Identifying Unknown Tags with Proxmark3

March 08, 2016

1. Connect your Proxmark3 to your computer.

2. Launch the Proxmark3 client. If you do not have the Proxmark3 client setup check out our Getting Started Guide.

3. Once connected to the client run the 'hw ver' command. You should see output similar to what is below. If the version is not v2.2 your steps and commands may differ from the ones below.

proxmark3> hw ver
Prox/RFID mark3 RFID instrument          
bootrom: master-rysc/v3.0.1 2017-09-21 16:36:44
os: master-rysc/v3.0.1 2017-09-21 16:36:45
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2017/05/17 at 17:48:26
          
uC: AT91SAM7S512 Rev B          
Embedded Processor: ARM7TDMI          
Nonvolatile Program Memory Size: 512K bytes. Used: 192856 bytes (37). Free: 331432 bytes (63).          
Second Nonvolatile Program Memory Size: None          
Internal SRAM Size: 64K bytes          
Architecture Identifier: AT91SAM7Sxx Series          
Nonvolatile Program Memory Type: Embedded Flash Memory

4. Connect an HF or LF Antenna based upon whether you think the tag uses 13.56mhz or 125khz. Thicker / larger tags generally have larger antennas and use 125khz.

Here are some examples of HF tags: Mifare Ultralight, Mifare 1K, Mifare 4K, Mifare Desfire 4K and HID iClass 2000.

Here are some examples of LF Tags: HID 1326, EM4100, T5577.

5. Run the commands below based upon the Antenna you connected.

Low Frequency Tags

Run command:

lf search u 

This command will detect HID 1326 and EM4100 tags. See examples below. It will not detect T5577 tags.

HID 1326
proxmark3> lf search
Reading 30000 bytes from device memory
          
Data fetched          
WARNING: Command buffer about to overwrite command! This needs to be fixed!          
Samples @ 8 bits/smpl, decimation 1:1           
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible          

Checking for known tags:
          
HID Prox TAG ID: 2004e2068a (837) - Format Len: 26bit - FC: 113 - Card: 837          

Valid HID Prox ID Found!
EM4100
lf search
#db# DownloadFPGA(len: 42096)                 
Reading 30000 bytes from device memory
          
Data fetched          
WARNING: Command buffer about to overwrite command! This needs to be fixed!          
Samples @ 8 bits/smpl, decimation 1:1           
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
          

Checking for known tags:
          
EM410x pattern found:           

EM TAG ID      : 1C003B347B          
Unique TAG ID  : 3800DC2CDE          

Possible de-scramble patterns          
HoneyWell IdentKey {          
DEZ 8          : 03880059          
DEZ 10         : 0003880059          
DEZ 5.5        : 00059.13435          
DEZ 3.5A       : 028.13435          
DEZ 3.5B       : 000.13435          
DEZ 3.5C       : 059.13435          
DEZ 14/IK2     : 00120262964347          
DEZ 15/IK3     : 000240532597982          
DEZ 20/ZK      : 03080000131202121314          
}
Other          : 13435_059_03880059          
Pattern Paxton : 474968699 [0x1C4F727B]          
Pattern 1      : 6184748 [0x5E5F2C]          
Pattern Sebury : 13435 59 3880059  [0x347B 0x3B 0x3B347B]          

Valid EM410x ID Found!
T5577
proxmark3> lf search
Reading 30000 bytes from device memory
          
Data fetched          
WARNING: Command buffer about to overwrite command! This needs to be fixed!          
Samples @ 8 bits/smpl, decimation 1:1           
NOTE: some demods output possible binary
  if it finds something that looks like a tag          
False Positives ARE possible
          

Checking for known tags:
          

No Known Tags Found!
          

Checking for Unknown tags:
          
Possible Auto Correlation of 96 repeating samples          

Using Clock:64, Invert:0, Bits Found:469          
ASK/Manchester - Clock: 64 - Decoded bitstream:          
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000011000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000110
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000001
1000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0110000000000000
0000000000000000
00000          

Unknown ASK Modulated and Manchester encoded Tag Found!

