Help me with t5577 fobs acting weird

seanedu · 2021-07-02 23:05:21

I've ordered and received bunch of t5577 fobs from china,but this fob acting very weird,for example it can only copy em 4100 fobs,I tried Hid,Indala,and many other fobs,no luck,any help will be appreciated,
First I will display version of software below.

[+] loaded from JSON file C:\Users\Valued Customer\OneDrive\Desktop\pm3iceman1001-2021\client\/.proxmark3/preferences.json
[=] Using UART port COM6
[=] Communicating with PM3 over USB-CDC

[ Proxmark3 RFID instrument ]

[ CLIENT ]
client: RRG/Iceman/master/v4.9237-3013-g6bcf31e68-dirt...-unclean 2021-02-05 09:34:07
compiled with MinGW-w64 10.2.0 OS:Windows (64b) ARCH:x86_64

[ PROXMARK3 ]
firmware.................. PM3GENERIC

[ ARM ]
bootrom: RRG/Iceman/master/v4.9237-3013-g6bcf31e68-dirt...-unclean 2021-02-05 10:25:14
os: RRG/Iceman/master/v4.9237-3013-g6bcf31e68-dirt...-unclean 2021-02-05 10:25:44
compiled with GCC 8.4.0

[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23: 8: 7
HF image built for 2s30vq100 on 2020-07-08 at 23: 8:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23: 8:30

[ Hardware ]
--= uC: AT91SAM7S512 Rev A
--= Embedded Processor: ARM7TDMI
--= Nonvolatile Program Memory Size: 512K bytes, Used: 276125 bytes (53%) Free: 248163 bytes (47%)
--= Second Nonvolatile Program Memory Size: None
--= Internal SRAM Size: 64K bytes
--= Architecture Identifier: AT91SAM7Sxx Series
--= Nonvolatile Program Memory Type: Embedded Flash Memory

and then I tried clone pyramid fobs with facility code and card number,when I recheck,showed no valid fobs below,
[usb] pm3 --> lf py cl --fc 89 --cn 62274
[=] Preparing to clone Farpointe/Pyramid to T55x7 with Facility Code: 89, Card Number: 62274
[+] Blk | Data
[+] ----+------------
[+] 00 | 00107080
[+] 01 | 00010101
[+] 02 | 01010101
[+] 03 | 0101014A
[+] 04 | 9E9B0B13
[+] Done
[?] Hint: try `lf pyramid reader` to verify
[usb] pm3 --> lf pyramid reader
[usb] pm3 --> lf sea

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
Couldn't identify a chipset

after I did tried detect and info showed below[usb] pm3 --> lf t55 detect
[=] Chip Type : T55x7
[=] Modulation : FSK2a
[=] Bit Rate : 4 - RF/50
[=] Inverted : Yes
[=] Offset : 33
[=] Seq. Term. : No
[=] Block0 : 0x00107080 (Auto detect)
[=] Downlink Mode : default/fixed bit length
[=] Password Set : No

[usb] pm3 --> lf t55 du
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] 00 | 00107080 | 00000000000100000111000010000000 | ..p.
[+] 01 | 00010101 | 00000000000000010000000100000001 | ....
[+] 02 | 01010101 | 00000001000000010000000100000001 | ....
[+] 03 | 00000000 | 00000000000000000000000000000000 | ....
[+] 04 | 00000000 | 00000000000000000000000000000000 | ....
[+] 05 | 00000000 | 00000000000000000000000000000000 | ....
[+] 06 | 00000000 | 00000000000000000000000000000000 | ....
[+] 07 | 12345678 | 00010010001101000101011001111000 | .4Vx
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] 00 | 00107080 | 00000000000100000111000010000000 | ..p.
[+] 01 | 701C8168 | 01110000000111001000000101101000 | p..h
[+] 02 | 501086CC | 01010000000100001000011011001100 | P...
[+] 03 | 00A00003 | 00000000101000000000000000000011 | ....
[+] saved to json file lf-t55xx-00010101-01010101-dump-1.json
[+] saved 12 blocks to text file lf-t55xx-00010101-01010101-dump-1.eml
[+] saved 48 bytes to binary file lf-t55xx-00010101-01010101-dump-1.bin
[usb] pm3 --> lf t55 info

