| blob | 967a2179b20888e8223ea203e4ded54e1999a2a9 |
1 # T5577 Introduction Guide
2 <a id="Top"></a>
4 ### Based on Iceman Proxmark3 repo
6 ### Ver.1 8 Sep 2019
7 ### Ver.2 7 March 2021
9 # Table of Contents
11 | Contents |
12 | ----------------------------------------------------------------------------------- |
13 | [Part 1](#part-1) |
14 | [Introduction](#introduction) |
15 | [T5577 Overview](#t5577-overview) |
16 | [What data is on my T5577](#what-data-is-on-my-t5577) |
17 | [Read and Write Blocks of Data](#read-and-write-blocks-of-data) |
18 | [Exercise 1](#exercise-1) |
19 | [How do I use a password](#how-do-i-use-a-password) |
20 | |
21 | [Part 2 – Configuration Blocks](#part-2-configuration-blocks) |
22 | [The configuration Block – Block 0 Page 0](#the-configuration-block-block-0-page-0) |
23 | [Exercise 2](#exercise-2) |
24 | [The configuration Block – Block 3 Page 1](#the-configuration-block-block-3-page-1) |
25 | [Sniffing commands](#sniffing-commands) |
26 | [T5577 and Keysy](#t5577-and-keysy) |
28 # Part 1
29 ^[Top](#top)
31 ## Introduction
32 ^[Top](#top)
34 The T5577 is a generic LF (Low Frequency) RFID card that is used in the
35 125 Khz frequency space. It is a good card to use to learn about RFID and
36 learn how to use the proxmark3.
38 It is highly recommended that when learning about RFID that learning how
39 to read the data sheets be near the top of the list. It can be very hard
40 as the data sheet will hold the information you need, but you don’t yet
41 know what it means. As such, I will attempt to point to sections of the
42 data sheet and would highly advise that you look at the data sheet as
43 you go. Overtime the data sheet may change, as a result things may not
44 always be referenced correctly.
46 As at writing this guide, the data sheet can be found at :
48 <http://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-9187-RFID-ATA5577C_Datasheet.pdf>
50 This guide is not a how do I clone document. It is meant to help people
51 learn how to use the T5577 and in the process learn about rfid and the
52 proxmark3.
54 Throughout this guide I will give examples. It is recommended that you
55 try these as we go. To do so, have a blank T5577 card that you can use
56 for this purpose.
58 ## T5577 Overview
59 ^[Top](#top)
61 The T5577 is a chip that can hold data and a configuration (Section
62 4.12).
64 In the diagram below, all white blocks can hold data. Some can be used
65 for a second purpose, such as the ‘password’ and ‘traceability data’.
66 The ‘Configuration Data’ and ‘Analog front end option setup’ will tell
67 the chip how to behave.
69 
71 #### What is "Traceability Data"?
73 Traceability data is manufacturer-programmed (and locked) data that contains information related to the manufacture of the chip - presumably so that issues can be "traced back" to the point and date of manufacture. It contains data such as the year and quarter of manufacture, the wafer number on which the chip was produced, and the die number on the wafer. The traceabiltiy data occupies blocks 1 and 2 of Page 1, and is normally NOT writeable, although some T5577 clones will allow you to overwrite these blocks. You can read the traceability data with the `lf t55xx trace` command.
76 ## What data is on my T5577
77 ^[Top](#top)
79 Let’s have a look and see what a card might look like in the proxmark3
80 software. Since we can change the configuration of how the T5577 will
81 output data, the proxmark3 software needs to work out how to interpret
82 the data it receives, we do this with the following command.
84 It should be noted that the T5577 has many clones. As such the default
85 setup of each card may be different. If the tractability data is
86 present, then this will vary based on the batch of cards.
88 Always run this command when you place a t5577 on the proxmark3. In all
89 examples shown, it will be assumed you have run the detect command.
90 ```
91 [usb] pm3 --> lf t55xx detect
92 ```
93 You should see a results similar to the following:
94 ```
95 [=] Chip type......... T55x7
96 [=] Modulation........ ASK
97 [=] Bit rate.......... 2 - RF/32
98 [=] Inverted.......... No
99 [=] Offset............ 33
100 [=] Seq. terminator... Yes
101 [=] Block0............ 000880E0 (auto detect)
102 [=] Downlink mode..... default/fixed bit length
103 [=] Password set...... No
105 ```
106 Now that the proxmark3 has detected a T55x7 chip, and found some
107 information about it, we should be able to see all the data on the chip.
