Anyone have a glass transponder chip reader?

[Bki26]

Trying to work out if I can hack a hilti gx120 nail gun to run on a gc42 gas can which is designed for the tool (gx3) that replaced it and from initial testing the gun won't fire with a full can if the transponder chip hidden in the gas bottle retaining clip is removed since it thinks it's empty.

I'm hoping it's a standard chip and can be read hence does anyone have a reader that I can post the chip to you to check.

If it is standard then I can probably clone it to another off the shelf id48 chip as a solution if the chip in the gc42 gas can't be read by the gx120 hardware, though I'm hoping it'll be the same setup as doubt hilti would decide to completely change the setup requiring a new production line but I won't know until I can get my hands on a cheap gc42 can (anyone have an almost empty one?)

 

[Kram]

Can you bypass the original electronics? I dont know whats involved in a gas powered nail gun.

 

[Bki26]

Can you bypass the original electronics? I dont know whats involved in a gas powered nail gun.

I found a very short forum post that's several years old that mentioned a swap in chip which bypassed/tricked it but unfortunately I can't find any information on it.

Chatgpt believes it's not a ID48 since that's for car keys but possibly a standard 125khz "t5577" chip being disposable and can be rewritten so if anyone has a rfid reader it should work.

 

[voipio]

Have you tried an NFC reader app on your phone? It might work.

7 Best NFC Reading Apps for Android & iOS | Freeappsforme - Free apps for Android and iOS

Manage NFC at you mobile easily. Check our list of best NFC reading apps. Free download for Android and iOS devices

freeappsforme.com

 

[jmp49]

System schematics any use? no mention of the chip in use, but probably useful in any attempt to bypass the need for the transponder...

 

[jmp49]

I would say cut the passive rfid chip out of a working empty gx120 canister, and just hot melt glue gun it the transponder reader coil inside the gun itself, but it looks like it also exchanges information on how much gas is left for the gun's level meter and mechanism to work, so you would have to work out how it knows how much gas it has to fool it somehow, or the gun knows the id of the transponder and counts internally or updates the rfid chip itself with something each fire...
It'd be interesting if you took one gas canister from a gun half used, and put it in a second and see if it displays the same level in the next gun, or just shows full indicating the gas level update is only happening gun side..

You can search the FCC ID database for the gun & canister and get more indepth data on frequency and actual chipset in use etc with some digging. If its sold in the USA it HAS to be disclosed to the FCC, and when reversing something that's where we check for more indepth stuff to help the reverse engineering...
If its not immediately obvious TeraTron GmbH is the maker of the rfid side of it. I would guess its one buried in the following.

Teratron Device Database

device.report

Tera Tron GmbH FCC Filings

fcc.report

Stopping here because dont want to expose forum in trouble by discussing hacking of devices openly. But you now how the tools to dig deeper.

 

[Bki26]

Have you tried an NFC reader app on your phone? It might work.

7 Best NFC Reading Apps for Android & iOS | Freeappsforme - Free apps for Android and iOS

Manage NFC at you mobile easily. Check our list of best NFC reading apps. Free download for Android and iOS devices

freeappsforme.com

Different frequencies unfortunately for nfc/rfid.

I would say cut the passive rfid chip out of a working empty gx120 canister, and just hot melt glue gun it the transponder reader coil inside the gun itself, but it looks like it also exchanges information on how much gas is left for the gun's level meter and mechanism to work, so you would have to work out how it knows how much gas it has to fool it somehow, or the gun knows the id of the transponder and counts internally or updates the rfid chip itself with something each fire...
It'd be interesting if you took one gas canister from a gun half used, and put it in a second and see if it displays the same level in the next gun, or just shows full indicating the gas level update is only happening gun side..

You can search the FCC ID database for the gun & canister and get more indepth data on frequency and actual chipset in use etc with some digging. If its sold in the USA it HAS to be disclosed to the FCC, and when reversing something that's where we check for more indepth stuff to help the reverse engineering...
If its not immediately obvious TeraTron GmbH is the maker of the rfid side of it. I would guess its one buried in the following.

