(This guide is a work in progress)
This guide will take you through the basics of Paxton access control systems Net2, Switch2 and Paxton 10.
Downgrading is the process of taking the authentication token from one form and putting it into another meaning you can deliver the token in a way that was not originally provisioned. IE taking the ID from a paxton hitag2 bullet fob and writing it into a T5577 emulating EM4100.
Paxton Net2 uses Hitag2, Em4100 and Mifare classic (UID-only) all of which can serve as the vehicle to deliver the Paxton ID so long as the chipset in question is enabled on the backend and/or if the reader hardware even supports it (paxton produces LF only readers alongside their HF/LF readers). In my experience EM4102 is left enabled in a lot of cases, allowing for easy downgrades.
NOTE
All Paxton Hitag2 use the same global password to access their memory:BDF5E846
In order to clone a Net2 Hitag2 credential to another Paxton Hitag2 all you need to copy from the original to the new one is blocks 4 & 5 as this is where the Paxton ID is held. If you are copying from a Net2 Hitag2 to a non-paxton Hitag2 you need to copy blocks 1/2/3/4/5 in order to also copy over the password.
Net2 does not care that the Hitag2's will have different UIDs, this is disregarded when sent to the backend.
You can tell a Hitag2 is Net2 because the first nibble of the second byte in block 5 is F, this signifies the cutoff for the ID, Switch2 does not have this F as the ID is a long convoluted selection mask that spans through blocks 4/5/6/7.
Block 4: 422C1C88
Block 5: 823F0840
Block 4 - 422C1C88
01000010001011000001110010001000
Block 5 - 823F0840
10000010001111110000100001000000
Block 4 - 422C1C88
01000 01000 10110 00001 11001 00010 [00]
Block 5 - 823F0840
10000 01000 11111 10000 10000 10000 [00]
1111 nibble F signifying the end of the ID.Block 4 - 422C1C88
1000 1000 0110 0001 1001 0010
8 8 6 1 9 2
Block 5 - 823F0840
0000 1000 1111 0000 0000 0000
0 8 F 0 0 0
1111 F nibble into one string to produce the decimal ID. Convert the ID to hexadecimal and pad with 0's at the BEGINNING of the ID to reach a length of 5 bytes in order to form the EM4100 ID.net2 ID:88619208
em4100 ID (hex with padding): 00054838C8