iceman1001
commented
5 years ago This is a known issue.
The reading any LF has better distances with the current dual lf antenna, but writing t55x7 is worse. It usually needs the tag direct over the antenna very close.
As improvements @proxgrind has created a first prototype lowQ LF antenna which has great write distance but it comes with the price of shorter reading distances. The second prototype uses swithes to switch between lowQ and highQ, giving best of worlds. I think it will be released in May. At the same time as the large LF antenna will be released.
digitalentropy
mwalker33
Describe the bug I have observed that the RDV4 LF antenna appears to have some degraded performance on some T5577 tags. While I have observed the issue on a few generic blank T5577 cards, in my own testing the behavior is most pronounced on clamshell-style T5577 cards, such as those used by an OEM, as seen below.
In the above example, Kantech happens to use a non-protected T5577 chip in their OEM cards which allows the cards to be erased and re-written.
While read performance is quite forgiving, I have been unable to successfully perform any writes or ioProx clone operations to one of these clamshell-style cards using the RDV4.
Running the same version of the firmware on an RDV2 board results in highly reliable writes and I have no issues performing writes on RDV2 hardware.
To Reproduce Steps to reproduce the behavior:
Expected behavior Writing to full-sized T5577 credentials should be reliable regardless of antenna shape or size used in the card.
Screenshots N/A
Desktop (please complete the following information):
RDV2 Hardware Info
RDV4 Hardware Info
```code pm3 --> hw version [ Proxmark3 RFID instrument ] [ CLIENT ] client: RRG/Iceman [ PROXMARK ] external flash: present smartcard reader: present USART for addon support: absent [ ARM ] bootrom: RRG/Iceman/master/2ec05efa 2019-05-02 11:25:24 os: RRG/Iceman/master/2ec05efa 2019-05-02 11:25:57 [ FPGA ] LF image built for 2s30vq100 on 2019/ 4/18 at 9:35:32 HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23 [ Hardware ] --= uC: AT91SAM7S512 Rev B --= Embedded Processor: ARM7TDMI --= Nonvolatile Program Memory Size: 512K bytes, Used: 249944 bytes (48%) Free: 274344 bytes (52%) --= Second Nonvolatile Program Memory Size: None --= Internal SRAM Size: 64K bytes --= Architecture Identifier: AT91SAM7Sxx Series --= Nonvolatile Program Memory Type: Embedded Flash Memory pm3 --> hw status #db# Memory #db# BIGBUF_SIZE.............40000 #db# Available memory........40000 #db# Tracing #db# tracing ................1 #db# traceLen ...............0 #db# Currently loaded FPGA image #db# mode.................... HF image built for 2s30vq100 on 2018/ 9/ 3 at 21:40:23 #db# Flash memory #db# Baudrate................24MHz #db# Init....................OK #db# Memory size.............2 mbits / 256kb #db# Unique ID...............0xd567a882a72ab725 #db# Smart card module (ISO 7816) #db# version.................v3.11 #db# LF Sampling config #db# [q] divisor.............95 (125 KHz) #db# [b] bps.................8 #db# [d] decimation..........1 #db# [a] averaging...........Yes #db# [t] trigger threshold...0 #db# LF T55XX config #db# [a] startgap............29*8 (232) #db# [b] writegap............17*8 (136) #db# [c] write_0.............15*8 (120) #db# [d] write_1.............47*8 (376) #db# [e] readgap.............15*8 (120) #db# Transfer Speed #db# Sending packets to client... #db# Time elapsed............1500ms #db# Bytes transferred.......884736 #db# Transfer Speed PM3 -> Client = 589824 bytes/s #db# Various #db# MF_DBGLEVEL.............1 #db# ToSendMax...............-1 #db# ToSendBit...............0 #db# ToSend BUFFERSIZE.......2308 #db# Installed StandAlone Mode #db# LF HID26 standalone - aka SamyRun (Samy Kamkar) pm3 --> data tune [=] Measuring antenna characteristics, please wait... ... [+] LF antenna: 72.23 V - 125.00 kHz [+] LF antenna: 39.80 V - 134.00 kHz [+] LF optimal: 72.23 V - 125.00 kHz [+] LF antenna is OK [+] HF antenna: 49.00 V - 13.56 MHz [+] HF antenna is OK [+] Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz. ```
Additional context In testing I have also observed that placement of the target antenna coil appears to be far more sensitive on the default RDV4 hardware, while the default RDV2 hardware appears to be more forgiving in alignment and distance of the target T5577 tag. I do not know if this is something that can be mitigated in software or if it is a limitation of the more compact antenna design used in RDV4.