108 ```
109 [usb] pm3 --> lf t55xx dump
110 ```
111 Your results should look similar to the following:
112 ```
113 [+] Reading Page 0:
114 [+] blk | hex data | binary | ascii
115 [+] ----+----------+----------------------------------+-------
116 [+] 00 | 000880E0 | 00000000000010001000000011100000 | ....
117 [+] 01 | 00000000 | 00000000000000000000000000000000 | ....
118 [+] 02 | 00000000 | 00000000000000000000000000000000 | ....
119 [+] 03 | 00000000 | 00000000000000000000000000000000 | ....
120 [+] 04 | 00000000 | 00000000000000000000000000000000 | ....
121 [+] 05 | 00000000 | 00000000000000000000000000000000 | ....
122 [+] 06 | 00000000 | 00000000000000000000000000000000 | ....
123 [+] 07 | 00000000 | 00000000000000000000000000000000 | ....
124 [+] Reading Page 1:
125 [+] blk | hex data | binary | ascii
126 [+] ----+----------+----------------------------------+-------
127 [+] 00 | 000880E0 | 00000000000010001000000011100000 | ....
128 [+] 01 | 00000000 | 00000000000000000000000000000000 | ....
129 [+] 02 | 00000000 | 00000000000000000000000000000000 | ....
130 [+] 03 | 00000000 | 00000000000000000000000000000000 | ....
131 ```
132 I will cover the meaning of this data as we go, but for now, lets keep
133 it simple.
135 ## Read and Write Blocks of Data
136 ^[Top](#top)
138 The basic function of using the proxmark3 with rfid cards is to read and
139 write data. This reading and writing must be done in the correct way
140 needed for the chip (and its configuration). Lucky for us, the
141 developers have done a great job and gave us commands. What we need to
142 know is that with the T5577, data is read/written one complete block at a
143 time. Each block holds 32 bits of data (hence the binary output shown)
145 Since we know that the card has data and configuration blocks, lets stay
146 away from those while we learn how to read and write. I suggest you
147 follow along and perform each command and check the results as we go.
149 We can store our own data in blocks 1-7 (remember that block 7 will be
150 needed if we want to set a password).
152 (Don’t forget to run the detect command: lf t55xx detect, and ensure you
153 can see the card)
155 1) Check what is stored in block 1. The following command can be read
156 as, run a low frequency (lf) command for the T55xx chip (t55xx) and
157 read block (b) number 1.
158 ```
159 [usb] pm3 --> lf t55xx read -b 1
160 ```
161 result:
162 ```
163 [+] Reading Page 0:
164 [+] blk | hex data | binary | ascii
165 [+] ----+----------+----------------------------------+-------
166 [+] 01 | 00000000 | 00000000000000000000000000000000 | ....
167 ```
168 Note: Depending on the history of your card, your data may vary, but
169 should match the dump data.
171 2) Write some new data into block 1 on the card.
173 We use the -d option to supply the data ‘12345678’
174 ```
175 [usb] pm3 --> lf t55xx write -b 1 -d 12345678
176 ```
177 result:
178 ```
179 [=] Writing page 0 block: 01 data: 0x12345678
180 ```
181 3) Now, lets check if the data was written.
182 ```
183 [usb] pm3 --> lf t55xx read -b 1
184 ```
185 result:
186 ```
187 [+] Reading Page 0:
188 [+] blk | hex data | binary | ascii
189 [+] ----+----------+----------------------------------+-------
190 [+] 01 | 12345678 | 00010010001101000101011001111000 | .4Vx
191 ```
192 4) The data is written in Hexadecimal. A single hex digit holds 4 bits
193 of data. So to store 32 bits in a block, we need to supply 8 hex
194 digits (8 \* 4 = 32). If you are not familiar with hex and binary do a
195 little bit of home work to learn. The following is a quick start.
