1

tricky apartment key fob

I have this key fob for our apartment building, and I want to make a copy of it.

I've taken it to 3 locksmiths who are able to create a copy, but the copies don't work.

I've confirmed that it doesn't appear to be a rolling fob by comparing the frequency and code of the original and the copy after using the original again at the building.

What other security measures could be in place? And how would I be able to copy it?

Does anyone recognize this particular product or know how I can copy it?

Improve this question
5
  • 1
    Have you checked if data in the signal varies when you use it? Commented Dec 14, 2021 at 4:49
  • After using the original fob, I checked it and the code was the same as before using it. So it's not a rolling fob. Is that what you mean? Commented Dec 14, 2021 at 5:36
  • 2
    If it always sends the same signal, then it should work. Don't just compare the code, compare the entire signal bit by bit by using Software Defined Radio. Your signal encoding can be wrong. Commented Dec 14, 2021 at 7:49
  • I took it to a locksmith and they just had a simple handheld machine to copy it, and it only showed the frequency and code. Can you suggest some other kind of service provider who can copy it correctly? Or if I want to do it myself, what kind of hardware do I need? Commented Dec 14, 2021 at 9:14
  • Software defined radio or someone who has it what all you need. The code is carried over the signal but the signal itself should also be correct so it can be recognisable. Digital modulation technique, data encoding, bytes padding and spacing between the pulses should be correct (One keypress sends 3 or more pulses to mitigate signal loss). The demonstration here if done right should be enough for your task: I Hacked Into My Own Car. Commented Dec 14, 2021 at 13:44

3 Answers 3

Reset to default
1

Look for a Fob Copy place in your area. The reputable ones will tell you right away if it's possible.

I have duplicated many condo fobs and keys that I have learned a bit about them.

  • Low-frequency fobs, from what I am told, are easy to duplicate.
  • High-frequency fobs range quite a bit.
  • Desfire fobs can not be done at this time.
  • Mifare Classics can all be duplicated if they have 4byte UID or 7byte UID, their magic is in the blank, some systems can write back to the card or use some sort of rolling code. If the correct blank is used, some Chinese firewall blanks you can bypass these systems.
  • Hid iclass SE cannot all can be duplicated, it is based on the configuration of the readers

There are many types of formats out there.

Improve this answer
1

There just isn't enough information here for the likes of me to state anything with certainty.

Mifare Classic 1k has a unique ID number and several data sectors which are encoded with keys. A basic duplicator/cloning device might copy the unique ID but not reproduce the data sectors properly without first cracking the associated keys. This is one of many possible explanations for what went wrong with your locksmith duplicate.

Another possibility is the IDTK format which is popular at apartment buildings. This format loops through the bitstream and some duplicators may arbitrarily duplicate bits without the right start/length. The result could be a sequence on the clone which is disjointed when it wraps around.

Unlikely, but maybe this is a dual-frequency fob. If only one format is cloned, the reader could be expecting the other, or even both formats. There are so many more possibilities, I'll stop guessing here.

The most powerful and widely supported tool for identifying, emulating and duplicating RFIDs is the Proxmark 3. Knock-off variants of the "Proxmark3 Easy" can be purchased for less than $40 on sites like AliExpress.

The one thing I am confident of is that your photo is of a passive token. This means RFID/NFC, not an active RF remote that can be sniffed with average SDR. Whatever tools you use will need to be sensitive to near-field electromagnetic energy.

Improve this answer
-7

This looks like a dual-chip generic key fob that can emulate many common formats. Typically it has both a 13.56Mhz and a 125Khz chip installed.

Traditional locksmiths are a bit behind the time on copying RFID based access control keys. Especially the newer formats that are coming out.

Improve this answer
1
  • 1
    Don't advertise your services here Commented Jan 7, 2023 at 14:52

You must log in to answer this question.