Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

  • Logged in as ikarus
  • Last visit: Today 11:22:42

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2014-10-05 08:31:40

Sentinel
Contributor
Registered: 2012-11-26
Posts: 190

Card for Siemens access control system

my friend has 2 cards for access control system Siemens.
Its a conventional 64-bit card.
but the code is printed on the cards somehow encrypted.
I have not been able to understand exactly how.
Maybe some one knows?

0F00CD7CF1     => 0011000653 (printed)
0F00CD9C42     => 0010969444 (printed)

Offline

#2 2014-10-05 19:38:31

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: Card for Siemens access control system

In my very humble opinion the decimal value, converted in binary, is obtained taking specific bits of the hex value converted in bin; in practice there is a bit scrambling only, no encryption. I think I will be able to identify a correlation if I have 2 more examples, for now I seem to have located 8 bits only.

Offline

#3 2014-10-06 05:24:52

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Card for Siemens access control system

I've seen this.  I believe it to be just as asper said..  Pattern goes like this: convert hex ID to binary:

bit 18,20,17,19,23,21,24,22,26,28,25,27,35,37,40,34,31,29,39,38,36,30,32,33

no 0 bit in count, count from left(msb). (Make sure to pad leading zeros.)
Convert binary to decimal.

You said this is for a Siemens?  Do you know the reader/models?

Last edited by marshmellow (2014-10-06 05:37:06)

Offline

#4 2014-10-06 06:00:24

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: Card for Siemens access control system

Wow! You were able to detect the scrambling pattern with 2 IDs only! Can you explain me how you did it?

@sentinel: what is the name of the system?

Last edited by asper (2014-10-06 06:01:10)

Offline

#5 2014-10-06 14:10:55

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Card for Siemens access control system

As I mentioned, I've seen these tags before.  smile

Offline

#6 2014-10-06 14:15:46

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Card for Siemens access control system

I Just don't know the system they were used for

Offline

#7 2014-10-06 14:44:28

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: Card for Siemens access control system

marshmellow wrote:

As I mentioned, I've seen these tags before.  smile

Missed it, sorry wink

Last edited by asper (2014-10-06 14:44:58)

Offline

#8 2014-10-06 15:51:06

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Re: Card for Siemens access control system

actually you've seen this format before as well asper..  it is already included in the [EM4100-Unique blocks calculator.xlsm], you made (or helped make?)...

Offline

#9 2014-10-06 15:55:26

marshmellow
Contributor
From: US
Registered: 2013-06-10
Posts: 2,302

Offline

#10 2014-10-06 16:16:56

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: Card for Siemens access control system

You are right, I assumed it was a new format without checking the calculator... I would have saved time... sad

Offline

#11 2014-10-06 19:45:16

Sentinel
Contributor
Registered: 2012-11-26
Posts: 190

Re: Card for Siemens access control system

The speed of solving the problem is fantastic)) thank you very much, Мarshmellow

Offline

Quick reply

Write your message and submit

Board footer

Powered by FluxBB