Antennas
Connecting the Proxmark3 to an antenna
The proxmark supports two loop antennas that are each used to transmit and receive. One is used for LF (125kHz and 134kHz frequencies) and another for HF (13.56MHz). A homegrown antenna does not have to connect through the Hirose connector and can be soldered directly to the test points TP2 through TP5.
Hirose pinout
The figure below shows which Hirose connector pins connect to which test point:
High frequency antenna
High frequency coils should be connected between TP3 and TP4 either on the Hirose connector or soldered direct to the test points. A standard 13.56MHz coil is usually made out of about 4 turns of enamel wire and the coil diameter is about 5 cm. The coil can be circular but deforming it into a rectangular shape can help tune it closer to the desired frequency. It is preferrable to use a distance between 0.2 and 0.4 inches (0.5 - 1.0 cm) between HF tags and this kind of antenna.
The tune command can be used to verify that the antenna is tuned properly. For a High frequency antenna, it should return a value over 10 Volts in the HF coil; if lower, interaction with HF tags may be incorrect. Remember that smaller tags (smaller than a plastic credit-card-size tag) may require a smaller antenna.
Low frequency antenna
Low frequency coils should be connected between TP2 and TP5 either on the Hirose connector or soldered direct to the test points. A standard 125kHz coil is made of around a hundred turns of thin enamel wire (preferably 0.1 mm).
The tune command should return a value of over 20 Volts for a properly tuned antenna but it should not exceed 45 Volts; if lower, interaction with LF tags may be incorrect.
Antenna examples
Roel’s HF Hirose antenna
This antenna design uses a standard Hirose mini USB cable to make a neat and cheap High Frequency (HF) antenna for all 13.56MHz modulations (MIFARE, Felica,etc.).
The antenna forms a LC circuit with proxmark3's C35 capacitor.
- Proxmark3.com C35 = 47pF
- CCC PM3 C35 = 47 pF
This design works best when C35 is a 47pF capacitor, but some proxmark3 boards are known to have 100pF capacitors. If you have a 100pF capacitor, the inductance of L will need to be lower than the antenna of this design creates. The formula for calculating the proper value of L given a known frequency (F) and capacitor value (C) is F=1/(2pisqrt(L*C)).
In the picture below you see a Hirose connector; there are multiple mini-USB cables available on the market, so make sure you buy the correct one. The unit I received has the one showed below but there are units with the other connector too so check your proxmark3 female receptacle before buying it:
Anyway the right one (the one marked with "wrong") should work with both female configuration.
- First you have to strip the cable.
- You can cut of the USB side ; we do not need this part.
- Make sure the total size of the cable is bigger than 80 cm.
- After cutting the cable you make an incision at 6.5 cm and remove the insulation.
- Do the same to the shielding that is underneath the plastic insulation. You will see 4 wires appear in different colors.
- We do not need the red and white wire for a HF antenna. Those are for connecting a LF antenna. So cut away the shielding, red and white wire.
- We have left, the connector and 2 wires, black and green, which are at least 80 cm.
- Cut the green wire at 19 cm from the connector and strip it a bit.
- Cut the black wire at 76 cm from the connector and strip it a bit.
- Make an antenna coil by, winding the black cable 3x, then solder the black cable end to the green cable end.
Plug it into the Proxmark and you should get an antenna with 12V+.
You can even optimize this value by adjusting the length of the wires. Note that small changes (1 cm) can already have a big impact. If you found out better values than we describe, please drop a note so we update this manual.
D18c7db's LF Antenna
Take an old CD case and cut four rectangles out of it by using a ruler and a box cutter. Scour a line on the CD case and bend along it so the CD case snaps along the line, this is similar to cutting glass.
- Two of the cut rectangles are the size of the proxmark3 PCB 80x50mm while the other two rectangles are 70x40mm.
- Epoxy the two smaller rectangles together
- Then epoxy the resulting block between the larger two rectangles in the approximate centre as in the picture below. This makes up the coil former with a groove approximately 5mm deep and 2mm wide.
- Use 40AWG / 0.125mm enamelled wire to built a coil
- The theory for a rectangular multilayer coil 40x70mm with a coil cross-section of 2x1mm comes out with 107 turns so I started with 120 turns as in the picture below.
