New blog #rfid #hacking

When debugging LF RFID protocols on the #ChameleonUltra, you often need to answer a basic question: is the field actually doing what the firmware thinks it is? For reader-talk-first protocols like #EM4305, the entire exchange depends on gap-encoded commands being sent correctly into the field. Without a way to observe the field directly, a firmware bug that silently prevents gaps from being sent looks identical to a tag that isn't responding, both produce LF tag not found.

The #ProxMark3 has lf sniff and a full suite of data analysis commands for exactly this reason. These commands bring the same capability to the ChameleonUltra, using the SAADC already present on the #nRF52840 to sample the antenna field at 125kHz.

https://sec1.dk/blog/lf_sniff_blog.html