--- T55x7 Configuration & Information ---------
-------------------------------------------------------------
Safer key : 0
reserved : 1
Data bit rate : 0 - RF/8
eXtended mode : No
Modulation : 0x0E (Unknown)
PSK clock frequency : 0 - RF/2
AOR - Answer on Request : No
OTP - One Time Pad : Yes - Warning
Max block : 0
Password mode : No
Sequence Terminator : No
Fast Write : No
Inverse data : No
POR-Delay : No
-------------------------------------------------------------
Raw Data - Page 0, block 0
0x0020E100 00000000001000001110000100000000
-------------------------------------------------------------

[!] Communicating with Proxmark3 device failed

[=] Running in OFFLINE mode. Use "hw connect" to reconnect

but when I clone with em tag id,clone fob working fine,can any one tell what's wrong with this fobs??
EM TAG ID : 4F00D76573

Possible de-scramble patterns
Unique TAG ID : F200EBA6CE
HoneyWell IdentKey {
DEZ 8 : 14116211
DEZ 10 : 0014116211
DEZ 5.5 : 00215.25971
DEZ 3.5A : 079.25971
DEZ 3.5B : 000.25971
DEZ 3.5C : 215.25971
DEZ 14/IK2 : 00339316532595
DEZ 15/IK3 : 001039397529294
DEZ 20/ZK : 15020000141110061214
}
Other : 25971_215_14116211
Pattern Paxton : 1340842867 [0x4FEBA373]
Pattern 1 : 15440686 [0xEB9B2E]
Pattern Sebury : 25971 87 5727603 [0x6573 0x57 0x576573]

Valid EM410x ID Found!
Writing T55x7 tag with UID 0x4f00d76573 (clock rate: 64)
#db# Started writing T55x7 tag ...
#db# Clock rate: 64
#db# Tag T55x7 written with 0xffa7c006dec53ccc

NOTE: some demods output possible binary
if it finds something that looks like a tag
False Positives ARE possible

Checking for known tags:

EM410x pattern found:

EM TAG ID : 4F00D76573

Possible de-scramble patterns
Unique TAG ID : F200EBA6CE
HoneyWell IdentKey {
DEZ 8 : 14116211
DEZ 10 : 0014116211
DEZ 5.5 : 00215.25971
DEZ 3.5A : 079.25971
DEZ 3.5B : 000.25971
DEZ 3.5C : 215.25971
DEZ 14/IK2 : 00339316532595
DEZ 15/IK3 : 001039397529294
DEZ 20/ZK : 15020000141110061214
}
Other : 25971_215_14116211
Pattern Paxton : 1340842867 [0x4FEBA373]
Pattern 1 : 15440686 [0xEB9B2E]
Pattern Sebury : 25971 87 5727603 [0x6573 0x57 0x576573]

Valid EM410x ID Found!

iceman · 2021-07-04 09:48:25

It looks like you are running a old fw/client. Try latest release instead and see if that helps your setup.

seanedu · 2021-07-04 17:19:00

@Iceman,thanks for your reply,I will try later this latest release,but other T5577 fobs working without any issues,only couple of fobs that are not working,as far as I know,t5577 fobs supposed to clone mostly any fobs,funny thing is,it can copy only em tags but no other kind of tags though.

Proxmark3 community

Announcement

#1 2021-07-02 23:05:21

Help me with t5577 fobs acting weird

#2 2021-07-04 09:48:25

Re: Help me with t5577 fobs acting weird

#3 2021-07-04 17:19:00

Re: Help me with t5577 fobs acting weird

Board footer