RFID UID Calculator?

chick0n · 2014-08-13 11:05:41

I know RFID has a Internal UID and this can be Converted in Various External UIDs.

Internal HEX 10 = 0102b0c1fd
Converted in:
IK2-Nummer DEZ 14 = 00004340105725
IK3-Nummer DEZ 15 = 000550830441407
ZK-Nummer DEZ 20 = 08000400001308031115
DEZ 8 = 11583997
DEZ 10 = 0045138429
DEZ 5.5 = 00688.49661
DEZ 3.5A = 001.49661
DEZ 3.5B = 002.49661
DEZ 3.5C = 176.49661

Is it possible for Example, to Convert the "ZK Nr." Back to the Internal UID?

Thanks!!

iceman · 2014-08-13 12:29:54

It would be nice to have all the UID transformations back and forward...
Does someone have the definitions regarding the conversions above?

chick0n · 2014-08-13 15:38:33

Ok, the problem is, I want to Clone a Honeywell IdentKey3 Keyfob.

I found out this is EM41xx Chip based.

EM41xx has Internal 10 HEX Code.

But this Honeywell System uses this 20 Digit ZK Nr. (Called CC NR. in English?). So it would be nice to Convert the ZK back to Hex, to Clone the fob.

I found this Excel Converter Script:

http://i-keys.de/download_free/Hexa.xls

But it cant Convert ZK.

Maybe this is Honeywell propietary Algorhitm?

asper · 2014-08-13 21:14:14

I found some correlations but more examples are needed; my preliminary (very simple) analysis suggests that it will be probably impossible to obtain back the full 10 HEX ID starting from the already converted value, only a part should be "recoverable". If you can provide more examples I can try to investigate deeper and dismatle this supposition.

Last edited by asper (2014-08-13 21:15:14)

chick0n · 2014-08-14 07:33:59

I found Another Example:

Original HEX 10 = 0400F5B541
umgerechnet in:
IK2-Nummer DEZ 14 = 00017195971905
IK3-Nummer DEZ 15 = 000550830441407
ZK-Nummer DEZ 20 = 02000000101510130802
DEZ 8 = 16102721
DEZ 10 = 0016102721
DEZ 5.5 = 00245.46401
DEZ 3.5A = 004.46401
DEZ 3.5B = 000.46401
DEZ 3.5C = 245.46401

http://www.i-keys.de/ claims, they can Convert ZK back to HEX. For 0,70€ per piece.

I sent them some ZK's...

asper · 2014-08-14 16:28:45

Mmmm there must be an error... IK3-Nummer DEZ 15 it's the same as the other one you posted earlier... are you sure other values are correct ?

chick0n · 2014-08-14 17:11:21

No im not sure...

just took them off i-keys.de

But I will send you my results from i-keys.

marshmellow · 2014-08-14 20:06:33

it is possible to translate the ZK number to the original.
below is how it appears to be originally calculated:

Reverse each nibble:
0102B0C1FD --->  10200B1CDF
reverse the binary of each nibble: 0001 ---> 1000 = 8...
10200B1CDF --->  80400D83BF
convert each hex nibble to a 2 digit decimal number:
80400D83BF --->  08000400001308031115

enjoy.

marshmellow · 2014-08-14 20:14:29

Based on the first sample above I'd assume the remainder of the calculations are as follows:

11583997        = DEZ 8             = last 6 hex converted to dec	
0045138429      = DEZ 10            = last 8(7?) hex converted to dec
00688.49661     = DEZ 5.5           = digits 4-7 hex converted to dec "." last 4 hex converted to dec	
001.49661       = DEZ 3.5A          = first 2 hex digits "." last 4 converted to dec	
002.49661       = DEZ 3.5B          = Digits 3,4 "." last 4 converted to dec
176.49661       = DEZ 3.5C          = digits 5,6 hex converted to dec "." last 4 hex converted to dec
00004340105725  = IK2-Nummer DEZ 14 = entire hex converted to dec	
000550830441407 = IK3-Nummer DEZ 15 = reverse the binary for each byte and convert to decimal

EDIT: fixed DEZ 5.5 (had digits 3-6 should have been 4-7 at beginning)
EDIT: fixed DEZ 3.5C (had digits 4,5 should have been 5,6 at beginning) Thanks Asper!

