proxmark3 gerbers and bill of material

gaucho · 2014-03-12 12:02:13

now i tried again with a lf tag in the following way:

proxmark3> lf read
#db# buffer samples: ff ff ff ff ff
proxmark3> data sample 16000
Reading 16000 samples

Done!

proxmark3> data plot

and this is the signal i get:

then i sent the following commands:

proxmark3> data buffclear
#db# Buffer cleared (40000 bytes)
proxmark3>
proxmark3>
proxmark3>
proxmark3> hf 14a read
ATQA : 02 00
 UID : 9d 1e 0c eb
 SAK : 03 [2]
proprietary non iso14443a-4 card found, RATS not supported
proxmark3>
proxmark3>
proxmark3> data sample 16000
Reading 16000 samples

Done!

proxmark3> data plot
proxmark3>

but now i don't get the signal neither the noise but...i get this!!!!:

i really don't understand. I even tried resetting the board...

piwi · 2014-03-12 12:40:06

Don't use data plot with HF commands - at least don't try to read anything from it.

data plot displays the content of the trace buffer. For LF commands the trace buffer is filled with raw signal samples - it's like a digital oscilloscope in one shot mode. For HF commands it is filled with time stamps and decoded bytes (i.e. what you see in hf 14a list).

gaucho · 2014-03-12 13:17:56

piwi wrote:

Don't use data plot with HF commands - at least don't try to read anything from it.
data plot displays the content of the trace buffer. For LF commands the trace buffer is filled with raw signal samples - it's like a digital oscilloscope in one shot mode. For HF commands it is filled with time stamps and decoded bytes (i.e. what you see in hf 14a list).

thank you very much. i was scared about the result. thinking it was some other strange problem.

what about the lf reading of a tag. how to check it is working fine?

asper · 2014-03-12 13:41:46

Remember to use THE SAME firmware+client revisions (do not mix them !).

vivat · 2014-03-12 14:34:59

Your oscilloscope waveforms seems to be correct.

gaucho wrote:

what about the lf reading of a tag. how to check it is working fine?

You can do this test:
Take 2 proxmarks with good LF antennas. First pm3 will act as reader, second as fake LF tag. On first pm3 launch command lf hid fskdemod; on second lf hid sim. You may need 2 computers to run the client software.

P.S. long time ago pm3 client had support of running many proxmarks on single machine. I have never used this feature before and don't know if it's working now.

Enio · 2014-03-12 15:38:16

Nice! Your plots look good, unlike mine.

Can you let me know which parts you have changed so far? Just Op Amp? Hows the "final" R9,10,12,13,30,.. values? I will put my order then! Great Work!

gaucho · 2014-03-12 20:11:34

Enio wrote:

Nice! Your plots look good, unlike mine.
Can you let me know which parts you have changed so far? Just Op Amp? Hows the "final" R9,10,12,13,30,.. values? I will put my order then! Great Work!

most of the boards now are working but few boards have still problems. I'll detail the problems here tomorrow and we will analyze and solve them.

All the boards have been tested with the following COMMANDS:
HW TUNE (with both antennas) checking that the voltage value is good.
HF 14 A READ (with a mifare 1k tag) checking that 10 requests are decoded correctly
LF READ and then DATA SAMPLE 16000 and then DATA PLOT checking that the readed signal is a square waveform.

the bom sent to the manufacturer is correct, apart C35.
you will find the bom that i sent to manufacturer here:
http://www.4shared.com/office/gSpv_olRce/BOM.html

I replaced bad Op.Amp. IC6 (component's buyer error) and bad resistor (manufacturer error) R12.

Last edited by gaucho (2014-03-12 20:15:01)

gaucho · 2014-03-12 20:15:48

vivat wrote:

Your oscilloscope waveforms seems to be correct.
gaucho wrote:
what about the lf reading of a tag. how to check it is working fine?
You can do this test:
Take 2 proxmarks with good LF antennas. First pm3 will act as reader, second as fake LF tag. On first pm3 launch command lf hid fskdemod; on second lf hid sim. You may need 2 computers to run the client software.
P.S. long time ago pm3 client had support of running many proxmarks on single machine. I have never used this feature before and don't know if it's working now.

vivat i have 20 boards to test, are you sure that your test is needed?

