logo elektroda
logo elektroda
X
logo elektroda

The inside of the UNIQUE 125kHz key copier

TechEkspert 4797 6

TL;DR

  • The teardown examines a UNIQUE 125 kHz key copier used to duplicate access tags after a move.
  • Inside are two AAA batteries, a UNIQUE communication coil/antenna, a small PCB, and a main control unit marked F300.
  • The copier reads a constant 64-bit string from a tag and writes 8 bytes to T5577 or EM4305 key fobs.
  • U1 generates the read control signal, Q1 drives the buzzer, and Q2/Q3 control coil current; detection takes 10 ms.
  • The author flags security concerns about multi-system copiers claiming 125 kHz to 1000 kHz support and bundled software that may hide extra features.
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
📢 Listen (AI):
  • The inside of the UNIQUE 125kHz key copier
    In the material you will see the inside of the UNIQUE tag copier, which made it easier to use the space after the company moved. Part of the building is separated by doors equipped with electric strikes and keyfob/card readers. The problem is that only three of the transferred tags work, each entrance has a different type of reader, one of which even has a buffer power supply, the rest is powered by plug-in power supplies connected near the passages, the company that serviced it has no contact.

    Of course, we will replace this "system" with connected MIFARE readers, but everything in order. To make it easier for yourself, you need to "multiply" your UNIQUE tags. A copier was used for this, reading a constant string of 64 bits from the applied tag to memory and writing a string of 8 bytes to the T5577 or EM4305 key chains. In this way, for "PLN 100" we have the freedom to move around, without excessive investment in a makeshift, which is intended for disassembly.

    Below is the inside of the copier, which is mostly empty space :) a basket of two AAA batteries, a UNIQUE communication coil/antenna and a small printed circuit board. The main control unit is designated F300.

    The inside of the UNIQUE 125kHz key copier


    Transistor Q1 controls the buzzer without a generator, transistors Q2 and Q3 control the coil current. U1 during the reading generates a control signal that goes through R8 to the transistors.

    The inside of the UNIQUE 125kHz key copier


    The signal on the coil looks like this:
    The inside of the UNIQUE 125kHz key copier


    Detection takes 10ms.
    The inside of the UNIQUE 125kHz key copier


    There are no SMD components on the other side of the PCB.

    The inside of the UNIQUE 125kHz key copier


    The device did its job well and we will not waste funds on checking how to change the settings of existing readers, especially since each of them is of a different type and some of the cards did not work. This is a good solution to reduce the urgency of replacing the access control system.

    When looking for a copier, I thought hard about the security of such solutions, because the search engine showed multi-system copiers for tags, working at frequencies of 125 kHz, 250 kHz, 500 kHz, 375 kHz, 625 kHz, 750 kHz, 875 kHz, 1000 kHz, but also those that supposedly duplicate Mifare HID cards. Some have bundled software that supposedly decodes scanned cards (whatever that means). It is difficult to predict whether bundled software from a little-known publisher has bugs or "hidden features".

    Cool? Ranking DIY
    About Author
    TechEkspert
    Editor
    Offline 
    TechEkspert wrote 7018 posts with rating 5445, helped 16 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 20604766
    prosiak_wej
    Level 39  
    Posts: 5273
    Help: 501
    Rate: 1456
    Board Language: polish
    I found such a copier for PLN 10 with a bag of keyrings. As it turned out, it is not compatible (keyrings too) with the KD system that we have in the company. On the other hand, for copying Mifare, I use cards and keyrings bought on Allegro and the Mifare Classic Tool application on the CAT S61 phone. In this way, apart from the main card, I also have a backup card in the car and a keychain :)
  • ADVERTISEMENT
  • #3 20604774
    szymon122
    Level 38  
    Posts: 4085
    Help: 302
    Rate: 754
    Board Language: polish
    What is the general process of "programming" a TAG?
    It receives some command, then 8 bytes and then sends these 8 bytes each time?

    Is such a tag writeable only once?
  • #4 20604812
    TechEkspert
    Editor
    Posts: 7018
    Help: 16
    Rate: 5445
    Board Language: polish
    The keychains are programmable many times and cost about PLN 3.
    Originally, UNIQUE key chains and cards had a factory-assigned number just like "Dallas pills" DS1990A.

