Decoding HID proximity cards
Do you manage a card-key system?
I do. And until recently, I've been buffaloed by being unable to integrate cards (and key fobs) from other systems into our own.
Well, I've recently learned how to do this, and I'm writing it up to share it with you. I hope it helps. When I went googling for information on this, I couldn't find anything useful.
The system I manage uses Ademco Passpoint Plus. I believe that Ademco was absorbed by Honeywell a while ago, and I've lately had trouble finding much Ademco branded information online.
Getting down and dirty - card codes in HEX
There are lots of different "formats" for these cards, but it seems that all the cards my system can detect produce a "card id" which is an 8-byte string. When I look at this in "raw format" it is show as 16 hex characters like this:
The following information has been gleaned from observation and experimentation, and may be incorrect in some detail, but it is close enough for me to work with. If you have more or better information, please let me know so I can correct this post.
Digits 0 through 3 identify the "card type". Depending on the card type, the remaining digits are parceled out into various fields with cryptic names, like "RCM code" "facility code" and "card stamp". RCM codes and facility codes seem to exist solely to allow batches of related cards to be managed without having to manage all the bits that make up the total card code.
Card stamp is the last 4 or 5 hex digits; the 26-bit formats use 4, and the 34-bit formats use 5.
Facility Code, RCM code
The RCM code and facility code occupy varying parts of the remaining bits; some of the formats convert cleanly from hex to decimal and some I haven't figured out yet.
My system recognizes a number of card types including (with their corresponding values):
26 bit raw card image (0000)
26 bit Wiegand NCC (8101)
26 bit prox ncc (8201)
26 bit mag stripe ncc (8301)
34 bit raw ADEMCO prox (0000)
34 bit ADEMCO Prox NCC (8206)
ABA TRACK II Mag Stripe - format C (C000)
ABA TRACK II Mag Stripe - format D (D000)
ABA TRACK II Mag Stripe - format E (E000)
ABA TRACK II Mag Stripe - format F (F000)
EMPI-II Wiegand NCC (8105)
EMPI-II Prox NCC (8205)
EMPI-II Mag Stripe NCC (8305)
34 bit Northern Wiegand NCC (8107)
34 bit Northern Prox NCC (8207)
34 Bit Northern Mag Stripe NCC (8307)
Each card format has its own rules for what to do with the digits that aren't the "card stamp," but the card stamp seems to consistently be in the last 4 or 5 digits of the code.
My system also supports a "raw code image" format that lets you enter a RAW card code, so if you know a card's code but you can't decode the card format and other fields, you can still enter the card and manage it like any other card.
The images above are related; the raw card code "8206-EFFF-0000-FFFF" shown above is related to the details in the next image; the image shows a 34 bit ADEMCO Prox NCC (8206), with RCM code 14 (E) and Facility code 4095 (FFF). The third group of four digits is unused, and the card code/card stamp for this card is 65535 (FFFF), although it's not show in any of these images.
What do you do with an unknown card?
So you have a card from a foreign system, and you don't know the card type or any of the other fields you need to make it work. How do you get the information you need?
There are a number of choices depending on your situation. If your card key system includes an "enrollment reader" you can use that to swipe cards and automatically add them to your system. Unfortunately, my system does NOT have an enrollment reader, so I needed another solution.
In my Passpoint's "System Administration Options" menu (pull down "Config" and select "Admin") there is an option "Denial Override." When selected, it has two effects. First of all, this is dangerous to leave active for any period of time, because "Denial override" is what this does; any card swipe will open the door, even an unknown card... do don't leave this setting activated! The other effect it has, though, is to include the card code in the message log, so it's easy to capture the code for an unknown card.
So, to use an unknown card:
1) swipe it on a reader. If the reader doesn't beep, it is incompatible with the system.
2) on the Passpoint control station, set the "denial override" feature, and upload the changes to the MLB
3) swipe your unknown cards and record the card codes from the log
4) turn off "denial override" and upload the change to the MLB
5) create new card records for your unknown cards. If you can decode the card type and other fields, great. If not, just use the RAW card type, and put in the full card code reported when you had "denial override" active.
6) upload the new cards to the MLB, and test.
Easy hex conversions
If you have trouble converting between decimal and hex in your head, there's a very simple tool already installed on most computers that will do this for you.
The calculator program included with MS Windows knows how to do base conversions. Rather than re-invent the wheel here, though, I'll refer you to
another article that covers this topic. I just wanted to mention it here, in case you as a reader were wondering where to get an easy hex-to-decimal converter, or vice versa.
If you've found this to be useful...
Please consider a donation to Rescue Animal Placements, an animal rescue organization that could really use your support, or your local animal shelter.