Almost impossible to read LF NExT with Proxmark3 RDV4.01 and ProxLF ant

Hi all,

I have a 10 day old NExT install which feels very well settled now but I still really struggle to get a read on the LF side with my Proxmark3.

The HF side reads perfectly well with no problems and did after a day or two after install however I’ve only had a successful read (lf search) maybe once or twice with the flat antenna but never with the ProxLF and when I try a lf tune I can’t get the voltage to budge at all, except maybe 100mV sometimes but honestly not sure if that’s just noise or something else going on.

I can read other flat cards with the ProxLF no problem if I line up the card antenna perpendicular to the ProxLF coil as you would expect. Both lf search and lf t5 detect - no problems. My LF field detector keyring shaped like an implant lights up nice and bright too.

Am I just being too impatient or is something wrong?

hw version

[usb] pm3 → hw version

[ Proxmark3 RFID instrument ]

[ CLIENT ]
client: RRG/Iceman/master/v4.9237-3970-g899f269a9 2021-06-02 17:55:15
compiled with Clang/LLVM Apple LLVM 12.0.5 (clang-1205.0.22.9) OS:OSX ARCH:x86_64

[ PROXMARK3 ]
device… RDV4
firmware… RDV4
external flash… present
smartcard reader… present
FPC USART for BT add-on… present

[ ARM ]
bootrom: RRG/Iceman/master/v4.9237-3970-g899f269a9 2021-06-02 17:55:54
os: RRG/Iceman/master/v4.9237-3970-g899f269a9 2021-06-02 17:56:12
compiled with GCC 10.2.1 20201103 (release)

[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30

[ Hardware ]
–= uC: AT91SAM7S512 Rev A
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 60% used )

hw tune (ProxLF)

[usb] pm3 → hw tune
[=] ---------- Reminder ------------------------
[=] hw tune doesn’t actively tune your antennas,
[=] it’s only informative.
[=] Measuring antenna characteristics, please wait…
:clock12: 9
[=] ---------- LF Antenna ----------
[+] LF antenna: 27.71 V - 125.00 kHz
[+] LF antenna: 26.01 V - 134.83 kHz
[+] LF optimal: 28.34 V - 127.66 kHz
[+] Approx. Q factor (): 4.1 by frequency bandwidth measurement
[+] Approx. Q factor (
): 4.9 by peak voltage measurement
[+] LF antenna is OK
[=] ---------- HF Antenna ----------
[!] :warning: HF antenna is UNUSABLE

(*) Q factor must be measured without tag on the antenna

[+] Displaying LF tuning graph. Divisor 88 (blue) is 134.83 kHz, 95 (red) is 125.00 kHz.

[!] :warning: You appear to be on a MacOS device without XQuartz.
[!] :warning: You may need to install XQuartz (https://www.xquartz.org/) to make the plot work.

Can you get lf tune to change more with an external card? Does it make much difference which antenna you use with another card?

If a normal card shows a bigger change with either antenna then you are having issues reading the implant. If not then you might have issues with the proxlf antenna. You might want to make sure that it is connected well.

If it is just the implant I would give it a few more days, but keep checking. However I am no expert.

(Basically you want to make sure that your Proxmark3 is working, and that your antenna is working. If they are both working then you know it is reading the implant that is at issue.)

1 Like

Thanks for the suggestions!

The voltage dips nice and obviously with a normal card so I’m pretty confident it’s all working correctly.

1 Like

It shouldn’t matter but I’d go ahead and get xquartz. Mine seemed to work better with it for some reason.

Updating this thread:

I can read the LF side of the NExT fairly reliably using lf search to detect the EM card details as below however only with the Proxgrind LF Medium Range Antenna (from Lab401).

lf search
[usb] pm3 --> lf search`

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID 7130004189
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID      : 8E0C008291
[=] HoneyWell IdentKey
[+]     DEZ 8          : 00016777
[+]     DEZ 10         : 0805323145
[+]     DEZ 5.5        : 12288.16777
[+]     DEZ 3.5A       : 113.16777
[+]     DEZ 3.5B       : 048.16777
[+]     DEZ 3.5C       : 000.16777
[+]     DEZ 14/IK2     : 00486136627593
[+]     DEZ 15/IK3     : 000610086716049
[+]     DEZ 20/ZK      : 08140012000008020901
[=]
[+] Other              : 16777_000_00016777
[+] Pattern Paxton     : 1897168777 [0x71147F89]
[+] Pattern 1          : 34307 [0x8603]
[+] Pattern Sebury     : 16777 0 16777  [0x4189 0x0 0x4189]
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[=] Couldn't identify a chipset

With the standard Proxmark combined LF/HF antenna it’s very difficult and I have never been able to read the NExT with the ProxLF antenna which seems strange since this should be the ‘best’ option.

All of my LF antennas can read the bundled T5577 card (both lf search and lf t5 detect) which came with the Proxmark so do I assume the LF antenna in my NExT has some kind of problem?

I’ve also confirmed my T55xx device config is set to the defaults per this post.