Proxmark3 community

hheile

Contributor

Registered: 2014-03-03

Posts: 35

Identify a LF TAG

Question one: is this the latest version? I believe it is, but not 100% sure.

When i do a hw tune without any tag the result is like this:

1st try:
proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
         
# LF antenna: 14,50 V @   125.00 kHz         
# LF antenna: 21,08 V @   134.00 kHz         
# LF optimal: 26,45 V @   130,43 kHz         
# HF antenna:  1,00 V @    13.56 MHz         
# Your HF antenna is unusable.

2nd try:
proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
         
# LF antenna: 14,50 V @   125.00 kHz         
# LF antenna: 20,95 V @   134.00 kHz         
# LF optimal: 26,59 V @   130,43 kHz         
# HF antenna:  0,61 V @    13.56 MHz         
# Your HF antenna is unusable.

3rd try:
proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
         
# LF antenna: 14,23 V @   125.00 kHz         
# LF antenna: 21,08 V @   134.00 kHz         
# LF optimal: 26,72 V @   130,43 kHz         
# HF antenna:  1,00 V @    13.56 MHz         
# Your HF antenna is unusable.

4th try:
# LF antenna: 14,50 V @   125.00 kHz         
# LF antenna: 21,08 V @   134.00 kHz         
# LF optimal: 26,45 V @   130,43 kHz         
# HF antenna:  1,03 V @    13.56 MHz         
# Your HF antenna is unusable.

When i put the unknown token to the reader (of course with lf antenna attached) the results are like this:

1st try:
proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
         
# LF antenna: 13,43 V @   125.00 kHz         
# LF antenna: 21,08 V @   134.00 kHz         
# LF optimal: 24,98 V @   130,43 kHz         
# HF antenna:  0,58 V @    13.56 MHz         
# Your HF antenna is unusable.

2nd try:
proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
         
# LF antenna: 13,56 V @   125.00 kHz         
# LF antenna: 20,95 V @   134.00 kHz         
# LF optimal: 25,24 V @   130,43 kHz         
# HF antenna:  0,61 V @    13.56 MHz         
# Your HF antenna is unusable.

3rd try:
proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
         
# LF antenna: 13,96 V @   125.00 kHz         
# LF antenna: 20,95 V @   134.00 kHz         
# LF optimal: 26,18 V @   130,43 kHz         
# HF antenna:  0,58 V @    13.56 MHz         
# Your HF antenna is unusable.

For now, i'm pretty sure its a low-frequency tag.(125KHz??)

what i did next:

lf read result

data sample 16000
data plot
gives me this output:

a bit closer look:

sample is uploaded here:
http://we.tl/5iP1cxsMky

now, here is my problem: i have some difficulties to interpret the data.

any ideas how to identify will be fine.

thank you for your interest in helping

hheile

Enio

Contributor

Registered: 2013-09-24

Posts: 175

Re: Identify a LF TAG

You didnt get any response from tag there. As you see min/max differs just by 1, thats just distortions. have you tried  lf read on 134Mhz yet? For 125 Mhz your antenna is a bit weak too, can you tune it to reach15+ Volts?

hheile

Contributor

Registered: 2014-03-03

Posts: 35

Re: Identify a LF TAG

Hi Enio,

thanks for your reply.
to answer your question: the antenna was bought at proxmark3.com, i havent got any values above 14.something volts ever.
when i use
lf read h the result is like this:

the sampled data is here:
http://we.tl/XmmkOT9G68

i have no idea where to get a better antenna :-(

thanks

hheile

app_o1

Contributor

Registered: 2013-06-22

Posts: 247

Re: Identify a LF TAG

Make sure it plugged properly. This trace looks like there is no antenna at all.

hheile

Contributor

Registered: 2014-03-03

Posts: 35

Re: Identify a LF TAG

hi app_01,

thanks for the reply. i think i have some issues here with my proxmark.
the antenna is completly correct plugged in.
i can read a em4410x tag successfully.
attached image

my hw tune gives me:
proxmark3> hw tune
#db# Measuring antenna characteristics, please wait...                 
#db# Measuring complete, sending report back to host                 
         
# LF antenna: 14,50 V @   125.00 kHz         
# LF antenna: 21,08 V @   134.00 kHz         
# LF optimal: 26,45 V @   130,43 kHz         
# HF antenna:  0,97 V @    13.56 MHz         
# Your HF antenna is unusable

no chance to get better values.
maybe a update to the latest version helps?
mabe the device is broken?
or the antenna?

