Proxmark3 community

Rosco

Contributor

Registered: 2019-12-10

Posts: 43

lf t5577 write bug

I'm trying to set the sequence terminator bit in block 0 in a T5577.

So first off I get the tag's info:

[usb] pm3 --> lf t55xx info

--- T55x7 Configuration & Information ---------
-------------------------------------------------------------
 Safer key                 : 0
 reserved                  : 0
 Data bit rate             : 5 - RF/64
 eXtended mode             : No
 Modulation                : 8 - Manchester
 PSK clock frequency       : 0 - RF/2
 AOR - Answer on Request   : No
 OTP - One Time Pad        : No
 Max block                 : 2
 Password mode             : No
 Sequence Terminator       : No
 Fast Write                : No
 Inverse data              : No
 POR-Delay                 : No
-------------------------------------------------------------
 Raw Data - Page 0
     Block 0  : 0x00148040  00000000000101001000000001000000

Then I set the ST bit by writing 0x00148048 in block 0. No problem apparently:

[usb] pm3 --> lf t55xx write b 0 d 00148048
[=] Writing page 0  block: 00  data: 0x00148048 

But then if I get the info again, block 0 is all messed up: all the bits are shifted left one bit:

[usb] pm3 --> lf t55xx info

--- T55x7 Configuration & Information ---------
-------------------------------------------------------------
 Safer key                 : 0
 reserved                  : 1
 Data bit rate             : 2 - RF/32
 eXtended mode             : No
 Modulation                : 16 - Biphase
 PSK clock frequency       : 0 - RF/2
 AOR - Answer on Request   : No
 OTP - One Time Pad        : No
 Max block                 : 4
 Password mode             : Yes
 Sequence Terminator       : No
 Fast Write                : No
 Inverse data              : No
 POR-Delay                 : No
-------------------------------------------------------------
 Raw Data - Page 0
     Block 0  : 0x00290090  00000000001010010000000010010000

If I set the block to 0x00148044, 0x00148042 or 0x00148041, the bit shifting doesn't happen.

Rosco

Contributor

Registered: 2019-12-10

Posts: 43

Re: lf t5577 write bug

And here's another one:

[usb] pm3 --> lf t55xx write b 3 d 0
[=] Writing page 0  block: 03  data: 0x00000000
[usb] pm3 --> lf t55xx read b 3
[+] Reading Page 0:
[+] blk | hex data | binary                           | ascii
[+] ----+----------+----------------------------------+-------
[+]  03 | FFFFFFFF | 11111111111111111111111111111111 | ....

Last edited by Rosco (2021-08-08 16:10:38)

iceman

Administrator

Registered: 2013-04-25

Posts: 9,468

Website

Re: lf t5577 write bug

... detect?

Rosco

Contributor

Registered: 2019-12-10

Posts: 43

Re: lf t5577 write bug

[usb] pm3 --> lf t55xx detect
[=]      Chip Type      : T55x7
[=]      Modulation     : ASK
[=]      Bit Rate       : 5 - RF/64
[=]      Inverted       : No
[=]      Offset         : 32
[=]      Seq. Term.     : No
[=]      Block0         : 0x00148040
[=]      Downlink Mode  : default/fixed bit length
[=]      Password Set   : No

Vanilla EM encoding.

Last edited by Rosco (2021-08-08 23:57:41)