PM3 Easy -- Troubleshoot hardware

I purchased a first PM3 Easy (PM3 #1), and have been using it without issue. I have both used and submitted PRs for the RRG/Iceman firmware.

In my critical path, I am successfully using it to get transponder info, write new keys to the transponders, and perform authentications with the transponder. Client commands:

  • lf em 4x70 info
  • lf em 4x70 writekey --key A090A0A02080000000000000
  • lf em 4x70 auth --rnd 3FFE1FB6CC513F --frn F355F1A0
  • lf em 4x70 write -b 1 -d 7777

I then purchased a second PM3 Easy (PM3 #2) here. It appeared to be from a different source … the box closed with magnets, and the LF antenna’s enamel was a darker orange-red. PM3 #2 is able to read the same transponder. (info), but has 100% failed every attempt I’ve made to write to these tags (writekey, write commands).

[usb] pm3 --> lf em 4x70 write -b 0 -d 7777
[-] ⛔ Writing Failed
[usb] pm3 --> lf em 4x70 write -b 15 -d 7777
[-] ⛔ Writing Failed
[usb] pm3 --> lf em 4x70 write -b 1 -d 7777
[-] ⛔ Writing Failed
[usb] pm3 --> lf em 4x70 writekey -k AA55AA55AA55AA55AA55AA55
[-] ⛔ Writing new crypt key: FAILED

What steps can I take to effectively root-cause this problem? (hw tune output provided below)

DT Staff – If troubleshooting doesn’t resolve, is there an option to swap for a replacement? (I am in the greater Seattle area, if in-person session would be helpful.)

Thanks!

[=] ---------- LF Antenna ----------
[+] LF antenna: 26.30 V - 125.00 kHz
[+] LF antenna: 19.51 V - 134.83 kHz
[+] LF optimal: 26.30 V - 125.00 kHz
[+] Approx. Q factor (*): 6.8 by frequency bandwidth measurement
[+] Approx. Q factor (*): 7.6 by peak voltage measurement
[+] LF antenna is OK
[=] ---------- HF Antenna ----------
[+] HF antenna: 14.79 V - 13.56 MHz
[+] Approx. Q factor (*): 4.3 by peak voltage measurement
[+] HF antenna is OK

Oh that’s odd… can you do hid emulation successfully?

Yeah, I also thought it was odd. I’ve spent some time trying all sorts of different orientations, but in the end … it’s just works on #1 but not #2. Wierd.

I can have both devices proximate to each other, and run the whatever commands are needed on each one. If I understand, you want to see if the other PM3 can then detect / read / dump the emulated one?

I’m novice at anything other than em4x70 (id48). That said, if you list commands for me to run, I’m game.

P.S. - I’ve tried
lf hid watch on one, and lf hid sim -r 2006ec0c86 on the other, and moving the coils near each other … but nothing appears, regardless of which one I set to sim, and which to watch. So, this is why I ask for commands to run … as my guesses did not work in only one direction.

On the #2 one that doesn’t work when you run the sim command what are the LEDs doing?

First time, LED B stays red for a second or so (while updating FPGA?), then LED A stays solid green. Second time, it skips programming the FPGA, so it goes straight to LED A staying solid green.

It’s may have been the antenna board (or a loose antenna screw). I swapped the known good antenna board from #1 onto #2, and it was immediately able to write. I am now swapping back… Embarrasing story likely to follow… :face_with_hand_over_mouth:

I regret to inform you that, because this is so odd, my embarrassing story is on hold.

I’ll now name the parts as follows:

  • PM#1 (known good) → mainboard #1 + antenna #1
  • PM#2 (suspect) → mainboard #2 + antenna #2

When I tried the known-good antenna on the second mainboard, it worked. This made me happy, as it supported the idea that the second antenna board was at fault.

But … then when I tested the second antenna board on the known-good mainboard, it also worked. That supported the idea that the mainboard was at fault.

That’s where I got to, when I wrote the above response, thinking it was a loose screw causing intermittent or marginal connection.

But… when I swapped the antennas back to their original pairings, (#1/#1 and #2/#2), PM#2 once again succeeded to read while failing to write. And this time, I’m sure all the screws are tight. Obviously transponder placement matters, which is why I’ve had the transponders stuck to the antennas with blue tack … so that’s also out as a cause. I also swapped which USB cable was used (in case one was providing lower power supply from thinner wires). Finally, PM#1 and PM#2 have visually distinct(*) parts, so it was easy to be sure that I wasn’t mixing up which one was which. Sigh…

After triple-checking everything, my summary:

Mainboard Antenna Result Notes
1 1 Works known-good
2 2 Fails suspect parts
2 1 Works? Bad antenna #2?
1 2 Works? Bad mainboard #2?

Resulting in me being slightly mystified.

I could leave it with the mainboards and antennas swapped. Without more, this leaves me somewhat uncomfortable, since doing so might cause both PM #1 and PM #2 to be less stable … and I need the stability(**) of PM #1.

I can’t get PM #2 to write, while PM #1 was a rock star for my purposes.

Any other thoughts or additional data I can collect to help understand this?

(In software, I’m an expert; in hardware, I’m a hobbyist dabbler; but in em fields, I’m just plain ignorant of both theory and practice.)

(*) PM#1 came with boards that appear to be HASL (or at least, silvery-colored). PM#2 came with boards that appear to be ENIG (or at least, copper-colored).

(**) On PM#1, I’ve been running auth / writekey cycles for multiple hours at a time, without a single failure (Yes, I’m keeping manual count of approximate write cycles).

It’s possible that the tolerance with board 2 and antenna 2 is out of spec but board 1 w antenna 2 and board 2 with antenna 1 are both in spec. There are tuning caps involved on the main boards and the antenna inductance must be within a range to make it work properly… so it’s possible what I said above is the cause.

This comes from the fact that the proxmark3 easy is made by many different factories in China and not all of them use the same capacitors or inductance for their antenna coils.

1 Like

Thanks for the help understanding the possibilities on the EE/EM side! While I have desoldered 0608 jumpers, my ignorance around antenna inductance is complete, so I don’t think I could mod the board myself. I’ll send mail to the orders alias. I’m open to keeping it, if I can verify stability of both (without losing option of RMA, if I find stability is lost).

NOTE: I have high hopes on the stability … I’ve been running it non-stop for >4 hours now. So, crossing fingers…

1 Like

Got your ticket. Keep testing and if it proves unstable we’ll take care of you.

2 Likes

Unfortunately, the mix’n’match of mainboards and antennas did not work for me. Restoring PM#2 to its original antenna confirmed the inability to write the tags (reading is still fine). I’ve requested to swap the second unit out.

May as well share my (now slightly less) embarrassing story. (expand details)

When I got my first PM3 Easy here, I had problems reading LF tags. With help from the great discord community, I was introduced to the hw tune command… which said the LF antenna was bad. However, they also suggested I first check if any of the screws were loose (not including the ones in my head).

Sure enough, the screws (including the ones to the LF antenna) were loose, resulting in intermittent / failing LF antenna connection. After tightening them all down, everything has been working like a dream with PM3 #1 ever since.

What would have made this particularly embarrassing? If the source of the issue with PM3 #2 above also turned out to be a loose screw, which I thought was the case at one point above. Sadly, it did not turn out to be the cause this time.

Morale: If LF antenna having troubles, first check the screws are all tight, because some of them are used to connect the LF antenna to the mainboard.


Amal … can you please confirm email is the preferred mechanism to setup an RMA?

Thanks for the support!

1 Like

yes i can reply to the support ticket email soon and get this sorted

1 Like