Skip to content

Instantly share code, notes, and snippets.

@non-bin

non-bin/pm3 output.txt Secret

Created July 25, 2021 07:42
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save non-bin/e0525c9636602dc06233b1923f431e13 to your computer and use it in GitHub Desktop.
Save non-bin/e0525c9636602dc06233b1923f431e13 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
pm3 output.txt
pm3 ~$ ./proxmark3/client/proxmark3.exe com8
[=] Session log D:\ProxSpace\pm3/.proxmark3/logs/log_20210724.txt
[+] loaded from JSON file D:\ProxSpace\pm3/.proxmark3/preferences.json
[=] Using UART port com8
[=] Communicating with PM3 over USB-CDC
██████╗ ███╗ ███╗█████╗
██╔══██╗████╗ ████║╚═══██╗
██████╔╝██╔████╔██║ ████╔╝
██╔═══╝ ██║╚██╔╝██║ ╚══██╗
██║ ██║ ╚═╝ ██║█████╔╝ Iceman
╚═╝ ╚═╝ ╚═╝╚════╝ bleeding edge
https://github.com/rfidresearchgroup/proxmark3/
Warning: QT_DEVICE_PIXEL_RATIO is deprecated. Instead use:
QT_AUTO_SCREEN_SCALE_FACTOR to enable platform plugin controlled per-screen factors.
QT_SCREEN_SCALE_FACTORS to set per-screen DPI.
QT_SCALE_FACTOR to set the application global scale factor.
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:11:32
compiled with MinGW-w64 10.3.0 OS:Windows (64b) ARCH:x86_64
[ PROXMARK3 ]
firmware.................. PM3 GENERIC
[ ARM ]
bootrom: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:13:15
os: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:13:58
compiled with GCC 10.1.0
[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30
[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Internal SRAM size: 64K bytes
--= Architecture identifier: AT91SAM7Sxx Series
--= Embedded flash memory 512K bytes ( 53% used )
[usb] pm3 --> exit
pm3 ~$
pm3 ~$ ./proxmark3/client/proxmark3.exe com8
[=] Session log D:\ProxSpace\pm3/.proxmark3/logs/log_20210725.txt
[+] loaded from JSON file D:\ProxSpace\pm3/.proxmark3/preferences.json
[=] Using UART port com8
[=] Communicating with PM3 over USB-CDC
██████╗ ███╗ ███╗█████╗
██╔══██╗████╗ ████║╚═══██╗
██████╔╝██╔████╔██║ ████╔╝
██╔═══╝ ██║╚██╔╝██║ ╚══██╗
██║ ██║ ╚═╝ ██║█████╔╝ Iceman
╚═╝ ╚═╝ ╚═╝╚════╝ bleeding edge
https://github.com/rfidresearchgroup/proxmark3/
Warning: QT_DEVICE_PIXEL_RATIO is deprecated. Instead use:
QT_AUTO_SCREEN_SCALE_FACTOR to enable platform plugin controlled per-screen factors.
QT_SCREEN_SCALE_FACTORS to set per-screen DPI.
QT_SCALE_FACTOR to set the application global scale factor.
