Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2017-06-30 13:01:30

Onisan
Contributor
From: London
Registered: 2016-07-18
Posts: 88

Fermax EM fobs

I have three Fermax fobs with numbers on them:
003019276      internal hex    01108B2411
002893668     internal hex    01108A8C4B
003496488     internal hex    010FAC3033

More for fun than anything else as I can copy these quite easily but I've been trying to work out how the numbers are derived from the Hex.
I've tried converting the hex to binary , reversing each byte, converting back to hex but no luck, I've even looked at seeing if the binary could be in a different order etc.

Any ideas?

Offline

#2 2017-06-30 13:04:28

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Fermax EM fobs

What is the output of 'lf search'

Offline

#3 2017-06-30 14:48:07

Onisan
Contributor
From: London
Registered: 2016-07-18
Posts: 88

Re: Fermax EM fobs

I bricked My Proxmark and haven't had time to reload it. I read the hex from my Smartcard Deluxe machine.

Offline

#4 2017-10-22 11:29:37

Heru
Contributor
Registered: 2017-10-08
Posts: 78

Re: Fermax EM fobs

Onisan wrote:

I have three Fermax fobs with numbers on them:
003019276      internal hex    01108B2411
002893668     internal hex    01108A8C4B
003496488     internal hex    010FAC3033

More for fun than anything else as I can copy these quite easily but I've been trying to work out how the numbers are derived from the Hex.
I've tried converting the hex to binary , reversing each byte, converting back to hex but no luck, I've even looked at seeing if the binary could be in a different order etc.

Any ideas?

Is it possible to copy these Fermax fobs on Proxmark#3?
Can you help me how to clone one? thanks so much

Offline

#5 2017-10-22 12:30:13

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Fermax EM fobs

without traces or a proper t55x7 configuration block it is not possible.

Offline

#6 2017-10-25 00:24:49

mnelson
Contributor
From: Outside Denver, CO, USA
Registered: 2015-06-05
Posts: 33

Re: Fermax EM fobs

Heru wrote:
Onisan wrote:

I have three Fermax fobs with numbers on them:
003019276      internal hex    01108B2411
002893668     internal hex    01108A8C4B
003496488     internal hex    010FAC3033

More for fun than anything else as I can copy these quite easily but I've been trying to work out how the numbers are derived from the Hex.
I've tried converting the hex to binary , reversing each byte, converting back to hex but no luck, I've even looked at seeing if the binary could be in a different order etc.

Any ideas?

Is it possible to copy these Fermax fobs on Proxmark#3?
Can you help me how to clone one? thanks so much

Yes, you can clone the Fermax FOBs on your PM3.  Just present the FOB to the and use lf se u.  If you've spent much time learning how to use the PM3, you should see what you need to be able to clone a FOB.

Offline

#7 2017-10-25 01:43:13

Heru
Contributor
Registered: 2017-10-08
Posts: 78

Re: Fermax EM fobs

Thanks guys for the hints, my one is actually Chubb system and the copy I made does not seem to work, I ll do further reading ,

thanks again

Offline

#8 2017-10-25 11:21:07

iceman
Administrator
Registered: 2013-04-25
Posts: 9,497
Website

Re: Fermax EM fobs

ok,  not to be a party pooper,  but someone sent me what looks legit decode of this pattern.

I'm swamped with work and I maybe make a decode in a few months of it.   Or you go-fund me to do it smile haha,

The reason for not publishing is that that someone belives ppl needs to learn by them self.  Good exercise in problem solving.
I agree with it.  So far I have not seen any attempts here on this thread to have a real go at it.   No partial solutions, nada, and I don't want to spoil the fun.

Hint:
you can go from hex to internal number.   Do what we always do,  look at hex and binary.
The solution involves bit scrambling, I don't expect many to figure that part out but it is doable. 

(well easy for me to say looking at the answer, I know)   

To the someone who might read here, thank you so much!  It was a great explaintion.
If you have more solutions, keep them coming smile

Offline

#9 2017-10-25 13:30:38

Onisan
Contributor
From: London
Registered: 2016-07-18
Posts: 88

Re: Fermax EM fobs

Thank you Iceman,
I tried binary and bit shifting with little luck. I shall have to re-address it and see what I can come up with.
It's fun trying to work out these things but a shame that our full time jobs get in the way..  smile smile

Offline

Board footer

Powered by FluxBB