Proxmark3 community

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Honeywell NexWatch

I was messing around with some Honeywell cards...and the bit structure is pretty much exactly what is listed in this thread:

http://proxmark.org/forum/viewtopic.php?id=2341

...except that the Checksum calculation given in that thread does not seem to be correct.  The proxmark firmware does not use this checksum when determining if the card is a valid format. 

Has anyone done any further work on the checksum calculation for these types of cards?

Thanks
HK

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Re: Honeywell NexWatch

Sorry just to clarify, I have two cards marked "Honeywell" and the Bit structure and the scrambled ID bits are similar to the thread mentioned above.  The only issue is that my parity and checksum values are completely different.  I am trying to figure out if this is a different series of card from that manufacturer...when I demod the Proxmark has to invert the bits and after inversion the demods look like:

Card ID:66027263  BIT HEX: 5600000000577377FD1 C 70 0000000000
Card ID:65889046  BIT HEX: 5600000000466145BE1 6 88 0000000000

On the first card, the parity 0x0C works out according to the earlier thread's procedure, but the checksum of 0x70 does not.
On the second card, the parity of 0x06 does not work out at all, and the checksum of 0x88 doesn't either.

Any ideas on why I can't calculate these values on these original cards?

Thank you

Last edited by hkplus (2019-11-15 06:44:14)

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Honeywell NexWatch

how about you save two signal traces of your and share here?  Easier to let ppl work on it.

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Re: Honeywell NexWatch

I would love to do that and appreciate your interest Iceman... but could you tell me what Proxmark commands can produce this trace? I typically just use lf search and demod dump...

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Honeywell NexWatch

easy,   I suggest you replace n  with printed number or found id

lf read
data save lf_honeywell_nnnn.pm3

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Re: Honeywell NexWatch

I am not familiar with these files...I have generated them...how do I upload them to the forum?

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Re: Honeywell NexWatch

Weird just checked these files and there are zero bytes in them...

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Honeywell NexWatch

You should use a file share service and post the links here

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Re: Honeywell NexWatch

File sizes are zero - no content in them after creation with proxmark.exe?

Nubian

Contributor

Registered: 2018-03-23

Posts: 11

Re: Honeywell NexWatch

Hi Iceman

I have one honeywell quadrakey dual chips.
lf search: NexWatch ID: 71510297         
Had to Invert - probably NexKey         
DemodBuffer: A9FFFFFFFFFBDEC7B8EE08FFFFFFFFFF －560000 000004213847-11F7(Checksum different from 17CD/1797)
I'm using proxmark easy, can you advsie more detials on how to save two signal traces?

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Honeywell NexWatch

I suggest you replace n  with printed number or found id

lf read
data save lf_quadrakey_nnnn.pm3

hf search

Since you have a dual card, you will need to figure out which kind of tech the second interface uses.

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: Honeywell NexWatch

try pulling latest code,  it should atleast give you the descrambled 88bit format id.

The checksum / parity is still unknown.