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:11:32
compiled with MinGW-w64 10.3.0 OS:Windows (64b) ARCH:x86_64
[ PROXMARK3 ]
firmware.................. PM3 GENERIC
[ ARM ]
bootrom: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:13:15
os: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:13:58
compiled with GCC 10.1.0
[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30
[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Internal SRAM size: 64K bytes
--= Architecture identifier: AT91SAM7Sxx Series
--= Embedded flash memory 512K bytes ( 53% used )
[usb] pm3 --> l
help This help
----------- -------------- Low Frequency --------------
awid { AWID RFIDs... }
cotag { COTAG CHIPs... }
destron { FDX-A Destron RFIDs... }
em { EM CHIPs & RFIDs... }
fdxb { FDX-B RFIDs... }
gallagher { GALLAGHER RFIDs... }
gproxii { Guardall Prox II RFIDs... }
hid { HID Prox RFIDs... }
hitag { Hitag CHIPs... }
idteck { Idteck RFIDs... }
indala { Indala RFIDs... }
io { ioProx RFIDs... }
jablotron { Jablotron RFIDs... }
keri { KERI RFIDs... }
motorola { Motorola RFIDs... }
nedap { Nedap RFIDs... }
nexwatch { NexWatch RFIDs... }
noralsy { Noralsy RFIDs... }
pac { PAC/Stanley RFIDs... }
paradox { Paradox RFIDs... }
pcf7931 { PCF7931 CHIPs... }
presco { Presco RFIDs... }
pyramid { Farpointe/Pyramid RFIDs... }
securakey { Securakey RFIDs... }
ti { TI CHIPs... }
t55xx { T55xx CHIPs... }
viking { Viking RFIDs... }
visa2000 { Visa2000 RFIDs... }
----------- --------------------- General ---------------------
config Get/Set config for LF sampling, bit/sample, decimation, frequency
cmdread Modulate LF reader field to send command before read
read Read LF tag
search Read and Search for valid known tag
sim Simulate LF tag from buffer
simask Simulate ASK tag
simfsk Simulate FSK tag
simpsk Simulate PSK tag
simbidir Simulate LF tag (with bidirectional data transmission between reader and tag)
sniff Sniff LF traffic between reader and tag
tune Continuously measure LF antenna tuning
[usb] pm3 --> LF em 401x clone
help This help
410x { EM 4102 commands... }
4x05 { EM 4205 / 4305 / 4369 / 4469 commands... }
4x50 { EM 4350 / 4450 commands... }
4x70 { EM 4070 / 4170 commands... }
[usb] pm3 --> LF em 410 clone
Writes EM410x ID to a T55x7 or Q5/T5555 tag
usage:
lf em 410x clone [-h] [--clk <dec>] --id <hex> [--q5]
options:
-h, --help This help
--clk <dec> <16|32|40|64> clock (default 64)
--id <hex> ID number (5 hex bytes)
--q5 specify writing to Q5/T5555 tag
examples/notes:
lf em 410x clone --id 0F0368568B -> write id to T55x7 tag
lf em 410x clone --id 0F0368568B --q5 -> write id to Q5/T5555 tag
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 -->
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[\]Searching for MOTOROLA tag...[=] signal looks like noise
[|]Searching for COTAG tag....
[-] No data found!
[=] Signal looks like noise. Maybe not an LF tag?
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 102) Raw: 80000000000000000000001ffdfff200020002000200020002000200
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[=] DEBUG: detectindala | 50
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 92) Raw: 7ffffffffffffffffffffff000020000000200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 96) Raw: 7fffffffffffffffffffffff00020000000200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 98) Raw: 7fffffffffffffffffffffffc0020000000200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> LF em 410 read
[usb] pm3 --> LF em 410 read
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id feedbeef
[+] Preparing to clone EM4102 to T55x7 tag with ID 00FEEDBEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff801eef777ef7cc
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef --help
Writes EM410x ID to a T55x7 or Q5/T5555 tag
usage:
lf em 410x clone [-h] [--clk <dec>] --id <hex> [--q5]
options:
-h, --help This help
--clk <dec> <16|32|40|64> clock (default 64)
--id <hex> ID number (5 hex bytes)
--q5 specify writing to Q5/T5555 tag
examples/notes:
lf em 410x clone --id 0F0368568B -> write id to T55x7 tag
lf em 410x clone --id 0F0368568B --q5 -> write id to Q5/T5555 tag
[usb] pm3 --> lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] Done.
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 121) Raw: 800000000000000000000000000003fc000200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf t55 det
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 read
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> LF em 410 read
[usb] pm3 --> for
help Use `<command> help` for details of a command
prefs { Edit client/device preferences... }
-------- ----------------------- Technology -----------------------
analyse { Analyse utils... }
data { Plot window / data buffer manipulation... }
emv { EMV ISO-14443 / ISO-7816... }
hf { High frequency commands... }
hw { Hardware commands... }
lf { Low frequency commands... }
nfc { NFC commands... }
reveng { CRC calculations from RevEng software... }
smart { Smart card ISO-7816 commands... }
script { Scripting commands... }
trace { Trace manipulation... }
wiegand { Wiegand format manipulation... }
-------- ----------------------- General -----------------------
auto Automated detection process for unknown tags
clear Clear screen
hints Turn hints on / off
msleep Add a pause in milliseconds
rem Add a text line in log file
quit
exit Exit program
[usb] pm3 --> auto
[=] lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[=] hf search
[!] No known/supported 13.56 MHz tags found
[=] lf search - unknown
[=] --> trying (125.00 kHz)
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[=] --> trying (134.83 kHz)
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[=] --> trying (250.00 kHz)
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[|]Searching for MOTOROLA tag...[=] signal looks like noise
[/]Searching for COTAG tag....
