dandri/proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-09-17 16:45:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

hf thinfilm sim - shorter frame gap

Browse Source 
The inter frame delay was 3600us for a 128 bit payload and 2400us for 256 bit,
sized so that either one holds a constant 4.8ms repeat period.  That is the wrong
target.  A Kovio tag is never transacted with - the reader captures it during a
poll slot and hands the bytes up as an activation, see
nfa_dm_disc_handle_kovio_activation() in libnfc-nci, which reads the barcode
straight out of rf_tech_param.param.pk.uid - so the only thing that matters is how often a frame is on the air.

Measured repeat period before today was 8.66ms, ie 14% duty cycle.  A fixed 500us
gap takes a 128 bit payload to roughly 2.2ms.  The gap cannot go to zero, a reader
needs unmodulated carrier to find the frame start and our own demod wants three
quiet bytes, but 500us is an order of magnitude clear of that.

Also drop the 'not correct' caveat from 'hf thinfilm list', the sim side traces
properly now.

Tested on RDV4 against an Android reader.  Builds clean for PM3RDV4 and PM5.

Co-Authored-By: Claude Opus 5 (1M context)
This commit is contained in:
iceman1001
2026-09-12 14:17:13 +02:00
co-authored by Claude Opus 5 (1M context)
parent a7c6116258
commit a967560335
4 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
armsrc/thinfilm.c
+6 -7
View File
@@ -60,6 +60,11 @@ void ReadThinFilm(void) {
#define SEC_E 0x0f
#define SEC_F 0x00
// Frame delimiter. A reader needs some unmodulated carrier to find the start of a
// frame (our own demod wants three quiet bytes), but a Kovio tag is only read by
// landing a frame inside the reader's poll slot, so keep the gap short.
#define THINFILM_FRAME_GAP_US 500
// A 32 sample average costs about 3.8 ms, since every sample pays a 42.7 us ADC
// startup and a 40 us sample & hold. That is fine once, for the baseline, but in
// the send loop it costs more than the deliberate inter frame delay and nearly
@@ -231,13 +236,7 @@ void SimulateThinFilm(uint8_t *data, size_t len) {
// one tosend byte == one 106 kbit/s bit == 8 ssp clk ticks
LogTrace(data, len, start_time * 16, (start_time + (ts->max * 8)) * 16, NULL, false);
if (len == 16) {
// wait 3.6ms
SpinDelayUs(3600);
} else {
// wait 2.4ms
SpinDelayUs(2400);
}
SpinDelayUs(THINFILM_FRAME_GAP_US);
}
}
client/src/cmdhfthinfilm.c
+1 -1
View File
@@ -212,7 +212,7 @@ static int CmdHfThinFilmList(const char *Cmd) {
static command_t CommandTable[] = {
{"help", CmdHelp, AlwaysAvailable, "This help"},
{"info", CmdHfThinFilmInfo, IfPm3NfcBarcode, "Tag information"},
{"list", CmdHfThinFilmList, AlwaysAvailable, "List NFC Barcode / Thinfilm history - not correct"},
{"list", CmdHfThinFilmList, AlwaysAvailable, "List NFC Barcode / Thinfilm history"},
{"sim", CmdHfThinFilmSim, IfPm3NfcBarcode, "Fake Thinfilm tag"},
{NULL, NULL, NULL, NULL}
};
doc/commands.json
+17 -3
View File
@@ -10474,7 +10474,7 @@
},
"hf thinfilm help": {
"command": "hf thinfilm help",
"description": "help This help list List NFC Barcode / Thinfilm history - not correct --------------------------------------------------------------------------------------- hf thinfilm info available offline: no Get info from Thinfilm tags",
"description": "help This help list List NFC Barcode / Thinfilm history --------------------------------------------------------------------------------------- hf thinfilm info available offline: no Get info from Thinfilm tags",
"notes": [
"hf thinfilm info"
],
@@ -10927,6 +10927,20 @@
],
"usage": "hw bwm autooff [-h]"
},
"hw bwm name": {
"command": "hw bwm name",
"description": "Get or set the BWM BLE advertising name (stored on the BWM, in NVS). With no --set, prints the current name. Setting a name stores it and reboots the BWM to apply it - this briefly drops a BLE/WiFi connection; reconnect after a few seconds. Over USB the reboot is not noticeable.",
"notes": [
"hw bwm name -> show current BLE name",
"hw bwm name --set MyPM5 -> set BLE name to 'MyPM5'"
],
"offline": false,
"options": [
"-h, --help This help",
"--set <name> new BLE name (1-31 chars); omit to read current name"
],
"usage": "hw bwm name [-h] [--set <name>]"
},
"hw bwm setcap": {
"command": "hw bwm setcap",
"description": "Program the BWM fuel gauge (BQ27427) Design Capacity for the fitted cell. Run ONCE after fitting or replacing the battery. This triggers a gauge config-update; do not run it repeatedly, as that disrupts the Impedance Track learning cycle. PM5 only.",
@@ -16494,8 +16508,8 @@
}
},
"metadata": {
"commands_extracted": 918,
"commands_extracted": 919,
"extracted_by": "PM3Help2JSON v1.00",
"extracted_on": "2026-09-11T13:13:54+00:00"
"extracted_on": "2026-09-12T12:14:59+00:00"
}
}
doc/commands.md
+2 -1
View File
@@ -938,7 +938,7 @@ Check column "offline" for their availability.
|------- |------- |-----------
|`hf thinfilm help `|Y |`This help`
|`hf thinfilm info `|N |`Tag information`
|`hf thinfilm list `|Y |`List NFC Barcode / Thinfilm history - not correct`
|`hf thinfilm list `|Y |`List NFC Barcode / Thinfilm history`
|`hf thinfilm sim `|N |`Fake Thinfilm tag`
@@ -1042,6 +1042,7 @@ Check column "offline" for their availability.
|`hw bwm help `|Y |`This help`
|`hw bwm autooff `|N |`Toggle auto power-off on USB unplug`
|`hw bwm charge `|N |`Enable/disable battery charging (one-shot)`
|`hw bwm name `|N |`Get/set the BWM BLE advertising name`
|`hw bwm setcap `|N |`Set fuel-gauge design capacity (run once after battery change)`
|`hw bwm upgrade `|N |`Reflash BWM (ESP32) firmware over the BWM link, no header`
|`hw bwm vchg `|N |`Set charger charge-voltage target (default 4100 mV)`