All the boards have been tested with the following COMMANDS:
HW TUNE (with both antennas) checking that the voltage value is good.
HF 14 A READ (with a mifare 1k tag) checking that 10 requests are decoded correctly
LF READ and then DATA SAMPLE 16000 and then DATA PLOT checking that the readed signal is a square waveform.

read also my previous post.

gaucho · 2014-03-12 20:34:04

P.S.: to unsolder the IC6 i did the following:

placed the board on a heated floor. the heated floor was setted to 100°C. This is not mandatory but it helps.

then i placed some paper adhesive tape on the board, leaving unprotected the IC6.

then i heated with a hot air gun like this http://www.ebay.it/itm/BEST-8016-Withou … 2c7cc4d090

the hot air gun was setted at 300°C with the fan at minimum.
maintain it at about 5cm from the board for about 20seconds, then take out the chip from the board with a tweezers.

with this procedure you can remove any component from the board.

don't put it too close to the board cause the air could blow away the components.

I have the linked gun at home, but in the lab we have a better one with temperature regulator.

Last edited by gaucho (2014-03-12 20:37:36)

vivat · 2014-03-13 04:05:30

gaucho wrote:

vivat wrote:
Your oscilloscope waveforms seems to be correct.
gaucho wrote:
what about the lf reading of a tag. how to check it is working fine?
You can do this test:
Take 2 proxmarks with good LF antennas. First pm3 will act as reader, second as fake LF tag. On first pm3 launch command lf hid fskdemod; on second lf hid sim. You may need 2 computers to run the client software.
P.S. long time ago pm3 client had support of running many proxmarks on single machine. I have never used this feature before and don't know if it's working now.
vivat i have 20 boards to test, are you sure that your test is needed?
read also my previous post.

Yes, this test will test analog LF TX/RX path on both boards. I think it's necessarry to test it.

piwi · 2014-03-13 07:33:01

lf read and hf 14a read already tests both analog TX and RX path. No need for complicated tests with two proxmarks.

gaucho · 2014-03-13 10:42:49

piwi wrote:

lf read and hf 14a read already tests both analog TX and RX path. No need for complicated tests with two proxmarks.

yes but what should i check when i send "lf read" ?

when i send "HF 14A READ" i check that the tag is read with the same uid for 10 times.

vivat · 2014-03-13 16:16:34

gaucho wrote:

piwi wrote:
lf read and hf 14a read already tests both analog TX and RX path. No need for complicated tests with two proxmarks.
yes but what should i check when i send "lf read" ?
when i send "HF 14A READ" i check that the tag is read with the same uid for 10 times.

By this test I mean to signal strength that our proxmarks generate. If the signal is weak, tag simulator won't work good. For example, my pm3 can be read by desktop reader on bigger distance than real card.
gaucho
So, you don't have any problems with the boards?

gaucho · 2014-03-13 16:26:38

summary:
i have made 20 boards.
3 has been shipped to benoit and enio
2 are in the hands of my friend that helped me to repair solderings (but i still didn't replaced the op.amp. on that boards)
on the remaining 15 boards I replaced the op.amp. IC6.
on these 15 boards i repaired also the following: bad solderings, wrong resistors, wrong capacitors, broken arm.
now i have 12 working boards and 3 not working boards.
the working boards are declared "working" because:

BOARDS TESTS PROCEDURE wrote:

-HW TUNE gives good signal both on HF and LF path.
-HF 14A READ gives always the same feedback to HF 14A read, testing 10 times this command on mifare 1k and 10 times on mifare 4k.
-sending LF READ without a tag and then sending DATA SAMPLE 16000 and then DATA PLOT i get negative continuous signal
-sending LF READ with a lf tag on the antenna and then repeating the DATA SAMPLE 16000 and DATA PLOT commands i get a saturating square waveform.

The 3 not working boards have the following simphtoms:
Board1: DATA PLOT for LF TAGS gives always negative continuous signal and HF 14A READ can't read tags. HW TUNE is ok on both antennas.

Board2: DATA PLOT for LF TAGS gives noise but without tags there is the expected negative signal. HF part of the board is ok, included the reading of mifare. HW tune is ok for both antennas.

Board3: DATA PLOT for LF TAGS is ok, but without tags gives noise instead of negative signal. HF 14A READ can't read tags. HW tune is ok for both antennas.

tomorrow i'll try to find the time to upload some measurements on these boards.

Last edited by gaucho (2014-03-13 16:34:29)

vivat · 2014-03-13 17:11:49

Board1: DATA PLOT for LF TAGS gives always negative continuous signal and HF 14A READ can't read tags. HW TUNE is ok on both antennas.
Board2: DATA PLOT for LF TAGS gives noise but without tags there is the expected negative signal. HF part of the board is ok, included the reading of mifare. HW tune is ok for both antennas.
Board3: DATA PLOT for LF TAGS is ok, but without tags gives noise instead of negative signal. HF 14A READ can't read tags. HW tune is ok for both antennas.

