Proxmark3 community

Danz

Contributor

From: Dubai

Registered: 2015-10-24

Posts: 98

Keri Tags *Updated

Hello Gents,

I have encountered many Keri type FOBs and most of them were easy to read and copy (K format for indala - H format for HID and W).

How ever I have new type (N) that seems to be pyramid series, anyone encounter one of those before ?

the raw code from proxmark is : 00010101012f31d046a87ad99abd6ab
Bit length : 67
Internal card (I think) : 38261

Printed code is : N2314,937528

I don't have that card anymore but would like to get it copied by this info,

Considering Pyramid to T55 block0 is  0x00107080
what the other blocks should be based on the data above ?

Thanks for the help 

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Keri Tags *Updated

you skipped the important parts of the output.  modulation, bitrate/clock, what it tried and didn't find...

sorry cannot help.

Last edited by marshmellow (2016-01-12 18:17:07)

iceman

Administrator

Registered: 2013-04-25

Posts: 9,538

Website

Re: Keri Tags *Updated

yeah,  if you can get a trace and share it,  that will help.

Danz

Contributor

From: Dubai

Registered: 2015-10-24

Posts: 98

Re: Keri Tags *Updated

That picture is the only thing I got for now, I can call my friend from other city to bring it back but it would be much of hassle for a test .

modulation, bitrate/clock ? ain't theses standards for each type and won't change, perhaps if anyone got Keri N format can help.

Thanks again guys ,

Apt-Get

Contributor

Registered: 2015-12-23

Posts: 111

Re: Keri Tags *Updated

Your original post had the wrong raw data compared to the pic. you forgot an 8

This should work on a t5577

Proxmark3> lf t55xx write b 0 d 00107080  <<<<  maxblock 4, pyramid config block.. Default block 0 for PYRAMID
Proxmark3> lf t55xx write b 1 d 00010101  <<< Blocks 1-4 are taken from the raw data
Proxmark3> lf t55xx write b 2 d 012f31d0
Proxmark3> lf t55xx write b 3 d 46a87ad9
Proxmark3> lf t55xx write b 4 d 98abd6ab

Last edited by Apt-Get (2016-02-05 06:21:46)

ntk

Contributor

Registered: 2015-05-24

Posts: 701

Re: Keri Tags *Updated

00107080 this is equal data bit rate RF/50; FSK2a; PSK-CF is set to RF/2; max 4blocks data;no password bit set;no STT bit set

Could you pls confirm that this is the universal config for a keri to at55x7 clone? And how do you detect RF/50 data bit rate? Manual?

Apt-Get

Contributor

Registered: 2015-12-23

Posts: 111

Re: Keri Tags *Updated

00107080 is the default block 0 for pyramid/keri tags, as far as i have been taught..

heres another pyramid i have cloned, if you wanna check it out.

Checking for known tags:
         
Pyramid ID Found - BitLength: 26, FC: 9, Card: 33278 - Wiegand: 21303fd, Raw: 000101010101010101010161980efb6e         
Checksum 6e passed         

Valid Pyramid ID Found!         
pm3 --> lf t55 det
Chip Type  : T55x7         
Modulation : FSK2a         
Bit Rate   : 4 - RF/50         
Inverted   : Yes         
Offset     : 31         
Block0     : 0x00107080

ntk

Contributor

Registered: 2015-05-24

Posts: 701

Re: Keri Tags *Updated

so RF/50 is confirmed when it works here and there. Invert maybee. definite fsk2a.

No about checking I havent got a real reader to see it blinks/pips when seeing its own fob/card type. But it is good to know with  this block 0, we can have a reliable working version.

Thanks

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Re: Keri Tags *Updated

This is not a Pyramid tag, although the format is borrowed from Pyramid.  This is a Keri NXT tag.  I am looking at this format myself...

iceman

Administrator

Registered: 2013-04-25

Posts: 9,538

Website

Re: Keri Tags *Updated

Does someone has more information about Keri NXT tags?  Some traces maybe?

iceman

Administrator

Registered: 2013-04-25

Posts: 9,538

Website

Re: Keri Tags *Updated

--- Keri NXT should be
N in the printed number indicates Keri NXT
borrowed format from Pyramid, which explains why the current pyramid decode works sometimes on a trace.
FSK 
clock 50
inverted YES
128bits w parity
ODD Parity every 8bit of the previous 7bits.

T55x7 Block0 = 0x00107080 

pm3 --> data raw fs 50 1

hkplus

Contributor

Registered: 2015-01-07

Posts: 127

Re: Keri Tags *Updated

The problem with the NXT tags is although the data is structured like a Pyramid tag, the actual data in the content of the tag is encrypted with a Kung Fu grip...

marshmellow

Contributor

From: US

Registered: 2013-06-10

Posts: 2,302

Re: Keri Tags *Updated

yes but the more valid samples we see the more we may learn

iceman

Administrator

Registered: 2013-04-25

Posts: 9,538

Website

Re: Keri Tags *Updated

Or someone makes a static analyse of the reader firmware.