ID card copy tutorial (use t5577 card to copy 4100 card)

Hello everyone , I meet you again , I'm your friend, Quan Jun .

1 ID Common types and differences of cards

Common in China ID Cardowei EM 4100 or EM 4102 card , Its characteristic is that it cannot be modified ID Number . In order to copy the common ID card , Usually used T5577 or EM4305 card （ Be commonly called ID White card ）, It is characterized by an internal EEPROM Can read but write , Modify the card EEPROM You can modify the external contents of the card ID Number , To copy the common ID Purpose of the card .

This article takes T5577 Card copy normal EM4100 card . Readers should have basic electronic skills DIY Ability .

Many say ,ID Card and IC Cards are different , This article is only for ID card , most ID There will be a string of numbers on the card , If there is no number, it may be IC Card Oh , This article is not applicable .

2 Hardware preparation

A. ID Card reading module , Used to read data to be copied ID The card number of the card , The price of a treasure 10 yuan .

B. T5577 Card reading and writing module , Used to read or write ID Number to T5577 card , A treasure is lower than 20 element .

C.T5577 Blank card

D.USB To serial port TTL modular （10 Yuan of the following ）（ I'm too lazy to put the picture ）

3 ID Card number Introduction

standard EM ID Card number （ Manchester yard ） from 10 position 16 Base numbers make up , for example ：

7200944C78

among 7 For version code ,2 For customer code ,00944C78 by ID Code

Manchester yard Do not mark on the card surface , The card surface is commonly marked in the following two forms ：

The card numbers marked on this card surface are ABA code （0009718904） and wiegand26 code （148,19576）：

As shown in the picture ABA Code from ID Code Convert to 10 Binary result , namely ：

（00944C78）16 →（0009718904）10

As shown in the picture wiegand26 Code from ID Code countdown 5、6 Position and back 4 The bits are converted into 10 Composition of binary system , namely ：

（94,4C78）16 →（148,19576）10

in summary ： Only Manchester inner size （7200944C78） Contains the complete ID Card number information , Therefore, the card number described below 、ID No. unless otherwise specified 10 position 16 Base number Manchester yard .

4 Use ID The card reading module reads ID Number

From the first 3 We can see that ： although ID The card face will contain ”ID Number ”, But the information is not complete , Only through ID Only the card reader can read the complete Manchester code .

adopt USB To serial port TTL The module connects the computer to ID Card reading module , Pay attention to the connection TXD and RXD cross , Use Serial debugging assistant Read ID Number . Read ID The process is relatively simple , Refer to the module manual for details .

（ A hardware connection diagram will be displayed here if there is time ）

5 towards T5577 Blank card write ID Number （ Original content ）

ID The number is just a string 16 Hexadecimal number , and T5577 Cards can store large amounts of data , Only will ID The number is written in the specified format T5577 after ,T5577 To play the role of the original card .

5.1 Ordinary ID In the card ID Number

EM4100 The card can store 64bits data , Read only Don't write , The data format is as follows ：

EM4100 Card and RFID During the interaction of the card reader , Transmit circularly according to the above data format , continuity 9 individual 1 Indicates the beginning of a transmission , Each group 5 The last of the bits （P0~P9） It's even check （ Each group 5 In a 1 The number of is even ）, While performing data verification , It ensures that no continuous 9 individual 1 Conflict with transfer start flag .PC0~PC3 Bit is the column check bit ,S0 Bit stop bit .

The following is the data of one transmission , The card number of the card （ Manchester yard ） by ：

06001259E3

If we can be like 4100 Send the above to the card reader like a card 64bit data , Replication can be achieved ID Purpose of the card .

5.2 T5577 Blank card

The original English text ：http://www.priority1design.com.au/t5557_rfid_transponder.html

T5577 Be able to store 330bits The data of , Can read but write , The data format is as follows ：

Block 0 Configure the block for ：

The configuration block bits are described in detail in Atmel’s T5557 datasheet, see T5557 datasheet. Here is a description of some of the more important configuration bit details.