197 | Hex | Binary | Decimal |
198 |:---:|:------:|:-------:|
199 | 0 | 0000 | 0 |
200 | 1 | 0001 | 1 |
201 | 2 | 0010 | 2 |
202 | 3 | 0011 | 3 |
203 | 4 | 0100 | 4 |
204 | 5 | 0101 | 5 |
205 | 6 | 0110 | 6 |
206 | 7 | 0111 | 7 |
207 | 8 | 1000 | 8 |
208 | 9 | 1001 | 9 |
209 | A | 1010 | 10 |
210 | B | 1011 | 11 |
211 | C | 1100 | 12 |
212 | D | 1101 | 13 |
213 | E | 1110 | 14 |
214 | F | 1111 | 15 |
216 To use all the bits we supply the data in Hex format and it will
217 always be 8 hex digits.
219 Lets try and write 89ABCDEF
220 ```
221 [usb] pm3 --> lf t55xx write -b 1 -d 89abcdef
222 ```
223 result:
224 ```
225 [=] Writing page 0 block: 01 data: 0x89ABCDEF
226 ```
227 and check
228 ```
229 [usb] pm3 --> lf t55xx read -b 1
230 ```
231 result:
232 ```
233 [+] Reading Page 0:
234 [+] blk | hex data | binary | ascii
235 [+] ----+----------+----------------------------------+-------
236 [+] 01 | 89ABCDEF | 10001001101010111100110111101111 | ....
237 ```
239 ### Exercise 1
240 ^[Top](#top)
242 Using the read and write commands you have learnt see if you can make
243 the lf t55 dump command show the following data for blocks 1-7 (Page 0).
244 Do not write to block 0 or try and change the data on page 1.
245 ```
246 [usb] pm3 --> lf t55 dump
247 ```
248 result:
249 ```
250 [+] Reading Page 0:
251 [+] blk | hex data | binary | ascii
252 [+] ----+----------+----------------------------------+-------
253 [+] 00 | 000880E0 | 00000000000010001000000011100000 | ....
254 [+] 01 | 89ABCDEF | 10001001101010111100110111101111 | ....
255 [+] 02 | 00000000 | 00000000000000000000000000000000 | ....
256 [+] 03 | 00000000 | 00000000000000000000000000000000 | ....
257 [+] 04 | 00000000 | 00000000000000000000000000000000 | ....
258 [+] 05 | 00000000 | 00000000000000000000000000000000 | ....
259 [+] 06 | 00000000 | 00000000000000000000000000000000 | ....
260 [+] 07 | 00000000 | 00000000000000000000000000000000 | ....
261 [+] Reading Page 1:
262 [+] blk | hex data | binary | ascii
263 [+] ----+----------+----------------------------------+-------
264 [+] 00 | 000880E0 | 00000000000010001000000011100000 | ....
265 [+] 01 | 00000000 | 00000000000000000000000000000000 | ....
266 [+] 02 | 00000000 | 00000000000000000000000000000000 | ....
267 [+] 03 | 00000000 | 00000000000000000000000000000000 | ....
268 ```
270 Practice reading and writing to blocks 1 to 6 until you are happy you
271 can do it and get the results you wanted (i.e. the data you want stored
272 is written to the block you want it stored in). I recommend staying
273 away from block 7 as this is where the password is stored, if used.
274 If you forget this data/password, you won't be able to read or write
275 to the card.
277 ## How do I use a password
278 ^[Top](#top)
280 This can be a little tricky for beginners.
281 ***If you forget your password you will lose access to your card***.
283 To tell the T5577 to use a password, we have to change the data in the
284 configuration block (0). To help learn this and make it as simple as I
285 can, please read and follow exactly. If your results DON’T match 100% as
286 required, please do not proceed.
288 1) Lets start with a known card state and wipe the card. This will set
289 a default configuration to block 0 and set all the data in blocks
290 1-7 to a default.
291 ```
292 [usb] pm3 --> lf t55xx wipe
293 ```
294 Result:
295 ```
296 [=] Target T55x7 tag
297 [=] Default configuration block 000880E0
299 [=] Begin wiping...
300 [=] Writing page 0 block: 00 data: 0x000880E0
301 [=] Writing page 0 block: 01 data: 0x00000000
302 [=] Writing page 0 block: 02 data: 0x00000000
303 [=] Writing page 0 block: 03 data: 0x00000000
304 [=] Writing page 0 block: 04 data: 0x00000000
305 [=] Writing page 0 block: 05 data: 0x00000000
306 [=] Writing page 0 block: 06 data: 0x00000000
307 [=] Writing page 0 block: 07 data: 0x00000000
308 ```
310 2) Check that the card is in the desired state.
