Proxmark3 community

actionbias

Contributor

Registered: 2017-07-22

Posts: 26

ioprox 3-character hex versus 2-character hex

Folks!

I'm have 2 types of ioprox fobs:

First one ---> XSF(01)2B:58714
second one ---> XSF(02)7A:08055

The first one I can get the hex from the ioprox calculator and create a duplication.
The second one I'm struggling with the 3-character hex in front of the colon :

Any suggestions? Or point me to a link that can guide me?

Thanks!

Last edited by actionbias (2020-07-25 22:42:34)

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: ioprox 3-character hex versus 2-character hex

Can you post a trace of the tag?

actionbias

Contributor

Registered: 2017-07-22

Posts: 26

Re: ioprox 3-character hex versus 2-character hex

Sorry I don't have the tags on me. I'm trying to duplicate with the serial number.

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: ioprox 3-character hex versus 2-character hex

Then I would guess the serial number you have been given is invalid

Charlie

Contributor

Registered: 2017-01-27

Posts: 129

Re: ioprox 3-character hex versus 2-character hex

Beginning in 2019, Kantech is no longer manufacturing cards that look like this:  XSF (01) 78:6430.  They are still using XSF 26Bit Format but the new format is XSF 0258:14639.

Last edited by Charlie (2019-11-18 06:30:03)

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: ioprox 3-character hex versus 2-character hex

If you can get your hands on such tags then it would be good if you could share some trace files.  In order to look at the new decoding.

actionbias

Contributor

Registered: 2017-07-22

Posts: 26

Re: ioprox 3-character hex versus 2-character hex

From duplicating several ioProx by serial number I've recognize some patterns. Using the ioProx calculator it can only process XSF(01) and it will return a hex conversion.

Consistenly if you take that 9th digit and change that from a 3 to a 5 the conversion works.

The tricky part is the very last digit. I've seen 7, 3, F work.

For e.g.

XSF(02) 9C : 16684

The ioProx Calculator takes the XSF(01)9C:16684 conversion outputs 0078672034196417

Change the 9th digit from a 3 to a 5, this one consistently works.

XSF(01)9C : 16684 = lf io clone 0078672034196417
XSF(02)9C : 16684 = lf io clone 007867205419641 *7* <<< Where I'm struggling is the last digit. I've seen 7, 3, F work.

Any advice or direction on how to solve this riddle?

actionbias

Contributor

Registered: 2017-07-22

Posts: 26

Re: ioprox 3-character hex versus 2-character hex

Here's some further insight I produced 2 fobs using the following commands. I used the number 3 and 7 for the last digit.
In result, this outputed a different checksum value.

Which checksum is correct?

lf io clone 0078672054196413
lf io clone 0078672054196417


Last digit is #3:

00000000 0
11110000 1
10011100 1 facility
00000010 1 version
01000001 1 code1
00101100 1 code2
00000100 11 checksum
IO Prox XSF(02)9c:16684 (0078672054196413) [04 crc ok]

Last digit is #7

00000000 0
11110000 1
10011100 1 facility
00000010 1 version
01000001 1 code1
00101100 1 code2
00000101 11 checksum
IO Prox XSF(02)9c:16684 (0078672054196417) [05 !crc]

Last edited by actionbias (2020-04-03 20:35:55)

actionbias

Contributor

Registered: 2017-07-22

Posts: 26

Re: ioprox 3-character hex versus 2-character hex

Any tips or can you point me a to a calculator?