[-] No data found!
[=] Signal looks like noise. Maybe not an LF tag?
[=] --> trying (375.00 kHz)
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-]Searching for MOTOROLA tag...[=] signal looks like noise
[\]Searching for COTAG tag....
[-] No data found!
[=] Signal looks like noise. Maybe not an LF tag?
[=] --> trying (500.00 kHz)
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[|]Searching for MOTOROLA tag...[=] signal looks like noise
[/]Searching for COTAG tag....
[-] No data found!
[=] Signal looks like noise. Maybe not an LF tag?
[=] Failed both LF / HF SEARCH,
[=] Trying `lf read` and save a trace for you
[#] LF Sampling config
[#] [q] divisor............. 95 ( 125.00 kHz )
[#] [b] bits per sample..... 8
[#] [d] decimation.......... 1
[#] [a] averaging........... no
[#] [t] trigger threshold... 0
[#] [s] samples to skip..... 0
[#] LF Sampling Stack
[#] Max stack usage......... 4032 / 8480 bytes
qt.qpa.fonts: Unable to enumerate family ' "Copyright (C) H&Co | typography.com" '
[+] saved 40000 bytes to PM3 file 'lf_unknown_2021-07-25_07:19.pm3'
[usb] pm3 --> auto
[=] lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 104) Raw: 8000000000000000000000001ffc0000000200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> auto
[=] lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 107) Raw: 800000000000000000000000007c0000000200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> auto
[=] lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[=] hf search
[\] Searching for ThinFilm tag...pm3 ~$ ./proxmark3/client/proxmark3.exe com8
[=] Session log D:\ProxSpace\pm3/.proxmark3/logs/log_20210725.txt
[+] loaded from JSON file D:\ProxSpace\pm3/.proxmark3/preferences.json
[=] Using UART port com8
[=] Communicating with PM3 over USB-CDC
██████╗ ███╗ ███╗█████╗
██╔══██╗████╗ ████║╚═══██╗
██████╔╝██╔████╔██║ ████╔╝
██╔═══╝ ██║╚██╔╝██║ ╚══██╗
██║ ██║ ╚═╝ ██║█████╔╝ Iceman
╚═╝ ╚═╝ ╚═╝╚════╝ bleeding edge
https://github.com/rfidresearchgroup/proxmark3/
Warning: QT_DEVICE_PIXEL_RATIO is deprecated. Instead use:
QT_AUTO_SCREEN_SCALE_FACTOR to enable platform plugin controlled per-screen factors.
QT_SCREEN_SCALE_FACTORS to set per-screen DPI.
QT_SCALE_FACTOR to set the application global scale factor.
[ Proxmark3 RFID instrument ]
[ CLIENT ]
client: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:11:32
compiled with MinGW-w64 10.3.0 OS:Windows (64b) ARCH:x86_64
[ PROXMARK3 ]
firmware.................. PM3 GENERIC
[ ARM ]
bootrom: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:13:15
os: RRG/Iceman/master/v4.13441-276-g9625369fe 2021-07-24 11:13:58
compiled with GCC 10.1.0
[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30
[ Hardware ]
--= uC: AT91SAM7S512 Rev B
--= Embedded Processor: ARM7TDMI
--= Internal SRAM size: 64K bytes
--= Architecture identifier: AT91SAM7Sxx Series
--= Embedded flash memory 512K bytes ( 53% used )
[usb] pm3 --> lf t5
----------- ---------------------------- notice -----------------------------
Remember to run `lf t55xx detect` first whenever a new card
is placed on the Proxmark3 or the config block changed.
