Proxmark3 – Clone EM4xx RFID tag

One day I just got dead tired of that plastic RFID key fob I used to have in my key ring. Every once in a while the plastic broke and I lost the fob. So I ordered an empty rewritable leather key fob from China and decided to make my own copy using my Proxmark3 RFID development board.

The below is just a quick write-up so I don’t forget how I did it.

Verify your Proxmark3

[usb] pm3 --> hw tune
Measuring antenna characteristics, please wait......
# LF antenna: 23.79 V @   125.00 kHz
# LF antenna: 30.25 V @   134.00 kHz
# LF optimal: 31.21 V @   131.87 kHz
# HF antenna: 26.91 V @    13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.

Clone your tag

Read original tag

[usb] pm3 --> lf search
EM TAG ID: XXXXXXXXXXX (xxxxx_xxx_xxxxxxxx)

Write to new tag

[usb] pm3 --> lf em 410x_write XXXXXXXXXXX 1
[+] Writing T55x7 tag with UID 0xXXXXXXXXXXX  (clock rate: 64)
#db# Started writing T55x7 tag ...
#db# Clock rate: 64
#db# Tag T55x7 written with 0xXXXXXXXXXXXXXXXXXX

Verify new tag

[usb] pm3 --> lf search
EM TAG ID: XXXXXXXXXXX (xxxxx_xxx_xxxxxxxx)