Add Electra intercom tag read/write support with slot auto switch

[naaraxi]

Fixes #203

[github-actions]

You are welcome to add an entry to the CHANGELOG.md as well

[github-actions]

Built artifacts for commit 7efde79

Firmware

• Ultra APP DFU Package
• Ultra binaries
• Lite APP DFU Package
• Lite binaries

Client

• Linux
• macOS
• Windows

[GameTec-live]

Cool, thanks! I dont see any major issues? Can anyone please test this PR and report back?

[naaraxi]

Note, Electra isn’t writable to T55xx.
I don't have any tags available for write testing on hand

Update: I cloned my tag and used it on my building's reader, at the entrance. It worked 😄

Later edit: Write support added

[nedeleav]

Hi there, It doesn't work, cli throws errors during the tag reading
CLI exception: Traceback (most recent call last):
File "chameleon_cli_main.py", line 146, in exec_cmd
File "chameleon_cli_main.py", line 141, in exec_cmd
File "chameleon_cli_unit.py", line 3138, in on_exec
File "enum.py", line 751, in call
File "enum.py", line 1170, in new
ValueError: 104 is not a valid TagSpecificType

[USB] chameleon --> lf em 410x read
CLI exception: Traceback (most recent call last):
File "chameleon_cli_main.py", line 146, in exec_cmd
File "chameleon_cli_main.py", line 141, in exec_cmd
File "chameleon_cli_unit.py", line 3137, in on_exec
File "chameleon_utils.py", line 235, in error_throwing_func
File "chameleon_cmd.py", line 437, in em410x_scan
struct.error: unpack requires a buffer of 15 bytes

I have tags and possibility to test them. Could you adjust the code for Electra tags.

[naaraxi]

@nedeleav
It still seems to be working for me, tried it just now (both using the script in the repo and the client artifact above).
Make you're using the correct firmware and client script, the errors are indicative of using the old fw/sw

[nedeleav]

@nedeleav It still seems to be working for me, tried it just now (both using the script in the repo and the client artifact above). Make you're using the correct firmware and client script, the errors are indicative of using the old fw/sw

I'm a bit confused: shall the Built artifacts for commit 93877d1 be used from the thread or the link you've suggested ?
As I am a bit new with CU I'm using GUI but CLI also.
For Electra is it recommended to use GUI o rather CLI ?
One more problem after this fw update (Built artifacts for commit 93877d1) the Ultralight V1 tag was not emulated while reading from CU, once updated from GUI to standard fw g97dfe5b, it worked fine but no support for Electra.

Update:
It works :) Just need to read Tag with lf em 410x read and the result should be with Electra before the full key, something like EM410xElectraxxxxxxxxxxxxxxxxxxxxxxxxxx, then write with econfig --id xxxxxxxxxxxxxxxxxxxxxxxxxx, from lf menu. The GUI will show Unknown tag, though you can switch to EMX410(64) and see full key, do not save afterwards.
!!!IMPORTANT: do not forget to set beforehand tag type (hw slot type -s -t EM410X_ELECTRA.
Use cli client from here.

Now the question is how to write 125kHz Tag with ELECTRA KEYM as there is an error: Writing to T55xx supports 5-byte EM410X IDs (10 hex characters). @naaraxi Could you give some hints on that ?

Thanks a lot!

[naaraxi]

@nedeleav
The GUI is a separate repo, I haven't looked into that. It shouldn't be too difficult to add support to that as well (but again, I haven't looked into it). So, CLI for now...

Glad you got it working, yeah I forgot to mention you have to set the slot type to EM410X_ELECTRA.

Support for writing isn't there yet, I'll have to get a few tags to test on before I can get into that (don't want to push anything if I can't see it working on an actual tag, with my own eyes).

[nedeleav]

).

I have a couple of tags 125kHz and could try couple Electra keys.

[naaraxi]

@nedeleav
̷I̷t̷'̷s̷ ̷O̷K̷,̷ ̷I̷ ̷h̷a̷v̷e̷ ̷a̷ ̷c̷o̷u̷p̷l̷e̷ ̷o̷f̷ ̷t̷a̷g̷s̷ ̷I̷ ̷w̷a̷s̷ ̷s̷a̷v̷i̷n̷g̷ ̷f̷o̷r̷ ̷p̷e̷r̷s̷o̷n̷a̷l̷ ̷u̷s̷e̷,̷ ̷I̷ ̷c̷a̷n̷ ̷j̷u̷s̷t̷ ̷g̷e̷t̷ ̷m̷o̷r̷e̷ ̷l̷a̷t̷e̷r̷.̷
Edit: I'll get new tags, mine are already locked, it seems.

I'll double check the (local) commit that adds writing and then see if it works as expected.
If it works for r/w, I'll check it downstairs at the entrance 😅

[naaraxi]

@nedeleav
OK, writes appear to be working.
Note, (when configured for EM410x) T5577 only broadcasts the 5‑byte EM410x frame, so Chameleon’s reader will still show EM410X/64.
I did check with a PM3 and a Flipper Zero, and it looks like the tags were written correctly, even though they still show up as EM410X/64 in the Chameleon CLI.
I haven't checked it at the entrance yet, it's freezing out there :D

[nedeleav]

I haven't checked it at the entrance yet, it's freezing out there :D

I've checked all functions: write && emulation, it works like charm.
Guess next step is to add full Electra functions to GUI, now it is shown as Unknown tag and can't write full key.
@naaraxi Good job!

