OverviewEvery access card, keyfob and other types of RFID tags in existence today uses some sort of embedded integrated circuit transponder to perform their RF Identification function. Some of these devices are designed to use a specific encoding format, some are read-only (programmed at the factory), and others like the Atmel T5557 and ATA5567 are extremely versatile.
The T55x7 devices are capable of supporting multiple encoding formats and timing options such that they can be used to emulate the majority of the 125 Khz RFID tag transponders on the market today. The T55x7 also has the ability to be written a minimum of 100,000 times, or locked permanently so that it cannot be rewritten after initial programming. As a result, this is the device that I chose to utilize for my RFID cloning project.
A photo showing the internal layout of a typical T5557 access card is included below.
A PDF copy of the T5557 datasheet can be found here on the Atmel Website. T5557 datasheet
Card ProgrammingThe T55x7 family of devices use 125 Khz On/Off Keying modulation as the means to program the device. This concept is depicted in the following drawing where a series of variable timing gaps and 125 khz modulated pulse widths are used to send the binary serial data used to program the device's register blocks. A complete description of the programming procedures can be found in the device's datasheet.
An example of a simple programmer circuit is shown below. Any generic microcontroller can be used to control the on/off carrier modulation provided it is capable of operating at a speed that allows all programming timing requirements to be satisfied.
Note: The mechanics of programming a card is fairly straightforward and the knowledge to do so can be obtained by thoroughly reading the T55x7 datasheet. Knowing what data to program into the device is a bit more complicated and requires a thorough understanding of the speciic vendor card format. A logic analyzer used to capture and analyze the FSK output from the card reader is highly recommended for anyone desiring to program their own clone cards.
Card AvailabilityAlthough the T55x7 IC's themselves can be purchased from various electronic component suppliers (large quantities only), I have been unable to find any US suppliers that sell the blank laminated R/W cards that have the embedded T55x7 device. I theorize that for security reasons, the access card vendors and/or Atmel puts enormous pressure or restrictions on the overseas card manufactures to not actively market their cards on the open US market. The cards however can be purchased directly from various overseas suppliers. A web search for T5557 or ATA5567 will yield numerous asian and european suppliers who manufacture and/or sell the cards. A link to a few places that I found who sell small quantities of the cards is included below.
SonMicro Electronics - Turkey
RFID Shop - Hong Kong
APD Anglia - UK