Last edited by marshmellow (2014-08-19 15:29:08)

chick0n · 2014-08-14 21:03:26

Awesome dude... Thanks

I checked with Windows Calculator...it works:

ZK to HEX:

convert each 2 digit decimal number to hex:
08000400001308031115 > 80400D83BF

convert each digit from hex to binary, then reverse binary and convert to hex again: 8 > 1000 = 0001
80400D83BF > 10200B1CDF

D > 1101 > 1011 > B
3 > 0011 > 1100 > C
B > 1011 > 1101 > D

Reverse each nibble:
10200B1CDF > 0102B0C1FD

asper · 2014-08-15 05:37:08

Great work marshmellow I was near, you were faster

marshmellow · 2014-08-18 15:40:34

asper · 2014-08-18 21:19:22

There is a little error:
DEZ 3.5C = digits 5,6 hex (and not 4,5) converted to dec "." last 4 hex converted to dec

marshmellow · 2014-08-18 21:28:05

You are correct. I will edit my post above. I had a typo when transferring the info from my excel sheet.

asper · 2014-08-19 14:38:45

I have a problem decoding to dec the IK3 DEZ15, in excel i receive this value -5,48681E+11 for 0102b0c1fd ID (revesed = 80400D83BF), i think the problem is that the number decoded to dec is too long... any help with excel sheet ?

marshmellow · 2014-08-19 14:59:22

you can build a function (macro) to calculate it and return a string. I could help if I had the sheet.

marshmellow · 2014-08-19 15:01:11

the ' will also change numbers to text and prevent auto formatting. but I believe excel can only handle a 15 digit number max then it will round up (which is why I sometimes use vba functions and return text to the cell)

marshmellow · 2014-08-19 15:04:06

you can also do a custom formatted and put 0 (or 15 zeros if you want leading zeros) in for the format (it should remove scientific notation)

Last edited by marshmellow (2014-08-19 15:04:57)

marshmellow · 2014-08-19 15:58:23

the issue is the hex2dec function in excel treats certain ranges of hex values as negative numbers
to avoid this you have to create your own function to change the hex 2 dec.
like: (probably other ways to do this but..)

Public Function Hex2DecStr(x As String, Optional Length As Integer = 0) As String
    Hex2DecStr = CDec("&H" & x)
    If Length > Len(Hex2DecStr) Then
        Hex2DecStr = Left("00000000000000000", Length - Len(Hex2DecStr)) & Hex2DecStr
    End If
End Function

asper · 2014-08-19 18:32:53

Here it is my sheet to automatically decode any Hex 10 digit number (mainly used for EM4100); feel free to use and modify at your pleasure and also add functions and other decoding patterns when you discoverw them ! It also ancode the T55x7 block0 (configuration)

Credits given in the sheet !

Last edited by asper (2014-08-19 18:36:31)

marshmellow · 2014-08-19 19:48:44

Here is a slightly revised version.

asper · 2014-08-21 06:51:00

Thank you !

MilkThief · 2014-10-13 17:02:48

It would be wonderful if that would be integrated in a "verbose" version of the "lf em4x em410xwatch" / "lf em4x em410xsim" command...
That way we would be able to emulate a broken tag reading the printed serial number...

marshmellow · 2014-10-17 03:39:36

Imo .Too many possible calculations, many of which don't represent the entire EM ID.

MilkThief · 2014-12-10 00:50:05

Not exactly what you are looking for, but a great tool that nobody should miss...
HERE

iceman · 2014-12-10 12:42:13

Just for the fun of it.

