proxmark3 icon indicating copy to clipboard operation
proxmark3 copied to clipboard

LF tags not wowrking

Open PrimaLuceEnrico opened this issue 9 months ago • 6 comments

On a Proxmark3 RDV4 I installed the latest FW (Release v4.19552). BT is enabled as I have the blueshark module.

All works fine with HF tags (I've succesfully tested some mifare).

With a tag I suppose is a EM tag i get this result:

[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
[=] Odd size,  false positive?
[+] Indala (len 400)  Raw: 800000001fffffffffffffffffffffffffffffffffffffffffffffff


[+] Valid Indala ID found!

[=] Couldn't identify a chipset

The Raw response variates a little but is mostly the one above. I think is not an Indala, anyway I treate it as it would be. I clone it writing on a t55xx the raw data and read back the same values. The cloned tag doesen't work on the "original" reader (door access).

If I clone that tag with a simple LF "duplicator" (dupliprox), the cloned tag works at the door. (It's frustrating that my beloved PM3 can't do what the duplicator does without difficulty.)

If I read the working cloned tag, I get:

[usb] pm3 --> lf search

[=] Note: False Positives ARE possible
[=] 
[=] Checking for known tags...
[=] 
[-] ⛔ No known 125/134 kHz tags found!
[+] Chipset detection: T55xx
[?] Hint: try `lf t55xx` commands

I succesfully read any kind of EM tag with this PM3 in the past, I'm pretty sure I read EM tag working on the same system (and I remember they were EM). The same happens with a different RDV3 pm3. Nothing changes between BT and USB connection.

I'm supposing something is broken on the LF code.

PrimaLuceEnrico avatar Mar 05 '25 13:03 PrimaLuceEnrico

I tried a lot of positions, with "lf tune" at minimum or maximum value, with a CD cover inserted between the tag and the reader. If I go far away from the reader, the raw data is variable (= it reads noise)

The "cloned" tag opens the door because it contains valid data, otherwise the door would remain closed (as happens with the tag copied with raw indala data on the pm3)! It is an access control system, not a "tag present in front of the reader" system!

Il 6 marzo 2025 02:50:38 CET, "小兽兽" @.***> ha scritto:

zhiyan114 left a comment (RfidResearchGroup/proxmark3#2771)

Regarding the "EM Tag", try position it differently and see if you can get it to read (i.e. maybe a few CM above the PM3's antenna).

For the "cloned" tag, the output indicates that no valid tag data is written to it, but it is working since it's detecting the tag.

-- Reply to this email directly or view it on GitHub: https://github.com/RfidResearchGroup/proxmark3/issues/2771#issuecomment-2702517819 You are receiving this because you authored the thread.

Message ID: @.***>

PrimaLuceEnrico avatar Mar 06 '25 06:03 PrimaLuceEnrico

Hello,

I have the same problem with an EM 4x50 tag. It used to work fine, now I have Indala.

wfire06100 avatar May 19 '25 17:05 wfire06100

pull latest and EM4x50 should be fixed now.

iceman1001 avatar Jun 08 '25 19:06 iceman1001

No puedo detectar en cuerpo un implante de 134.00 khz con proxmark3 easy. alguien que me pueda guiar.

elchipeado21 avatar Sep 03 '25 20:09 elchipeado21

and on a RDV4, flip the Q switch to 7

iceman1001 avatar Sep 03 '25 20:09 iceman1001

Mr. Iceman ¿Se puede piratear NFC kill desde un implante Verichip en el cuerpo, ¿alguien puede enviar una especie de señal al dispositivo para que no funcione? alguien que me pueda guiar.Please

elchipeado21 avatar Sep 06 '25 22:09 elchipeado21