Proxmark3 community

kingdiablo2001

Contributor

Registered: 2021-02-12

Posts: 6

Create new card with same information Rfid T5577

Hi, i have same card with different number,
this card have unique number

i have proxmark3 and i receive No Known Tags Found! with command lf search

I need to create other card with different number, but all number of original card is hidden, also i have ts5577 card blank

I need help to find information of original card and for create new card with different number

proxmark3> lf search u
NOTE: some demods output possible binary
  if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

No Known Tags Found!

Checking for Unknown tags:

Possible Auto Correlation of 7296 repeating samples

Found Sequence Terminator - First one is shown by orange and blue graph markers

Using Clock:32, Invert:0, Bits Found:513
ASK/Manchester - Clock: 32 - Decoded bitstream:
0100001100000000
0000000000000000
0110101111111111
1111111111111111
1111111111111111
1111111111111111
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0100001100000000
0000000000000000
0100001100000000
0000000000000000
0110101111111111
1111111111111111
1111111111111111
1111111111111111
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0100001100000000
0000000000000000
0100001100000000
0000000000000000
0110101111111111
1111111111111111

Unknown ASK Modulated and Manchester encoded Tag Found!

if it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'

Valid T55xx Chip Found
Try lf t55xx ... commands

proxmark3> lf t55xx detect
Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'

proxmark3> lf t55xx read
Reading Page 0:
blk | hex data | binary
----+----------+---------------------------------

proxmark3> lf read 10000
#db# LF Sampling config:
#db#   [q] divisor:           95
#db#    bps:               8
#db#   [d] decimation:        1
#db#   [a] averaging:         1
#db#   [t] trigger threshold: 0
#db# Done, saved 40000 out of 40000 seen samples at 8 bits/sample
#db# buffer samples: 96 b9 cf db e2 e8 e8 e5 ...
Reading 39999 bytes from device memory

Data fetched
Samples @ 8 bits/smpl, decimation 1:1
proxmark3>

proxmark3> data detectclock a
Auto-detected clock rate: 32, Best Starting Position: 4
proxmark3>
proxmark3> data rawdemod am 32

Using Clock:32, Invert:0, Bits Found:1250
# Errors during Demoding (shown as 7 in bit stream): 12
ASK/Manchester - Clock: 32 - Decoded bitstream:
0000000000010000
1100000000000000
0000000000171701
0000110000000000
0000000000000001
1010111111111111
1111111111111111
1111111111111111
1111111111111100
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000001
0000110000000000
0000000000000017
1701000011000000
0000000000000000
0001101011111111
1111111111111111
1111111111111111
1111111111111111
1100000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0001000011000000
0000000000000000
0017170100001100

kingdiablo2001

Contributor

Registered: 2021-02-12

Posts: 6

Re: Create new card with same information Rfid T5577

Can i clone this card?
Thanks

kingdiablo2001

Contributor

Registered: 2021-02-12

Posts: 6

Re: Create new card with same information Rfid T5577

can sameone help me? i can pay for your attention, i am about 2 day with this tag and i can be crazy

thanks of all

kingdiablo2001

Contributor

Registered: 2021-02-12

Posts: 6

Re: Create new card with same information Rfid T5577

i have read more of 200 post, but i not find a solution for this tag.
i am try to undestand the best way and i want learn this word
how i can try to solve this big problem?
thanks

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: Create new card with same information Rfid T5577

Hi kingdiablo2001!
pls, save a trace  *.pm3

BeStPRoGiE

Contributor

Registered: 2023-05-27

Posts: 2

Re: Create new card with same information Rfid T5577

i too was having problems with false ids and unknown tags.
The card i was trying to crack/duplicate was for a beline hotel lock.
i kept getting that it was an indala tag. i would get this fake tag depending on how i placed the card on the pm3.
When it comes up as unknown tag i would type

lf t55xx detect --all

the result would be...

[=]  Chip type......... T55x7
[=]  Modulation........ ASK
[=]  Bit rate.......... 5 - RF/64
[=]  Inverted.......... No
[=]  Offset............ 33
[=]  Seq. terminator... Yes
[=]  Block0............ 001480C0 (auto detect)
[=]  Downlink mode..... default/fixed bit length
[=]  Password set...... No

afterwards i would type

lf t55xx dump -f room21

result is....