    I wonder why the programmed keyrings did not work, maybe a different operating frequency?
  • ADVERTISEMENT
  • #5 20604838
    prosiak_wej
    Level 39  
    Posts: 5273
    Help: 501
    Rate: 1456
    Board Language: polish
    My tags (cards and keyrings) are rewritable, you can delete, assign your own numbers.
  • #6 20604944
    nukedclxx
    Level 7  
    Posts: 3
    Rate: 2
    I have a similar device somewhere and you can select several different frequencies, but the cards that I use at work do not respond, practically no other reader except those at the company, even a pinball machine that knows a lot, does not respond. What other solutions are there and at what frequency do they work? Unfortunately, I can't find the readers themselves on the Internet to get to the name of the manufacturer. And it seems to me that the author made a mistake, rather 125 kHz.
  • ADVERTISEMENT
  • #7 20605119
    TechEkspert
    Editor
    Posts: 7018
    Help: 16
    Rate: 5445
    Board Language: polish
    I changed the title to 125 kHz, out of curiosity you can check your KD, whose tags cannot be read. Using an oscilloscope and a coil close to the reader, you can determine what frequency your system is operating at. A frequency counter could also be used, but the signal from the coil applied to the reader may be too weak without an additional amplifier.
📢 Listen (AI):

Topic summary

✨ The discussion revolves around the UNIQUE 125kHz key copier, which is used to duplicate tags for access control systems in a company. The original system has compatibility issues, with only three out of several tags functioning correctly due to different reader types and power supplies. Users share experiences with various key copying methods, including using MIFARE cards and the Mifare Classic Tool application. The conversation highlights the programmability of keychains, the importance of operating frequencies, and troubleshooting techniques such as using an oscilloscope to determine the frequency of the readers. The need for a more reliable system is emphasized, with plans to transition to MIFARE readers.
Generated by the language model.

FAQ

TL;DR: Detection completes in 10 ms, “The device did its job well” [Elektroda, TechEkspert, post #20604527]; a PLN 100 copier reads 64-bit UNIQUE tags and rewrites them to cheap PLN 3 T5577/EM4305 keyfobs [Elektroda, TechEkspert, post #20604527]

Why it matters: Fast, low-cost cloning keeps doors working while you upgrade access control.

Quick Facts

• Operating frequency: 125 kHz low-frequency RFID standard [Elektroda, TechEkspert, post #20605119] • Data moved: 64-bit UID read, 8-byte string written [Elektroda, TechEkspert, post #20604527] • Tag detection time: 10 ms per scan [Elektroda, TechEkspert, post #20604527] • Copier cost: ≈ PLN 100 with two AAA cells [Elektroda, TechEkspert, post #20604527] • Blank T5577/EM4305 keyfob: ≈ PLN 3, multi-write [Elektroda, TechEkspert, post #20604812]

How does the 125 kHz copier work?

The MCU (marked F300) reads a fixed 64-bit UID, then drives Q2–Q3 to load-modulate the coil and flash-write that 8-byte data into a blank tag [Elektroda, TechEkspert, post #20604527]

Are T5577 and EM4305 keyfobs rewritable?

Yes. They support hundreds of reprogram cycles; T5577 guarantees 100 k writes in the datasheet [NXP, 2023] and costs only PLN 3 each [Elektroda, TechEkspert, post #20604812]

Why might a copied tag fail on some readers?

Readers may expect different modulation, clocking, or bit ordering; mismatched parameters let the door stay silent, an edge-case noted when a PLN 10 copier failed on a KD system [Elektroda, prosiak_wej, post #20604766]

How can I measure an unknown reader’s frequency?

  1. Wind a small pickup coil and hold it to the reader.
  2. View the induced signal on an oscilloscope or counter.
  3. Read the dominant frequency peak; 125 kHz is common [Elektroda, TechEkspert, post #20605119]

What pitfalls should I watch for when buying cheap copiers?

Firmware can carry hidden features or malware; unknown PC software may leak card data, a risk flagged by the thread’s author [Elektroda, TechEkspert, post #20604527]

How secure are UNIQUE 125 kHz tags?

They transmit unencrypted 64-bit IDs; any listener can clone them, making security low compared with HF cards using AES [EM Microelectronic, 2022].

How many times can I safely rewrite a T5577 key?

T5577 guarantees 100 000 write/erase cycles and 10-year data retention at 55 °C [NXP, 2023].
Generated by the language model.
ADVERTISEMENT