High Frequency Tags

Run command:

hf search

This command detects Mifare Ultralight, Mifare 1K, Mifare 4K, Mifare Desfire 4K, and HID iClass 2000. See Examples below.

Mifare Ultralight
proxmark3> hf search
          
 UID : 04 ff 55 22 98 28 80           
ATQA : 00 44          
 SAK : 00 [2]          
TYPE : MIFARE Ultralight (MF0ICU1)           
MANUFACTURER : NXP Semiconductors Germany          
proprietary non iso14443-4 card found, RATS not supported          
Answers to chinese magic backdoor commands: NO          

Valid ISO14443A Tag Found - Quiting Search
Mifare 1K
proxmark3> hf search
          
 UID : 6b ec 41 2a           
ATQA : 00 04          
 SAK : 08 [2]          
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1          
proprietary non iso14443-4 card found, RATS not supported          
Answers to chinese magic backdoor commands: NO          

Valid ISO14443A Tag Found - Quiting Search
Mifare 4K
proxmark3> hf search
          
 UID : 04 11 3b 62 4d 3c 80           
ATQA : 03 44          
 SAK : 20 [1]          
TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41          
MANUFACTURER : NXP Semiconductors Germany          
 ATS : 06 75 77 81 02 80 02 f0           
       -  TL : length is 6 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 5 (FSC = 64)          
       - TA1 : different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]          
       - TB1 : SFGI = 1 (SFGT = 8192/fc), FWI = 8 (FWT = 1048576/fc)          
       - TC1 : NAD is NOT supported, CID is supported          
       -  HB : 80           
Answers to chinese magic backdoor commands: NO          

Valid ISO14443A Tag Found - Quiting Search
Mifare Desfire 4k
proxmark3> hf search
          
 UID : 04 75 69 12 75 22 80           
ATQA : 03 44          
 SAK : 20 [1]          
TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41          
MANUFACTURER : NXP Semiconductors Germany          
 ATS : 06 75 77 81 02 80 02 f0           
       -  TL : length is 6 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 5 (FSC = 64)          
       - TA1 : different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]          
       - TB1 : SFGI = 1 (SFGT = 8192/fc), FWI = 8 (FWT = 1048576/fc)          
       - TC1 : NAD is NOT supported, CID is supported          
       -  HB : 80           
Answers to chinese magic backdoor commands: NO          

Valid ISO14443A Tag Found - Quiting Search
HID iClass 2000
proxmark3> hf search
          
CSN: 93 e3 a9 01 f8 ff 12 e0           
	Mode: Application [Locked]          
	Coding: ISO 14443-2 B/ISO 15693          
	Crypt: Secured page, keys not locked          
	RA: Read access not enabled          
	Mem: 2 KBits ( 32 * 8 bytes)          
	AA1: blocks 6-18          
	AA2: blocks 19-          

Valid iClass Tag (or PicoPass Tag) Found - Quiting Search

Or, if you like things easy, you could get a ProxmarkPro






Also in Blog

ProxmarkPro - General Tag Operations - Getting Started
ProxmarkPro - General Tag Operations - Getting Started

October 15, 2019

This blog post covers operations you can do with tags in Unchained Mode with the ProxmarkPro.

View full article →

ProxmarkPro - Unchained Mode - Getting Started
ProxmarkPro - Unchained Mode - Getting Started

October 15, 2019

Unchained mode is a user friendly on-screen menu to perform various tag operations. This blog post covers the main menus of these operations.

View full article →

ProxmarkPro - Client Setup - Getting Started
ProxmarkPro - Client Setup - Getting Started

October 15, 2019

Follow this guide to learn how to setup the client with the ProxmarkPro. The client is a way to communicate over USB with the ProxmarkPro, you can issue commands and the ProxmarkPro will output the results. The client is accessed through a terminal or command prompt.

View full article →

We use cookies to ensure that we give you the best experience on our website. If you continue we'll assume that you are understand this. Learn more
Accept