Working With RFID Tags - An Introduction To The Proxmark3: Jonathan Westhues User Jwesthues, at Host CQ - CX
Working With RFID Tags - An Introduction To The Proxmark3: Jonathan Westhues User Jwesthues, at Host CQ - CX
Jonathan Westhues
user jwesthues, at host cq.cx
1 Overview
I intend this document as a brief introduction to my proxmark3 hardware. In
addition to this, I will try to describe the signal processing that this device must
perform. In concept this is the same correlation that any digital radio receiver
performs; some details are fundamentally specific to the kinds of signals involved
in an RFID system, and some are specific to my implementation.
The proxmark3 is a test instrument capable of manipulating RFID tags in
a number of different ways. For example, a proxmark3 can:
read almost any low-frequency (∼100 kHz) or high-frequency (13.56 MHz)
tag, including the ISO-standard tags;
emulate a low- or high-frequency tag, appearing almost indistinguishable
from a real tag; or
eavesdrop on the signals exchanged between another reader and tag
When the reader wants to receive a signal from the tag (whether we are read-
ing an ID-only tag, like a prox card, or whether we are expecting some response
that is a function of some message that we previously sent to a 13.56 MHz ISO-
standard tag), it transmits only the unmodulated carrier that powers the tag.
The tag transmits its message by alternately making the circuit across its an-
tenna look more like an open, or more like a short (or, equivalently, by changing
the resonant frequency of its antenna circuit, by disconnecting or reconnecting
some inductance or capacitance to the antenna; the reader ‘sees the tag more’
when the tag’s antenna resonates closer to the frequency of the energizing car-
rier).
The reader sees a lower voltage at its antenna when the tag’s antenna is
‘more shorted.’ This means that the tag can amplitude-modulate a subcarrier
onto the carrier transmitted by the reader, by varying the
It looks at the received signal on its antenna—possibly, but not necessarily,
the same antenna used to transmit—and demodulates this signal
1
In a sense, the circuit that interprets the signal returned from the tag is a
radio receiver like any other. The major peculiarity in this application is that
our transmitted carrier will always bleed through, because it is so much more
powerful than the information-bearing signal returned from the tag. We can
consider the signal at the reader’s antenna as having the form
v(t) = (Ac + vs (t))(cos ωc t) = Ac cos ωc t + vs (t) cos ωc t = vtx (t) + vrx (t)
2
(a) A ceramic or crystal filter is one practical implementation of this. The
filter could either be applied directly, at the carrier frequency, or at at some
IF after mixing the signal up or down. The frequency tolerance is tight enough
that passive RLC, switched-capacitor, or active (R, C, and opamp) filters are not
practical; but if the received signal is (b) mixed down by the carrier frequency,
then the carrier is translated to DC, and the notch filter becomes a low-pass,
which might be easier to implement. At that point only the dynamic range of
the mixer is an issue, and that is likely an easier problem to solve.
(c) Equivalently, we could try to measure Ac , and add in
−Ac cos ωc t
va (t) = Ac + vs (t)
less, because Ac depends on a number of factors, including things like the proximity of metal
objects to the reader.