Proxmark3 community

foamfield

Contributor

Registered: 2019-04-22

Posts: 5

Help recovering 'bricked' xEM glass chip implant

Recently implanted the xEM glass chip, tried to write an HID card to it.  All write commands were unresponsive, so I used the t55 wipe command.  Now the chip is unresponsive.  The lf search u command returns a long string of 1s.  Any help getting this chip back to a responsive state is appreciated.  Relevant details are below:

Prox/RFID mark3 RFID instrument         
bootrom: master/v3.1.0-70-g1338d24-suspect 2019-03-04 23:03:00
os: master/v3.1.0-70-g1338d24-suspect 2019-03-04 23:03:00
fpga_lf.bit built for 2s30vq100 on 2015/03/06 at 07:38:04
fpga_hf.bit built for 2s30vq100 on 2019/02/15 at 20:40:32
SmartCard Slot: available
         
uC: AT91SAM7S512 Rev B         
Embedded Processor: ARM7TDMI         
Nonvolatile Program Memory Size: 512K bytes. Used: 205281 bytes (39). Free: 319007 bytes (61).         
Second Nonvolatile Program Memory Size: None         
Internal SRAM Size: 64K bytes         
Architecture Identifier: AT91SAM7Sxx Series         
Nonvolatile Program Memory Type: Embedded Flash Memory         
proxmark3> hw tune

Measuring antenna characteristics, please wait.........         
# LF antenna: 66.82 V @   125.00 kHz         
# LF antenna: 43.17 V @   134.00 kHz         
# LF optimal: 69.71 V @   126.32 kHz         
# HF antenna: 48.40 V @    13.56 MHz         
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

proxmark3> lf search u
NOTE: some demods output possible binary
  if it finds something that looks like a tag         
False Positives ARE possible
         

Checking for known tags:
         

No Known Tags Found!
         

Checking for Unknown tags:
         
Possible Auto Correlation of 1 repeating samples         

Using Clock:32, Invert:0, Bits Found:513         
ASK/Manchester - Clock: 32 - Decoded bitstream:         
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
         

Unknown ASK Modulated and Manchester encoded Tag Found!         

if it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'

link to the 'lf search u' trace (not sure how to embed images here)
https://drive.google.com/file/d/1QOu_GvAZZ2u_kiNfvC_kX31nTOUvkq-K/view?usp=sharing

iceman

Administrator

Registered: 2013-04-25

Posts: 9,538

Website

Re: Help recovering 'bricked' xEM glass chip implant

Looks like a RDV4...
Are you sure you put the RRG repo on it?  https://github.com/RfidResearchGroup/proxmark3
It has the latest fixes for RDV40.

foamfield

Contributor

Registered: 2019-04-22

Posts: 5

Re: Help recovering 'bricked' xEM glass chip implant

I used the link provided, and followed the OS install instructions, and cannot get the bootloader or flasher to work.  Any insight would be helpful.  Should I wipe the proxmark3 folder from my HD and start over?
Please advise.

(For the record, I was able to install proxmark3, and update the bootloader and flash the device successfully when I first received it using the guide here: https://github.com/Proxmark/proxmark3/wiki/MacOS#Installing_from_HomeBrew_tap )

foamfield

Contributor

Registered: 2019-04-22

Posts: 5

Re: Help recovering 'bricked' xEM glass chip implant

Now my proxmark3 rdev4 is bricked... lol awesome
When I'm done with this mess, I'll post tutorials for everyone, since the online instructions for installing proxmark3, flashing, and updating bootloader are all in need of clarification/revision.

That being said, anyone in the LA area have a JTAG I could borrow for a few hours?

Tom5ive

Contributor

Registered: 2017-09-18

Posts: 53

Re: Help recovering 'bricked' xEM glass chip implant

I’ve seen this before, bad coupling makes the wipe command do funny things and make the xem seem bricked. I’ve actually had this happen with my implanted xem lol. What you need is a better antenna my friend. We are working on getting one released specifically for implants ASAP!