I built a WebService which you can call to decode a Em41xx tag, either you call it with sniffed hexvalues or the command "data mandemod" output (binary string)

http://www.icesql.se/Services/Em41xxDec … ervice.svc

crazy_coloradoan · 2018-06-16 02:56:18

Hey, sorry to dredge up an old thread, but since I found it thru google, maybe other people are finding it too...

Anyway, here is a version of Marshmallow's conversion procedure from ^above, ported to javascript for google sheets.

Just open a google sheet, go to Tools > "Script Editor" and paste in the following code. Then you'll be able to use the formulas zk_to_hex() and hex_to_zk() anywhere in your sheet.

The input is a 20-digit decimal number, that some RFID companies calla "ZK code". The output is a 10-digit hex code. The process works in both directions.

function zk_to_hex(value) {
return value
  .match(/\d{2}/g)
  .map(dec2hex)
  .map(hex2bin)
  .map(reverse)
  .map(bin2hex)
  .join('')
  .toUpperCase()
  .match(/[0-9A-F]{2}/g)
  .map(reverse)
  .join('')
}

function hex_to_zk(value) {
return value
  .toUpperCase()
  .match(/[0-9A-F]{2}/g)
  .map(reverse)
  .join('')
  .match(/[0-9A-F]{1}/g)
  .map(hex2bin)
  .map(reverse)
  .map(bin2dec)
  .join('')
}

function reverse(value) {
  return value.split('').reverse().join('')
}

function dec2hex(value) {
  return parseInt(value, 10).toString(16)
}

function bin2hex(value) {
  return parseInt(value, 2).toString(16)
}

function hex2bin(value) {
  return paddingLeft(parseInt(value, 16).toString(2), '0000')
}

function dec2bin(value) {
  return paddingLeft(parseInt(value, 10).toString(2), '0000')
}

function bin2dec(value) {
  return paddingLeft(parseInt(value, 2).toString(10), '00')
}

function hex2dec(value) {
  return paddingLeft(parseInt(value, 16).toString(10), '00')
}

function paddingLeft(value, padding) {
  return (padding + value).slice(-padding.length)
}

schneeer · 2018-11-25 00:24:20

Hi,
i have written a little program for calculating from UID to IK2, IK3/IS, ZK, Dorma … and backward.
It's in german, named Code-Rechner:
Overview
Pictures
Downloadside

To your help:
Needed:
Net Framework 4
Visual Basic Powerpack
coderechnersetup.zip (CodeRechnerSetup has most trouble with Antivirus Software (not enough downloads for trust)).

The program calculate etherything without a licence.
With a licence is it posible to generate a list and export to Excel, text, … or to special software.
A demo-mode is plant/in work/comes in the next 2-3 weeks to be included in the next version of my software for 30 days, after is needed to start the internal licence tool and doing a little spend.
For only calculation is no licence needed!

Use:
On the left side:
1. Select transponder type:
-> pull down: "HID-USB-Leser-/ Datenträgerformat":
-> (HID-) Uni, EM41xx, IK2, IK3) for 125 Khz Transponders (forward calculation)
-> Uni, EM41xx, IK2, IK3 (Rückwärts) for 125 Khz Transponders (backward calculation, with a "shorter" UID (Hex8))
-> (HID-) Mifare-Classic for 13,75 Khz Transponders (NFC) with 8-char UID
-> (HID-) Mifare-Desfire" for 13,75 Khz Transponders, NFC with 14-char UID

2. Select code type:
-> pull down: "Codetyp / Eingabe in":
-> for UID: HEX10
-> …
-> for Dorma: DormaXS (You must first do step 1, select: Uni, EM41xx, IK2, IK3 (Rückwärts)

3. Do your Input here: "Eingabe:"

4. Click on "Übernehmen/ Rechnen" or hit "enter" on Keyboard

5. Look on the right side …
white: should be correct calculated
yellow: correct calculated for Honeywell, Esser, Novar, Telenot… intruder detection system and some others.
pink: light (less) and dark (more), most not right, but can be calculate

If you need IK2 , IK3, ZK in a shorter version, click on "Extras" here you can set temporary IK2 and IK3 from 13 to 10 digits and ZK from 20 to 16 digits.