help This help
----------- --------------------- operations ---------------------
clonehelp Shows the available clone commands
config Set/Get T55XX configuration (modulation, inverted, offset, rate)
dangerraw Sends raw bitstream. Dangerous, do not use!!
detect Try detecting the tag modulation from reading the configuration block
deviceconfig Set/Get T55XX device configuration
dump Dump T55xx card Page 0 block 0-7
info Show T55x7 configuration data (page 0/ blk 0)
p1detect Try detecting if this is a t55xx tag by reading page 1
read Read T55xx block data
resetread Send Reset Cmd then lf read the stream to attempt to identify the start of it
restore Restore T55xx card Page 0 / Page 1 blocks
trace Show T55x7 traceability data (page 1/ blk 0-1)
wakeup Send AOR wakeup command
write Write T55xx block data
----------- --------------------- recovery ---------------------
bruteforce Simple bruteforce attack to find password
chk Check passwords from dictionary/flash
protect Password protect tag
recoverpw Try to recover from bad password write from a cloner
sniff Attempt to recover T55xx commands from sample buffer
special Show block changes with 64 different offsets
wipe Wipe a T55xx tag and set defaults (will destroy any data on tag)
[usb] pm3 --> lf t5 danger
[!] lf t55xx dangerraw: missing option -d|--data <string>
[!] lf t55xx dangerraw: missing option -t|--time <us>
[!] Try 'lf t55xx dangerraw --help' for more information.
[usb] pm3 --> lf t5 danger --help
This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.
Uncontrolled usage can easily write an invalid configuration, activate lock bits,
OTP bit, password protection bit, deactivate test-mode, lock your card forever.
WARNING: this may lock definitively the tag in an unusable state!
usage:
lf t55xx dangerraw [-h] -d <string> -t <us>
options:
-h, --help This help
-d, --data <string> raw bit string
-t, --time <us> <0 - 200000> time in microseconds before dropping the field
examples/notes:
lf t55xx dangerraw -d 01000000000000010000100000000100000000 -t 3200
[usb] pm3 --> lf em 410 clone --id beeeeeeeeef
[!!] Parameter error: parameter too large
[usb] pm3 --> lf em 410 clone --id beeeeeeef
[!!] Parameter error: Hex string must have EVEN number of digits
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 -->
[usb] pm3 --> lf em 410 clone --id beeeeeeeef
[+] Preparing to clone EM4102 to T55x7 tag with ID BEEEEEEEEF (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xffdfbdef7bdef7c8
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 clone --id beeeeeeeef--help
[!!] Parameter error: Invalid HEX value
[usb] pm3 --> lf em 410 clone --id beeeeeeeef -h
Writes EM410x ID to a T55x7 or Q5/T5555 tag
usage:
lf em 410x clone [-h] [--clk <dec>] --id <hex> [--q5]
options:
-h, --help This help
--clk <dec> <16|32|40|64> clock (default 64)
--id <hex> ID number (5 hex bytes)
--q5 specify writing to Q5/T5555 tag
examples/notes:
lf em 410x clone --id 0F0368568B -> write id to T55x7 tag
lf em 410x clone --id 0F0368568B --q5 -> write id to Q5/T5555 tag
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 -->
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 -->
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] Done.
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 -->
[usb] pm3 --> lf tune
[=] Measuring LF antenna at 125.00 kHz, click pm3 button or press Enter to exit
[=] Done.
