Long Range Cloner
#RFID
#125Khz
#access control
#keyfob
#antenna
#receiver sensitivity
#cloner
#long range
#wireless
#security
Description: The capability to read a 125 kHz access card or key fob at a significant distance is influenced by various factors, including the size of the reader antenna, radiated power, and receiver sensitivity. The reader cloner described previously offers simplicity and low cost but can only read an RFID tag from approximately 3-4 inches. Achieving longer reading distances necessitates more complex receiver circuitry and the generation of a higher power RF magnetic field. Instead of designing a long-range reader from the ground up, the long-range cloner project utilizes a commercially available long-range reader that has been modified to write to a T5567 Read/Write card using the information provided by the commercial reader. The selected reader for this project is the HID 5375AGN00 MaxiProx reader, which has a typical read range of up to 24 inches for a standard ProxCard II access card. The reader outputs card information via a standard Wiegand interface after each valid tag read. This Wiegand data stream is sent to a custom circuit board installed in the unused space of the MaxiProx reader. The custom circuit board employs a Parallax SX28 8-bit microcontroller to decode, display, and store the data received from the reader. Commercial readers do not transmit all binary information from the tag; they provide the card number, facility code, and parity bits, while the front-end preamble and detailed card format information are verified but not output. This missing information can be captured and displayed by another custom reader/cloner device, allowing the combination of the commercial reader's output data with this "fixed" information to create a programming sequence for a clone card. The top photo illustrates the completed long-range reader/cloner, while the second photo shows the internal layout, which includes the stock commercial reader circuitry (on the right) alongside the added circuitry and LCD display (on the left), as well as a 12x AA rechargeable battery pack for portability. The reader's high-power antenna, measuring 12"x12", is used for reading tags, while a smaller 2" diameter antenna is employed for writing T5567 R/W cards. The modified reader's local power source enables complete portability for field use. When within a couple of feet of a valid HID (or HID-compatible) card, the reader's LED blinks, and it begins outputting the Wiegand data stream. The microcontroller decodes this stream and drives a 2x16 LCD to display information, including the card format (bit length) and the hexadecimal value of the 26-37 bits of Wiegand data received. Further decoding reveals the decimal values of the facility code and card number, which are displayed on the second line of the LCD. The card number typically matches the one printed on the card's back. To copy a read card, the operator simply brings a T5567 R/W card near the smaller antenna and presses the "write" button, creating a duplicate card in less than a second. The long read range and portability of the unit enable covert reading and copying of cards, raising concerns about its use in high-security applications. A schematic of the hardware design is provided below.
The described long-range cloner project integrates several key components to achieve its functionality. The HID 5375AGN00 MaxiProx reader serves as the primary RFID reader, capable of reading standard ProxCard II cards at a distance of up to 24 inches. The design incorporates a robust high-power antenna, which enhances the magnetic field strength, allowing for the extended reading range.
The custom circuit board plays a crucial role in the system by utilizing the Parallax SX28 microcontroller, which is responsible for processing the Wiegand data and managing the LCD display. The microcontroller is programmed to interpret the incoming data stream, extract relevant information such as the card number and facility code, and present this information in a user-friendly format on the LCD.
The incorporation of a rechargeable battery pack ensures that the entire system remains portable, enabling field operations without reliance on external power sources. The dual antenna configuration allows for both reading and writing capabilities, with the larger antenna optimized for reading and the smaller antenna designed for writing to T5567 cards.
The design emphasizes ease of use; the operator can quickly clone a card by simply presenting a T5567 card to the writing antenna and pressing a button. This streamlined process, combined with the device's portability, raises potential security concerns, particularly in environments where sensitive access control is critical. The system's ability to covertly read and duplicate cards necessitates careful consideration of its applications in security-sensitive areas. The accompanying schematic provides a visual representation of the circuit design, illustrating the interconnections between the reader, microcontroller, LCD, and power supply components.The ability to be able to read a 125Khz access card or keyfob at a large distance involves numerous factors including reader antenna size, radiated power, receiver sensitivity and the like. The reader cloner shown on the previous web page has the benefit of simplicity and low cost but is only capable of reading an RFID tag from a distance of appro
ximately 3-4 inches. The ability to read a tag from much greater distances requires much more complicated receiver circuitry and the ability to generate a higher power RF magnetic field. Rather than designing a long range reader from scratch, my long range cloner project leverages the use of a commercial off-the-shelf long-range reader that I have modified to be able to write a T5567 Read/Write card with the information that is output by the commercial reader.