- REPEAT - Hook it up to a hirose cable by soldering / connecting the two ends to each of the red & white wires
- Test the antenna with
hw tune - If the optimal frequency is not between 125 - 134 KHz
- un-connect the hirose
- remove a single coil
- goto repeat...
- note: I found removing 8-9 coils did the trick
- The enamelled wire is quite fragile, consider taping the enamelled wire ends, and the hirose cable against the antenna with electrical tape.
- Hopefully you should have a 38v+ LF antenna
LF antenna
For this I used:
- 0.25mm enamel wire
- The thinnest I could find locally
- a USB socket
- ...stolen from an old PC case
- an old (empty) wire reel
- Inner diameter was 25mm, outer diameter was 55mm
- The label said it originally came with 25ft of 22AWG wire.
The USB socket should be wired as follows:
+-----------+
| |
| XXXXXXXXX | -- plastic section
| 1 2 3 4 | -- pins
| |
+-----------+
- Pin 1: TP3 (HF antenna)
- Pin 2: TP4 (HF antenna)
- Pin 3: TP2 (LF antenna)
- Pin 4: TP5 (LF antenna)
As this is only an LF antenna, only Pin 3 and 4 are connected. You could get fancy and also setup some coils for HF operation, but I already bought a HF antenna board.
I started out by creating the coil with 100 turns of enamel wire. I then hooked it up to the PM3, and ran hw tune:
# LF antenna: 6.74 V @ 125.00 kHz
# LF antenna: 6.60 V @ 134.00 kHz
# LF optimal: 44.41 V @ 250.00 kHz
RF coils for dummies: when the optimal frequency is too high, you need more wire. When the optimal frequency is too low, you need less wire. The antenna might sometimes still work, even if it is outside the target of 20-45v.
In my coil, I didn't have enough turns of wire, because the LF optimal frequency was too high. I could sometimes read LF cards with this antenna, but it was not reliable. I needed to double the length of wire, because the optimal frequency was twice as high as it should be.
I added another 110 turns of enamel wire (for 210 turns total), joining it to the previous piece of wire I had cut. I then ran hw tune again and got a much better result:
# LF antenna: 30.39 V @ 125.00 kHz
# LF antenna: 44.27 V @ 134.00 kHz
# LF optimal: 44.27 V @ 127.66 kHz
The range I was aiming for was 20-45v on both 125 kHz and 134 kHz frequencies, and this antenna hit the sweet spot. I could have made the LF antenna slightly longer, but for 125 kHz tags it was very reliable.
I printed some plastic pieces to shroud the USB port and reinforce each end of the wire reel. And then, I had a good antenna! 😄
Antenna Building tips
Those various tips were taken from forum posts :
From http://www.proxmark.org/forum/viewtopic.php?id=122
Glad to see someone else is still working with the antennas ! I’ve had decent results with my 50 ohm antennas without much additional matching, only tuning of parallel RLC circuits. One that seems to work particularly well and is small was a RR-IDISC-ANT4-3-A from Digi-key (though kind of pricey). It gave read ranges of about 3 cm.
I also made up some antennas using copper tape and a few trimmer caps. This seemed to work almost as well and was a lot cheaper. With larger loops I could get 3 - 4 cm. I made a fixture for the PM3 that attaches an SMA connector to the test points. That way I could attach my homemade antennas (which also have SMA connectors) via coax. This avoids the TL effects and allows the antenna to be located pretty far away from the device.
Either way you’ll probably have to tune the antennas slightly (or tune the PM3 by changing C35/C36), but you should get it to work. The RR antenna has a trimmer cap so that is nice. From http://www.proxmark.org/forum/viewtopic.php?id=90 : very good description of how to build a home-made antenna.
Here are some HF and LF homemade antennas examples:
Antenna and tag orientation
From proxmark.org/forum/viewtopic.php?id=119
What works for me is the plane of the PM3 antenna is right next to the plane of the RFID card but the long side of the RFID card is rotated about 45 degrees relative to the long side of the antenna. If you look here at the first two pictures, where the green wire rectangle is the PM3 antenna you get an idea of the setup.
Where to buy
If you don't feel comfortable to build it yourselves you can find some already-made solutions in the following links:
Read store-reviews here: Market / Trade section of forum
List of shops on proxmark.org site here: List of shops