Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2019-08-12 21:44:03

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Schlage HID fob cloned but not working

I successfully cloned a Schlage HID fob, but the cloned tags won't open the door.

What more do these little grey/gray Schlage key fobs have beyond the HID tag?

Offline

#2 2019-08-12 21:55:43

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working

Too little information to answer the question.


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#3 2019-08-12 22:43:36

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

hf search yields nothing, lf search yields exact same HID card for the original that works and the clone that doesn't.

Im exploring lf t55 dump and things seem both bitshifted and different. What can I offer to help diagnose?

Lock is this model: https://www.schlage.com/content/dam/sch-us/documents/pdf/Schlage-Control-Smart-Deadbolt-Sell-Sheet.pdf

Last edited by theguy (2019-08-12 22:50:59)

Offline

#4 2019-08-12 23:02:10

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working

a HID prox card...  and you use what to clone ?


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#5 2019-08-12 23:11:17

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

you use what to clone?

Command: lf hid clone ##########

Hardware: A proxmark 3

Software: I tried both the iceman latest and normal latest

Not sure what you mean by what I use to clone.

Offline

#6 2019-08-13 00:31:30

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

Reupdated, recompiled, reflashed everything just to check, and now getting this when I run dump in the iceman fork:

pm3 --> lf t55 dump
Reading Page 0:         
blk | hex data | binary                           | ascii         
----+----------+----------------------------------+-------         
Reading Page 1:         
blk | hex data | binary                           | ascii         
----+----------+----------------------------------+-------

And this is a cloned hid card that shows the same info as the original, and shows actual data when I ran lf t55 dump in basic pm3 fork.

Last edited by theguy (2019-08-13 00:32:24)

Offline

#7 2019-08-13 04:44:51

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working

The lf t5577 commands have their charm.  In short,  you will need a successful lf t5577 detect first every time you use them.

How about you start with running lf search?


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#8 2019-08-13 17:37:34

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

Done that, the lf search finds it successfully, then the dump is always blank, on 4 different tags, the original and 3 of my rewriteable t5577s in 2 different form factors. This blank dump output happens only in the iceman client. If I run regular proxmark client, i get dumps easily, but they appear to be bitshifted, and I'm having a lot of trouble copying block by block. Something will always mess up, for example, page 0 block 1 WON'T bitshift (but the other 6 blocks will), and it won't accept the write of the not-bitshifted data, so I can't copy the blocks effectively by hand. But do you think that's why the Schlage lock is ignoring my otherwise properly-cloned hid tags?

Offline

#9 2019-08-13 18:12:54

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working

....and what is your exact command sequence when you do this dumping?


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#10 2019-08-13 18:27:05

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

One time I saw the original tag having an offset of 33, but I think it was a bitshift fluke. It's usually 32 for both original and clones. I tried setting offset on clone to 33, but that didn't stick.

proxmark3> lf t55 detect
Chip Type  : T55x7         
Modulation : FSK2a         
Bit Rate   : 4 - RF/50         
Inverted   : Yes         
Offset     : 32         
Seq. Term. : No         
Block0     : 0x60107C60     
         
proxmark3> lf t55 detect
Chip Type  : T55x7         
Modulation : FSK2a         
Bit Rate   : 4 - RF/50         
Inverted   : Yes         
Offset     : 33         
Seq. Term. : No         
Block0     : 0x60107C60

I still can't write correctly to block 1 of page 0. It's always shifting by 1 bit. Every other block is fine.

Offline

#11 2019-08-13 18:28:07

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

lf search
lf t55 dump

It works without lf searching first in normal proxmark client. Only the iceman distro is blank when I lf t55 dump, and it's blank whether I run lf search first or not.

Offline

#12 2019-08-13 18:36:32

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

Randomly the iceman client just worked, every dump is different, bitshifted -1, 0, or 1 bits. So it looks like my clone is good, but I can't be 100% sure. Some dumps it's matching, others it's not. But now the original gets bitshifted on the lf dump too, so I don't know. Is there another feature to this Schlage reader+lock mechanism that I might be missing?

Seems like playback speed between my clones' block 0 and block 1 is a beat too fast or slow relative to the original Schlage.

Last edited by theguy (2019-08-13 18:41:19)

Offline

#13 2019-08-14 00:51:15

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

All clones look like this, and every other block matches original.

Reading Page 0:
00 | 60107C60 | 01100000000100000111110001100000   
01 | 3AAAB2AA | 00111010101010101011001010101010

But original, and what I'm writing to the blocks is:

Reading Page 0:           
00 | 60107C60 | 01100000000100000111110001100000         
01 | 1D555955 | 00011101010101010101100101010101

Again, all the other blocks match. It's just this bitshifty block 1 of page 0 that's not looking right, and it's highly repeatable.

Also, I've found that the clones work on all the readers EXCEPT the Schlage lock reader. So I think there must be something sneaky/extra it's checking for that my clones lack.

Offline

#14 2019-08-14 01:27:27

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working

I would suggest you try RRG/Iceman  repo. https://github.com/RfidResearchGroup/proxmark3/

Remember to compile it with the right target device (it defaults to RDV4) ,  and there is lots of docs you can enjoy reading.


