hacking rfid for fun
Description: Articles about reading and writing RFID proximity cards used for access to controlled areas emerged from discussions regarding the ease of cloning such cards. Research led to discussions with Carl, who has dedicated significant time to exploring these hacks. Proxclone serves as an information hub aimed at elucidating the technologies behind 125 kHz proximity-based access control systems and cards. Numerous vendors manufacture proximity-based reader and card products, and Carl's focus has been on some of the more popular options in the market. The prototype described is a combination card reader and cloner, designed to operate independently without the need for a PC or external equipment. The operation is user-friendly; simply holding a card near the antenna allows the unit to read and decode the card's information, which is then displayed on a 4G—20 character LCD. To clone a card, the operator brings a T5557/5567 Read/Write card near the antenna and presses the write button, resulting in a programmed clone card in less than a second. The device's construction cost was minimal (approximately $30), including the LCD display and circuit board, which was designed to fit as a single assembly. The project began with the intention of creating a simple card reader capable of retrieving all transmitted information from the card during a read operation, as most commercial readers do not output all data. Information such as the header and card format is crucial for replicating card operations. A significant resource during this process was Microchip's 125 kHz RFID System Design Guide, which provided foundational design ideas. The original FSK reference circuit was modified to utilize a Parallax SX28 microcontroller instead of a PIC. Further analysis of the T5557/5567 IC revealed that the reader circuit could be slightly adjusted to also function as an RFID writer. This involved enabling the microcontroller to modulate the 125 kHz RF carrier using On/Off Keying (OOK) modulation, which is the programming method for T55x7 chips. An additional push button was incorporated for user input. The updated schematic of the reader circuit, now capable of writing, features a commercial 44780 4G—20 LCD and a 125 kHz loop antenna. The completed unit was mounted on acrylic plastic for aesthetic purposes. The device has been tested with various card types, including 26-bit, 34-bit, 36-bit, 37-bit, and 35-bit Corporate 1000 formats, successfully duplicating all without issues, outperforming commercially available readers.
The prototype card reader and cloner integrates several key components to facilitate its operation. The system utilizes a 125 kHz loop antenna that serves as both the transmitter and receiver for RFID signals. The Parallax SX28 microcontroller acts as the central processing unit, managing the reading and writing operations. The microcontroller's firmware is programmed to handle the On/Off Keying modulation necessary for writing to the T5557/5567 chips, allowing for seamless cloning of RFID cards.
The LCD display provides real-time feedback to the user, showing the decoded card information during read operations and confirming successful write operations. The choice of a 4G—20 character LCD enables clear visibility of the card data, crucial for user interactions. The device's compact design allows it to be easily handled, and the self-contained nature eliminates the need for cumbersome external power sources or connections, enhancing portability.
For power supply, a suitable battery or power adapter can be integrated, ensuring that the device remains functional during field operations. The design can also be expanded to include additional features, such as an SD card slot for data logging or a USB interface for connecting to external devices for software updates or data management.
In conclusion, this RFID proximity card reader and writer exemplifies a practical application of RFID technology, demonstrating the potential for both security and convenience in access control systems. The development process highlighted the importance of thorough research, component selection, and circuit design, culminating in a versatile tool for RFID card management.Interesting articles about reading/writing RFID proximity cards that we use foraccess to controlled areas. This all came about after a discussion with a colleague about how easy it would be to clone a card. After a bit of research we managed to find and talk to Carl whohas spent numerous hours working on his hacks.
Proxclone was put togetheras an information hubto help understand the technologies used in 125Khz proximity based access control systems and cards. Since there are numerous vendors who manufacture proximity based reader and card products, Carl`s efforts have been focused on the some of the more popular and widely used products in the marketplace.
The picture below is of my prototype combination card reader and cloner. The unit is self contained and does not require the use of a PC or other external equipment to operate. Operation is simple and straightforward. Simply hold a card near the antenna and the unit reads and decodes the information from the card. The information is then formatted and displayed on a 4G—20 character LCD. If the operator wishes to make a copy of the card he simply brings a T5557/5567 Read/Write card near the antenna and presses the write button.