I think you should compare signals of LF and HF Peak-Detected path on working and non-working boards.

piwi · 2014-03-13 18:06:42

vivat wrote:

By this test I mean to signal strength that our proxmarks generate. If the signal is weak, tag simulator won't work good. For example, my pm3 can be read by desktop reader on bigger distance than real card.

Bigger distances while simulating are probably caused by the proxmark being an active device while a real card needs to be powered by the reader field. Both pm3 when simulating and the tag don't "send" any signals but assert a modulated load to the reader field (by short-circuiting the antenna with varying resistance).

Enio · 2014-03-13 19:04:45

You have checked resistors on these boards? ( Considering my lf path was broken due to mixed up resistor - r30 i think- 10k instead of 10 M) Maybe another such accident on these?

My parts are arriving tomorrow. I dont have a hot air gun but im positive i can remove it with help of a solder remover wick and then disconnecting pin by pin with help of a needle. Pity im low on time this weekend, i cant wait to play with the code.
Edit: Removal worked well.

Last edited by Enio (2014-03-13 22:42:10)

gaucho · 2014-03-14 07:52:09

Enio wrote:

You have checked resistors on these boards? ( Considering my lf path was broken due to mixed up resistor - r30 i think- 10k instead of 10 M) Maybe another such accident on these?
My parts are arriving tomorrow. I dont have a hot air gun but im positive i can remove it with help of a solder remover wick and then disconnecting pin by pin with help of a needle. Pity im low on time this weekend, i cant wait to play with the code.
Edit: Removal worked well.

Good.

yes i replaced R30.

I also cheched with a multimeter.
Now i test it with the scope, and then we will discuss about signals.
Nice game. Isn't it?

gaucho · 2014-03-14 07:57:02

vivat wrote:

...If the signal is weak, tag simulator won't work good.

yes but if the signal is weak you are not able to read a tag all the times you try it.
The reason is that if the energy is not enough, the tag will not be energized well and moreover it will not decode the data requests from the board.
So i think that the HF 14A READ test is enough.

gaucho · 2014-03-14 08:08:47

just a note,
just to report here all my experience on the repaired boards:

1) 2 boards had the following simphtom: low voltage on LF antenna.
It was really hard to understand what was not going well.
At the end i placed a square waveform signal generator (125KHz, 10Vpp amplitude) on TP2.
I connected the ground of the scope and te ground of the signal generator to the ground of the proxmark.
I connected the usb port to the pc.
i connected a probe of the oscilloscope on the TP2
I found that changing the frequency to 225KHz, then 325KHz the signal decrease exponentially its amplitude, while on a working board the changes in amplitude are very small.
By this way I understood that the C39 was wrong amd i replaced it.

2) 1 board was programmed entirely on the JTAG interface, but it was not visibile on usb.
then i flashed it with jtag only the bootrom, and at this moment i could see it on the usb.
then i flashed it with the usb flasher tool, but then it becomed not visible on usb.
I repeated these steps many times. At the end i replaced the arm and the problem was solved.

Last edited by gaucho (2014-03-14 08:09:11)

Neuer_User · 2014-03-14 08:55:14

It's an incredible amount of work you are doing there. Hope the learning effect compensates for this huge amount of time it is taking you.

Thank you for putting this energy into the boards. You should definitely tell the seller what awful quality he has produced.

vivat · 2014-03-14 10:49:07

gaucho
So, you have repaired all non-working boards and don't have any other issues?

gaucho · 2014-03-14 11:41:18

vivat wrote:

gaucho
So, you have repaired all non-working boards and don't have any other issues?

no vivat, i wrote that i have 3 not working boards.

last posts were just for reference, just to let you know what i did during the troubleshooting of the boards that i repaired.

@Neuer_User: it's really big work and ofcourse i did it even because i like it, otherwise no money can pay it.

this morning I made some measurements on the 3 boards.
let's start from the first one:

powered board,connected lf antenna without tag and made hw tune: it's ok.
sent command LF READ without tag on working board and on not working board and then compared the results sampling the signal on TP1:

on working board:

on not working board:

I tried to check the signal before TP1 and finally i couldn't understand if the problem is caused by D1,C11 or C12.
I will replace them all, but now the lab is closed.

Last edited by gaucho (2014-03-14 11:44:13)

Enio · 2014-03-14 13:04:00

Hello folks!

I finally replaced the fake opamp.
HF path seems to works now on latest svn! hf 14a read and snoop show correct data.

LF path seems to be distorted quite a bit.

Antenna Voltage for 125khz reads 24.84 V.
Let me show you a lf read of a tag most likely type em4200:

No Tag

With Tag

Closer

Even closer

Reference from this thread

Any thoughts or comments on these? Which parts could i check/replace? Maybe the ADC is bad quality? You can easily spot up and down-shifts on specific voltage levels there.