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#15 2019-08-14 03:00:09

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

theguy wrote:

Also, I've found that the clones work on all the readers EXCEPT the Schlage lock reader. So I think there must be something sneaky/extra it's checking for that my clones lack.

Can you please address this? I have no idea why or how this could possibly happen. Do you have any ideas?

Offline

#16 2019-08-14 03:27:39

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working

How about you get some nice signal traces and share with the community via a filesharing service.
if should be a normal HID prox tag...

lf read 3000 
data save schlage_(written cardid).pm3

If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#17 2019-08-14 03:30:56

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

When I do full image flash after bootloader flash for RRG, I get this:

[+] Waiting for Proxmark3 to appear on /dev/ttyACM0           
........... Found           
[=] Available memory on this board: 256K bytes
         
[=] Permitted flash range: 0x00102000-0x00140000         
[+] Loading ELF file armsrc/obj/fullimage.elf           
[+] Loading usable ELF segments:         
[+]    0 : V 0x00102000 P 0x00102000 (0x0003ec40->0x0003ec40) [R X] @0x94         
[!!] Error: PHDR is not contained in Flash         
[!!] Aborted on error.

Does this just mean the RRG fullimage is too big for my pm3?

Last edited by theguy (2019-08-14 03:34:29)

Offline

#18 2019-08-14 03:33:35

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

It definitely is a normal HID prox tag, but the door reader, and the door reader only, may have an additional check or quirk that the standard readers don't. The cloned cards/tags/fobs work on all the readers except the Schlage door reader. The other readers are regular, unbranded. The fob is a gray Schlage brand keyfob, but maybe it has some secret sauce inside that I haven't detected/duplicated.

Offline

#19 2019-08-14 03:48:18

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#20 2019-08-14 06:19:10

mwalker
Contributor
Registered: 2019-05-11
Posts: 125

Re: Schlage HID fob cloned but not working

Some things to keep in mind.
FSK2a  can be a bit hard to detect the start of.  I have always seen it a bit tricky on my easy and the rdv4.0 and rdv4.1.  But you will get better results with a stronger read.  Being a fob, the position of the fob can affect how well it will read.  I have also seen different bit patterns have different levels of success locking onto the start of the card data.
When it writes, it uses a different encoding to when it reads, so if the data "looks" mostly right (bit shifted), I would take that as the write was OK, just not a strong signal to get a good lock on the start offset.

As to the fob working on all but one reader, this confirms the write was OK and that the one reader may be a bit smarter and can see its a clone.   
Here, you can try a few things that may help it.
1. Set a password on the clone : If the reader is sending a t55xx read and gets a valid response, then by setting the password, it wont get a valid response unless it also sends the correct password.
2. With the latest software you can also set the downlink mode to something different (leading 0 or 1 of 4), this will stop the card seeing commands unless sent using the correct downlink mode.

I would start with the password.
a) Set a known password (write it down) into block 7 page 0.
lf t55 write b 7 d 11223344
where 11223344 is the 8 Hex digit password you want.
b) when you are happy that is saved as needed, you will need to update block 0 page 0 to set the "use password" flag.
lf t55 write b 0 d 60107C70

That said, not sure why the master key is set (first byte is a 6), can only assume this was set to stop a reader sending the test mode command to reset the card ?

Offline

#21 2019-08-15 02:36:14

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

I think I'm onto something. The fob and reader are dual- Mifare Classic 1K and HID, so perhaps the reader wants to handshake with a disabled Mifare chip before reading and accepting the HID tag?

What would you guys recommend to test this out?

Offline

#22 2019-08-15 02:42:11

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

Also, playing with
lf t55 write b 7 d 11223344

but it writes 22446688 to block 7 (same bitshift error!)

Any ideas what's causing this inability to write to (some) blocks correctly?

Offline

#23 Yesterday 00:32:07

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

Card/fob type is Schlage 9691T

Offline

#24 Yesterday 04:25:36

theguy
Contributor
Registered: 2017-08-08
Posts: 26

Re: Schlage HID fob cloned but not working

Is there a command to listen/record the interaction between reader and fob?

Offline

#25 Yesterday 07:37:33

iceman
Administrator
Registered: 2013-04-25
Posts: 5,595
Website

Re: Schlage HID fob cloned but not working

RRG/Iceman repo
for lf you save the signal data with  data save
for hf you save the trace data with  trace save


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#26 Yesterday 08:42:27

mwalker
Contributor
Registered: 2019-05-11
Posts: 125

Re: Schlage HID fob cloned but not working

I still believe the write is ok, just that the fob is a little low on "signal strength" thus incorrect offset getting detected.

For interest can do the following.
1. Change the modulation/config to ASK
lf t55 write b 0 d 000880E0
2. lf t55 detect
3. lf t55 dump

I expect you will find the data is correct when using the ask modulation.  BUT the fob wont work as it needs to be FSK
so this is just a test to check the data on the fob

(then put back to your block 0 config)
lf t55 write b 0 d 60107C60
and re detect.

The other thing that looks a little weird is the block 0.  When I do a lf hid clone it is :  00107060,, yet your fob is showing PSKCF of 11 (reserved)

Offline

Board footer

Powered by FluxBB