The LED flashes and in less than a second the R/W card has been programmed with the information that was read from the original. Voila ! A clone card. The cost to build the device was minimal (approx. $30) including the LCD display and circuit board. The design fit on a single sided circuit board that I etched myself. The PWB was made to be the same size as the LCD so that they could be plugged together as a single assembly.
I initially began this activity by trying to build a simple card reader that could be used to obtain all of the information that was transmitted by the card during a simple read operation. Most commercial card readers do not output all of the data that is read. Information such as the header and card format are never transmitted as part of the readers normal output stream.
Knowing this information is critical for being able to replicate a cards operation. As a result, I set out to build my own custom reader. A document that I found to be invaluable during my learning process was Microchip`s 125 Khz RFIDSystem Design Guide which can be found on their website. RFID System Design Guide. Their FSK reference design circuit was basically what I used for my design. I made a couple of small modifications to simplify the design and to allow the use of a Parallax SX28 microcontroller instead of the PIC.
After studying the datasheet for the T5557/5567 IC (used in many vendors access cards), I soon realized that the reader circuit would only have to be modified slightly in order to also be able to function as an RFID writer. To function as a writer the design simply needed to be able to modulate the 125Khz RF carrier using On/Off Keying (OOK) modulation since this is how the T55x7 chips are programmed.
I modified the design to accomplish this by basically giving the microcontroller the ability to control the 125 Khz divide counter reset signal. An extra push button was also added to an unused GPIO input on the microcontroller. A schematic of my reader circuit (modified to become a writer) is shown below: My updated write-capable version of the Reader/Writer assembly along with a commercial 44780 4G—20 LCD and 125Khz loop antenna is shown in the photo below.
The completed unit was installed onto a piece of acryllic plastic in lieu of trying to find an off-the-shelf plastic box that everything would fit in and still look halfway decent. I have tested the unit with numerous card types including 26-bit, 34-bit, 36-bit, 37-bit and the 35-bit Corporate 1000 formats.
The cloner was able to duplicate all of them without any difficulty. In all cases, the vendors own commercially available readers were unab
The prototype card reader and cloner integrates several key components to facilitate its operation. The system utilizes a 125 kHz loop antenna that serves as both the transmitter and receiver for RFID signals. The Parallax SX28 microcontroller acts as the central processing unit, managing the reading and writing operations. The microcontroller's firmware is programmed to handle the On/Off Keying modulation necessary for writing to the T5557/5567 chips, allowing for seamless cloning of RFID cards.
The LCD display provides real-time feedback to the user, showing the decoded card information during read operations and confirming successful write operations. The choice of a 4G—20 character LCD enables clear visibility of the card data, crucial for user interactions. The device's compact design allows it to be easily handled, and the self-contained nature eliminates the need for cumbersome external power sources or connections, enhancing portability.
For power supply, a suitable battery or power adapter can be integrated, ensuring that the device remains functional during field operations. The design can also be expanded to include additional features, such as an SD card slot for data logging or a USB interface for connecting to external devices for software updates or data management.
In conclusion, this RFID proximity card reader and writer exemplifies a practical application of RFID technology, demonstrating the potential for both security and convenience in access control systems. The development process highlighted the importance of thorough research, component selection, and circuit design, culminating in a versatile tool for RFID card management.Interesting articles about reading/writing RFID proximity cards that we use foraccess to controlled areas. This all came about after a discussion with a colleague about how easy it would be to clone a card. After a bit of research we managed to find and talk to Carl whohas spent numerous hours working on his hacks.
Proxclone was put togetheras an information hubto help understand the technologies used in 125Khz proximity based access control systems and cards. Since there are numerous vendors who manufacture proximity based reader and card products, Carl`s efforts have been focused on the some of the more popular and widely used products in the marketplace.
The picture below is of my prototype combination card reader and cloner. The unit is self contained and does not require the use of a PC or other external equipment to operate. Operation is simple and straightforward. Simply hold a card near the antenna and the unit reads and decodes the information from the card. The information is then formatted and displayed on a 4G—20 character LCD. If the operator wishes to make a copy of the card he simply brings a T5557/5567 Read/Write card near the antenna and presses the write button.
