mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-10-15 02:20:19 +00:00
GetT55xxBlockData extracted every block at config.offset, a bit index into a demod buffer cached by the last detect - a different capture. Demodulators do not all start on the same bit, so a later read could return a rotation of the block with nothing marking it as wrong: psk1 by four or five bits, fsk2a and nrz by one, manchester and biphase never. Record the boundary where it is stable instead. Every demodulator reports the graph sample its first bit sits on, and turn_read_lf_on(137 * 8) makes the firmware open each read acquisition at the same point, so the word boundary lands on the same sample every time. Convert back per demodulation. Block 0 re-anchors from its known value, and a write is now verified by the value being anywhere in the repeating stream rather than at one cached offset - which also fixes correct writes reporting as validation failures. A block 0 verify re-detects on a mismatch, not only on a decode failure: the pre-write config can decode the post-write signal into garbage rather than failing. Also fixes a -1 password sentinel truncated to 32 bits by a ternary, which made that detect report a password that was never supplied. Measured on a T5577 across psk1, fsk2a and direct/nrz: three consecutive dumps agree field for field, against a baseline where psk1 corrupted 22 of 24. Co-Authored-By: Claude Opus 5 (1M context)