Back to Proxmark3

LF_EM4100RWC — EM4100 Read/Write/Clone (16 Slots)

doc/standalone/lf_em4100rwc.md

4.92372.5 KB
Original Source

LF_EM4100RWC — EM4100 Read/Write/Clone (16 Slots)

Author: temskiy Frequency: LF (125 kHz) Hardware: RDV4 (flash memory for slot storage)

Back to Standalone Modes Index | Source Code | Development Guide


What

Read, simulate, and clone EM4100 tags with 16 storage slots. Pre-loaded with 3 sample IDs. Provides the largest card storage capacity of any EM4100 standalone mode.

Why

When you need to collect and manage many EM4100 IDs on a single assessment — for example, reading badges from multiple employees — having 16 slots lets you capture a full team's credentials on-device. Each slot is independently selectable for simulation or cloning.

How

  1. SELECT: Navigate between the 16 slots using button clicks
  2. READ: Read an EM4100 tag and store it in the currently selected slot
  3. SIMULATE: Broadcast the selected slot's ID
  4. WRITE: Clone the selected slot's ID to a T5555 card

The mode cycles through these four states with button holds to switch modes and clicks to execute within a mode.

LED Indicators

LEDMeaning
A/B/C/D (binary)Slot number in binary (0–15)
Blink patternsOperation success/failure

Button Controls

StateActionEffect
SELECTSingle clickNext slot
SELECTHoldSwitch to SIMULATE mode
READSingle clickRead tag into current slot
READHoldSwitch to WRITE mode
SIMULATESingle clickStart simulation
SIMULATEHoldSwitch to READ mode
WRITESingle clickWrite current slot to T5555
WRITEHoldSwitch to SELECT mode

State Machine

mermaid
stateDiagram-v2
    [*] --> SELECT : Startup

    SELECT --> SIMULATE : Hold
    SIMULATE --> READ : Hold
    READ --> WRITE : Hold
    WRITE --> SELECT : Hold

    SELECT --> SELECT : Click (next slot)
    READ --> READ : Click (read tag)
    SIMULATE --> SIMULATE : Click (simulate)
    WRITE --> WRITE : Click (write)

    SELECT --> [*] : USB data received

Compilation

make clean
make STANDALONE=LF_EM4100RWC -j
./pm3-flash-fullimage