Last edited by Enio (2014-03-14 13:11:53)

Enio · 2014-03-14 13:43:59

Gaucho, back then you just tested square waveform, which would hide distortions in between lo/hi values. Any chance you can verify with a sine wave?

gaucho wrote:

I applied a square waveform (200KHz) to the IC14 pin 5 (AD8052 input) and i verified that the output signal on pin 7 is exactly the same signal but amplified by factor 2 (il i well remember). Anyway i'm sure now that the AD8052 is not fake.

gaucho · 2014-03-14 15:34:26

i found the keys of the lab, i replaced D1,C11 and C12, then i tested the board and it was still with the same preoblem.
Finally i replaced C39 and now without a tag i get negative continuous signal on DATA PLOT.
Unfortunately i lost my LF tag and i can not continue tests.. I will take another one at home this evening (same type but bigger shape).

gaucho · 2014-03-14 15:53:47

@enio: here i can't see your posted images cause http://i.imgur.com is banned here. I will reply you this evening.
Components have been purchased all together, so if there is a problem with that chip, all the boards have it.
As you know square waveform has large spectrum than sine waveform, so if the chip was fake i suppose that it was visible.
Consider that today I had to replace C39 on one board cause it was with wrong value.
Did you tested it without tag? your voltage value is low. Are you sure your antenna is ok? I get 26V and vivat told me that it's a low value cause i used 0,4mm diameter wire instead of 0,1mm.
We should also find a method to be sure that lf path is working.
I did not understood the following: I have a lf tag, i read it with LF READ and then? how to see the uid of this tag?
it is a T55xx in my case

reading samples with DATA SAMPLE and DATA PLOT i see a saturating square waveform when there is the tag over the antenna. Is it correct?
When the tag is not present i see a negative continuous signal (negative means the minimum value displayable on the DATA PLOT graph.

EDIT:EM4200 is LF? i have EM4233 but i suppose it is high frequency tag. i didn't tried it with pm3.

Last edited by gaucho (2014-03-14 16:17:28)

gaucho · 2014-03-14 16:22:29

asper wrote:

This is a T5567 waveform (a little zoomed out):

hey I found this post. Do you remember it? so my square waveform seems to be correct.. even if i don't understand how to see the blocks data and the uid.. may be we need Neo to wach in to the signal like in matrix.
images?q=tbn:ANd9GcTNqm9nuIWWGMV77c9_GAmHCvsZlCh20byR9FBfIDeJZoKbEX2-RXyJES6R

Last edited by gaucho (2014-03-14 16:26:05)

vivat · 2014-03-14 16:38:40

With T55x7 you can do following:
lf hid clone 20042ea607
lf hid fskdemod
You should get that hex UID.

Enio · 2014-03-14 17:31:08

@Gaucho, i saw them, i saw a little distortion on some of your pictures but it was really low - but the tag you measured uses an almost-square wave for communicating (fast voltage raise/drop - a vertical shift wouldnt do much harm to the wave, but on my tag with slower drops it does.

I tested a bit more. The distortion seems to mess with some of the built in commands.

I implemented a simple data smooth command for testing, without it i do not have success demodulating the manchester encoding, with smoothing the graph a few times it works... and i get similar 64bit strings from different reads, so it defenitely works.

See: 1st lf read 1x without smooth, then with smooth. 2nd lf read to proove the result is correct.

proxmark3> lf read
#db# buffer samples: 5c 5e 5f 50 52 54 54 56 ...                 
proxmark3> data samples 16000
Reading 16000 samples
          
Done!
          
proxmark3> data hpf
proxmark3> data smoo
proxmark3> data thres 0
proxmark3> data askdemod 1
proxmark3> data mandemod
Warning: Manchester decode error for pulse width detection.          
(too many of those messages mean either the stream is not Manchester encoded, or clock is wrong)          
Warning: Manchester decode error for pulse width detection.          
(too many of those messages mean either the stream is not Manchester encoded, or clock is wrong)          
Warning: Manchester decode error for pulse width detection.          
(too many of those messages mean either the stream is not Manchester encoded, or clock is wrong)          
Warning: Manchester decode error for pulse width detection.          
(too many of those messages mean either the stream is not Manchester encoded, or clock is wrong)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Error: too many decode errors, aborting.          
proxmark3> data samples 16000
Reading 16000 samples
          
Done!
          