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x clone --id 0F0368568B
[+] Preparing to clone EM4102 to T55x7 tag with ID 0F0368568B (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff83c03322a646e4
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 --> lf em 410x read
[usb] pm3 -->
[usb] pm3 -->
[usb] pm3 --> lf em 410x read-h
help This help
demod demodulate a EM410x tag from the GraphBuffer
reader attempt to read and extract tag data
sim simulate EM410x tag
brute reader bruteforce attack by simulating EM410x tags
watch watches for EM410x 125/134 kHz tags (option 'h' for 134)
spoof watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)
clone write EM410x UID to T55x7 or Q5/T5555 tag
[usb] pm3 --> lf em 410x read -h
read EM 410x tag
usage:
lf em 410x reader [-hiab@v] [--clk <dec>] [--err <dec>] [--len <dec>]
options:
-h, --help This help
--clk <dec> clock (default autodetect)
--err <dec> maximum allowed errors (default 100)
--len <dec> maximum length
-i, --invert invert output
-a, --amp amplify signal
-b break on first found
-@ continuous reader mode
-v, --verbose verbose output
examples/notes:
lf em 410x reader -> reader
lf em 410x reader -@ -> continuous reader mode
lf em 410x reader --clk 32 -> reader using a clock of RF/32
lf em 410x reader --clk 32 -i -> reader using a clock of RF/32 and inverting data
lf em 410x reader -i -> reader while inverting data
lf em 410x reader --clk 64 -i --err 0 -> reader using a clock of RF/64 and inverting data and allowing 0 demod errors
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -a
[usb] pm3 --> lf em 410x read -@ -a
[=] Press <Enter> to exit
[usb] pm3 --> lf em 410x read -@
[=] Press <Enter> to exit
[usb] pm3 --> lf em 410x read -@ -v
[=] Press <Enter> to exit
[usb] pm3 --> lf t55
----------- ---------------------------- notice -----------------------------
Remember to run `lf t55xx detect` first whenever a new card
is placed on the Proxmark3 or the config block changed.
help This help
----------- --------------------- operations ---------------------
clonehelp Shows the available clone commands
config Set/Get T55XX configuration (modulation, inverted, offset, rate)
dangerraw Sends raw bitstream. Dangerous, do not use!!
detect Try detecting the tag modulation from reading the configuration block
deviceconfig Set/Get T55XX device configuration
dump Dump T55xx card Page 0 block 0-7
info Show T55x7 configuration data (page 0/ blk 0)
p1detect Try detecting if this is a t55xx tag by reading page 1
read Read T55xx block data
resetread Send Reset Cmd then lf read the stream to attempt to identify the start of it
restore Restore T55xx card Page 0 / Page 1 blocks
trace Show T55x7 traceability data (page 1/ blk 0-1)
wakeup Send AOR wakeup command
write Write T55xx block data
----------- --------------------- recovery ---------------------
bruteforce Simple bruteforce attack to find password
chk Check passwords from dictionary/flash
protect Password protect tag
recoverpw Try to recover from bad password write from a cloner
sniff Attempt to recover T55xx commands from sample buffer
special Show block changes with 64 different offsets
wipe Wipe a T55xx tag and set defaults (will destroy any data on tag)
[usb] pm3 --> lf t55 -h
----------- ---------------------------- notice -----------------------------
Remember to run `lf t55xx detect` first whenever a new card
is placed on the Proxmark3 or the config block changed.
help This help
----------- --------------------- operations ---------------------
clonehelp Shows the available clone commands
config Set/Get T55XX configuration (modulation, inverted, offset, rate)
dangerraw Sends raw bitstream. Dangerous, do not use!!
detect Try detecting the tag modulation from reading the configuration block
deviceconfig Set/Get T55XX device configuration
dump Dump T55xx card Page 0 block 0-7
info Show T55x7 configuration data (page 0/ blk 0)
p1detect Try detecting if this is a t55xx tag by reading page 1
read Read T55xx block data
resetread Send Reset Cmd then lf read the stream to attempt to identify the start of it
restore Restore T55xx card Page 0 / Page 1 blocks
trace Show T55x7 traceability data (page 1/ blk 0-1)
wakeup Send AOR wakeup command
write Write T55xx block data
----------- --------------------- recovery ---------------------
bruteforce Simple bruteforce attack to find password
chk Check passwords from dictionary/flash
protect Password protect tag
recoverpw Try to recover from bad password write from a cloner
sniff Attempt to recover T55xx commands from sample buffer
special Show block changes with 64 different offsets
wipe Wipe a T55xx tag and set defaults (will destroy any data on tag)
[usb] pm3 --> lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 108) Raw: 7ffffffffffffffffffffffffff5555555555552aaaaaaaaaaaaaa55
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 105) Raw: 7fffffffffffffffffffffffffaa8000000200000002000000020000
[+] Valid Indala ID found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 118) Raw: 7ffffffffffffffffffffffffffffc00000200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[=] DEBUG: detectindala | 57
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[=] DEBUG: detectindala | 56
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf search
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 p1
[+] T55xx chip found!
