Proxmark3 community
Research, development and trades concerning the powerful Proxmark3 device.
Remember; sharing is caring. Bring something back to the community.
"Learn the tools of the trade the hard way." +Fravia
- Logged in as ikarus
- Last visit: Today 11:22:42
- Topics: Posted | New | Active | Unanswered
Announcement
Time changes and with it the technology
Proxmark3 @ discord
Users of this forum, please be aware that information stored on this site is not private.
#1 2021-10-21 16:06:25
- Wolftech
- Contributor
- Registered: 2021-10-04
- Posts: 3
The Zonsin ZX-300CD writer passwords
Running a brand new PM3 Easy w. release v4.14434 on macOS via Homebrew i started sniffing passwords set by some of my other writers.
First was the handheld Zonsin ZX-300CD "Invincible King" Ver: OB-03026-04-01-191106 that looks like this: https://www.google.com/search?q=Zonsin+ … D&tbm=isch
This particular unit uses static passwords instead of the calculated ones mentioned here: http://www.proxmark.org/forum/viewtopic.php?id=6482
---
For the T55xx it uses 19920427
For the EM4x05 it uses 84AC15E2
---
As it turns out, they are in fact the same as the passwords set by the unit mentioned here: http://www.proxmark.org/forum/viewtopic.php?id=8451
The Zonsin ZX-300CD also has the "scrambling bug" pertaining to the read back of the card numbers. Copying cards as well as entering card numbers manually when writing works as expected, however when reading back the card numbers this unit only uses 3 of the 4 bytes necessary to form the 10 digit decimal card number in the display: 12345678 (0xBC614E) will be presented as 0012345678 but 1234567890 (0x499602D2) will be presented as 0009831122 (0x9602D2).