311 ```
312 [usb] pm3 --> lf t55xx detect
313 ```
314 result:
315 ```
316 [=] Chip type......... T55x7
317 [=] Modulation........ ASK
318 [=] Bit rate.......... 2 - RF/32
319 [=] Inverted.......... No
320 [=] Offset............ 33
321 [=] Seq. terminator... Yes
322 [=] Block0............ 000880E0 (auto detect)
323 [=] Downlink mode..... default/fixed bit length
324 [=] Password set...... No
325 ```
327 If block 0 does not hold the hex data **0x000880E0 resolve this
328 first before proceeding.**
330 3) Set the password we want to use. For this example lets use the
331 password : ***12345678***
333 The password is saved in block 7 of page 0.
334 ```
335 [usb] pm3 --> lf t55xx write -b 7 -d 12345678
336 ```
337 result:
338 ```
339 [=] Writing page 0 block: 07 data: 0x12345678
340 ```
342 4) Lets verify both block 0 and block 7
343 ```
344 [usb] pm3 --> lf t55xx dump
345 ```
346 result:
347 ```
348 [+] Reading Page 0:
349 [+] blk | hex data | binary | ascii
350 [+] ----+----------+----------------------------------+-------
351 [+] 00 | 000880E0 | 00000000000010001000000011100000 | ....
352 [+] 01 | 00000000 | 00000000000000000000000000000000 | ....
353 [+] 02 | 00000000 | 00000000000000000000000000000000 | ....
354 [+] 03 | 00000000 | 00000000000000000000000000000000 | ....
355 [+] 04 | 00000000 | 00000000000000000000000000000000 | ....
356 [+] 05 | 00000000 | 00000000000000000000000000000000 | ....
357 [+] 06 | 00000000 | 00000000000000000000000000000000 | ....
358 [+] 07 | 12345678 | 00010010001101000101011001111000 | .4Vx
359 [+] Reading Page 1:
360 [+] blk | hex data | binary | ascii
361 [+] ----+----------+----------------------------------+-------
362 [+] 00 | 000880E0 | 00000000000010001000000011100000 | ....
363 [+] 01 | 00000000 | 00000000000000000000000000000000 | ....
364 [+] 02 | 00000000 | 00000000000000000000000000000000 | ....
365 [+] 03 | 00000000 | 00000000000000000000000000000000 | ....
366 ```
367 ***Important : If block 0 and block 7 don’t match exactly, do not continue.***
369 5) Now we have a known configuration block and a known password of
370 12345678, we are ready to tell the card to use the password.
372 To do this the datasheet tells us we need to set the 28<sup>th</sup>
373 bit “PWD”. Check your datasheet and see the entire table (remember
374 the data sheet is your friend).
376 
378 We will cover other things in the configuration later. But the key
379 note here, is we ONLY want to change bit 28 and nothing else.
381 Current Block 0 : ***000880E0***
382 New Block 0 : ***000880F0***
384 To understand what happened to get from 000880E0 to 000880F0 we need
385 to look at the binary data.
387 While this can be confusing, it is important to understand this as we
388 do more advanced things.
390 Bit Location (28)
391 000000000011111111112222222 ***2*** 2233
392 123456789012345678901234567 ***8*** 9012
394 | Hex Data | Binary Data |
395 |:--------:|:---------------------------------------|
396 | 000880E0 | 000000000000100010000000111***0***0000 |
397 | 000880F0 | 000000000000100010000000111***1***0000 |
399 See how in the above we changed the bit in location 28 from a 0 to 1
400 0 = No Password, 1 = Use Password
402 Note how we did NOT change any other part of the configuration, only bit 28.
404 To re-cap.
405 We put the card into a known configuration Block 0 : 000880E0
406 We set the a known password Block 7 : 12345678
407 We altered the config data to tell the T5577 to use the password.
408 New Block 0 : 000880F0
410 If you have completed all steps and have the exact same results, we are
411 ready to apply the new configuration.
412 ```
413 [usb] pm3 --> lf t55xx write -b 0 -d 000880F0
414 ```
415 result:
416 ```
417 [=] Writing page 0 block: 00 data: 0x000880F0
418 ```
420 6) Lets check what happens when the password is set.