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Identify a LF TAG

looks to me like the card you were trying to read is not a LF card, since it works on a EM410x.

Enio

Contributor

Registered: 2013-09-24

Posts: 175

Re: Identify a LF TAG

looks to me like the card you were trying to read is not a LF card, since it works on a EM410x.

Its weird it reduces voltage on LF 125 khz though. Do LF tags exist that act like the HF tags - reply on special commands only?

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Identify a LF TAG

There are a few tags that need a wake command.

Enio

Contributor

Registered: 2013-09-24

Posts: 175

Re: Identify a LF TAG

There are a few tags that need a wake command.

Thank you, that could explain the seen behaviour.

0xquad

Member

Registered: 2014-08-23

Posts: 3

Re: Identify a LF TAG

More or less of an old topic, but I wanted to say that I've also found a tag that behaves in the same way. Found this topic by searching Google Images. hheile, did you happen to figure out how to read the tag? Mine is actually identified and it's an HID MicroProx Tag, which according to HID is a 125kHz tag, but I have found no further information about it. Their documentation says that we can also write to those tags, so adding support for them could be an interesting feature for the proxmark.

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Identify a LF TAG

The hid microprox tag is just like hid's other prox tags and is a password protected ata55x7 or em41x0 chip so only their prox programmer can program it.  If someone had the password the proxmark already has the functions needed to reprogram these. 

However I've never seen an hid prox tag configured where it could not be read easily unless it was damaged.

Does your tag function normally at the hid reader?

http://www.hidglobal.com/products/cards … imity/1391

Last edited by marshmellow (2014-08-24 00:25:22)

0xquad

Member

Registered: 2014-08-23

Posts: 3

Re: Identify a LF TAG

I have no reader to test with and I've randomly found the tag on the street. Perhaps it is damaged, but the MicroProx transponder itself seems to be perfectly intact.

I cannot make it react to LF or HF using my otherwise working proxmark and stock antennas. The only feedback I have is when I use the 'lf read' command and get samples from the proxmark. I then have the same graph as hheile's in post #11244. There is no samples at all when 'lf read' is used while the tag is off the antenna, so I presume the tag does give some feedback. Or maybe it's broken somehow (?). Not sure how to verify this. How can we explain the graphs we get?

Didn't know about the mentioned MicroProx capabilities; the literature is silent about it and googling for "proxmark" + "microprox" reveals that apparenly nobody has done research on them before with the proxmark. Was it documented somewhere? Where can I find more information about those tags?

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Identify a LF TAG

Microprox is just the name of the size/shape of the tag.  (Like isoprox is just a name for a cr80 size card with a prox chip in it)

It does not indicate a programming format or type, as they can be programmed in any hid compatible format.

Other than having a smaller antenna it is virtually the same as having an hid isoprox or hid proxcard.  There is little to find out.  cloning those chips normally only takes seconds.

If you happen to have found a tag programmed with a format that requires a wakeup command then you want to be searching for that format or the reader/system it works in as searching for microprox will get you nowhere. (I'm skeptical such a format exists, but it is possible)

0xquad

Member

Registered: 2014-08-23

Posts: 3

Re: Identify a LF TAG

Alright, thanks for that info, it's interesting.

So if I get the same kind of trace as hheile's above (the one that looks like there's no antenna), I could assume the tag is broken, or that for some reason it doesn't work with my LF antenna (?). As hheile reported, my antenna is also correctly plugged in and I can read other LF tags with no problems, so it's really confusing to me. I'm not sure what else I can try.

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Identify a LF TAG

I just ran across a 153khz LF key fob called a PAC by Stanley/bosch . I believe the standard antenna is unable to capture the samples from this tag even though it will suck the power from the antenna.  Any chance this may be what has been found in this thread?