Help with 40bit tag (Farpointe?)

Gratefuldeadbolt · 2015-01-22 05:29:07

Hello all.

Greetings again. After a long break I have returned again determined to learn with much enthusiasm what I can about RFID technology.

I am looking to learn what I can no longer just in theory but in practice also so that I can be better informed when selling this technology to my clients as a security integrator / installer involved with access control , locksmithing, cctv and alarm systems.

I just recieved my Proxmark3 from proxmark3.com . Thanks to Jason and Rysc Corp. For the excellent service.

I got the pm3 running on my toughbook running xp.

Detected on com9 , installed the driver ok and was running from cmd prompt.

I first ran > HW TUNE to check LF antenna... got 13.56 V @ 125kHz and 21.21 V @ 134kHz and 24.44 V @ 130.43 kHz

I read a dozen or so standard HID 26 bit tags no problem with > lf hid fskdemod

Now for my challenge at this point.

I have a keytag from a vendor I would like to learn to read.

It is a 40 bit keytag from a vendor that came from FARPOINTE through another vendor.

It is a small grey keyfob with the FARPOINTE logo , a 3 digit (facility code 034) , a 5 digit ID number (1xxxx), the letter A , and then followed by HCC40

I spent a great deal of time online trying to find out what I could about 40 bit keyfobs and I believe it may be on a Casi Rusco C10106 format.

CASI RUSCO 4001(with facility code) /4002(without facility code)

I searched Farpointe info and saw a pdf that mentioned the delta3 readers following iso 14443 A standard and that the 40 bit is actually 32 bit with a 8 bit crc checksum.

So now I tried to figure out how to read this tag.

I was struggling at this point but have tried the following:

>Data samples 20000
>Data fskdemod
actual data bits start at sample 1756
length 50/50
bits: '000110100101010101010111011011101011011100001'
hex: 0000034a aaedd6e1

Interesting as the 34 is the printed facility code. But the aaedd6e1 doesnt relate to the card # printed on tag.

I then found a neat utility for card calculations at :

http://www.brivo.com/support/card-calculator/

but entering the hex for a 40 bit card didnt help either.

Now I am stuck.

I Dont know what to try next.

I have tried the PLOT command after the data samples but to be honest I am not
entirely sure what I am looking at or where to go next.

Wondering if anyone could assit or hint at other commands to try or if someone could shine light of knowlege on this mysterious 40 bit tag.

Thanks in advance.

Gratefuldeadbolt · 2015-01-22 05:44:16

***Attention moderators****

I apologize, I probably should have been more specific in the title of this thread.

pperhaps I could have called it:

Help with LF125kHz 40Bit tag (Farpointe?)

I don't know how to edit posts and will try to be more specific when posting.

marshmellow · 2015-01-22 05:58:37

first, I'd recommend you update your proxmark to the latest github version. this has new demodulation commands that will help you. there is a lot of various information about updating a green proxmark. (i haven't done it in years so i won't be a lot of help.)

I believe this link may be the same format you are looking for:
http://www.proxmark.org/forum/viewtopic.php?id=1655

marshmellow · 2015-01-22 06:02:10

however there are new demodulation methods in the latest code so we don't have to manually demod this anymore.

Gratefuldeadbolt · 2015-01-22 06:12:35

would the github version be newer than my hw version that the pm3 just shipped with?

my setup :

bootrom :svn 0 2014-0401 12:12:24
os: same
FPGA image built on 2014 03 24

Thanks Marshmellow. I did see that link as I did a forum search for Farpointe, but it did not make much sense to me at this point in relation to my tag. I will have a closer look again and see if I can learn more about how the bits are divided up and encoded.

marshmellow · 2015-01-22 06:33:38

Usually they ship with a very old version. Granted yours looks like it is only a year old or so. There have been a lot of improvements the last month or so, and still more to come.

Gratefuldeadbolt · 2015-01-22 06:45:50

Great thanks Mm. I will continue this thread after a bit more reading in:

https://github.com/Proxmark/proxmark3/wiki

Once I have updated the pm3 and read up a little more I will come back to figuring out this Tag unless anyone else has some ideas RE deriving the UID from the readings on pm3 with the eventual goal of simulating the card.

Gratefuldeadbolt · 2015-01-22 07:01:24

I do believe that the tag is a custom 40 bit Farpointe PSK-3 key tag from the datasheet on google.

iceman · 2015-01-22 10:03:00

I recommend that you upgrade to the latest GitHub source. Noone on the forum wants to help if you don't do it. (usually) and especially since Marshmellow just released very important enhancements to the LF Demodulation code. Trust me, you want to have them.

