mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-11-14 11:48:45 +00:00
The tag does not send block numbers (datasheet 5.1, 6.1); only block 1 (sync pattern and RFB/RLB/RB1 selection) identifies positions. The reader printed raw captures, repeated and unordered. - ReadPCF7931: field off 50ms before each capture so it starts from a tag reset (first block = RFB, or block 1 with RB1, fig 10), record the start sample of each block and return its index in the sequence sent after reset in a pcf7931_read_t reply. Keep the longest capture, at least 10 blocks (a full cycle plus repeats) - DemodPCF7931: capture 12.5 blocks (~0.9s) instead of 4.5, enough for the 9-block cycle (RB1 with a full range sends block 1 twice) to repeat - PMC/block debug prints only at DBG_EXTENDED - client: identify block 1 as the block whose selection explains the observed cycle; it must match the minimal period of the data (a single repeated block was taken for a 2-block selection). Print blocks 0-7 (missing ones as not transmitted) and decode PAC, password, write protected blocks and selection - client: when several blocks fit as block 1 (a full 8-block cycle is rotation symmetric, e.g. a user block ending in 55 C4 reads as RFB 5, RLB 4) pick --rfb, then the one with fewest reserved bits set (fig 8), else print the reset order as #n with the possible RFB values - without block 1: print the blocks in transmission order as RFB+n, list the RFB values that keep block 1 out of the range, number them when only one is possible, or with the new --rfb option - client: reader timeout 15s, covers the no-tag path Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>