421 ```
422 [usb] pm3 --> lf t55 detect
423 ```
424 result:
425 ```
426 [!] Could not detect modulation automatically. Try setting it manually with 'lf t55xx config'
427 ```
428 Note how the lf t55 detect no longer seems to work\!
430 In this case, this is due to needing a password to read/write to the
431 card.
433 Lets try again, but this time supply the password. We use the option
434 -p followed by the password.
435 ```
436 [usb] pm3 --> lf t55 detect -p 12345678
437 ```
438 result:
439 ```
440 [=] Chip type......... T55x7
441 [=] Modulation........ ASK
442 [=] Bit rate.......... 2 - RF/32
443 [=] Inverted.......... No
444 [=] Offset............ 33
445 [=] Seq. terminator... Yes
446 [=] Block0............ 000880F0 (auto detect)
447 [=] Downlink mode..... default/fixed bit length
448 [=] Password set...... Yes
449 [=] Password.......... 12345678
450 ```
452 7) Write a block of data with a password
453 ```
454 [usb] pm3 --> lf t55xx write -b 1 -d 1234abcd -p 12345678
455 ```
456 result:
457 ```
458 [=] Writing page 0 block: 01 data: 0x1234ABCD pwd: 0x12345678
459 ```
461 8) Read a block of data with a password
463 ***\*\*\*\* Important \*\*\*\****
465 ***Reading a T5577 block with a password when a password is not
466 enabled can result in locking the card. Please only use read with a
467 password when it is known that a password is in use.
469 At least don't use block 0 for this and password with `1` in the most significant bit***
471 The proxmark3 has a safety check\!
472 ```
473 [usb] pm3 --> lf t55xx read -b 1 -p 12345678
474 ```
475 result:
476 ```
477 [+] Reading Page 0:
478 [+] blk | hex data | binary | ascii
479 [+] ----+----------+----------------------------------+-------
480 [!] Safety check: Could not detect if PWD bit is set in config block. Exits.
481 ```
483 Note that the proxmark3 did not read the block, the safety kicked in
484 and wants us to confirm by supply the override option ‘-o’.
486 Lets try again with the ‘-o’ option as we know the password is set.
487 ```
488 [usb] pm3 --> lf t55xx read -b 1 -p 12345678 -o
489 ```
490 result:
491 ```
492 [+] Reading Page 0:
493 [+] blk | hex data | binary | ascii
494 [+] ----+----------+----------------------------------+-------
495 [=] Safety check overridden - proceeding despite risk
496 [+] 01 | 1234ABCD | 00010010001101001010101111001101 | .4..
497 ```
498 This time, we can see the data we wrote to block 1 is found with the
499 read command.
501 9) Remove the need to supply the password.
503 To do this we need to clear Bit 28 (set to 0) in the config. We have
504 this from above.
506 Remember if we don’t know the config and write this config to the
507 card, it will overwrite all other settings. This can recover the
508 card, but will lose any settings you may want. So it’s a good idea
509 to read the config, and set bit 28 to 0, rather than just overwrite
510 the config and change the way the card works.
512 In our examples we know what it should be : 000880E0
513 ```
514 [usb] pm3 --> lf t55xx write -b 0 -d 000880E0 -p 12345678
515 ```
516 result:
517 ```
518 [=] Writing page 0 block: 00 data: 0x000880E0 pwd: 0x12345678
519 ```
520 Now check if we can detect without a password
521 ```
522 [usb] pm3 --> lf t55 detect
523 ```
524 result:
525 ```
526 [=] Chip type......... T55x7
527 [=] Modulation........ ASK
528 [=] Bit rate.......... 2 - RF/32
529 [=] Inverted.......... No
530 [=] Offset............ 33
531 [=] Seq. terminator... Yes
532 [=] Block0............ 000880E0 (auto detect)
533 [=] Downlink mode..... default/fixed bit length
534 [=] Password set...... No
535 ```
536 Yes we can! We can see Block 0 is the correct config 000880E0
538 # Part 2 – Configuration Blocks
539 ^[Top](#top)
541 One of the things a lot of people have trouble with or miss, is that the
542 T5577 has two different and separate communications protocols, each with
543 their own sub-protocols.
