Parameters

Meaning

Reader:

Reading distance:

Keyboard

package 8 bit

Interfaces:

Exit Wiegand 26

10 - 14 V (DC), max 40 mA

Operating temperature range:

As you know, many access systems use EM-Marin RFID cards with a frequency of 125 kHz. The intercom of my house was no exception. One problem - it would be nice to learn how to copy such cards, because the price tags for copying them are not encouraging. Of course, there are quite a few copier schemes on the net (and the Chinese sell their copiers for a penny - however, they often put their password on blanks when copying), but why not build your own copier? That's what the article below is about.

It’s worth starting the development of a copier from finding out, what can such labels be copied to? After reading the forums, you can find out that the most common blanks for copying are T5577, T5557, EM4305.

Now we need a diagram. Let's take the analog part of such a copier from RECTO and connect it to the atmega8 microcontroller. Let's add a level converter to connect to a max232-based COM port (those who wish can use ST232 or something else to connect via USB, but I have a COM port on my computer, as well as a USB-COM adapter, so I have such a task did not stand).

You get the following scheme:

What is she like? Dual emitter follower, oscillating circuit, detector and RC filters. Due to the fact that RC filters have different time constants, by comparing the voltage levels between the stages, it is possible to highlight the change in the signal of the RFID tag. The comparator built into the atmega8 will deal with this task. The generation of a 125 kHz signal will be provided by the PWM controller built into the atmega8.

The combination of an RFID tag and a reader form a transformer, where the tag is the secondary winding. The transfer of information by the label is carried out by changing the load of the secondary winding. As a result, the current in the reader coil (primary winding) changes. The above analog part of the circuit is engaged in the selection of these current pulses. The oscillatory circuit must be adjusted to the maximum voltage at the test point, for example, by winding / winding the turns of the coil. True, they say, the voltage is still better a little less than the maximum - it works more stable. I have about 40 V at the control point.

The label to be copied uses Manchester encoding. In order to decrypt this code, it is enough to skip three quarters of the bit slot period by any change in the signal edge and, by the signal edge following it, fix the bit value that will correspond to the signal value after the edge. When decoding, it is worth setting a window in which the signal transition should occur - no more than half the period of the bit slot.

The method for deciphering the Manchester encoding and the code for this I took from Shads. Of course, it was possible to write my own, but I was in a hurry to start the copier - I wanted to make sure that the scheme was working and the tags were being received. So this fragment remained in the copier code. It also turned out that my comparator is set inversely than the decoding code needs. Changed in the code. So, we got sequences of zeros and ones. How to get the card code from them?

And it's very simple. Let us assume that the card number according to nibbles has the form AB CD EF GH IJ. The map shows this:

1) Nine units at the beginning;
2) Nibble A;
3) Nibble parity A (1 bit);
4) Nibble B;
5) Nibble parity B (1 bit);
…
16) Nibble I;
17) Nibble parity I (1 bit);
18) Nibble J;
19) Nibble parity J (1 bit);
20) Nibble parity columns for nibbles A B C D E F G H I J;
21) Bit 0.

We read all 64 bits, decrypt and get 40 bits of the card code. It is logical that if we issue such a code ourselves, closing the coil of the card attached to the reader, we will get a card emulator. But now we are not interested in him.

We learned how to read the map, but how to transfer data to the map? To do this, you just need to turn on or off the frequency of 125 kHz in accordance with the exchange protocol with the card. During the “silence” of the reader, the card is powered by stored energy.

The T5557/T5577 blanks are fully compatible with each other in terms of recording protocols, however, they have slightly different minimum and maximum pulse times (fortunately, the T5557 times overlap with the T5577). The EM4305 has a different recording protocol.

To record T5557 I used BolshoyK's code. The table below shows the signal parameters for the T5557 key fob.

The recording begins with the StartGape signal - it is required to turn off the 125 kHz signal for about 300 µs. This is a signal to the card that data will now be transferred to it. Further it is necessary to transfer to a blank the information. The encoding of the transmitted data is the same Manchester.

T5557 / T5577 and EM4305 blanks are multifunctional and can different types modulations, support passwords and much more. Each disc has a set of 32-bit blocks on board. The purpose of these blocks is different. In some - the issued key code (it takes two blocks). Others are configuration. Thirdly, the manufacturer's identifier. We will use limited functionality, so those who want to understand what all these bits mean can look at the documentation for the blanks (I attached it to the archive).

