Reading a 134kHz EM4100 Tag with the Proxmark3
Follow the instructions below to read a 134kHz EM4100 tag using the Proxmark3.
Begin by connecting the proxmark to a PC and connecting the LF antenna to the proxmark.
Launch the client and enter the command below.
proxmark3> lf em em410xwatch h
Reading 8201 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
Reading 8201 bytes from device memory
Data fetched
Samples @ 8 bits/smpl, decimation 1:1
EM410x pattern found:
EM TAG ID : 1C003CA6EE
Unique TAG ID : 38003C6577
Possible de-scramble patterns
HoneyWell IdentKey {
DEZ 8 : 03974894
DEZ 10 : 0003974894
DEZ 5.5 : 00060.42734
DEZ 3.5A : 028.42734
DEZ 3.5B : 000.42734
DEZ 3.5C : 060.42734
DEZ 14/IK2 : 00120263059182
DEZ 15/IK3 : 000240522126711
DEZ 20/ZK : 03080000031206050707
}
Other : 42734_060_03974894
Pattern Paxton : 475063534 [0x1C50E4EE]
Pattern 1 : 5586357 [0x553DB5]
Pattern Sebury : 42734 60 3974894 [0xA6EE 0x3C 0x3CA6EE]
The output shown above was obtained using version 2.2.0 of the client software/firmware.
Also in Blog
ProxmarkPro - Using HID Brute
This blog post covers how to do a brute force attack with a HID tag on the ProxmarkPro. A Brute force attack is done by trying to guess multiple tag UID's similar to a known working tag UID to gain access.
ProxmarkPro - Cloning a HID Tag
This blog post covers the steps to clone a HID tag to a T5577 with a ProxmarkPro.