Last edited by iceman (2015-02-05 10:55:04)

Gratefuldeadbolt · 2015-01-22 14:31:11

Thanks Iceman. I am working on the update and will post again once that is done.

sambo · 2015-02-05 02:35:59

I've also got what I believe to be a Farpointe PSK-3 Prox Key fob.

Using the latest GUI build, I was able to gather some data from the key:

[== Undefined ==]
proxmark3> data fskpyramiddemod
Pyramid ID Found - BitLength: 90 -unknown BitLength- (7215), Raw: 1c10101013b04104383d5f1e0bf62

I've used the Brivo utility (and saved it - what a great tool!) but the results don't seem to match the printed code on the fob (4 numbers, 6 hex values, the letter M)

Does anyone have any further suggestions for this type of key and is there any way to clone it?

marshmellow · 2015-02-05 02:48:02

Do a data fskrawdemod

marshmellow · 2015-02-05 02:50:07

And do you mind sharing the number on the fob?

sambo · 2015-02-05 02:58:15

The number on the fob is: 0793 1e57e8 M

proxmark3> data fskrawdemod
Args invert: 0 - Clock:50 - fchigh:10 - fclow: 8          
FSK decoded bitstream:          
1111100011111011          
1111101111111011          
1111101100010011          
1110111110111110          
1111000111110000          
1010100000111000          
0111110100000010          
0111011111111111          
1111100011111011          
1111101111111011          
1111101100010011          
1110111110111110          
1111000111110000          
1010100000111000          
0111110100000010          
0111011111111111

marshmellow · 2015-02-05 03:18:24

It appears the first pyramid demod was correct. The raw data (preceded by 000) would be what is needed to make a copy. The fskrawdemod tells us what the chip settings to use, FSK2a RF/50, and you have 128 bits or 4 blocks. Note that the fskrawdemod output needed to be inverted for fsk2a instead of fsk2.

sambo · 2015-02-05 03:34:34

Thanks marshmellow (particularly for the new LF commands!)
After clearing buffer, here is the inverted output - does this look correct?:

proxmark3> #db# Buffer cleared (40000 bytes)                 
proxmark3> lf search
#db# buffer samples: 52 57 76 87 93 96 7f 65 ...                 
Reading 20000 samples from device memory
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
Checking for known tags:
Pyramid ID Found - BitLength: 90 -unknown BitLength- (7215), Raw: 1c10101013b04104383d5f1e0bf62          
Valid Pyramid ID Found!          
proxmark3> 
proxmark3> data fskrawdemod 50 1 10 8
Args invert: 1 - Clock:50 - fchigh:10 - fclow: 8          
FSK decoded bitstream:          
1000010000000100          
0000010000000100          
1110110000010000          
0100000100001110          
0000111101010111          
1100011110000010          
1111110110001000          
0000000000000111          
0000010000000100          
0000010000000100          
1110110000010000          
0100000100001110          
0000111101010111          
1100011110000010          
1111110110001000          
0000000000000111

Do you know what type of blank media I need to obtain to copy this card?

marshmellow · 2015-02-05 04:22:08

The proxmark3 works well with ata5577s

marshmellow · 2015-02-05 04:44:57

The tag appears to be a farpointe data tag just not a format the pm3 has been programmed to recognize. Thus the "unknown BitLength". But the raw data is correct, just needs leading zeros to get up to 128 bits

sambo · 2015-02-05 05:03:44

Thanks for your help. I'll order in some new ATA5577s, check out the data sheet, and see what I can write to it. I'll let you know how I go.

sambo · 2015-02-12 06:34:25

@marshmellow: I've also got a 26 bit Pyramid tag I'm going to clone which also has 116 bits of raw data. Can you please confirm what block 0 you would use to to write to an ATA5577 to match the Pyramid requirements?
The one I've come up with is: 0x00107080 - does that look right to you?

marshmellow · 2015-02-12 06:41:37

Should have an even 128 bits (probably missing the leading zeros). Block 0 looks right, though I don't have the datasheet in front of me

sambo · 2015-02-17 04:29:37

Yep, that block 0 and padding on block 1 was enough to clone a different Farpointe card to the one I originally posted about. Thanks for the advice, marshmellow and sorry for the thread hijack Gratefuldeadbolt!

Gratefuldeadbolt · 2015-03-02 02:08:27

HI ICEMAN / MARSHMELLOW and SAMBO

I'm back again after a bit of a break to concentrate on work projects.