proxmark3> data hpf
proxmark3> data smoo
proxmark3> data smoo
proxmark3> data smoo
proxmark3> data smoo
proxmark3> data thres 0      
proxmark3> data askdemod 1
proxmark3> data mandemod
Warning: Manchester decode error for pulse width detection.          
(too many of those messages mean either the stream is not Manchester encoded, or clock is wrong)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Manchester decoded bitstream          
0 0 1 0 1 1 1 1 1 1 1 1 0 1 1 1          
1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1          
0 0 0 0 0 1 0 1 1 1 0 0 0 0 0 0          
1 0 1 0 1 0 1 0 0 0 1 0 1 0 1 0          
0 0 1 0 1 1 1 1 1 1 1 1 0 1 1 1          
1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1          
0 0 0 0 0 1 0 1 1 1 0 0 0 0 0 0          
1 0 1 0 1 0 1 0 0 0 1 0 1 0 1 0          
0 0 1 0 1 1 1 1 1 1 1 1 0 1 1 1          
1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1          
0 0 0 0 0 1 0 1 1 1 0 0 0 0 0 0          
1 0 1 0 1 0 1 0 0 0 1 0 1 0 1 0          
0 0 1 0 1 1 1 1 1 1 1 1 0 1 1 1          
1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1          
0 0 0 0 0 1 0 1 1 1 0 0 0 0 0 0          



proxmark3> lf read
#db# buffer samples: 91 90 7f 7d 7c 7a 72 66 ...                 
proxmark3> data samples 16000
Reading 16000 samples
          
Done!
          
proxmark3> data hpf
proxmark3> data smoo
proxmark3> data smoo
proxmark3> data smoo
proxmark3> data thres 0
proxmark3> data askdemod 1
proxmark3> data mandemod
Warning: Manchester decode error for pulse width detection.          
(too many of those messages mean either the stream is not Manchester encoded, or clock is wrong)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Unsynchronized, resync...          
(too many of those messages mean the stream is not Manchester encoded)          
Manchester decoded bitstream          
1 1 0 0 0 0 0 1 0 1 1 1 0 0 0 0          
0 0 1 0 1 0 1 0 1 0 0 0 1 0 1 0          
1 0 0 0 1 0 1 1 1 1 1 1 1 1 0 1          <-- 3rd bit here is start of previous result.
1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0          
1 1 0 0 0 0 0 1 0 1 1 1 0 0 0 0          
0 0 1 0 1 0 1 0 1 0 0 0 1 0 1 0          
1 0 0 0 1 0 1 1 1 1 1 1 1 1 0 1          
1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0          
1 1 0 0 0 0 0 1 0 1 1 1 0 0 0 0          
0 0 1 0 1 0 1 0 1 0 0 0 1 0 1 0          
1 0 0 0 1 0 1 1 1 1 1 1 1 1 0 1          
1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0          
1 1 0 0 0 0 0 1 0 1 1 1 0 0 0 0          
0 0 1 0 1 0 1 0 1 0 0 0 1 0 1 0          
1 0 0 0 1 0 1 1 1 1 1 1 1 1 0 1          
proxmark3>

Could just my ADC8052 be bad? Or some diode/Capacitor/..? Any ideas welcome.

gaucho · 2014-03-14 20:15:51

connect lf antenna
remove the tag
power the pm3
send LF READ, DATA SAMPLE 16000 and DATA PLOT and post here result.

do you have also a T55x7 tag?

gaucho · 2014-03-14 20:17:14

i understood what you said, if we can compare results doing tests in the same manner i can help you.

Enio · 2014-03-14 21:15:05

Sadly i only have this other lf tag - supposedly em4100/em4200.

I might just test with a new ADC, but need to wait next month :-/

I have enough to play with till then. Just - if adc is bad for all boards, it would be good to know.

Gaucho - can you put one pic of lf read plot very zoomed in? To see if you have shifts up/down better. I fear adc is not linear.

In case you do tests with oscilloscope - I think a saw wave would be even better to check on bad linear adc. But both, a rising saw wave, and a falling.

gaucho · 2014-03-15 08:37:16

Enio, i had the time to watch your screenshots.
The 3 broken boards have similar problem to yours:
before to replace the C39 on one board there was noise, after replacing it, i can see a negative signal (about -128) while in your case i see i value of about -23.
So i would try first to replace C39.
So at this point, if you have this C39 (1nF) you will also have some spare 1nF capacitors, then replace also C11 and C12.
I did this on a board with "high noise" in the DATA PLOT graph (without tag on antenna).
Now that board has negative signal of about -128.
When i place the tag over the antenna, this board (but also other boards) has simphom similar to your board.
Consider that with T55x7 i expect a square waveform, so i suppose that if i don't get a square waveform on the graph, there is a problem.

