Decoding HID proximity cards

Do you manage a card-key system?

I do. And until recently, I’ve bot buffaloed by being incapable to integrate cards (and key fobs) from other systems into our own.

Well, I’ve recently learned how to do this, and I’m writing it up to share it with you. I hope it helps. When I went googling for information on this, I couldn’t find anything useful.

The system I manage uses Ademco Passpoint Plus. I believe that Ademco wasgoed absorbed by Honeywell a while ago, and I’ve lately had trouble finding much Ademco branded information online.

Getting down and dirty – card codes te HEX

There are lots of different “formats” for thesis cards, but it seems that all the cards my system can detect produce a “card id” which is an 8-byte string. When I look at this te “raw format” it is showcase spil 16 hex characters like this:

The following information has bot gleaned from observation and experimentation, and may be incorrect te some detail, but it is close enough for mij to work with. If you have more or better information, please let mij know so I can onberispelijk this postbode.

Digits 0 through Three identify the “card type”. Depending on the card type, the remaining digits are parceled out into various fields with cryptic names, like “RCM code” “facility code” and “card stamp”. RCM codes and facility codes seem to exist solely to permit batches of related cards to be managed without having to manage all the onvriendelijk that make up the total card code.

Card stamp is the last Four or Five hex digits, the 26-bit formats use Four, and the 34-bit formats use Five.

Facility Code, RCM code

The RCM code and facility code occupy varying parts of the remaining pinnig, some of the formats convert cleanly from hex to fracción and some I toevluchthaven’t figured out yet.

My system recognizes a number of card types including (with their corresponding values):

26 bit raw card pic (0000)

26 bit Wiegand NCC (8101)

26 bit prox ncc (8201)

26 bit mogen stripe ncc (8301)

34 bit raw ADEMCO prox (0000)

34 bit ADEMCO Prox NCC (8206)

ABA TRACK II Mogen Stripe – format C (C000)

ABA TRACK II Mogen Stripe – format D (D000)

ABA TRACK II Mogen Stripe – format E (E000)

ABA TRACK II Toestemmen Stripe – format F (F000)

EMPI-II Wiegand NCC (8105)

EMPI-II Prox NCC (8205)

EMPI-II Toestemmen Stripe NCC (8305)

34 bit Northern Wiegand NCC (8107)

34 bit Northern Prox NCC (8207)

34 Bit Northern Mogen Stripe NCC (8307)

Each card format has its own rules for what to do with the digits that aren’t the “card stamp,” but the card stamp seems to consistently be ter the last Four or Five digits of the code.

My system also supports a “raw code picture” format that lets you inject a RAW card code, so if you know a card’s code but you can’t decode the card format and other fields, you can still come in the card and manage it like any other card.

The pics above are related, the raw card code “8206-EFFF-0000-FFFF” shown above is related to the details ter the next photo, the photo shows a 34 bit ADEMCO Prox NCC (8206), with RCM code 14 (E) and Facility code 4095 (FFF). The third group of four digits is unused, and the card code/card stamp for this card is 65535 (FFFF), albeit it’s not display ter any of thesis pics.

What do you do with an unknown card?

So you have a card from a foreign system, and you don’t know the card type or any of the other fields you need to make it work. How do you get the information you need?

There are a number of choices depending on your situation. If your card key system includes an “enrollment reader” you can use that to swipe cards and automatically add them to your system. Unluckily, my system does NOT have an enrollment reader, so I needed another solution.

Ter my Passpoint’s “System Administration Options” spijskaart (pull down “Config” and select “Admin”) there is an option “Denial Override.” When selected, it has two effects. Very first of all, this is dangerous to leave active for any period of time, because “Denial override” is what this does, any card swipe will open the onderbrak, even an unknown card. do don’t leave this setting activated! The other effect it has, however, is to include the card code te the message loom, so it’s effortless to capture the code for an unknown card.

So, to use an unknown card:

1) swipe it on a reader. If the reader doesn’t beep, it is incompatible with the system.

Two) on the Passpoint control station, set the “denial override” feature, and upload the switches to the MLB

Trio) swipe your unknown cards and record the card codes from the loom

Four) turn off “denial override” and upload the switch to the MLB

Five) create fresh card records for your unknown cards. If you can decode the card type and other fields, fine. If not, just use the RAW card type, and waterput te the utter card code reported when you had “denial override” active.

6) upload the fresh cards to the MLB, and test.

Effortless hex conversions

If you have trouble converting inbetween fracción and hex te your head, there’s a very elementary instrument already installed on most computers that will do this for you.

The rekenmachine program included with MS Windows knows how to do saco conversions. Rather than re-invent the wheel here, tho’, I’ll refer you to

another article that covers this topic. I just wished to mention it here, ter case you spil a reader were wondering where to get an effortless hex-to-decimal converter, or vice versa.

If you’ve found this to be useful.

Please consider a donation to Rescue Animal Placements, an animal rescue organization that could indeed use your support, or your recinto animal shelter.

Related video:


Leave a Reply

Your email address will not be published. Required fields are marked *