Downlink Mode used : default/fixed bit length
[usb] pm3 --> lf t55 conf
[=] --- current t55xx config --------------------------
[=] Chip type......... T55x7
[=] Modulation........ ASK
[=] Bit rate.......... 0 - RF/8
[=] Inverted.......... No
[=] Offset............ 0
[=] Seq. terminator... No
[=] Block0............ 00000000 (n/a)
[=] Downlink mode..... default/fixed bit length
[=] Password set...... No
[usb] pm3 --> lf t55xx write b 0 d 000880E0 -t
lf t55xx write: unexpected argument "b"
lf t55xx write: unexpected argument "0"
lf t55xx write: unexpected argument "d"
lf t55xx write: unexpected argument "000880E0"
[!] Try 'lf t55xx write --help' for more information.
[usb] pm3 --> lf t55xx write -b 0 -d 000880E0 -t
[=] Writing page 0 block: 00 data: 0x000880E0
[#] Using Test Mode
[usb] pm3 --> lf t55xx write -b 0 -d 000880E0 -t
[=] Writing page 0 block: 00 data: 0x000880E0
[#] Using Test Mode
[usb] pm3 --> lf t55 p1
[+] T55xx chip found!
Downlink Mode used : default/fixed bit length
[usb] pm3 --> lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[usb] pm3 --> lf t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[usb] pm3 --> lf t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[usb] pm3 --> lf t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[usb] pm3 --> lf t55 p1
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 p1
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 p1
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 p1
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 p1
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 p1
[+] T55xx chip found!
Downlink Mode used : default/fixed bit length
[usb] pm3 --> lf t55 p1
[+] T55xx chip found!
Downlink Mode used : default/fixed bit length
[usb] pm3 --> lf t55 p1
[+] T55xx chip found!
Downlink Mode used : default/fixed bit length
[usb] pm3 --> lf t55 detect
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[usb] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 119) Raw: 800000000000000000000000000003c0000000000000000e3971c400
[+] Valid Indala ID found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf sear
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 120) Raw: 80000000000000000000000000000030000000000000000e3971c400
[+] Valid Indala ID found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf t55xx write b 0 d 000880E0 -t
lf t55xx write: unexpected argument "b"
lf t55xx write: unexpected argument "0"
lf t55xx write: unexpected argument "d"
lf t55xx write: unexpected argument "000880E0"
[!] Try 'lf t55xx write --help' for more information.
[usb] pm3 --> lf t55xx write -b 0 -d 000880E0 -t
[=] Writing page 0 block: 00 data: 0x000880E0
[#] Using Test Mode
[usb] pm3 --> lf t55xx write -b 0 -d 000880E0 -t
[=] Writing page 0 block: 00 data: 0x000880E0
[#] Using Test Mode
[usb] pm3 --> lf em 410 clone --id 0D00072C63
[+] Preparing to clone EM4102 to T55x7 tag with ID 0D00072C63 (RF/64)
[#] Clock rate: 64
[#] Tag T55x7 written with 0xff8360001e5c30c2
[+] Done
[?] Hint: try `lf em 410x reader` to verify
[usb] pm3 --> lf em 410 r
[usb] pm3 --> lf em 410 r
[usb] pm3 --> lf se
help This help
----------- -------------- Low Frequency --------------
awid { AWID RFIDs... }
cotag { COTAG CHIPs... }
destron { FDX-A Destron RFIDs... }
em { EM CHIPs & RFIDs... }
fdxb { FDX-B RFIDs... }
gallagher { GALLAGHER RFIDs... }
gproxii { Guardall Prox II RFIDs... }
hid { HID Prox RFIDs... }
hitag { Hitag CHIPs... }
idteck { Idteck RFIDs... }
indala { Indala RFIDs... }
io { ioProx RFIDs... }
jablotron { Jablotron RFIDs... }
keri { KERI RFIDs... }
motorola { Motorola RFIDs... }
nedap { Nedap RFIDs... }
nexwatch { NexWatch RFIDs... }
noralsy { Noralsy RFIDs... }
pac { PAC/Stanley RFIDs... }
paradox { Paradox RFIDs... }
pcf7931 { PCF7931 CHIPs... }
presco { Presco RFIDs... }
pyramid { Farpointe/Pyramid RFIDs... }
securakey { Securakey RFIDs... }
ti { TI CHIPs... }
t55xx { T55xx CHIPs... }
viking { Viking RFIDs... }
visa2000 { Visa2000 RFIDs... }
----------- --------------------- General ---------------------
config Get/Set config for LF sampling, bit/sample, decimation, frequency
cmdread Modulate LF reader field to send command before read
read Read LF tag
search Read and Search for valid known tag
sim Simulate LF tag from buffer
simask Simulate ASK tag
simfsk Simulate FSK tag
simpsk Simulate PSK tag
simbidir Simulate LF tag (with bidirectional data transmission between reader and tag)
sniff Sniff LF traffic between reader and tag
tune Continuously measure LF antenna tuning