Next days I will try to analyze again better, i suggest you to wait, if you want to save money.

cause i replaced components on the 3 boards but i didn't performed measures on oscilloscope.

gaucho · 2014-03-15 08:55:26

Enio wrote:

Gaucho - can you put one pic of lf read plot very zoomed in? To see if you have shifts up/down better. I fear adc is not linear.
In case you do tests with oscilloscope - I think a saw wave would be even better to check on bad linear adc. But both, a rising saw wave, and a falling.

if you can always read the HF tags, included cracking mifare, why should the ADC have problems?

these are screenshots of the not working boards:

with tag:

without tag:

gaucho · 2014-03-15 09:04:59

vivat wrote:

With T55x7 you can do following:
lf hid clone 20042ea607
lf hid fskdemod
You should get that hex UID.

vivat look at this log.
is it there a problem in the board?

proxmark3> lf hid clone 20042ea607
Cloning tag with ID 20042ea607
#db# DONE!
proxmark3> lf hid fskdemod
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 420042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 200042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 400042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 400042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 420042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 200042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# Stopped
proxmark3>

Last edited by gaucho (2014-03-15 09:05:25)

Neuer_User · 2014-03-15 09:25:02

Looks pretty good to me. I also get sometimes wrong UID back between mostly correct ones.

gaucho wrote:

vivat wrote:

With T55x7 you can do following:
lf hid clone 20042ea607
lf hid fskdemod
You should get that hex UID.

vivat look at this log.
is it there a problem in the board?

proxmark3> lf hid clone 20042ea607
Cloning tag with ID 20042ea607
#db# DONE!
proxmark3> lf hid fskdemod
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 420042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 200042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 400042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 400042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 420042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 200042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# Stopped
proxmark3>

Enio · 2014-03-15 11:48:39

gaucho wrote:

So i would try first to replace C39.

Hmm. I can try. Can such distortions come off that capacitor? My antenna is finely tuned.

gaucho wrote:

if you can always read the HF tags, included cracking mifare, why should the ADC have problems?

I'm sorry i spelled it wrong, its actually not an ADC. I mean AD8052 (IC14A/B on schematics).

For `fast' signals, I use an AD8052. This is a very fast voltage-feedback
amplifier (~100 MHz GBW). I use it immediately after the antenna for
both the low- and high-frequency cases, as a sort of an ugly LNA. It is
not optimal, but it certainly made the design easy.

Afaik AD8052 is not used in any PKD path. And I read that LF RAW is used in lf read. (In code i see alot of references to LF PKD though. This i will inspect further.)

Anyways, something must be wrong. Check the following comparison of waves. They show the same modulated bits. Grid is set to the same positions:

How it is supposed to look like:

How mine does look like, with some arrows how it should be like.

My question:
1) Is there another explaination beside ad8052 being bad?
2) Can i put a sine signal on antenna on ~125khz with homebrew materials, like something really cheap?

Last edited by Enio (2014-03-15 12:00:30)

asper · 2014-03-15 12:26:55

gaucho wrote:

vivat wrote:

With T55x7 you can do following:
lf hid clone 20042ea607
lf hid fskdemod
You should get that hex UID.

vivat look at this log.
is it there a problem in the board?

proxmark3> lf hid clone 20042ea607
Cloning tag with ID 20042ea607
#db# DONE!
proxmark3> lf hid fskdemod
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 420042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 200042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 400042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 400042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 420042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 200042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# TAG ID: 20042ea607 (21251)
#db# Stopped
proxmark3>

I have the same "problem" with my original pm3+good homemade lf antenna (35-40mV) but mine is lot less frequent than your and only happens when something is disturbing (ex. I move something or hit the table, touche the tag).

gaucho · 2014-03-15 12:52:27

Enio wrote:

gaucho wrote:
So i would try first to replace C39.
Hmm. I can try. Can such distortions come off that capacitor? My antenna is finely tuned.

I can't explain, but i've seen the "noise" reducing after replacing C39, even if the problem is still there.
I suppose it is not the center of the problem but it helps.

Enio wrote:

I'm sorry i spelled it wrong, its actually not an ADC. I mean AD8052 (IC14A/B on schematics).
...............
Anyways, something must be wrong.
........................
My question:
1) Is there another explaination beside ad8052 being bad?
2) Can i put a sine signal on antenna on ~125khz with homebrew materials, like something really cheap?

Vivat wrote that the RAW path is no more used, then the AD8052 should be not used... I understood that we're using the Peak detect path.
Damn let's unsolder the AD8052 and check if the square waveform is still there..
If we need this "hard test" i'll do it on monday, otherwise check the code.

