> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md).

# FZ - 125kHz RFID

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>

<figure><img src="/files/YM7uBW8YtIhrJWT3a6lG" alt=""><figcaption></figcaption></figure>

{% embed url="<https://websec.nl/>" %}

## 简介

有关125kHz标签工作原理的更多信息，请查看：

{% content-ref url="/pages/VFtBG4Mjn9ddvr6OIzVi" %}
[Pentesting RFID](/todo/radio-hacking/pentesting-rfid.md)
{% endcontent-ref %}

## 操作

有关这些类型标签的更多信息，请阅读[**此简介**](/todo/radio-hacking/pentesting-rfid.md#low-frequency-rfid-tags-125khz)。

### 读取

尝试**读取**卡片信息。然后可以**模拟**它们。

{% hint style="warning" %}
请注意，一些对讲机会通过在读取之前发送写入命令来防止复制钥匙。如果写入成功，则认为该标签是伪造的。当Flipper模拟RFID时，读卡器无法区分它与原始卡之间的区别，因此不会出现此类问题。
{% endhint %}

### 手动添加

您可以在Flipper Zero中创建**指示您手动输入的数据**的**伪造卡片**，然后模拟它。

#### 卡片上的ID

有时，当您获得一张卡时，您会发现卡片上写有ID（或部分ID）。

* **EM Marin**

例如，在这张EM-Marin卡片中，可以**清晰地读取卡片上的最后3个字节中的5个字节**。\
如果无法从卡片上读取它们，则可以通过暴力破解来找到其他2个字节。

<figure><img src="/files/eA9qxbabPO52ZaaKLuhQ" alt=""><figcaption></figcaption></figure>

* **HID**

在这张HID卡片中，只有2个字节中的3个字节可以在卡片上找到

<figure><img src="/files/a5Nl7VZ0Uj4KQelYzp2z" alt=""><figcaption></figcaption></figure>

### 模拟/写入

在**复制**卡片或**手动输入**ID后，可以使用Flipper Zero**模拟**它或将其**写入**真实卡片。

## 参考

* <https://blog.flipperzero.one/rfid/>

<figure><img src="/files/YM7uBW8YtIhrJWT3a6lG" alt=""><figcaption></figcaption></figure>

{% embed url="<https://websec.nl/>" %}

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacktricks.xsx.tw/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.