proxmark3 VS Flipper-IRDB

I would check out the Proxmark3 Github repo [0]. They have a cheatsheet [1] with the basics on how to get started. I also did a talk about RFID security last year about the basics [2]

To get started, the basics are: low freq (LF) is usually around 125khz and is rarely encrypted (HID Prox is the most common in the US). The data is often encoded in Wiegand format for access control systems (something to keep in mind when reading the raw data).

High freq (HF) (aka NFC) is ~13Mhz and is readable by most Android phones with NFC. Not all tag data can be read however. HF cards support a lot of different options including data storage (normally in a block layout with permissions to read and write depending on keys) and encryption (iCLASS and SEOS being the HID offerings and very common). Some can be cloned (like hotel cards) while others (like SEOS) require a downgrade attack to work correctly (SEOS -> normal SEOS reader -> Weigand data -> older style card like HID Prox).

[0] https://github.com/RfidResearchGroup/proxmark3

[1] https://github.com/RfidResearchGroup/proxmark3/blob/master/d...

[2] https://www.youtube.com/watch?v=zKOAywZqisc

🔗 https://github.com/RfidResearchGroup/proxmark3/releases/tag/v4.17140

After pulling and compiling a newer proxmark3 generic firmware from the RfidResearchGroup repo I got farther but now have a new message I've not found much about with static nonces. https://github.com/RfidResearchGroup/proxmark3/

you could use linux (ubuntu) https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Installation_Instructions/Linux-Installation-Instructions.md

You will have to do the leg word, but this is a starting point: https://github.com/RfidResearchGroup/proxmark3/blob/master/client/luascripts/hf_mf_sim_hid.lua

Grab yourself a Proxmark3, read the instructions here, and you can extract your iClass elite key in a few seconds. You can pick up a PM3 easy for a few bucks.

I cloned whatever the latest commit was at https://github.com/RfidResearchGroup/proxmark3, which is what the guide on dangerous things suggests (where I bought my PM).

Seems like there is at least a bit of interest [1] to convert lirc definitions [2], which is great, because there are so many of them. There even is a definition for my about 30 years old hifi! A really nice hack I saw is to send the code via something that reads lirc and capture it with a flipper in learning mode [3].

[1] https://forum.flipper.net/t/is-possible-to-convert-irplus-fi...

[2] https://lirc.sourceforge.net/remotes/

[3] https://github.com/Lucaslhm/Flipper-IRDB/pull/294

If you're actually looking as bruteforcing IR, have a look at an example .IR file from the IRDB. They are just text files with a bunch of values in them. It would be pretty trivial to create a Python script that generates every possible IR signal, then upload that .IR file to the Flipper, although I would expect it would take a long time to run.

If you're feeling generous, capture codes from remotes and submit them to https://github.com/UberGuidoZ/Flipper or https://github.com/Lucaslhm/Flipper-IRDB

Manufacturers will sometimes use the same IR codes across models. Try one of the files for Telefunken TVs in the IR database on Github - https://github.com/Lucaslhm/Flipper-IRDB/tree/main/TVs/Telefunken

As you noted, the universal remote can turn your TV on and off, so it s manufacturer, you can try signals from the flipper IRDB and see if any of them work. From there, you can cobble together a remote that hopefully covers most or all of your device's functions.

Here's the Flipper Zero IR config for the CLD-99 remote I created. It's not perfect but it's better than having no remote or having to walk across the room to press buttons on the device.