I agree with you that there is something strange.. (wrong?)

why you want to put a sine on the antenna signal? if you don't have oscilloscope to see it..
On the graph shown on DATA PLOT you will see a DC voltage.

Last edited by gaucho (2014-03-15 13:24:12)

Enio · 2014-03-15 13:11:10

gaucho wrote:

I can't explain, but i've seen the "noise" reducing after replacing C39, even if the problem is still there.
I suppose it is not the center of the problem but it helps.

What the..
I just replaced C39 with a 1000pf 100V Capacitor i got with the opamp.
I get noise. I replaced it with another and still get noise. I only touched C39. Could they ve shipped me wrong capacitors? Its been from farnell..

Nevermind. I changed my antenna tuning and im back to the distorted wave form.

Last edited by Enio (2014-03-15 13:43:22)

gaucho · 2014-03-15 13:27:03

Enio wrote:

gaucho wrote:
I can't explain, but i've seen the "noise" reducing after replacing C39, even if the problem is still there.
I suppose it is not the center of the problem but it helps.
What the..
I just replaced C39 with a 1000pf 100V Capacitor i got with the opamp.
I get noise. I replaced it with another and still get noise. I only touched C39. Could they ve shipped me wrong capacitors? Its been from farnell..

try to wash the board..
i don't know what to tell you, I hope farnell don't do these errors..
what voltage gives you HW tune? is it possible that you need to retune your antenna?

...also replace the other 2 capacitors...

that capacitors are a sort of low band pass filter and then high band pass filter, and they all uses the same 1nF capactor..

EDIT: when i washed the board i did it with alcool but my colleague told me that it's better to wash it with water and soap, and then heat to dry it.

Last edited by gaucho (2014-03-15 13:34:51)

Enio · 2014-03-15 13:44:15

I changed my antenna a bit, and im back to the old distorted waveform. This behaves weird..

The distortions seem a bit stronger even:

I will change the other capacitors and analyzu the code. Any ideas or advice welcome.
Thanks gaucho.

Last edited by Enio (2014-03-15 14:22:55)

vivat · 2014-03-15 14:47:08

Enio
Tell me what components have you changed. Did you placed them correctly? Your ADC is working as you can read and crack mifare without any problems. For LF READ command LF Peak-Detected path is used. You should check it first.
gaucho
Your log is good. You just cloned 26-bit HID card to T55x7 and checked that T55x7 simulates it correctly.

Enio · 2014-03-15 15:09:17

piwi wrote:

data plot displays the content of the trace buffer. For LF commands the trace buffer is filled with raw signal samples - it's like a digital oscilloscope in one shot mode. For HF commands it is filled with time stamps and decoded bytes (i.e. what you see in hf 14a list).

So it is not raw RAW samples but raw PKD samples?
Ill check schematics and tell what i changed when home.
Maybe its a diode in PKD path then.

vivat · 2014-03-15 15:56:19

Enio wrote:

piwi wrote:
data plot displays the content of the trace buffer. For LF commands the trace buffer is filled with raw signal samples - it's like a digital oscilloscope in one shot mode. For HF commands it is filled with time stamps and decoded bytes (i.e. what you see in hf 14a list).
So it is not raw RAW samples but raw PKD samples?
Ill check schematics and tell what i changed when home.
Maybe its a diode in PKD path then.

Don't be confused with LF RAW path and LF raw signal samples!.
When you read a tag, you usually do this:
lf read
data samples
data demodsomething

lf read command is genereal-purpose LF reader. It reads raw LF tag waveform via LF peak-detected path and writes raw samples inside ARM's internal RAM. See function AcquireRawAdcSamples125k() in ./armsrc/lfops.c
data samples downloads that raw samples from ARM to host PC. You can watch them with data plot.
data demodsomething demodulates our samples according to some algorithm.
Other LF tag reading commands operate almost same way, such as EM410xWatch(lf read+data samples 16000+em410xread in loop).

Enio · 2014-03-15 18:03:13

Thank you, i misunderstood it then. So AC8052 isnt even involved and its most likely a part of the resistors/capacitors/diodes after antenna on LF PKD path messing my samples up.

Ill change involved res/caps - diode i need to wait Monday.

Thanks alot.

gaucho · 2014-03-16 09:26:11

Enio wrote:

Thank you, i misunderstood it then. So AC8052 isnt even involved and its most likely a part of the resistors/capacitors/diodes after antenna on LF PKD path messing my samples up.
Ill change involved res/caps - diode i need to wait Monday.
Thanks alot.