Any translation from this program is not to be planed, it gives not enough support from user/ downloaders.
I am a private programmer, since 2 jears…, and i build intruder detection systems and more in my profession.

schneeer

Last edited by schneeer (2018-11-25 00:45:13)

nock · 2020-05-25 08:38:46

Hi, Thanks to all the previous contributors. Many of the download links no longer work but some do. I was able to download marshmallows revised excel sheet. I couldn't get crazy_coloradoan's Google Sheet to work.

However, I don't think those sheets will help me as I am hoping to be able to program some EM4100 cards with consecutive numbers based on DEZ 3.5A / DEZ 3.5C / 5.5.

For example for this card:
DEZ 5.5 : 00174.08774
DEZ 3.5A : 174.08774
DEZ 3.5B : 000.08774
DEZ 3.5C : 174.08774

I would be hoping to program EM4100 cards 174.08774 to 174.08873

I realise EM4100 cards are not normally programmed in sequential order, but I have a unique case for it.

Is there any calculator or tool that would help me to work out the EM Tag ID's needed to program T5577 cards into EM4100 tags in sequential order?

Thanks

mwalker · 2020-05-25 10:23:57

This i my thinking, please test and confirm.

If we consider the EM4100 card has 5 byte IDs - Lets say we call the bytes B0B1B2B3B4
If we split these numbers at the decimal point "." we have the format as

DEZ 5.5        : 00174.08774     B1B2 . B3B4
DEZ 3.5A       : 174.08774       B0 . B3B4
DEZ 3.5B       : 000.08774       B1 . B3B4
DEZ 3.5C       : 174.08774       B2 . B3B4

Those values are in Decimal, so lets convert to hex.
B0 = 174 => AE
B1 = 0 => 00
B2 = 174 => AE
B3B4 = 08774 => 2246

Now, put that together we get : AE00AE2246

Program that and read back and see if it works

[usb] pm3 --> lf em 410x_write AE00AE2246  1

[usb] pm3 --> lf sea
[+] EM410x pattern found

EM TAG ID      : AE00AE2246

Possible de-scramble patterns

Unique TAG ID  : 7500754462
HoneyWell IdentKey {
DEZ 8          : 11412038
DEZ 10         : 0011412038
DEZ 5.5        : 00174.08774
DEZ 3.5A       : 174.08774
DEZ 3.5B       : 000.08774
DEZ 3.5C       : 174.08774
DEZ 14/IK2     : 00747335721542
DEZ 15/IK3     : 000502518858850
DEZ 20/ZK      : 07050000070504040602
}
Other          : 08774_174_11412038
Pattern Paxton : 2931974214 [0xAEC26046]
Pattern 1      : 4002224 [0x3D11B0]
Pattern Sebury : 8774 46 3023430  [0x2246 0x2E 0x2E2246]

[+] Valid EM410x ID found!

So that seems to work.
To increment that last digit, just add 1 to the number and write to the card
(Remember this is in hex so 0-9 A-F)

[usb] pm3 --> lf em 410x_write AE00AE2247  1

[usb] pm3 --> lf sea
EM TAG ID      : AE00AE2247

Possible de-scramble patterns

Unique TAG ID  : 75007544E2
HoneyWell IdentKey {
DEZ 8          : 11412039
DEZ 10         : 0011412039
DEZ 5.5        : 00174.08775
DEZ 3.5A       : 174.08775
DEZ 3.5B       : 000.08775
DEZ 3.5C       : 174.08775
DEZ 14/IK2     : 00747335721543
DEZ 15/IK3     : 000502518858978
DEZ 20/ZK      : 07050000070504041402
}
Other          : 08775_174_11412039
Pattern Paxton : 2931974215 [0xAEC26047]
Pattern 1      : 4002736 [0x3D13B0]
Pattern Sebury : 8775 46 3023431  [0x2247 0x2E 0x2E2247]

We now have 174.08775, so that seems to work.

nock · 2021-03-12 20:36:51

mwalker wrote:

This i my thinking, please test and confirm.

