RadioKey ( Secura key) Tags ??

Upgrade · 2015-07-20 04:48:28

@Iceman, my apologies for the confusion.

I meant how to clone this tag.

phiber · 2016-10-21 04:38:36

joe wrote:

Anyway，I just managed to clone it successfully, it works well.
Block 1 fxxxxxxx
Block 2 4xxxxxxx
Block 3 1xxxxxxx

Hi Joe,

mind sharing how you copied the secura successfully?
If not, can you mail me at phiber@hostcalls.com?

Charlie · 2017-04-28 07:26:24

I'm trying to decode this key, but don't have the fob until the weekend so cant test or post the trace.

proxmark3> lf search u
Reading 30000 bytes from device memory
          
Data fetched          
Samples @ 8 bits/smpl, decimation 1:1           
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
        
Checking for known tags:          
No Known Tags Found!
Checking for Unknown tags:
          
Possible Auto Correlation of 2560 repeating samples          

Using Clock:40, Invert:0, Bits Found:513          
ASK/Manchester - Clock: 40 - Decoded bitstream:

0000000000000000
0000110100111011
1001011110001111
1111100000000000
0000000000000000
0000110100111011
1001011110001111
1111100000000000
0000000000000000
0000110100111011
1001011110001111
1111100000000000
0000000000000000
0000110100111011
1001011110001111
1111100000000000
0000000000000000
0000110100111011
1001011110001111
1111100000000000
0000000000000000
0000110100111011
1001011110001111
1111100000000000
0000000000000000
0000110100111011
1001011110001111
1111100000000000
0000000000000000
0000110100111011
1001011110001111
1111100000000000

Repeating Pattern
11111111100000000000000000000000
00000000110100111011100101111000

Block 0: 000C8060
Block 1: FF800000
Block 2: D3B978

Does that look correct?

iceman · 2017-04-28 10:40:19

well.. block two needs one more byte, but the preamble looks familiar and so do the configblock.

marshmellow · 2017-04-28 12:49:46

See http://www.proxmark.org/forum/viewtopic.php?id=4683 for what we know on this format.

Charlie · 2017-05-04 21:47:01

Still working on this issue... though I'm even more confused now. I didn't get the same fob back but did get another one and it scans the same???

proxmark3> lf search u
Reading 30000 bytes from device memory
          
Data fetched          
Samples @ 8 bits/smpl, decimation 1:1           
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
          
Checking for known tags:
         
No Known Tags Found!
          
Checking for Unknown tags:
          
Possible Auto Correlation of 2560 repeating samples          

Using Clock:40, Invert:0, Bits Found:513          
ASK/Manchester - Clock: 40 - Decoded bitstream:          
0000000000000000
0001111000010100
1010011001011111
1111000000000000
0000000000000000
0001111000010100
1010011001011111
1111000000000000
0000000000000000
0001111000010100
1010011001011111
1111000000000000
0000000000000000
0001111000010100
1010011001011111
1111000000000000
0000000000000000
0001111000010100
1010011001011111
1111000000000000
0000000000000000
0001111000010100
1010011001011111
1111000000000000
0000000000000000
0001111000010100
1010011001011111
1111000000000000
0000000000000000
0001111000010100
1010011001011111
1111000000000000
         
Unknown ASK Modulated and Manchester encoded Tag Found!

Same repeating pattern as the first fob.

Here is the trace of the second fob

https://pastebin.com/9DTQuaR5

number on the tag was - 1706562

Any tips on what I should try would be greatly appreciated.

Last edited by Charlie (2017-05-04 21:51:02)

Charlie · 2017-05-04 22:05:07

marshmellow wrote:

See http://www.proxmark.org/forum/viewtopic.php?id=4683 for what we know on this format.

Hi Marshmellow,

I had read over the preample's but didn't quiet follow it as i didn't think mine matched, do I need to run a demod on it?