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 118) Raw: 7ffffffffffffffffffffffffffffc30000000000000000e3971c400
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 126) Raw: 800000000000000000000000000007ffff8000000000000e3971c400
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 117) Raw: 7ffffffffffffffffffffffffffffd5fff8000000000000e3971c400
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 -->
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 127) Raw: 80000000000000000000000000000000006000000000000e3971c400
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 143) Raw: 80000000000000000000000000000ffffffffffffff0000e3971c400
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 127) Raw: 800000000000000000000000000007ffffe200000002000000020000
[+] Valid Indala ID found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[-] No known 125/134 kHz tags found!
[=] Couldn't identify a chipset
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 117) Raw: 800000000000000000000000000fffff000200000002000000020000
[+] Valid Indala ID found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 140) Raw: 80000000000000000000000000001bfffffdfffffe02000000020000
[+] Valid Indala ID found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf sea
[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] Indala (len 119) Raw: 800000000000000000000000000000001ffdfffffe02000000020000
[+] Valid Indala ID found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands
[usb] pm3 --> lf t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[usb] pm3 --> lf t55 p1
[+] T55xx chip found!
Downlink Mode used : default/fixed bit length
[usb] pm3 --> lf t55 det
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 det
[!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
[usb] pm3 --> lf t55 p1
[+] T55xx chip found!
Downlink Mode used : default/fixed bit length
[usb] pm3 --> lf t55
----------- ---------------------------- notice -----------------------------
Remember to run `lf t55xx detect` first whenever a new card
is placed on the Proxmark3 or the config block changed.
help This help
----------- --------------------- operations ---------------------
clonehelp Shows the available clone commands
config Set/Get T55XX configuration (modulation, inverted, offset, rate)
dangerraw Sends raw bitstream. Dangerous, do not use!!
detect Try detecting the tag modulation from reading the configuration block
deviceconfig Set/Get T55XX device configuration
dump Dump T55xx card Page 0 block 0-7
info Show T55x7 configuration data (page 0/ blk 0)
p1detect Try detecting if this is a t55xx tag by reading page 1
read Read T55xx block data
resetread Send Reset Cmd then lf read the stream to attempt to identify the start of it
restore Restore T55xx card Page 0 / Page 1 blocks
trace Show T55x7 traceability data (page 1/ blk 0-1)
wakeup Send AOR wakeup command
write Write T55xx block data
----------- --------------------- recovery ---------------------
bruteforce Simple bruteforce attack to find password
chk Check passwords from dictionary/flash
protect Password protect tag
recoverpw Try to recover from bad password write from a cloner
sniff Attempt to recover T55xx commands from sample buffer
special Show block changes with 64 different offsets
wipe Wipe a T55xx tag and set defaults (will destroy any data on tag)
[usb] pm3 --> lf t55 rec
[=] press <Enter> to exit
[=] Trying password 00000001
[=] Trying password 00000002
[=] Trying password 00000004
[=] Trying password 00000008
[=] Trying password 00000010
[=] Trying password 00000020
[=] Trying password 00000040
[=] Trying password 00000080
[=] Trying password 00000100
[=] Trying password 00000200
[=] Trying password 00000400
[=] Trying password 00000800
[=] Trying password 00001000
[=] Trying password 00002000
[=] Trying password 00004000
[=] Trying password 00008000
[=] Trying password 00010000
[=] Trying password 00020000
[=] Trying password 00040000
[=] Trying password 00080000
[=] Trying password 00100000
[=] Trying password 00200000
[=] Trying password 00400000
[=] Trying password 00800000
[=] Trying password 01000000
[=] Trying password 02000000
[=] Trying password 04000000
[=] Trying password 08000000
[=] Trying password 10000000
[=] Trying password 20000000
[=] Trying password 40000000
[=] Trying password 80000000
[=] Trying password 00000000
[-] Recover password failed
[usb] pm3 --> lf t55
----------- ---------------------------- notice -----------------------------
Remember to run `lf t55xx detect` first whenever a new card
is placed on the Proxmark3 or the config block changed.