[+] Page 0
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 001480C0 | 00000000000101001000000011000000 | ....
[+]  01 | A2F9C019 | 10100010111110011100000000011001 | ....
[+]  02 | 3A6F633D | 00111010011011110110001100111101 | :oc=
[+]  03 | 3B02493E | 00111011000000100100100100111110 | ;.I>
[+]  04 | FF7D493E | 11111111011111010100100100111110 | .}I>
[+]  05 | 3F3E3D2A | 00111111001111100011110100101010 | ?>=*
[+]  06 | 3FA37B2D | 00111111101000110111101100101101 | ?.{-
[+]  07 | FFFFFFFF | 11111111111111111111111111111111 | ....

[+] Page 1
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 001480C0 | 00000000000101001000000011000000 | ....
[+]  01 | E0150158 | 11100000000101010000000101011000 | ...X
[+]  02 | 319495C7 | 00110001100101001001010111000111 | 1...
[+]  03 | 00A00003 | 00000000101000000000000000000011 | ....
[+] saved to json file C:\Users\d8orelli\Downloads\proxmark3\client\/room21.json
[+] saved 12 blocks to text file C:\Users\d8orelli\Downloads\proxmark3\client\/room21.eml
[+] saved 48 bytes to binary file C:\Users\d8orelli\Downloads\proxmark3\client\/room21.bin

Not knowing how to write a tag (because none was given)

i ended up copying the whole card block by block.

[usb] pm3 --> lf t55xx write --blk 0 -d 001480c0
[=] Writing page 0  block: 00  data: 0x001480C0

then

lf t55xx write --blk 1 -d A2F9C019

result....

[=] Writing page 0  block: 01  data: 0xA2F9C019

etc....etc...etc...

and wala! it worked!!

This of course is a pain in the ass doing it block by block.

i eventually discovered that after you do
lf t55xx detect --all
lf t55xx dump -f room21

result is

Page 0
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 001480C0 | 00000000000101001000000011000000 | ....
[+]  01 | A2F9C019 | 10100010111110011100000000011001 | ....
[+]  02 | 3A6F633D | 00111010011011110110001100111101 | :oc=
[+]  03 | 3B02493E | 00111011000000100100100100111110 | ;.I>
[+]  04 | FF7D493E | 11111111011111010100100100111110 | .}I>
[+]  05 | 3F3E3D2A | 00111111001111100011110100101010 | ?>=*
[+]  06 | 3FA37B2D | 00111111101000110111101100101101 | ?.{-
[+]  07 | FFFFFFFF | 11111111111111111111111111111111 | ....

[+] Page 1
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  00 | 001480C0 | 00000000000101001000000011000000 | ....
[+]  01 | E0150158 | 11100000000101010000000101011000 | ...X
[+]  02 | 319495C7 | 00110001100101001001010111000111 | 1...
[+]  03 | 00A00003 | 00000000101000000000000000000011 | ....
[+] saved to json file C:\Users\d8orelli\Downloads\proxmark3\client\/room21.json
[+] saved 12 blocks to text file C:\Users\d8orelli\Downloads\proxmark3\client\/room21.eml
[+] saved 48 bytes to binary file C:\Users\d8orelli\Downloads\proxmark3\client\/room21.bin

afterwards you put new card on and type

lf t55xx restore -f room21.bin

[+] loaded 48 bytes from binary file room21
[=] Starting to write...
[=] Writing page 0  block: 01  data: 0xA2F9C019
[=] Writing page 0  block: 02  data: 0x3A6F633D
[=] Writing page 0  block: 03  data: 0x3B02493E
[=] Writing page 0  block: 04  data: 0xFF7D493E
[=] Writing page 0  block: 05  data: 0x3F3E3D2A
[=] Writing page 0  block: 06  data: 0x3FA37B2D
[=] Writing page 0  block: 07  data: 0xFFFFFFFF
[=] Writing page 1  block: 01  data: 0xE0150158
[=] Writing page 1  block: 02  data: 0x319495C7
[=] Writing page 1  block: 03  data: 0x00A00003
[=] Writing page 0  block: 00  data: 0x001480C0
[=] Done!

and there you have it!

iceman

Administrator

Registered: 2013-04-25

Posts: 9,536

Website

Re: Create new card with same information Rfid T5577

Beline hotel.   The data doesn't decode.  Were there some printed numbers?  Or details of the hotel room, date of stay etc?

iceman

Administrator

Registered: 2013-04-25

Posts: 9,536

Website

Re: Create new card with same information Rfid T5577

aha,  I see you are on discord.  Never mind.