I really appreciate all the help!

ntk · 2017-05-05 00:00:39

Alow me to mix in here. @Chalie, I think you Securakey is not what the other have in previous posts. Also things in Secura are not 100% certain, so that is very good that you can bring not only data of one but 2 new keys.

Do you have access to the reader for testing too, Charlie?

Charlie · 2017-05-05 04:05:15

~~Sorry, don't have access to the wall reader.~~ You're correct, i believe they are a different style fob, these two were either a RKKT-01 or RKKT-02. I think the ones in the earlier messages were the clam shell versions.

Last edited by Charlie (2017-05-10 20:57:23)

Charlie · 2017-05-10 19:49:39

found my errors i believe...

The two signals after closer look were actually different(not sure how I missed that) and Block 0 should have been...

Block 0: 000C8040

Charlie · 2017-05-10 20:56:44

ntk wrote:

Alow me to mix in here. @Chalie, I think you Securakey is not what the other have in previous posts. Also things in Secura are not 100% certain, so that is very good that you can bring not only data of one but 2 new keys.
Do you have access to the reader for testing too, Charlie?

I do have access to the reader now for testing

ntk · 2017-05-10 23:29:14

these should be all recognised by the reader as Secura keys. (reader blinks but not open for three C D E) but should open for your fob A and B)

fob A/
lf t55xx wr b 0 d 000C8040
lf t55xx wr b 1 d 1E14A65F
lf t55xx wr b 2 d F0000000

fob B/
lf t55xx wr b 0 d 000C8040
lf t55xx wr b 1 d D02884FF
lf t55xx wr b 2 d 80000000

fob C/
lf t55xx wr b 0 d 000C8060
lf t55xx wr b 1 d 1E14A65F
lf t55xx wr b 2 d F0000000
lf t55xx wr b 3 d 1E14A65F

fob D/
lf t55xx wr b 0 d 000C8060
lf t55xx wr b 1 d 1E14A65F
lf t55xx wr b 2 d F0000000
lf t55xx wr b 3 d 1E14A65F

Fob E/
lf t55xx wr b 0 d 000C8060
lf t55xx wr b 1 d FCB40000
lf t55xx wr b 2 d 01084003
lf t55xx wr b 3 d DA000007

Charlie · 2017-05-11 05:31:20

Here are two more that work....

fob F/
lf t55xx wr b 0 d 000C8040
lf t55xx wr b 1 d FF800000
lf t55xx wr b 2 d 00D3B978

fob G/
lf t55xx wr b 0 d 000C8040
lf t55xx wr b 1 d FF800000
lf t55xx wr b 2 d 00F0A532

Last edited by Charlie (2017-05-11 05:31:41)

ntk · 2017-05-11 08:28:55

So that has proved there are 2 different types of secura. Would be good if you note down the fob number for later development.

the fob A is 1706562 (I use your trace.)

Charlie · 2017-05-11 16:20:25

ntk wrote:

So that has proved there are 2 different types of secura. Would be good if you note down the fob number for later development.
the fob A is 1706562 (I use your trace.)

hmm. I had Fob G/ as fob # 1706562

ntk · 2017-05-11 16:24:20

the offset could be different that why the HEX looks not the same, use data print x o 1,2,3 etc you' ll see.

lockakey · 2017-11-21 19:41:06

iceman wrote:

if you take these blocks (as a starting point in your repeating output

0000000000000011
0110010100000010
0001101111111110
0000000000000000

You'll get:

1790019 ( 0x1B5043 ) ( 110110101000001000011 )
-              110110   10100000   1000011
 00000000000000110110 0 10100000 0 1000011 0 1111111110 0000000000000000

So I hope this isn't a stupid question.
Is the physical card # printed on the fob present in the demod.

Ive successfully cloned them.
I get the blocks, on some of them I can even directly dump the data.
Im just trying to learn how to extract/convert the hex into the decimal physical card ID?

iceman · 2017-11-24 11:12:29

Your questions needs to be more specific and less guessing. Or should I write that?

Charlie · 2018-01-14 21:57:12

Have an issue with a fob...