I think I finally figured out a way to upgrade to the latest build in a round about way.

I wasn't having much luck with the driver compatibility on win 7 64 bit on my home pc, so I went back to my xp install on laptop.

Next hurdle which I till have not solved was figuring out the auto updates though svn / proxspace install (I believe I got as far as declaring my path in the runme.bat when thing would fail)... still to solve at later time..

In the mean time I was getting the proxmark to show up on com9 so I manually edited the batch files on the updates and updated to the latest github build I believe.

Here is my latest hw version result:

proxmark3> hw version
#db# Prox/RFID mark3 RFID instrument
#db# bootrom: /-suspect 2015-01-31 07:13:30
#db# os: /-suspect 2015-01-31 07:13:36
#db# HF FPGA image built on 2015/01/15 at 12:19:06
uC: AT91SAM7S256 Rev A
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 256K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory

so, aside from figuring out the SVN /ProxSpace issue I believe i can go back to trying to read a 40 bit keyfob once I get familiar with some of the new commands and features available.

Looking forward to learning more.

sambo · 2015-03-02 02:16:42

Your versions match those which I am using with the Win GUI v0.0.7
Try downloading that and see if any of the previous discussions in this thread help you find what you are looking for.

Gratefuldeadbolt · 2015-03-02 02:22:18

Thanks Sambo.

That is the same build I used to update to when I was looking for current build (after i couldn't figure out SVN / ProxSpace update tool)

I am reviewing some of the old threads that might make more sense now.

Ran the LF SEARCH command and it confirmed a AWID 40 bit -unknown bitlength tag

This just got a little more fun!

Gratefuldeadbolt · 2015-03-02 02:34:14

Hmmmm interesting, it seems the AWID and PYRAMID 'Demodulate' commands are not functional in the Win GUI v0.0.7

marshmellow · 2015-03-02 02:51:00

AWID? Interesting. I don't think I've seen a 40 bit awid. Any chance you want to share a trace and printed ID? I could see if I could add the correct ID/FC decode.

marshmellow · 2015-03-02 02:53:31

If LF search told you it was an awid then you have the functions. If you are using the GUI there are a few bugs in the settings.XML in the 0.0.7 version. Try the direct commands to send a data help too see your versions available commands.

marshmellow · 2015-03-02 02:56:46

The awid demod is called by LF search. You won't get any more info directly from the data fskawidrawdemod .

Last edited by marshmellow (2015-03-02 03:13:05)

Gratefuldeadbolt · 2015-03-02 03:29:34

Marshmellow - Traces sent.

Last edited by Gratefuldeadbolt (2015-03-02 04:31:17)

marshmellow · 2015-03-02 03:37:37

Data save ./path/filename.pm3
Saves a trace. Then you could post it to a file share and post a link here. That is typically how it goes around here. You can zip it if you like.

If more discretion is needed I can provide an email or ICQ account.

It should be pretty easy to identify the location of the printed numbers. (If we clearly identify it I can add it to the demod.).

Yes the raw number should be the hex needed to clone or Sim (though FSK Sim is not currently capable... firmware issues atm)

Last edited by marshmellow (2015-03-02 03:38:08)

Gratefuldeadbolt · 2015-03-02 03:59:08

MARSHMELLOW -

OK I saved 12 traces named identical to what is printed on the keyfob (spares left over on a job) and can send them to you in an email preferably for research purposes, I look forward to seeing what you make of the traces.
Im not sure how to message you privately here. Do you have an email you can give out or we can head over to proxmark icq room.

marshmellow · 2015-03-02 04:00:54

...

Last edited by marshmellow (2015-03-02 05:08:35)

Gratefuldeadbolt · 2015-03-02 04:06:04

will do thanks. give me a few minutes. I need to redo the trace saves with more samples just in case would 8000 be enough or should I sample 10k?

marshmellow · 2015-03-02 04:08:24

8000 should be just enough, though I typically just do 20000 to be sure.

In fact I think if you just do LF search then data save it will save 20000. ( or 40000 can't remember)

Last edited by marshmellow (2015-03-02 04:10:38)

Gratefuldeadbolt · 2015-03-02 04:11:01

I'm almost half way through at 10k each so hopefully that's enough. If not I can always resend.

marshmellow · 2015-03-02 04:11:33

LF search is my favorite new command. . Saves so much typing.

marshmellow · 2015-03-02 04:13:39

Should be fine, at worst the bitstream for this kind of tag should be less than 6200 samples. Just it is nice if we get a clear repeat pattern.