Blocks are collected in two pages (0 and 1).

In the zero page there is a configuration block with index 0. We will set it. For T5557/T5577, we will have the following configuration bytes: 0x00.0x14.0x80.0x40 in accordance with the table from the documentation (I marked the modes selected by single bits in red):

Thus, we have chosen: the data transmission frequency RF / 64 (125 kHz / 64), Manchester-type coding, the issuance of blocks up to the second (in blocks 1 and 2 we will have the code issued by the card). The opcode (2 opcode bits) and one lockbit must be sent before writing. Opcodes 10b and 11b precede data writes for pages 0 and 1 (the low bit specifies the page number, the high bit specifies the page write code). We get 10b for the opcode (all work is page zero) and 0b for the latch bit. After transferring all this data, it is necessary to transfer the three-bit address of the page being written. All data transfers for the T5557/T5577 are MSB to LSB.

By setting the card code in blocks 1 and 2 and the configuration in block 0, you can get a duplicate RFID tag. As you can see, everything is simple.

The next type of blanks is EM4305. So I had to deal with the recording of this disc myself. It also consists of blocks of 32 bits, but their purpose is different.

The coding of the data transmitted to the card is based on changes over a time interval. If there was a difference over the time interval, then this is zero, and if there was not, it is one. The configuration word is stored in 4 bytes and for myself I defined it like this: 0x5F,0x80,0x01,0x00 (Manchester encoding, RF/64, output of word 6). In words 5 and 6, I write the card code (the same 64 bits that the card produces). The EM4305 requires that the transmission be from LSB to MSB. The card understands that an exchange begins with it after the issuance of a combination of impulses to it:

1. We turn off the field for 48 µs.
2. We turn on the field for 96 µs.
3. We turn off the field for 320 μs.
4. We turn on the field for 136 μs.
5. Disable the field until the next command.

1. We send the above sequence of pulses.
2. Helmet 0b.
3. We send CC0-CC1 and their parity P. (0101b for record, see tables below).
4. We pass the address of the block (see table), two padding zeros and the parity of the address.
5. We transfer block data (32 bits).

Command codes

Block address format

This sets the configuration of the EM4305 blank and its code.

Actually, nothing more is required for a simple copier.

I made several versions of the copier with different displays. For example, here is a copier with a 1602 display:

And here is a video of the copier working on the LPH9157-02 display:

But the reason why I became interested in copiers of such keys was that I had to make many copies of the intercom key (it was too lazy to wait for a parcel from China), but the price tag is this:

The archive contains all the schemes, seals, programs and documentation for blanks. There is a version for Arduino Nano (it needs to be flashed separately through programs for uploading third-party firmware).

Those who wish can open the documentation for all these discs and implement support for passwords and other card modes. I personally didn't need any of this.

Special huge thanks to RECTO, BolshoyK and Shads - without you I would have been having fun with development for quite some time!

Thank you for your attention.

P.S. I am not a professional in copying keys and in blanks, so I could well be mistaken in something. However, the copier works, and so far no one has found errors in it.

EM-Marine is the most popular type of identifier in Russia. The format was developed by a Swiss company E.M. Microelectronic.
The card production process is divided into two large iterations, first large high-tech companies produce chips, there are very few such companies. Then there are an innumerable number of card manufacturers who buy chips and produce ready-made identifiers.

Chip manufacturers
In Russia, you can find EM Marine identifiers with three types of chips
TK4100- the most common chip used by large Chinese companies.
EM4100- the original chip is practically not supplied due to the high price.
KB5004HK2- a Russian-made chip from the company angstrom

Any of these chips contain forty bits of data, usually only twenty-four of them are readable. This 24-bit number is written on thick cards on the outside in text and decimal form..

The card code in decimal form is 007369663, then the same code presented in text form is 112.29631.
Convert codemaps from decimal to text, you can use special converters. If you enter the card number manually,the use of a converter may be required to add a card to the ACS software or other systems.

To automate the input of a card into the software, you can use readers connected to a computer - the price is from 1535 rubles.
Before purchasing a card reader, check the compatibility of the reader model you have chosen with your software. For example withSigur ACS software , single reader compatible Sphinx-Reader-EH .