The LED flashes and in less than a second the R/W card has been programmed with the information that was read from the original. Voila ! A clone card. The cost to build the device was minimal (approx. $30) including the LCD display and circuit board. The design fit on a single sided circuit board that I etched myself. The PWB was made to be the same size as the LCD so that they could be plugged together as a single assembly.
I initially began this activity by trying to build a simple card reader that could be used to obtain all of the information that was transmitted by the card during a simple read operation. Most commercial card readers do not output all of the data that is read. Information such as the header and card format are never transmitted as part of the readers normal output stream.
Knowing this information is critical for being able to replicate a cards operation. As a result, I set out to build my own custom reader. A document that I found to be invaluable during my learning process was Microchip`s 125 Khz RFIDSystem Design Guide which can be found on their website. RFID System Design Guide. Their FSK reference design circuit was basically what I used for my design. I made a couple of small modifications to simplify the design and to allow the use of a Parallax SX28 microcontroller instead of the PIC.
After studying the datasheet for the T5557/5567 IC (used in many vendors access cards), I soon realized that the reader circuit would only have to be modified slightly in order to also be able to function as an RFID writer. To function as a writer the design simply needed to be able to modulate the 125Khz RF carrier using On/Off Keying (OOK) modulation since this is how the T55x7 chips are programmed.
I modified the design to accomplish this by basically giving the microcontroller the ability to control the 125 Khz divide counter reset signal. An extra push button was also added to an unused GPIO input on the microcontroller. A schematic of my reader circuit (modified to become a writer) is shown below: My updated write-capable version of the Reader/Writer assembly along with a commercial 44780 4G—20 LCD and 125Khz loop antenna is shown in the photo below.
The completed unit was installed onto a piece of acryllic plastic in lieu of trying to find an off-the-shelf plastic box that everything would fit in and still look halfway decent. I have tested the unit with numerous card types including 26-bit, 34-bit, 36-bit, 37-bit and the 35-bit Corporate 1000 formats.
The cloner was able to duplicate all of them without any difficulty. In all cases, the vendors own commercially available readers were unab
RF Signal Attenuator up to 30dB for 1MHz - 500MHz Input
This is a PIN diode-based RF signal attenuator circuit that operates with input frequencies ranging from 1 MHz to 500 MHz. PIN diodes are among the most commonly used components in RF applications.
The RF signal attenuator circuit utilizing PIN diodes...
RF data link and remote control
This section describes an experimental low power, low bandwidth data signaling system that was initially made to operate at 55 MHz (television channel 2 in the U.S.). Before operating a radio transmitter, find out what kind of transmitter operation, if...
RF Remote Control Switch Rx-Tx circuits
This circuit includes a 2048 radio remote control transmitter and a corresponding wireless receiver that features high reception sensitivity and low power consumption. The combination of these two components provides a highly reliable remote control system, suitable for various applications...
2 Channels RF remote control
Remote controls are often needed to manage various electric devices. There are several types of remote controls available, including infrared, RF (Radio Frequency), and SMS. Basic short-range remote controls primarily utilize infrared and RF technology. A limitation of infrared is...
connect 4000
The objective of this project was to investigate the wireless linkage of objects, locations, and individuals. Initial discussions revolved around the intended use of the project—whether for private or public purposes—and the number of participants involved. Considerations included the choice...
Jammer circuit
The frequency jammer operates by generating interfering RF noise centered around a 2.45 GHz carrier frequency. As the power of this noise increases, the signal-to-noise ratio of the wireless communication channel decreases, leading to a higher bit error rate until...
RF Remote Control With HT12E IC
The following circuit illustrates an RF Remote Control Circuit Diagram. This circuit is based on the HT12E IC. Features include the original data in parallel format, where the decoder IC receives the signal through the RF receiver module, utilizing an...
Basic RF Oscillator
Create a basic RF oscillator. The circuit is very simple, so complex calculations will be omitted, and component selection will be simplified using calculators. For this example, the target frequency is 7 MHz. The circuit includes a transistor (TR1) on...
GlueLogix Technical Services
A wireless interface for your next project. With a coil, a capacitor, and a transistor, it is possible to create a device that emulates a Radio Frequency Identification Device (RFID), commonly referred to as a "tag" or "RFID tag." A...