Bits 16 – 20: Determine the Encoding protocol upon start up. A bit pattern of 10000 selects Manchester Encoding. When data is transmitted from tag to reader the data is encoding using this selected scheme. See Data modulation

Bits 12 – 14: Determine the Bit rate of the data transmitted by the transponder to the reader. A bit pattern of 101 selects a bit rate of 64 Field Cycles per bit.

Bits 25 – 27: Determine the maximum block address transmitted in standard read mode. For the T5557 RFID transponder this value can be from 0 to 7.

Bit 28: When Set this bit activates the Password mode. In Password mode all blocks need a password to be sent before they can be read or written. The password required is stored in block 7.

This part means ” Configuration block ” The meaning of each person , It's kind of like 51 SCM configuration register feeling ……

When the card is put into the card reader , The card will read the data saved in the configuration block and send the data according to the configuration requirements . Then enter the standard read mode . In standard read mode , Card from Block1 Start sending data to the configuration block 25 To 27 A definition of Max Block end , The whole sending process is repeated .

Configuration block Block 0 The default configuration for is ：000880E8

Bit rate ：RF/32 Modulation mode ：Manchester The most massive ：7 PSKCF：RF/2 ST：1

The default configuration is Incorrect Of ,EM4100 The bit rate of the card is RF/64, And don't use ST（ST：0）

therefore ,Page0 Block0 Should be configured as :001480E0（ Some students are configured to 00148041 succeed , Too lazy to analyze , As long as it works OK, Thanks for the comments area @hahahwokao）

5.3 T5577 write in ID Number （ The core + original ）

Ordinary ID card （4100 card ） At work , It will send all of itself circularly 64bit data , The data contains the boot frame ,ID Card number , Row check , Column check . With ID Number ：06001259E3 write in 4100 Card, for example （4100 The card cannot be written , This is just an analysis ID The storage form of No. in the card , Then it is concluded that T5577 Card data ）

First step ： Write boot sequence and ID Card number

0→00006→0110E→1110 1→0001

1	1	1	1	1	1	1	1	1
				0	0	0	0
				0	1	1	0
				0	0	0	0
				0	0	0	0
				0	0	0	1
				0	0	1	0
				0	1	0	1
				1	0	0	1
				1	1	1	0
				0	0	1	1
								0

The second step ： Write column check and row check , The last one is fixed as 0

1	1	1	1	1	1	1	1	1
				0	0	0	0	0
				0	1	1	0	0
				0	0	0	0	0
				0	0	0	0	0
				0	0	0	1	1
				0	0	1	0	1
				0	1	0	1	0
				1	0	0	1	0
				1	1	1	0	1
				0	0	1	1	0
				0	1	0	0	0

Both column and row verifications are even verifications ： Each row or column in ”1″ When the number of is even , This check bit is ”0″, Otherwise, this check bit is ”1″

Expand the above table in the order of data transmission , be 4100 The final data sent by the card is ：

111111111 00000011000000000000000 （FF818000）

110010101 01010010111010011001000 （CAA974C8）

Just put this 64 Bit data write T5577 Of EEPROM in , That is to say ID Copy of the card .

Use T5577 Read write module and supporting software , First, in the Block1 writes FF818000, stay Block2 writes CAA974C8 That's it ID Writing of No , Last In the configuration block Block0 writes 001480E0（ Some students are configured to 00148041 succeed , Too lazy to analyze , As long as it works OK, Thanks for the comments area @hahahwokao）. here ,T5577 Card can replace the original ID card .

Read / write module supporting software ：

1. link ：https://pan.baidu.com/s/1Dxyq9kzN1gC3jAtIuTkwhg
2. Extraction code ：x5xx

Publisher ： Full stack programmer stack length , Reprint please indicate the source ：https://javaforall.cn/132872.html Link to the original text ：https://javaforall.cn