Teratron Device Database

device.report

Tera Tron GmbH FCC Filings

fcc.report

Stopping here because dont want to expose forum in trouble by discussing hacking of devices openly. But you now how the tools to dig deeper.

Thanks for that the manual lists "FCC ID: OLXGX120", shows quite a lot and confirms It's definitely a read/write cheap rfid chip as it stores the count of how many shots are left and uses the number to display how much gas is roughly left. I don't think it'll be a custom one with encryption because why spend so much on something that's disposable.

I think I should be able to read it if I had an rfid tool and perhaps could reset it being just a count down as unfortunately it doesn't open the solenoid if it thinks it's empty however it does fire the spark so they could have done that but decided to stop people just refilling the bottle.

If I can get ahold of a gc42 can I can test the rfid chip from that to see if it reads however I think it probably won't since that manual says the rfid does a check to confirm right gas and how many shots left but it might so I guess I'll need to buy an rfid read/write.

 

[jmp49]

It could also have a identity string encoded in the cartridge rfid tag and the gun tracks that identity to keep track of how many firings it has logged, making the logging and updating inside the non discardable bit but read/write rfid tags are buttons, even encrypted ones. Wouldnt be the first time a manufacturer bought in a 3rd party solution that was critically flawed by design for cheapness though, be interesting to sniff it happening. I think your going to have to invest in a working cartridge to do some research as you need to see a GOOD transaction and a empty one to help understand the bytes and commands that change in the packets once you have hardware that can at least see the transaction between the empty cartridge you have and the gun.

I have a icopykey for rfid cards, but I think its more targeted at cloning access cards etc but they make a icopykey-X for embedded rfid stuff, or there's flipper zero. But unless they are insanely expensive, the tools cost more than you will save to bypass the DRM in the canisters unless you already have them, or know someone who has.

 

[Bki26]

It could also have a identity string encoded in the cartridge rfid tag and the gun tracks that identity to keep track of how many firings it has logged, making the logging and updating inside the non discardable bit but read/write rfid tags are buttons, even encrypted ones. Wouldnt be the first time a manufacturer bought in a 3rd party solution that was critically flawed by design for cheapness though, be interesting to sniff it happening. I think your going to have to invest in a working cartridge to do some research as you need to see a GOOD transaction and a empty one to help understand the bytes and commands that change in the packets once you have hardware that can at least see the transaction between the empty cartridge you have and the gun.

I have a icopykey for rfid cards, but I think its more targeted at cloning access cards etc but they make a icopykey-X for embedded rfid stuff, or there's flipper zero. But unless they are insanely expensive, the tools cost more than you will save to bypass the DRM in the canisters unless you already have them, or know someone who has.

Happened to come across this video, seems you can get the ProxMark3 on AliExpress for £20 so that should do the trick for read/write/intercept.

I think the gas bottle chip records the total shots rather than the gun since it most certainly doesn't have the memory capacity to log each different bottle potentially placed inside, probably just writes to it how many shots after each trigger pull.

 

[jmp49]

The Icopy-X is a upgraded ProxMark3 with all the same pc side software but more capability, but the original proxmark should be ok depending on coverage and frequency (which is usually all the in fcc data if you dig).

Might get a cheap proxmark myself if theyre to be had for that cheap, just in case for a rainy day

 

[Bki26]

The Icopy-X is a upgraded ProxMark3 with all the same pc side software but more capability, but the original proxmark should be ok depending on coverage and frequency (which is usually all the in fcc data if you dig).

Might get a cheap proxmark myself if theyre to be had for that cheap, just in case for a rainy day

Certainly seems more expensive at £300 compared to the ProxMark3 at £20 haha, the chip is a standard 125khz as stated so should be good.

Proxmark3 Develop Suit Kits 3.0 Proxmark NFC PM3 Reader Writer ICEMAN Firmware For RFID NFC Card Copier Clone 2USB Port 512K - AliExpress 30

Smarter Shopping, Better Living! Aliexpress.com

a.aliexpress.com