mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-09-17 12:25:40 +00:00
iceman1001andClaude Opus 5 (1M context)
696b8357b6
hf thinfilm sniff passively records the frames a Kovio tag beams at a reader.
Kovio is tag-talks-first and the reader never sends a command, so only the tag
side is decoded - use 'hf 14a sniff' to watch a reader's poll loop. Same DMA
loop, overrun recovery and nibble de-interleave as SniffIso14443a().
ManchesterDecoding_Thinfilm() is no longer static and takes non_real_time, the
same way ManchesterDecodingEx() does. A DMA sniff loop cannot timestamp with
GetCountSspClk(); the clock has run on past the frame by the time the samples
are processed.
Only the decoder is RAMFUNC (724 bytes), not the sniff loop, since dropping the
Miller decode roughly halves the per sample work. The loop counts overrun
recoveries and DMA stalls separately, so a lossy capture says so instead of
looking like a quiet tag.
With that, the sim's frame period could be measured instead of guessed. A
genuine tag repeats every 65536 carrier periods - 2**16, it clocks a 16 bit
counter off the carrier - holding that to within 65520..65920. So 25% duty
cycle, not the continuous beam assumed when the gap was shortened to 500us in
a96756033. Revert to the tag's real rate.
SimulateThinFilm() now waits on the previous frame start rather than delaying a
fixed amount, so the field poll comes out of the gap instead of adding on top of
it, and the period stays right if the poll cost ever changes. Measured back
with a second pm3 sniffing: 65561 carrier periods against the genuine tag's
65588, inside the tag's own jitter.
Rig: pm3 simulating, second pm3 sniffing, Pixel 9a reading, all three at once.
Builds clean for PM3RDV4 and PM5.
Co-Authored-By: Claude Opus 5 (1M context)