The reader that I selected for my project is the 5375AGN00 MaxiProx reader that is manufactured by HID. The reader has a typical read range of up to 24 inches for a standard ProxCard II access card. The reader outputs the card information via a standard Wiegand interface following each read of a valid tag.
The wiegand data stream is then sent to a custom circuit board that I have physically installed into unused space within the MaxiProx reader. The custom circuit board utilizes a Parallax SX28 8-bit microcontroller to decode, display and store the data that is sent by the reader.
Commercial readers do not output all of the binary information that is transmitted by the tag. Information such as the card number, the facility code and parity bits are transmitted by the reader whereas the front end preamble and detailed card format information are verified by the reader but not output as part of the wiegand data stream. However, this missing information can be captured (and displayed) by my other custom reader/cloner device and once known, this "fixed" information can be combined with the commercial readers output data to generate the necessary programming sequence to create a clone card.
The top photo below shows the finished long range reader/cloner. The second photo shows the internal layout which includes the stock commercial reader circuitry (on right) along with my added circuitry and LCD display (on left) and a 12x AA rechargeable battery pack to allow the unit to be completely portable. The readers high power antenna 12"x12" is used to read the tags while the smaller 2" diameter antenna is used to write the T5567 R/W cards.
Since the modified reader has its own local power source it is completely portable and can easily be used in the field. When the unit gets within a couple of feet of a valid HID (or HID compatible) card the reader`s LED will blink and it will begin outputing the wiegand data stream.
The microcontroller will decode the readers wiegand data stream and drive the 2x16 LCD with information that includes the card format (bit length) and the hex value of the 26-37 bits of wiegand data that was received. The wiegand data is further decoded to determine the decimal value of the cards facility code and card number which is then displayed on the second line of the LCD display.
The card number is usually the same as is physically printed on the backside of the card. If the operator desires to make a copy of the card that was read, he simply brings a T5567 R/W card near the smaller antenna and then presses the "write" button. In less than a second a duplicate card is created. Note: The long read range of the unit combined with it`s portability makes it fairly simple to covertly read and copy a card.
The unit can easily be concealed in a briefcase or backpack. The simple act of walking by someone in a hallway or being in near vicinity (e. g. elevator) is sufficient to read and clone a persons card making this type of cards use questionable for high security applications. A schematic of the hardware design is shown below. The entire assembly (reader & custo
The described long-range cloner project integrates several key components to achieve its functionality. The HID 5375AGN00 MaxiProx reader serves as the primary RFID reader, capable of reading standard ProxCard II cards at a distance of up to 24 inches. The design incorporates a robust high-power antenna, which enhances the magnetic field strength, allowing for the extended reading range.
The custom circuit board plays a crucial role in the system by utilizing the Parallax SX28 microcontroller, which is responsible for processing the Wiegand data and managing the LCD display. The microcontroller is programmed to interpret the incoming data stream, extract relevant information such as the card number and facility code, and present this information in a user-friendly format on the LCD.
The incorporation of a rechargeable battery pack ensures that the entire system remains portable, enabling field operations without reliance on external power sources. The dual antenna configuration allows for both reading and writing capabilities, with the larger antenna optimized for reading and the smaller antenna designed for writing to T5567 cards.
The design emphasizes ease of use; the operator can quickly clone a card by simply presenting a T5567 card to the writing antenna and pressing a button. This streamlined process, combined with the device's portability, raises potential security concerns, particularly in environments where sensitive access control is critical. The system's ability to covertly read and duplicate cards necessitates careful consideration of its applications in security-sensitive areas. The accompanying schematic provides a visual representation of the circuit design, illustrating the interconnections between the reader, microcontroller, LCD, and power supply components.The ability to be able to read a 125Khz access card or keyfob at a large distance involves numerous factors including reader antenna size, radiated power, receiver sensitivity and the like. The reader cloner shown on the previous web page has the benefit of simplicity and low cost but is only capable of reading an RFID tag from a distance of appro
ximately 3-4 inches. The ability to read a tag from much greater distances requires much more complicated receiver circuitry and the ability to generate a higher power RF magnetic field. Rather than designing a long range reader from scratch, my long range cloner project leverages the use of a commercial off-the-shelf long-range reader that I have modified to be able to write a T5567 Read/Write card with the information that is output by the commercial reader.
