mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-09-27 17:58:08 +00:00
Matthew CarrollandClaude Opus 5
ff7766af77
Both psk3 entries run the same demodulation as the psk2 entry beside them and differ only in the constant given to test(). test() accepts a word only when that word's own modulation field matches the constant, so the psk3 entry needs a recovered word whose field reads 3. Field 3 is 00011, so it needs two adjacent 1's. What this demodulation recovers is the data's rising edges, and a rising edge needs a 0 before the 1, so no two of them are ever adjacent. The words it produces can never carry field 3, and so the psk3 entries can never match the case they were written for. What they can do, however, is match on a demodulation error, and then detect names psk3 and a block 0 word the tag does not hold. psk3 is still reached, by ruling psk2 out from the broadcast period rather than by demodulating for it - see t55xx_psk3_resolve(). Tags that only these branches matched now read as psk2, or as undetected where no offset yields a plausible psk2 word, on the basis that a wrong answer is worse than none if nothing about it tells you it is wrong. Edited by a human. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>