Number uniqueness
The uniqueness of the identifier is the most important factor in the stability and security of any system (access control systems, payment systems, paid parking systems, etc.), including Article about Mifare we wrote about the fact that, for example, NXP strictly controls the uniqueness of numbers.

In the case of EM Marine, no one controls anything, and a large number of chip manufacturers make the probability of accidentally encountering non-unique numbers quite high.

Card manufacturers
A huge number of manufacturers of cards, bracelets, key rings defies any review, the largest Russian manufacturer is the Angstrem campaign, the largest Chinese Tatwah Smartech.

There is no exact data, but experts agree that 80% of Chinese-made cards are sold on the Russian market.
Chinese IDs have the lowest price among all contactless cards. Most often, identifiers are made in the form of cards, but other forms are also used, such as key rings, bracelets and other options.

The production quality of EM Marine cards varies greatly depending on the manufacturer, and comes to the fore if we are talking about big projects. You can tell a quality card from a bad one only by opening it.

Identifier types

Thick maps EM-Marine - price from 11 rubles
Made from ABS plastic , with a special slot for the clip of any card holder.

EM-Marine thin cards - price from 12 rubles
Made and PVC plastic (Polyvinylchloride), designed for direct application of images using a sublimation printer or offset printing.

Keychains EM-Marine - price from 11 rubles
A huge variety of materials from leather to glass and the same variety of shapes.
It should be remembered that the reading range of the key fob will be less than that of the card.

EM Marine bracelets - price from 81 rubles
There are two types of bracelets
1. Reusable
2. Disposable - after putting on the arm, the bracelet cannot be removed without violating its integrity, thereby protecting it from transferring the identifier to another person.

Tags EM-Marine - price from 53 rubles
You can find marks of any size and shape, from standard to microscopic.

Personalization

Printing on a sublimation printer - price from 61,572 rubles
Ideal for printing employee badges, print quality will greatly depend on the printer model and, accordingly, its cost.

Screen printing
The second common name for this printing method is silk screen printing. An inexpensive way to apply a large number of simple, identical images, that is, a photograph cannot be applied by this method, it will also not be effective to apply many different images.
The great advantage of screen printing is the ability to print on almost any material. For example, only silk-screen printing can be printed on bracelets and key rings.

Offset printing
High quality printing, any type of image can be printed, some types of images can be very expensive, for example when each card has an employee photo printed on it.

Laminated stickers - price from 11 rubles
The most inexpensive option for personalizing contactless cards, in this case the information itself is printed on plain paper using any printer, inserted into a special sticker for lamination, then passed through a laminator and then glued onto the card.

Plastic stickers - price from 25 rubles
A thin sticker made of PVC plastic (Polyvinyl chloride) is suitable for both sublimation printing and offset printing. After printing, the sticker is pasted onto the card; some advantage of this personalization method can be considered the possibility of re-gluing the stickers.

Readers EM Marine - price from 921 rubles
The EM Marine technology is very simple: the implementation of readers for EM Marine is absolutely no problem. There is a huge selection of inexpensive readers for a variety of tastes.

There are readers with an interesting design, there are readers with fairly good vandal resistance, there are readers that can be installed outdoors, miniature readers and readers combined with support for some other standard, such as Mifare, or a PIN code keypad.

Reading range
Readers provide different reading ranges. The simplest readers usually provide a reading range of five to fifteen centimeters, but there are options up to one and a half meters.

The range essentially depends on the execution of the identifier. Keyrings and bracelets - small compact identifiers - are the least readable. Better to read thin cards of standard size, even better to read thick cards, and there are alsospecial versions of thick cards that cost about one and a half times more expensive, but also read about one and a half times further .

Other features of EM Marine long distance card reading is that the range drops significantly if there is metal near the card or reader.

The orientation of the card plays a role: it is best read if the card is in a plane parallel to the plane of the reader. Well, by the way, these nuances are peculiar not only to EM Marine technology.

What is specific for EM Marine technology is that the technology does not support anti-collision, that is, if several cards are located near the reader at the same time, then no definite result is guaranteed. Therefore, it should * be noted that the practical range, practically achievable, is significantly lower than those figures that can be seen in the reader parameters.

