Proxmark3 community

Homer7

Member

Registered: 2014-04-02

Posts: 7

Decoding guardall fob

Hi,

I'm very new to proxmark. but im learning quickly.

I could do with help decoding how the fob work. I've got access to about 10 fobs
They might be related to g-prox II fobs. but im unsure.

Homer7

Member

Registered: 2014-04-02

Posts: 7

Re: Decoding guardall fob

ok, so ive got

proxmark3> data fskdemod
actual data bits start at sample 2647         
length 50/50         
bits: '011110101110000111001001010000011100001010000'         
hex: 00000f5c 39283850     

proxmark3> data detectclock
Auto-detected clock rate: 40

I've tried writing to a Q5 fob but it returns

proxmark3> data fskdemod
actual data bits start at sample 974         
length 50/50         
bits: '000101111110111111100011100001010000100101111'         
hex: 000002fd fc70a12f

not sure where ive gone wrong

midnitesnake

Contributor

Registered: 2012-05-11

Posts: 151

Re: Decoding guardall fob

looks more like an EM4x tag to me?

app_o1

Contributor

Registered: 2013-06-22

Posts: 247

Re: Decoding guardall fob

Can you post a trace from your tag please ?

lf read
data sample 16000
data save guardall.pm3

And then upload that small file (you will find it in the /proxmark folder somewhere) and give us the link here.

Have a look here also : http://www.proxmark.org/forum/viewtopic.php?id=1459

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: Decoding guardall fob

hi Homer7!
Unfortunately code Guardall still not solved   I'm waiting, when Ebay bring the reader Guardal, then continue the experiment....

Homer7

Member

Registered: 2014-04-02

Posts: 7

Re: Decoding guardall fob

Ill upload some traces later on.

Ive borrowed a pack of 25 gprox II fobs off my boss. From the paper work
Its shows the serial number on the card isnt how its enoded.

Ie
serial 001255525 encoded 19878 pin 8294

Ive got the complete list with 25 cards.

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: Decoding guardall fob

Card No:1365205 

Tuning:
0x00150060 - for Temic
0x6001F066 - for sokymat Q5

Secrors:
0x69980299
0xA642C221
0x8DA5699F

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: Decoding guardall fob

If possible, record the information on the card, and bring it to the reader Gprox

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: Decoding guardall fob

Card No       Hex Code on card
1365208      580C6181  60734E41   1562581F
1365209      38146780   E0135647  14E1381F
1365210      18D4558C  63339E73  186118DF
1367510      10166500  403B4042   2C42101F
1367511      700E6301  C05B5844  2DC1701F
1367512      109E4508  423BC066  2442109F
1367513      70864309  C25BD860  25C1709F

Homer7

Member

Registered: 2014-04-02

Posts: 7

Re: Decoding guardall fob

I've recorded two of the black prox tags i've got

http://bifferclan.com/pm3/guardalltag1.pm3

http://bifferclan.com/pm3/guardalltag2.pm3

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: Decoding guardall fob

I think that Card No. and Hex code is related; only 25 bits seems to be taken from the hex value to obtain the 7-value number (maybe in reversed order). I will soon post a little table so someone can help me finding the solution (Sentinel? ) because I am running out of time in these weeks.

EDIT:
Here it is:

Long bit sequences are HEX values converted to bin (in the same order as the 1st list).
Short bit sequences are Card Numbers converted to bin (in the same order as the 1st list).

* = always the same
- = not always the same
| = suspected to be part of the Card No.
w = higly suspected to be part of the Card No.
? = bit patterns (in column) you can find in Card Numbers

Here is the .txt file.

Last edited by asper (2014-04-03 19:52:16)

midnitesnake

Contributor

Registered: 2012-05-11

Posts: 151

Re: Decoding guardall fob

Guardall programming reference guide: https://www.buyfromnorbain.com/Documents/ocw/0426050~Document~1.pdf

Hints that it is a 56bit proprietary format on page 89.

Also the two files you link to, are identical.  Maybe you accidentally read the same tag twice?

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: Decoding guardall fob

Sorry Sentinel, what do you mean with "hex code on card" ? Hex values streamed with rf or are them printed on the card ?

Can it be a "Temic 56 bit format" ? They seems to be them.

Last edited by asper (2014-04-03 20:55:24)

Homer7

Member

Registered: 2014-04-02

Posts: 7

Re: Decoding guardall fob

I've just had a look at my GSR Direct software, by default the panel is set up basic.

Homer7

Member

Registered: 2014-04-02

Posts: 7

Re: Decoding guardall fob

I've just re-uploaded both the fobs correctly this time

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: Decoding guardall fob

I have 96 bit card, you - 64 bit. Our cards are different
http://bifferclan.com/pm3/guardalltag1.pm3

Homer7

Member

Registered: 2014-04-02

Posts: 7

Re: Decoding guardall fob

Ive got 2 of the black fobs at the moment. I also have access to the gprox II cards.
Ill upload some of those traces later on.

Thanks for the numbered trace ive been looking for examples of how the bits are done.

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Decoding guardall fob

http://www.proxmark.org/forum/viewtopic … 877#p10877 for more guardell prox info by sentinel