Gratefuldeadbolt · 2015-03-02 04:32:33

MARSHMELLOW - Traces sent.

EDIT- Would it help to send you the LF SEARCH results for each Tag? I dont think you can run the command from a loaded trace so I could send you those also to confirm trace results. Let me know.

Last edited by Gratefuldeadbolt (2015-03-02 04:40:40)

marshmellow · 2015-03-02 05:10:37

There is an option to run LF search on the graphbuffer (loaded trace . See the lf search h (help)

I'll take a look at the traces.

iceman · 2015-03-02 11:07:22

@Marshmellow, I'm so happy you decided to implement the "lf seach" and added the option for reading traces from graphbuff.
It really did help the whole LF community, as seen with the new Awid/pyramide identifications.
Now just @Holiman can find some time to finish his updated GUI, the LF analyse part would be kind of complete.

Next would be to implement some write Awid/pyramid commands..

marshmellow · 2015-03-02 16:24:49

@iceman, i'd like to get the sim commands working. a write/clone command, I'm not sure I'll implement. the demods usually give the raw hex that can be split to the ata55x7 blocks and can be written with a few calls already. i might consider a write command that takes the FC and Card# and writes it, (but pyramid checksum would have to be cracked for that format to work, and there are so many HID formats that it may not be so useful to have just a few).

Last edited by marshmellow (2015-03-02 16:25:34)

iceman · 2015-03-02 16:47:42

yeah, the lf sim has been on my list since october. Never got a good clock to work with.
Much thing can be done right now but, sometimes its not about know a to program a t55x7 tag with the present commands.

BTW, whats up with the pyramid checksum? I think I miss that discusion.

marshmellow · 2015-03-02 20:46:08

This is the reason I haven't implemented write/clone commands. lazy.
but that is another discussion.

as far as lf simulating - that to is also another discussion here and here (though I have been able to get ASK above 16 clock to work fine. (EM41xx included).)

and Pyramid - again another discussion here (boils down to a CRC8 checksum with unknown parameters)

this discussion is about these strange 40 bit AWID (not Farpointe) tags.. and from the looks of them either they have some sort of bit scramble coupled with a couple parities or the printed number has nothing to do with the programmed number. (which is actually a good security practice)

@Gratefuldeadbolt is there anyway to verify the printed number is the number the reader sees and outputs to the access control software? or are the two completely unrelated? (it is a good security practice for these LF low tech cards to be supplied and issued with random programming so one cannot guess the next/previous valid key number).

Last edited by marshmellow (2015-03-02 20:48:45)

Gratefuldeadbolt · 2015-03-02 23:37:42

@Marshmellow

the number (facility code and card number) are what the access control equipment use to program the tags in. I have not scoped or captured the reader output although it is something I could probably do via a serial db9 port somehow to capture the raw data on the clock/data lines.

I agree that having an arbitrary number in the chip / related by encryption that is known by the reader is step up in security as it definitely would make rights amplification and brute force more difficult if all you captured was the raw data on the card but did not know the encryption used.

Gratefuldeadbolt · 2015-03-03 00:27:46

I am somewhat comforted by the small increase in security offered by a level of encryption between the printed ID on the tag and the Raw data. This seems more secure than basically giving out a clear text ID which one could otherwise reduce the guesswork from say a possible 65000 (26bit) tags down to a say 50 or 100 (depending on the bulk purchase by H. R. or access company) when looking at protecting against brute force attack.

Although if the encryption is weak then all this does really is add another step to demodulation.

One other great feature is that a manufacturer of readers and tags could theoretically introduce custom encryption on a national level down to a proprietary level and this again may frustrate any attempts at decryption because a random tag may not have a way of telling which method was used to encrypt the tag.

marshmellow · 2015-03-03 00:49:56

in looking closely at your samples it appears this HCC40 has a scrambled bit pattern similar to indala tags.
with only a few samples i was only able to work out a few confirmed bit translations:
(bits numbered MSB First)
Card10=Wiegand16
Card13=Wiegand29
Card14=Wiegand22 or 23
Card15=Inverse of Wiegand10
Card11=Wiegand25 or 35
Card12=Wiegand25 or 35
Card16=Wiegand5 or 17

However there appear to be at least 6 unknown parities
(they really didn't want anyone else decoding this tag)

without a reader and/or a large sample set of cards it is unlikely we will be able to descramble all the bits.

aydiosmio · 2015-09-11 06:36:43

Zipcar appears to be using 40-bit AWID cards. I'm working to get multiple samples. Unfortunately their cards do not have printed numbers.

aydiosmio · 2015-09-11 09:00:22

Sorry to have resurrected this old thread. I thought the format was 40 bit for Zipcar AWID cards, but the answer was more about the bit format than anything else.