Advantages of EM Marine
Very cheap, a huge range of readers, a huge range of identifiers.

Cons of EM Marine
1. Lack of any protection against card forgery .
Probably the biggest drawback. To create duplicates, you will need a programmer and a rewritable card, such as this. These devices are available, in any major city, for example, from organizations that create duplicate intercom keys.
It is also important that on thick cards, the identifier is written on it simply on the outside, often it can be simply read, and this is already enough information to make the same card that the reader cannot distinguish from the original.

Well, let's remember that the card can be considered from a long distance, therefore, in principle, one can even imagine such a story that the owner of the card did not get it and was not aware that it was read from a long distance and made a duplicate.
2. Not unique numbers
3. Lack of implementation of the anticollision mechanism

Well, the most important thing is your opinion.

EM-Marine is one of the most common formats used for contactless RFID. Developed by EM Microelectronic-Marin (Switzerland, Marin). The most common chips are EM4100, EM4102.

Identifiers are issued in the form of cards, key rings, bracelets, etc. based on international standard ISO14443.

They belong to the category of passive, because. do not have a built-in power supply. Each card has 64 bits of memory, 40 of which are occupied by a unique identification code. Em-Marine cards are not subject to rewriting. The interaction between the card and occurs at a frequency of 125 kHz, the range can be from 5 to 70 cm.

Em-Marine cards are available in two types: thin 0.8 mm and thick 1.6 mm.

The popularity of equipment based on the Em-Marine format is partly due to their lower cost, unlike other standards (HID or Mifare).

Material of the special project "Without a key"

The special project "Without a key" is an accumulator of information about ACS, converged access and personalization of cards

Articles

• Biometrics and mobility - a new word in modern access control systems
  

  The use of multiple authentication factors, including biometrics, significantly increases the likelihood that the user who swiped the card to the reader is the same person in whose name it was originally issued. Biometric technologies help verify a user's identity by checking their unique physical characteristics, such as fingerprints, hand and face geometry, or iris pattern.

• The history of the development of technologies that increase the reliability of the use of identifiers in ACS
  

  Approximately 20 years ago, for the first time in security systems, contactless access cards began to be used instead of the then widely used magnetic stripe cards and Wiegand cards.

• Transfer of ACS from EM MARIN cards to MIFARE® cards. Useful information for the owner of the ACS object.
  

  The vast majority of modern access control systems (ACS) use identifiers operating at a frequency of 125 kHz as a means of access. These are proximity access cards (read only), the most common are EM Marin cards, as well as HID, Indala®.

• How to prevent cloning of access cards? Solutions from IRON LOGIC®
  

  One way or another, city dwellers are faced with the need to create a clone of a card or keychain. The simplest example of such a situation is the recovery of a lost electronic key from your intercom. And, as we know, a copy of the key fob can be made in the nearest key-making workshop. In such a situation, copying a card or key fob looks quite harmless: we make an additional key from our own door.

• What is the role of the ACS in the IBS? Developers' view
  

  When the ES-Prom team received an assignment from the editors of the Security Algorithm magazine to prepare an article on the role of ACS in an integrated security system, a discussion arose on the topic: “How important is the access control system as part of the ISB? Is her role leading or supporting? As a result of the discussion, all involved experts came to the unanimous opinion that ACS is the basis of enterprise security, and it is advisable to use it as the “core” of the ISS created at the facility, and each of the participants in the discussion gave his weighty arguments in favor of this statement, of which as a result, this article was born

• Security of professional ACS ParsecNET 3
  

  Today, access control systems are increasingly viewed as tools for managing work discipline, increasing labor productivity, reducing theft rate, etc. However, no one canceled the role of ACS in the complex security system of the facility. The access control and management system is part of the security system, and therefore the requirements for it are special.

news

Similar posts

Heating 2022-01-22 12:21:54

UAE maritime safety rules

It is very beautiful on the coast: azure expanse, spaciousness, white boats, and pulls with a run to plunge into the warm embrace of the sea ....

Ventilation 2022-01-22 12:21:54

Is equality possible between husband and wife in marital relations?

Analytical capabilities of accounting (financial) reporting. Restless decade: Instability and equalization of opportunities ...