求助大神，这套数据怎么通层？

Qwer909

此卡用作：小区门禁，单元门禁，电梯卡（一个单元有两部电梯、都可刷）。
初步分析：
01~05扇区应该是门禁。

08~11扇区应该是梯控，多次刷卡没有发现滚动码。
8区0块13~15字节应该是到期时间(25年03月26日)、16字节可能是校验位。
9区2块前8字节与后8字节一致，应该分别是电梯1的楼层、电梯2的楼层(刷卡自动亮4层)。

尝试过修改为另一个楼层，也试过楼层数据改全0、全F，修改后刷卡无效、电梯发出滴滴两声。

附数据：

1. +Sector: 0
   
2. 45E7858AAD0804006263646566676869
   
3. 00000000000000000000000000000000
   
4. 00000000000000000000000000000000
   
5. FFFFFFFFFFFFFF078069FFFFFFFFFFFF
   
6. +Sector: 1
   
7. 9F979F9D5F5B5F5BB3F9FFFF9F9A3638
   
8. BFBF9167C19317144F6454F03DC78B57
   
9. 9571C5DD529B966E8322E34A87A16F23
   
10. FFFFFF545846FF078069FFFFFF545846
    
11. +Sector: 2
    
12. EF0C9B476F9F9962DCCDA4B1337F0376
    
13. F892C140172BD07CC78D0EA32D0AD8F7
    
14. 3F49A94640F813E3159F7D5A1C9F07F9
    
15. FFFFFF545846FF078069FFFFFF545846
    
16. +Sector: 3
    
17. 276B4B0A8A202BFE317094DA4565C11F
    
18. 9CF9D65267F0695B079FBFE4B9E9E529
    
19. 8282828041E4E4E545411F1E7B7B7F7D
    
20. FFFFFF545846FF078069FFFFFF545846
    
21. +Sector: 4
    
22. 7782808A40414045E1E1E1E280848063
    
23. 8A8A8A8045454540E2E3E2E581818180
    
24. 832C394B094DD69A5B55C2A154C7DD1F
    
25. FFFFFF545846FF078069FFFFFF545846
    
26. +Sector: 5
    
27. 00000000000000000000000000000000
    
28. 00000000000000000000000000000000
    
29. 00000000000000000000000000000000
    
30. FFFFFF545846FF078069FFFFFF545846
    
31. +Sector: 6
    
32. 00000000000000000000000000000000
    
33. 00000000000000000000000000000000
    
34. 00000000000000000000000000000000
    
35. FFFFFFFFFFFFFF078069FFFFFFFFFFFF
    
36. +Sector: 7
    
37. 00000000000000000000000000000000
    
38. 00000000000000000000000000000000
    
39. 00000000000000000000000000000000
    
40. FFFFFFFFFFFFFF078069FFFFFFFFFFFF
    
41. +Sector: 8
    
42. E7391800000988C401FF00FD1A031940
    
43. 12345682123456830000000000000000
    
44. 00000000000000000000000000000000
    
45. 315F1F55FBE8FF0780FFFFFFFFFFFFFF
    
46. +Sector: 9
    
47. 01180118011801180118011801180118
    
48. 65006500000000000000000000000000
    
49. 08000000000000000800000000000000
    
50. 315F1F55FBE8FF0780FFFFFFFFFFFFFF
    
51. +Sector: 10
    
52. 00000000000000000000000000000000
    
53. 00000000000000000000000000000000
    
54. 00000000000000000000000000000000
    
55. 315F1F55FBE8FF0780FFFFFFFFFFFFFF
    
56. +Sector: 11
    
57. FBFBB3FFFFFFFFFFFFFFFFFFFFFFFFFF
    
58. 0000000000FFFFFFFFFFFFFFFFFFFFFF
    
59. 00000000000000000000000000000000
    
60. 315F1F55FBE8FF0780FFFFFFFFFFFFFF
    
61. +Sector: 12
    
62. 00000000000000000000000000000000
    
63. 00000000000000000000000000000000
    
64. 00000000000000000000000000000000
    
65. 315F1F55FBE8FF0780FFFFFFFFFFFFFF
    
66. +Sector: 13
    
67. 00000000000000000000000000000000
    
68. 00000000000000000000000000000000
    
69. 00000000000000000000000000000000
    
70. FFFFFFFFFFFFFF078069FFFFFFFFFFFF
    
71. +Sector: 14
    
72. 00000000000000000000000000000000
    
73. 00000000000000000000000000000000
    
74. 00000000000000000000000000000000
    
75. FFFFFFFFFFFFFF078069FFFFFFFFFFFF
    
76. +Sector: 15
    
77. 00000000000000000000000000000000
    
78. 00000000000000000000000000000000
    
79. 00000000000000000000000000000000
    
80. FFFFFFFFFFFFFF078069FFFFFFFFFFFF

复制代码

rockwtr

---------------------------
提示
---------------------------
已分析出 2 个数据：
第 1-5 扇区为【晶控V10梯控】，不支持一键修改。
第 8-11 扇区为【无名梯控70】，到期日为25年3月26日，不支持一建修改。
---------------------------
OK   
---------------------------

rockwtr

晶控V10恐怕很难破解。

Qwer909

rockwtr 发表于 2024-7-24 02:24
---------------------------
提示
---------------------------

晶控V10应该是负责门禁的，下边这个应该才是梯控

Qwer909

rockwtr 发表于 2024-7-24 02:25
晶控V10恐怕很难破解。

晶控V10应该是门禁，刷单元门门禁前后对比还能发现4扇区0块有滚动码，就不打它的主意了。

8~11扇区应该是梯控，两部电梯来回刷好几次也没发现有滚动码。主要目标就是通层，或者能修改为指定楼层也行