Zipcard AWID Cloning

Apt-Get · 2016-01-25 19:27:40

sambo wrote:

@marshmellow: I've also got a 26 bit Pyramid tag I'm going to clone which also has 116 bits of raw data. Can you please confirm what block 0 you would use to to write to an ATA5577 to match the Pyramid requirements?
The one I've come up with is: 0x00107080 - does that look right to you?

HI guys, Thanks for this info. Im curious how you calculate out this block 0?
Im pretty new and was looking for info on how to copy my Pyramid tag also.

Thanks for any help.
Cheers,
Apt

Proxmark3 community

Announcement

#1 2015-01-22 05:29:07

Help with 40bit tag (Farpointe?)

#2 2015-01-22 05:44:16

Re: Help with 40bit tag (Farpointe?)

#3 2015-01-22 05:58:37

Re: Help with 40bit tag (Farpointe?)

#4 2015-01-22 06:02:10

Re: Help with 40bit tag (Farpointe?)

#5 2015-01-22 06:12:35

Re: Help with 40bit tag (Farpointe?)

#6 2015-01-22 06:33:38

Re: Help with 40bit tag (Farpointe?)

#7 2015-01-22 06:45:50

Re: Help with 40bit tag (Farpointe?)

#8 2015-01-22 07:01:24

Re: Help with 40bit tag (Farpointe?)

#9 2015-01-22 10:03:00

Re: Help with 40bit tag (Farpointe?)

#10 2015-01-22 14:31:11

Re: Help with 40bit tag (Farpointe?)

#11 2015-02-05 02:35:59

Re: Help with 40bit tag (Farpointe?)

#12 2015-02-05 02:48:02

Re: Help with 40bit tag (Farpointe?)

#13 2015-02-05 02:50:07

Re: Help with 40bit tag (Farpointe?)

#14 2015-02-05 02:58:15

Re: Help with 40bit tag (Farpointe?)

#15 2015-02-05 03:18:24

Re: Help with 40bit tag (Farpointe?)

#16 2015-02-05 03:34:34

Re: Help with 40bit tag (Farpointe?)

#17 2015-02-05 04:22:08

Re: Help with 40bit tag (Farpointe?)

#18 2015-02-05 04:44:57

Re: Help with 40bit tag (Farpointe?)

#19 2015-02-05 05:03:44

Re: Help with 40bit tag (Farpointe?)

#20 2015-02-12 06:34:25

Re: Help with 40bit tag (Farpointe?)

#21 2015-02-12 06:41:37

Re: Help with 40bit tag (Farpointe?)

#22 2015-02-17 04:29:37

Re: Help with 40bit tag (Farpointe?)

#23 2015-03-02 02:08:27

Re: Help with 40bit tag (Farpointe?)

#24 2015-03-02 02:16:42

Re: Help with 40bit tag (Farpointe?)

#25 2015-03-02 02:22:18

Re: Help with 40bit tag (Farpointe?)

#26 2015-03-02 02:34:14

Re: Help with 40bit tag (Farpointe?)

#27 2015-03-02 02:51:00

Re: Help with 40bit tag (Farpointe?)

#28 2015-03-02 02:53:31

Re: Help with 40bit tag (Farpointe?)

#29 2015-03-02 02:56:46

Re: Help with 40bit tag (Farpointe?)

#30 2015-03-02 03:29:34

Re: Help with 40bit tag (Farpointe?)

#31 2015-03-02 03:37:37

Re: Help with 40bit tag (Farpointe?)

#32 2015-03-02 03:59:08

Re: Help with 40bit tag (Farpointe?)

#33 2015-03-02 04:00:54

Re: Help with 40bit tag (Farpointe?)

#34 2015-03-02 04:06:04

Re: Help with 40bit tag (Farpointe?)

#35 2015-03-02 04:08:24

Re: Help with 40bit tag (Farpointe?)

#36 2015-03-02 04:11:01

Re: Help with 40bit tag (Farpointe?)

#37 2015-03-02 04:11:33

Re: Help with 40bit tag (Farpointe?)

#38 2015-03-02 04:13:39

Re: Help with 40bit tag (Farpointe?)

#39 2015-03-02 04:32:33

Re: Help with 40bit tag (Farpointe?)