Almost impossible to read LF NExT with Proxmark3 RDV4.01 and ProxLF ant

Hi all,

I have a 10 day old NExT install which feels very well settled now but I still really struggle to get a read on the LF side with my Proxmark3.

The HF side reads perfectly well with no problems and did after a day or two after install however I’ve only had a successful read (lf search) maybe once or twice with the flat antenna but never with the ProxLF and when I try a lf tune I can’t get the voltage to budge at all, except maybe 100mV sometimes but honestly not sure if that’s just noise or something else going on.

I can read other flat cards with the ProxLF no problem if I line up the card antenna perpendicular to the ProxLF coil as you would expect. Both lf search and lf t5 detect - no problems. My LF field detector keyring shaped like an implant lights up nice and bright too.

Am I just being too impatient or is something wrong?

hw version

[usb] pm3 → hw version

[ Proxmark3 RFID instrument ]

[ CLIENT ]
client: RRG/Iceman/master/v4.9237-3970-g899f269a9 2021-06-02 17:55:15
compiled with Clang/LLVM Apple LLVM 12.0.5 (clang-1205.0.22.9) OS:OSX ARCH:x86_64

[ PROXMARK3 ]
device… RDV4
firmware… RDV4
external flash… present
smartcard reader… present
FPC USART for BT add-on… present

[ ARM ]
bootrom: RRG/Iceman/master/v4.9237-3970-g899f269a9 2021-06-02 17:55:54
os: RRG/Iceman/master/v4.9237-3970-g899f269a9 2021-06-02 17:56:12
compiled with GCC 10.2.1 20201103 (release)

[ FPGA ]
LF image built for 2s30vq100 on 2020-07-08 at 23:08:07
HF image built for 2s30vq100 on 2020-07-08 at 23:08:19
HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23:08:30

[ Hardware ]
–= uC: AT91SAM7S512 Rev A
–= Embedded Processor: ARM7TDMI
–= Internal SRAM size: 64K bytes
–= Architecture identifier: AT91SAM7Sxx Series
–= Embedded flash memory 512K bytes ( 60% used )

hw tune (ProxLF)

[usb] pm3 → hw tune
[=] ---------- Reminder ------------------------
[=] hw tune doesn’t actively tune your antennas,
[=] it’s only informative.
[=] Measuring antenna characteristics, please wait…
:clock12: 9
[=] ---------- LF Antenna ----------
[+] LF antenna: 27.71 V - 125.00 kHz
[+] LF antenna: 26.01 V - 134.83 kHz
[+] LF optimal: 28.34 V - 127.66 kHz
[+] Approx. Q factor (): 4.1 by frequency bandwidth measurement
[+] Approx. Q factor (
): 4.9 by peak voltage measurement
[+] LF antenna is OK
[=] ---------- HF Antenna ----------
[!] :warning: HF antenna is UNUSABLE

(*) Q factor must be measured without tag on the antenna

[+] Displaying LF tuning graph. Divisor 88 (blue) is 134.83 kHz, 95 (red) is 125.00 kHz.

[!] :warning: You appear to be on a MacOS device without XQuartz.
[!] :warning: You may need to install XQuartz (https://www.xquartz.org/) to make the plot work.

Can you get lf tune to change more with an external card? Does it make much difference which antenna you use with another card?

If a normal card shows a bigger change with either antenna then you are having issues reading the implant. If not then you might have issues with the proxlf antenna. You might want to make sure that it is connected well.

If it is just the implant I would give it a few more days, but keep checking. However I am no expert.

(Basically you want to make sure that your Proxmark3 is working, and that your antenna is working. If they are both working then you know it is reading the implant that is at issue.)

1 Like

Thanks for the suggestions!

The voltage dips nice and obviously with a normal card so I’m pretty confident it’s all working correctly.

1 Like

It shouldn’t matter but I’d go ahead and get xquartz. Mine seemed to work better with it for some reason.

Updating this thread:

I can read the LF side of the NExT fairly reliably using lf search to detect the EM card details as below however only with the Proxgrind LF Medium Range Antenna (from Lab401).

lf search
[usb] pm3 --> lf search`

[=] NOTE: some demods output possible binary
[=] if it finds something that looks like a tag
[=] False Positives ARE possible
[=]
[=] Checking for known tags...
[=]
[+] EM 410x ID 7130004189
[+] EM410x ( RF/64 )
[=] -------- Possible de-scramble patterns ---------
[+] Unique TAG ID      : 8E0C008291
[=] HoneyWell IdentKey
[+]     DEZ 8          : 00016777
[+]     DEZ 10         : 0805323145
[+]     DEZ 5.5        : 12288.16777
[+]     DEZ 3.5A       : 113.16777
[+]     DEZ 3.5B       : 048.16777
[+]     DEZ 3.5C       : 000.16777
[+]     DEZ 14/IK2     : 00486136627593
[+]     DEZ 15/IK3     : 000610086716049
[+]     DEZ 20/ZK      : 08140012000008020901
[=]
[+] Other              : 16777_000_00016777
[+] Pattern Paxton     : 1897168777 [0x71147F89]
[+] Pattern 1          : 34307 [0x8603]
[+] Pattern Sebury     : 16777 0 16777  [0x4189 0x0 0x4189]
[=] ------------------------------------------------

[+] Valid EM410x ID found!

[=] Couldn't identify a chipset

With the standard Proxmark combined LF/HF antenna it’s very difficult and I have never been able to read the NExT with the ProxLF antenna which seems strange since this should be the ‘best’ option.

All of my LF antennas can read the bundled T5577 card (both lf search and lf t5 detect) which came with the Proxmark so do I assume the LF antenna in my NExT has some kind of problem?

I’ve also confirmed my T55xx device config is set to the defaults per this post.

I’m also having the same problem, cannot get a reliable read. And in the rare occasion I can read something, it’s junk and changes every time. I don’t think it’s reliable enough to try writing.

I know it’s not due to swelling of a new implant, as it has been inside my hand for 3 years. I have to concede the implant is not so shallow as it was supposed to (the implantation procedure was not ideal), but some access controllers appear to detect it sometimes.

At first I didn’t mess with the LF because I didn’t have hardware to program it, then I bought a proxmark3 rdv2 (easy), but couldn’t get a reliable read. So I then bought the RDV4 with the antenna bundles, no luck either. So I bought the ProxLF antenna, also with disappointing results :confused:.

Did you get to solve your reading problems? I cannot get a read with any antenna :frowning:

I never did get the ProxLF to work and I’ve heard several times since that it has been mostly disappointing.

It seems that although the LF side of the NExT does work well with readers it’s not great with the proxmark and requires very precise positioning.

My normal recommendation is that you use ‘lf tune’ to find a good location and then keep it there. Each time you attempt a write operation you must read it back to confirm it was successful. The t5577 chip is rather fickle to work with but that’s also what makes it so flexible so keep at it and you will get there!

2 Likes

Accurate, but at the same time, mine still works, just not as well I had hoped.
I wonder if sometimes for other people they may be trying to read perpendicular rather than parallel (how this antenna is specifically designed to work)

Very Accurate.
But, that positioning, once learnt, becomes easily repeatable, so generally , most read / write issues can be eliminated.

When using a ProxMark3, but that is a “limitation” of PM3 NOT the T5577

Agreed.

Just dropping this here for PM3 Easy owners

1 Like