545 - Card to Reader
546 - Reader to Card
548 In Card to Reader, the T5577 will encode its data using the settings
549 from Block 0 in Page 0. It will use this in both default read mode
550 (where is sends out the blocks from 1 to x on power up), as well as when
551 it responds to commands.
553 In the Reader To Card, the T5577 will encode the data using the settings
554 from Block 3 Page 1. If the command is not encoded correctly it will
555 ignore the command and revert back to default read mode.
557 ## The configuration Block – Block 0 Page 0
558 ^[Top](#top)
560 For this configuration the settings chosen will be for the purpose of
561 the card when used in production. E.G. If you want the card to act like
562 an EM4100, then we need to choose the settings that work like the
563 EM4100; same goes for others like HID. I am not going to cover these
564 here, rather use an example. Others have collected these and posted on the
565 forum or can be found by searching the web.
567 To get started lets look back at the data sheet.
569 
571 The non-password protect EM4100 could have a block 0 config of 00148040,
572 so what does it mean.
574 To decode this config, we need to look at it in binary
575 00000000000101001000000001000000. Note that it had 32 bits and the
576 config block 0 is 32 bits. Now we can break it down.
578 | Bits | Purpose | Value |
579 | ------- | ---------------------- | ----------- |
580 | 0000 | Master Key | Nothing Set |
581 | 0000000 | Not used in Basic Mode | |
582 | 101 | Data Bit Rate | RF/64 |
583 | 0 | Not used in Basic Mode | |
584 | 01000 | Modulation | Manchester |
585 | 00 | PSKCF | RF/2 |
586 | 0 | AOR | Not Set |
587 | 0 | Not used in Basic Mode | |
588 | 010 | Max Block | 2 |
589 | 0 | Password | Not Set |
590 | 0 | ST Sequence Terminator | Not Set |
591 | 00 | Not used in Basic Mode | |
592 | 0 | Init Delay | Not Set |
594 To get more detail on each item, read through the data sheet.
596 Lets see how the proxmark3 can help us learn. We will assume the T5577
597 is in the same state from Part 1, where we can write to the card with no
598 password set (if not, review and get you card back to this state).
600 1) Lets turn you T5577 into an EM4100 with ID 1122334455
601 ```
602 [usb] pm3 --> lf em 410x clone --id 1122334455
603 ```
604 result:
605 ```
606 [+] Preparing to clone EM4102 to T55x7 tag with ID 1122334455 (RF/64)
607 [#] Clock rate: 64
608 [#] Tag T55x7 written with 0xff8c65298c94a940
610 [+] Done
611 ```
613 2) Check this has worked.
614 ```
615 [usb] pm3 --> lf search
616 ```
617 result:
618 ```
619 [=] Note: False Positives ARE possible
620 [=]
621 [=] Checking for known tags...
622 [=]
623 [!] ⚠️ Specify one authentication mode
624 [+] EM 410x ID 1122334455
625 [+] EM410x ( RF/64 )
626 [=] -------- Possible de-scramble patterns ---------
627 [+] Unique TAG ID : 8844CC22AA
628 [=] HoneyWell IdentKey
629 [+] DEZ 8 : 03359829
630 [+] DEZ 10 : 0573785173
631 [+] DEZ 5.5 : 08755.17493
632 [+] DEZ 3.5A : 017.17493
633 [+] DEZ 3.5B : 034.17493
634 [+] DEZ 3.5C : 051.17493
635 [+] DEZ 14/IK2 : 00073588229205
636 [+] DEZ 15/IK3 : 000585269781162
637 [+] DEZ 20/ZK : 08080404121202021010
638 [=]
639 [+] Other : 17493_051_03359829
640 [+] Pattern Paxton : 289899093 [0x11478255]
641 [+] Pattern 1 : 5931804 [0x5A831C]
642 [+] Pattern Sebury : 17493 51 3359829 [0x4455 0x33 0x334455]
643 [+] VD / ID : 017 / 0573785173
644 [=] ------------------------------------------------
646 [+] Valid EM410x ID found!