Thank you so much. Yes, that worked (sorry for the late confirmation ).

Another question please - is it possible to program an EM4100 tag just based on the printed tag number?

The EM4100 tag ID is made up of 1 Byte "Customer ID" and 4 Bytes Card ID/Data. I know the 4 Bytes Card ID/Data corresponds to the printed card number (shown in Decimal instead of HEX).

I realise the 1 Byte "Customer ID" (the first 2 characters of the EM Tag ID) can't be determined by the printed card number. Is this "Customer ID" normally used the same way that facility codes are used in HID Prox tags (ie. Try and assign a different facility code to each building) or is it based on the manufacturer (eg different manufacturers of the chips have different customer ID)?

Also, I presume most access control systems use the full 5 bytes of the EM Tag ID and not just the last 4 bytes? Or is there a chance I could program a tag by just looking at the printed tag number to get the correct 4 Bytes Card ID/Data (use any 1st byte) and it might work?

Thanks a lot

Last edited by nock (2021-03-12 22:22:50)

Proxmark3 community

Announcement

#1 2014-08-13 11:05:41

RFID UID Calculator?

#2 2014-08-13 12:29:54

Re: RFID UID Calculator?

#3 2014-08-13 15:38:33

Re: RFID UID Calculator?

#4 2014-08-13 21:14:14

Re: RFID UID Calculator?

#5 2014-08-14 07:33:59

Re: RFID UID Calculator?

#6 2014-08-14 16:28:45

Re: RFID UID Calculator?

#7 2014-08-14 17:11:21

Re: RFID UID Calculator?

#8 2014-08-14 20:06:33

Re: RFID UID Calculator?

#9 2014-08-14 20:14:29

Re: RFID UID Calculator?

#10 2014-08-14 21:03:26

Re: RFID UID Calculator?

#11 2014-08-15 05:37:08

Re: RFID UID Calculator?

#12 2014-08-18 15:40:34

Re: RFID UID Calculator?

#13 2014-08-18 21:19:22

Re: RFID UID Calculator?

#14 2014-08-18 21:28:05

Re: RFID UID Calculator?

#15 2014-08-19 14:38:45

Re: RFID UID Calculator?

#16 2014-08-19 14:59:22

Re: RFID UID Calculator?

#17 2014-08-19 15:01:11

Re: RFID UID Calculator?

#18 2014-08-19 15:04:06

Re: RFID UID Calculator?

#19 2014-08-19 15:58:23

Re: RFID UID Calculator?

#20 2014-08-19 18:32:53

Re: RFID UID Calculator?

#21 2014-08-19 19:48:44

Re: RFID UID Calculator?

#22 2014-08-21 06:51:00

Re: RFID UID Calculator?

#23 2014-10-13 17:02:48

Re: RFID UID Calculator?

#24 2014-10-17 03:39:36

Re: RFID UID Calculator?

#25 2014-12-10 00:50:05

Re: RFID UID Calculator?

#26 2014-12-10 12:42:13

Re: RFID UID Calculator?

#27 2018-06-16 02:56:18

Re: RFID UID Calculator?

#28 2018-11-25 00:24:20

Re: RFID UID Calculator?

#29 2020-05-25 08:38:46

Re: RFID UID Calculator?

#30 2020-05-25 10:23:57

Re: RFID UID Calculator?

#31 2021-03-12 20:36:51

Re: RFID UID Calculator?

Board footer