0000000000000000
0000110110010001
0100110011101111
1111100000000000
0000000000000000
0000110110010001
0100110011101111
1111100000000000
0000000000000000
0000110110010001
0100110011101111
1111100000000000
0000000000000000
0000110110010001
0100110011101111
1111100000000000
0000000000000000
0000110110010001
0100110011101111
1111100000000000
0000000000000000
0000110110010001
0100110011101111
1111100000000000
0000000000000000
0000110110010001
0100110011101111
1111100000000000
0000000000000000
0000110110010001
0100110011101111
1111100000000000

lf t55xx wr b 0 d 000C8040
lf t55xx wr b 1 d FF800000
lf t55xx wr b 2 d 00D914CE

but when i program that lf search after i get...

proxmark3> lf sea u
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
Checking for known tags:
No Known Tags Found!
Checking for Unknown tags:
Possible Auto Correlation of 2560 repeating samples          
Using Clock:40, Invert:0, Bits Found:513          
ASK/Manchester - Clock: 40 - Decoded bitstream:          
0000000000000000
0001101100100010
1001100111011111
1111000000000000
0000000000000000
0001101100100010
1001100111011111
1111000000000000
0000000000000000
0001101100100010
1001100111011111
1111000000000000
0000000000000000
0001101100100010
1001100111011111
1111000000000000
0000000000000000
0001101100100010
1001100111011111
1111000000000000
0000000000000000
0001101100100010
1001100111011111
1111000000000000
0000000000000000
0001101100100010
1001100111011111
1111000000000000
0000000000000000
0001101100100010
1001100111011111
1111000000000000

I know im just off by a bit but cant figure out how to adjust.

Any suggestions?

Charlie · 2018-01-17 06:18:18

I'm an idiot.... disregard my last message

dygos2 · 2019-06-18 00:03:48

Does anybody got to clone RadioKey ?
I've copied page 0 blocks 0 to 3 and no luck.

Proxmark3 community

Announcement

#51 2015-07-20 04:48:28

Re: RadioKey ( Secura key) Tags ??

#52 2016-10-21 04:38:36

Re: RadioKey ( Secura key) Tags ??

#53 2017-04-28 07:26:24

Re: RadioKey ( Secura key) Tags ??

#54 2017-04-28 10:40:19

Re: RadioKey ( Secura key) Tags ??

#55 2017-04-28 12:49:46

Re: RadioKey ( Secura key) Tags ??

#56 2017-05-04 21:47:01

Re: RadioKey ( Secura key) Tags ??

#57 2017-05-04 22:05:07

Re: RadioKey ( Secura key) Tags ??

#58 2017-05-05 00:00:39

Re: RadioKey ( Secura key) Tags ??

#59 2017-05-05 04:05:15

Re: RadioKey ( Secura key) Tags ??

#60 2017-05-10 19:49:39

Re: RadioKey ( Secura key) Tags ??

#61 2017-05-10 20:56:44

Re: RadioKey ( Secura key) Tags ??

#62 2017-05-10 23:29:14

Re: RadioKey ( Secura key) Tags ??

#63 2017-05-11 05:31:20

Re: RadioKey ( Secura key) Tags ??

#64 2017-05-11 08:28:55

Re: RadioKey ( Secura key) Tags ??

#65 2017-05-11 16:20:25

Re: RadioKey ( Secura key) Tags ??

#66 2017-05-11 16:24:20

Re: RadioKey ( Secura key) Tags ??

#67 2017-11-21 19:41:06

Re: RadioKey ( Secura key) Tags ??

#68 2017-11-24 11:12:29

Re: RadioKey ( Secura key) Tags ??

#69 2018-01-14 21:57:12

Re: RadioKey ( Secura key) Tags ??

#70 2018-01-17 06:18:18

Re: RadioKey ( Secura key) Tags ??

#71 2019-06-18 00:03:48

Re: RadioKey ( Secura key) Tags ??

Board footer