648 [+] Chipset detection: T55xx
649 [?] Hint: try `lf t55xx` commands
650 ```
651 Looks good.
653 3) Now lets see what the T5577 detect and info shows
654 ```
655 [usb] pm3 --> lf t55 detect
656 ```
657 result:
658 ```
659 [=] Chip type......... T55x7
660 [=] Modulation........ ASK
661 [=] Bit rate.......... 5 - RF/64
662 [=] Inverted.......... No
663 [=] Offset............ 33
664 [=] Seq. terminator... Yes
665 [=] Block0............ 00148040 (auto detect)
666 [=] Downlink mode..... default/fixed bit length
667 [=] Password set...... No
668 ```
669 ```
670 [usb] pm3 --> lf t55xx info
671 ```
672 result:
673 ```
675 [=] --- T55x7 Configuration & Information ---------
676 [=] Safer key : 0
677 [=] reserved : 0
678 [=] Data bit rate : 5 - RF/64
679 [=] eXtended mode : No
680 [=] Modulation : 8 - Manchester
681 [=] PSK clock frequency : 0 - RF/2
682 [=] AOR - Answer on Request : No
683 [=] OTP - One Time Pad : No
684 [=] Max block : 2
685 [=] Password mode : No
686 [=] Sequence Terminator : No
687 [=] Fast Write : No
688 [=] Inverse data : No
689 [=] POR-Delay : No
690 [=] -------------------------------------------------------------
691 [=] Raw Data - Page 0, block 0
692 [=] 00148040 - 00000000000101001000000001000000
693 [=] --- Fingerprint ------------
694 [+] Config block match : EM unique, Paxton
696 ```
697 We can see that the info gave us more information and confirmed what
698 we decoded by hand. But remember, the detect is still needed so the
699 proxmark3 software will know how to decode the info block.
701 We can see that for the EM4100 emulation we have two blocks of data
702 (Max Block = 2). On the T5577 these will be Blocks 1 and 2.
704 ## Exercise 2
705 ^[Top](#top)
707 Using the skills form part 1, see if you can view the data in blocks 1 and 2.
709 Note: the EM4100 ID of 1122334455 is encoded, so don’t expect to see
710 those bytes as such. To learn how to do that, you guessed it, find the
711 datasheet and review.
713 At this point we have an EM4100 card. If we wanted to password protect
714 it, we can follow the password section and update the config from
715 00148040 to 00148050.
717 ***Important : Don’t forget to set a valid password in block 7 and remember it.***
719 ## The configuration Block – Block 3 Page 1
720 ^[Top](#top)
722 _to be written_
725 ## Sniffing commands
726 ^[Top](#top)
728 Some readers work with cards via T55xx commands (read/write/etc) and think that they are safe)
729 The password in this case is sent in clear text.
730 So) There is a sniff command to get this command from the buffer or the field:
732 [usb] pm3 --> lf t55xx sniff
734 result:
736 [=] T55xx command detection
737 [+] Downlink mode | password | Data | blk | page | 0 | 1 | raw
738 [+] ------------------------+------------+----------+-----+------+-----+-+---------------------------------------------
739 [+] Default write/pwd read | [FFxxxxxx] | FFxxxxxx | 6 | 0 | 16 | 45 | 1011111111101xxxxxxxxxxxxxxxx100000110
740 [+] Default write/pwd read | [FFxxxxxx] | FFxxxxxx | 6 | 0 | 17 | 46 | 1011111111101xxxxxxxxxxxxxxxx100000110
741 [+] -------------------------------------------------------------------------------------------------------------------
745 ## T5577 and Keysy
746 ^[Top](#top)
748 The Keysy tag cloning tool (https://tinylabs.io/keysy/) uses T5577 tags that have a special "password" value (NOT the password described above) written in Block 6 that is tied to the traceability data. The Keysy checks and computes the proper value for Block 6 and will not write to a tag that does not contain the proper value. This DRM technology relies on the face that genuine T5577 chips cannot have their traceability data (Blocks 1 and 2 of Page 1) re-written and that the method to computer the proper value for Block 6 is proprietary, therefore compelling you to buy their branded tags.
750 As noted earlier, certain T5577 clones DO allow you to overwrite the traceability data, thereby allowing a dump of a new Keysy tag to completely overwrite the entire memory and tricking the Keysy into using that tag. This also implies that you should NEVER overwrite Block 6 on a Keysy tag, as doing so will prevent the use of the Keysy to program that tag in the future without restoring that value.