How to open a Paxton Door with a Flipper Zero
If you would like to open a door on a Paxton Net2 System using a Flipper Zero like in the gif below then you will need a valid tag and to follow these simple steps.
Check the reader can read EM4100 tags
Some older Paxton readers that were sold in the U.K. don't have the ability to read EM4100 tags. Check if the reader you are interested in can by emulating any old EM4100 code and watching the reader. If it beeps and flashes red then you are golden. If nothing happens and then you are out of luck.
This is what you want to happen with a random card
I always carry a couple of cards with me to test readers quickly and surreptitiously. Usually I can be found with at least an EM4100 and a mifare classic.
If you don't have a card handy you could just use your flipper to emulate any EM41X id.
Obtain the code of your valid Paxton tag
This is the tricky part as a flipper zero cannot currently read hitag2 tags. You can either get the code from a Paxton reader connected to a PC running the Paxton Net2 software or scan your tag yourself using a different device. To do the first method simply set the reader into desktop reader mode and scan your tag. You should get a popup with your code shown. If you decide to go down the second route then I can recommend using an RFIDler or Proxmark3. Instructions on using the RFIDler are here. If you would like me to read your tag for you email me.
Convert the number to hexadecimal to enter into you flipper zero
If you have you number from a real Paxton reader it will be a decimal number such as 12345678. You can convert that easily to hexadecimal using an online calculator such as https://www.rapidtables.com/convert/number/decimal-to-hex.html e.g. 12345678 becomes BC614E. If you have scanned your tag with another device you can convert it to the correct format here
Enter your code into your flipper
You will need to put zeros in front of your number to make it 8 hex digits long e.g. for BC614E
oPeN DoOrS!
It may look pretty cool but a fob is actually more convenient.
If you have the downgrade working you can if you like copy the id to any other form factor with an EM4100 including the T5577 which is able to emulate an EM tag.