Enio, please keep me informed as soon as you found something, cause we have the same task.
If possible, replace components one at time in order to understand which is wrong.
Unfortunately My spare diodes are the same mounted on the board, so I can not be 100% sure that they are good.
I replaced the 3 capacitors (1nF capacitors) but i still have to check it with the scope. I suppose that the capacitor replacement didn't solved the problem.

Enio · 2014-03-16 14:26:18

Ok i changed a few and it looks a bit better. However shifts still occur on the peaks.

I had already changed R30 (10M Ohms) and R12 (100k Ohms) a while ago.

Now i went to change C11, C12, R11, R13.

I checked after C11. I was like "Cool" because the top-peak distortion was gone, until i noticed later that i read lf tag further away than usual - resulting in a weaker Voltage - and i think too high/low voltage makes it shift them instead of just cutting them off.
Signal after C11 - mind you - further away. the "middle" distortion is gone though and will not come back:

From the other changes i didnt notice any specific changes beside maybe voltage level. I am not sure.

This is how it generally looks now after the changes:

It looks fine in between the peaks now!

Anyone understanding the PKD path enough to see what could cause the peaks to be panned?

Last edited by Enio (2014-03-16 14:36:44)

Enio · 2014-03-16 14:35:54

I will also try to get a better antenna with higher voltage..

Proxmark3 community

Announcement

#351 2014-03-12 12:02:13

Re: proxmark3 gerbers and bill of material

#352 2014-03-12 12:40:06

Re: proxmark3 gerbers and bill of material

#353 2014-03-12 13:17:56

Re: proxmark3 gerbers and bill of material

#354 2014-03-12 13:41:46

Re: proxmark3 gerbers and bill of material

#355 2014-03-12 14:34:59

Re: proxmark3 gerbers and bill of material

#356 2014-03-12 15:38:16

Re: proxmark3 gerbers and bill of material

#357 2014-03-12 20:11:34

Re: proxmark3 gerbers and bill of material

#358 2014-03-12 20:15:48

Re: proxmark3 gerbers and bill of material

#359 2014-03-12 20:34:04

Re: proxmark3 gerbers and bill of material

#360 2014-03-13 04:05:30

Re: proxmark3 gerbers and bill of material

#361 2014-03-13 07:33:01

Re: proxmark3 gerbers and bill of material

#362 2014-03-13 10:42:49

Re: proxmark3 gerbers and bill of material

#363 2014-03-13 16:16:34

Re: proxmark3 gerbers and bill of material

#364 2014-03-13 16:26:38

Re: proxmark3 gerbers and bill of material

#365 2014-03-13 17:11:49

Re: proxmark3 gerbers and bill of material

#366 2014-03-13 18:06:42

Re: proxmark3 gerbers and bill of material

#367 2014-03-13 19:04:45

Re: proxmark3 gerbers and bill of material

#368 2014-03-14 07:52:09

Re: proxmark3 gerbers and bill of material

#369 2014-03-14 07:57:02

Re: proxmark3 gerbers and bill of material

#370 2014-03-14 08:08:47

Re: proxmark3 gerbers and bill of material

#371 2014-03-14 08:55:14

Re: proxmark3 gerbers and bill of material

#372 2014-03-14 10:49:07

Re: proxmark3 gerbers and bill of material

#373 2014-03-14 11:41:18

Re: proxmark3 gerbers and bill of material

#374 2014-03-14 13:04:00

Re: proxmark3 gerbers and bill of material

#375 2014-03-14 13:43:59

Re: proxmark3 gerbers and bill of material

#376 2014-03-14 15:34:26

Re: proxmark3 gerbers and bill of material

#377 2014-03-14 15:53:47

Re: proxmark3 gerbers and bill of material

#378 2014-03-14 16:22:29

Re: proxmark3 gerbers and bill of material

#379 2014-03-14 16:38:40

Re: proxmark3 gerbers and bill of material

#380 2014-03-14 17:31:08

Re: proxmark3 gerbers and bill of material

#381 2014-03-14 20:15:51

Re: proxmark3 gerbers and bill of material

#382 2014-03-14 20:17:14

Re: proxmark3 gerbers and bill of material

#383 2014-03-14 21:15:05

Re: proxmark3 gerbers and bill of material

#384 2014-03-15 08:37:16

Re: proxmark3 gerbers and bill of material

#385 2014-03-15 08:55:26

Re: proxmark3 gerbers and bill of material

#386 2014-03-15 09:04:59

Re: proxmark3 gerbers and bill of material

#387 2014-03-15 09:25:02

Re: proxmark3 gerbers and bill of material

#388 2014-03-15 11:48:39

Re: proxmark3 gerbers and bill of material

#389 2014-03-15 12:26:55

Re: proxmark3 gerbers and bill of material