9

Help cloning a HID Prox card - cloned card doesn't work?

Hi,

This is a follow-up to http://www.proxmark.org/forum/viewtopic.php?id=8128.

I have since updated to the latest Proxmark master, and updated all my firmware.

I have several cards which I assumed were HID Prox cards.

Here is the output of lf search on one of them:

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
[+] (wiegand unpack) unknown bit len 52
[=] raw: 09e000000018000910001050
[+] DemodBuffer: 1D96A9555555555555555695555555965655555556556655

[+] Valid HID Prox ID found!

Couldn't identify a chipset

Based on iceman's suggestions in the earlier thread, I was able to take a trace - here it is:

https://gist.github.com/fed396f591540505af10fbfa1b2ff6bd

I tried cloning this onto a T5577 card I had:

[usb] pm3 --> lf hid clone -r 8000910001050
[=] Preparing to clone HID tag using raw 8000910001050
[+] Done

Running a lf search on the T5577 card afterwards appears (at least to me) to yield the same data:

[usb] pm3 --> lf search

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
[+] (wiegand unpack) unknown bit len 51
[=] raw: 09e000000008000910001050
[+] DemodBuffer: 1D96A9555555555555555595555555965655555556556655

[+] Valid HID Prox ID found!

Couldn't identify a chipset

However, the actual card itself doesn't actually register correctly on the reader.

Does anybody have any idea what might be happening here?

Regards,
Victor

Last edited by victorhooi (2020-11-16 06:02:35)

mwalker

Moderator

Registered: 2019-05-11

Posts: 318

Re: Help cloning a HID Prox card - cloned card doesn't work?

just a very quick look, first tag showed 52 bits the 2nd 51 bits.
then align the two lf search results

[=] raw: 09e000000018000910001050	[+] DemodBuffer: 1D96A9555555555555555 6 95555555965655555556556655
[=] raw: 09e000000008000910001050	[+] DemodBuffer: 1D96A9555555555555555 5 95555555965655555556556655

6 v 5

So I tried  (included the leading "1")
lf hid clone -r 18000910001050
which seems to show the same lf search output as the original.