The reader that I selected for my project is the 5375AGN00 MaxiProx reader that is manufactured by HID. The reader has a typical read range of up to 24 inches for a standard ProxCard II access card. The reader outputs the card information via a standard Wiegand interface following each read of a valid tag.
The wiegand data stream is then sent to a custom circuit board that I have physically installed into unused space within the MaxiProx reader. The custom circuit board utilizes a Parallax SX28 8-bit microcontroller to decode, display and store the data that is sent by the reader.
Commercial readers do not output all of the binary information that is transmitted by the tag. Information such as the card number, the facility code and parity bits are transmitted by the reader whereas the front end preamble and detailed card format information are verified by the reader but not output as part of the wiegand data stream. However, this missing information can be captured (and displayed) by my other custom reader/cloner device and once known, this "fixed" information can be combined with the commercial readers output data to generate the necessary programming sequence to create a clone card.
The top photo below shows the finished long range reader/cloner. The second photo shows the internal layout which includes the stock commercial reader circuitry (on right) along with my added circuitry and LCD display (on left) and a 12x AA rechargeable battery pack to allow the unit to be completely portable. The readers high power antenna 12"x12" is used to read the tags while the smaller 2" diameter antenna is used to write the T5567 R/W cards.
Since the modified reader has its own local power source it is completely portable and can easily be used in the field. When the unit gets within a couple of feet of a valid HID (or HID compatible) card the reader`s LED will blink and it will begin outputing the wiegand data stream.
The microcontroller will decode the readers wiegand data stream and drive the 2x16 LCD with information that includes the card format (bit length) and the hex value of the 26-37 bits of wiegand data that was received. The wiegand data is further decoded to determine the decimal value of the cards facility code and card number which is then displayed on the second line of the LCD display.
The card number is usually the same as is physically printed on the backside of the card. If the operator desires to make a copy of the card that was read, he simply brings a T5567 R/W card near the smaller antenna and then presses the "write" button. In less than a second a duplicate card is created. Note: The long read range of the unit combined with it`s portability makes it fairly simple to covertly read and copy a card.
The unit can easily be concealed in a briefcase or backpack. The simple act of walking by someone in a hallway or being in near vicinity (e. g. elevator) is sufficient to read and clone a persons card making this type of cards use questionable for high security applications. A schematic of the hardware design is shown below. The entire assembly (reader & custo
Active Antenna
Antennas that are much shorter than 1/4 wavelength present a very small and highly relative impedance that is dependent on the received frequency. It is difficult to match impedances over a decade of frequency coverage. Instead, input stage Q1 is...
RFID id-12 tagreader
This document provides a straightforward code example for reading tags from the ID12 RFID reader. Modifications can be made easily if the data format sent by the reader is understood. It also includes instructions for connecting the reader for serial...
Quality Stereo Wireless Microphone or Audio Link
This stereo FM wireless microphone serves as an excellent audio link. Testing revealed a reliable range exceeding 50 meters. It is distinct from previous wireless microphones due to its stereo capability, which delivers unexpectedly high-quality sound. The range was tested...
Key Code Combination High Security Door Lock
This project involves an electronic lock that supports numerous combinations, which can be easily modified. It unlocks only with the correct sequence of four consecutive numbers. A significant feature of this electronic lock is that the four numbers must be...
EM4294 13.56MHz Crypto Analogue Front End Circuit For High Secure RFID Communication
The EUA2032 is a high-efficiency, 2.5W mono class-D audio power amplifier. A newly developed filterless PWM modulation architecture further reduces EMI and THD+N, as well as eliminates the LC output filter, thereby reducing the external component count, system cost, and...
wireless telephone line spy circuit
This design outlines a phone bug circuit. The wireless telephone line spy circuit is capable of transmitting phone conversations to a nearby FM radio. The circuit must be connected to a standard phone line. In the circuit, the first transistor...
Active Antenna
Antennas that are much shorter than 1/4 wavelength present a very small and highly relative impedance that is dependent on the received frequency. It is difficult to match impedances over a decade of frequency coverage. Instead, input stage Q1 is...
Wireless Headphone Transmitter Receiver Circuit
Wireless headphone transmitter and receiver systems are now widely available in the market, offering a variety of pricing options along with reliable technical specifications for various applications. These include wireless headphones for televisions, computers, and earbuds. A wireless headphone transmitter...
simple rf id reader module design
A coil of approximately 1 mH is utilized for both sides of the circuit. Given a chosen frequency of 125 kHz, the required capacitor value is calculated to be 1.62 nF, with a standard value of 1.5 nF selected. L1...