[naaraxi]

@nedeleav
Great! I had checked emulation but not writing, good to hear it works as expected.

As for the GUI, it looks like the juicy parts are in chameleonultragui/lib/gui but while I could wing it (Dart looks fairly easy to understand at first glance), I'm sure someone who's more comfortable with it would be a better fit.
If nobody steps up, I'll see if I can do anything.

But that's for later, if/after this is approved.

[GameTec-live]

@naaraxi If you file a PR to the GUI too (once this gets merged), that be amazing! Thanks!

[kirriuha]

can you help me i have tag electra blue one, what i need to do?

[GameTec-live]

Ok, so if I read correctly, 2 people have independently tested this now?

[kirriuha]

i try to open by intercom the door and i have no succes

UPD: Finally it works

[naaraxi]

@GameTec-live
If I count as a person, then yeah.

@kirriuha
Currently only T55XX can be written. If you have the same type of tag I do, that one's Hitag 1/S/82xx.
They look kind of like this

[kirriuha]

[nedeleav]

In order to write Electra you have to use this 67ce574 firmware and CLI client. GUI doesn't support yet Electra tags

Read firs Electra key with CLI, it might need several tries, at some point you will see Electra and a long key, that's it. With that one you can emulate or write. Tested on 3 readers, and couple of new tags written with CU in CLI.

[kirriuha]

can somebody help me, how i can write saved electra tag to another one

[naaraxi]

@kirriuha
i used a proxmark3 to write a couple of them. the chameleon implementation in this PR should only be able to write to t55xx chips (the electra ones are a different kind).
you can try getting a few of the cheap ones i mentioned before, those should work (usually advertised as t5577 rewritable)

@nedeleav
i am guessing you also used t5577 tags when write testing?

[nedeleav]

@kirriuha i used a proxmark3 to write a couple of them. the chameleon implementation in this PR should only be able to write to t55xx chips (the electra ones are a different kind). you can try getting a few of the cheap ones i mentioned before, those should work (usually advertised as t5577 rewritable)

@nedeleav i am guessing you also used t5577 tags when write testing?
@naaraxi Yes I was using T5577 and worked very well.

[naaraxi]

@GameTec-live

OK now we have 2 independent tests (myself excluded)

I can redo the PR more cleanly if necessary, IMO the history on this one is a bit messy

[GameTec-live]

If you feel like doing so, just lmk when / if you want to merge.

[nedeleav]

If you feel like doing so, just lmk when / if you want to merge.

@naaraxi What about GUI version? Could you handle that one too? I could test it.

[naaraxi]

@nedeleav
I'll look into it in a bit 👍

[naaraxi]

@GameTec-live moved to #338 👍

[nedeleav]

@naaraxi Today, I tried using the CU emulation of the Electra tags on an Electra reader. Apparently, it was an older model with a white background and two rows: one for the list and one for the buttons. The tags I wrote with CU were read, but there was no reaction on CU emulation. I had written three tags with that key before, and it had worked with those readers. I even tried different positions for the CU; the white LEDs were lit, indicating that the tag had been read, but there was still no reaction.
Any ideas on that?
@naaraxi How to see what Electra tag is emulated on a specific slot? Electra key itself.

[naaraxi]

@nedeleav
You can use the CLI client to check which slots are used for what (hw slot list I think).

I also have issues with Electra emulation sometimes, it usually helps to slowly move the CU around the reader. It seems related to the distance/angle of the CU relative to the reader. You may have noticed the same issue when reading the tags, sometimes they're reported as em410x/64

I'll write a couple of tags and test them tomorrow, just in case, but I only have one of these.

Edit: I think the white LEDs indicate the detection of an RF field btw, not a successful read 🤔

[naaraxi]

@nedeleav
I would start with using a separate reader (proxmark etc) to confirm the CU is emulating correctly, by reading a tag and the CU and comparing the output. It should be identical. I'll do that tomorrow after meetings and stuff, but it should be working as expected (I sometimes use it to enter the building, after all 😁), and considering we use the same firmware/same device/different readers, I suspect the reader(/model) is the issue in your case.

[naaraxi]

OK, so I did the following:

• Read Electra tag

[+] EM 410x ID 03xxxxxxxx
...
[+] Valid EM410x ID found!
[+] TYPE...... PCF 7945
[+] Chipset... Hitag 1/S / 82xx

• Clone tag via button
• Read Chameleon

[+] EM 410x ID 03xxxxxxxx
...
[+] Valid EM410x ID found!
[=] Couldn't identify a chipset

• Write tag via CLI
• Read t55xx tag

[+] EM 410x ID 03xxxxxxxx
...
[+] Valid EM410x ID found!
[+] Chipset... T55xx

It seems to be functioning...

Later edit:

Also tested downstairs Electra reader.
Using cloned tag, worked great.
Using CU, it took a bit of rubbing against it, moving it around, but it worked after a minute or less.