help This help
----------- --------------------- operations ---------------------
clonehelp Shows the available clone commands
config Set/Get T55XX configuration (modulation, inverted, offset, rate)
dangerraw Sends raw bitstream. Dangerous, do not use!!
detect Try detecting the tag modulation from reading the configuration block
deviceconfig Set/Get T55XX device configuration
dump Dump T55xx card Page 0 block 0-7
info Show T55x7 configuration data (page 0/ blk 0)
p1detect Try detecting if this is a t55xx tag by reading page 1
read Read T55xx block data
resetread Send Reset Cmd then lf read the stream to attempt to identify the start of it
restore Restore T55xx card Page 0 / Page 1 blocks
trace Show T55x7 traceability data (page 1/ blk 0-1)
wakeup Send AOR wakeup command
write Write T55xx block data
----------- --------------------- recovery ---------------------
bruteforce Simple bruteforce attack to find password
chk Check passwords from dictionary/flash
protect Password protect tag
recoverpw Try to recover from bad password write from a cloner
sniff Attempt to recover T55xx commands from sample buffer
special Show block changes with 64 different offsets
wipe Wipe a T55xx tag and set defaults (will destroy any data on tag)
[usb] pm3 --> lf t55 info
[usb] pm3 --> lf t55 wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0
[=] Begin wiping...
[=] Writing page 0 block: 00 data: 0x000880E0
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 --> lf t55 wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0
[=] Begin wiping...
[=] Writing page 0 block: 00 data: 0x000880E0
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 --> lf t55 wipe -h
This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block
usage:
lf t55xx wipe [-h] [-c <hex>] [-p <hex>] [--q5] [--r0] [--r1] [--r2] [--r3]
options:
-h, --help This help
-c, --cfg <hex> configuration block0 (4 hex bytes)
-p, --pwd <hex> password (4 hex bytes)
--q5 specify writing to Q5/T5555 tag using dedicated config block
--r0 downlink - fixed bit length (detected def)
--r1 downlink - long leading reference
--r2 downlink - leading zero
--r3 downlink - 1 of 4 coding reference
examples/notes:
lf t55xx wipe -> wipes a T55x7 tag, config block 0x000880E0
lf t55xx wipe --q5 -> wipes a Q5/T5555 tag, config block 0x6001F004
lf t55xx wipe -p 11223344 -> wipes a T55x7 tag, config block 0x000880E0, using pwd
[usb] pm3 --> lf t55xx wipe -p 11223344
[=] Target T55x7 tag
[=] Using password 11223344
[=] Default configuration block 000880E0
[=] Begin wiping...
[=] Writing page 0 block: 00 data: 0x000880E0 pwd: 0x11223344
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 --> lf t55 wipe
[=] Target T55x7 tag
[=] Default configuration block 000880E0
[=] Begin wiping...
[=] Writing page 0 block: 00 data: 0x000880E0
[=] Writing page 0 block: 01 data: 0x00000000
[=] Writing page 0 block: 02 data: 0x00000000
[=] Writing page 0 block: 03 data: 0x00000000
[=] Writing page 0 block: 04 data: 0x00000000
[=] Writing page 0 block: 05 data: 0x00000000
[=] Writing page 0 block: 06 data: 0x00000000
[=] Writing page 0 block: 07 data: 0x00000000
[usb] pm3 --> lf t55 info
[usb] pm3 --> lf t55 dump
[+] Reading Page 0:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[+] Reading Page 1:
[+] blk | hex data | binary | ascii
[+] ----+----------+----------------------------------+-------
[usb] pm3 -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment