Continue to Site

# 125kHz RFID Reader and Huge Field Antenna

Status
Not open for further replies.

#### Hordeus

##### New Member
Hello everyone
I'm working this circuit for a weeks.
But i can't seem to understand full details and it's working since i'm almost newbie to Radio Communications.
So i have few questions on this circuit.
2.Is it possible to change antenna to 1.5m diameter antenna?

The coil and capacitor must be resonant at 125KHz.

If you change the dimensions of the coil, you change the inductance; a larger coil will need less turns to give the same inductance.

The other problem is simply the power level; the circuit drives the coil with enough power for it to work when the card is within a couple of inches from the coil; I cannot see it working effectively with a very large coil - the coupling to the card (which contains a resonant coil circuit) would be very weak and the energy returned from the card weaker still, to the point of not being detectable with such a simple circuit.

The coil in a normal card reader and coil in the card act as a transformer when the two similar size coils are close together; the close spacing also means it's natural to present the card flat-on to the reader

A card could have any orientation relative to a massive 1.5m coiI. I would not say that long distance reading is impossible, but I'm about 99.999% sure that simple fixed-threshold reader would not work.

For reference the formula for resonant frequency of a capacitor and inductor tuned circuit is:
1 / (2 x pi x square root (L x C))

L is in henries, C is in farads.

The formulas for working out the inductance of a coil from physical dimensions are rather more complex and I can never remember those...

When reading a card, the "transformer effect" between the two coils, the reader and the card, passes power to activate the electronics in the card.
To send the card serial number back to the reader, the electronics in the card switch a load (eg. a resistor) in and out of circuit to change the amount of power drawn through the transformer on a cycle-by-cycle basis and that affects the voltage on the transformer coil in the reader - as in picture 4 & 5 in your link.

Edit - the wikipedia article here has pictures of a proximity card that's been cracked apart.
You can see the coil in it that makes up the other half of the "transformer" when that is close to the correct reader coil:

Edit 2:
If you just want to make a reader to experiment with, you would probably be better off with one of these:

They are a ready built module which has a HTRC110 rfid reader IC plus a microcontroller to manage it.

All you need is the antenna coil, power and something to read the serial data the module sends out.

Data on the reader IC that uses, for reference - but you do not need to know anything about how this works to use the complete module. It's likely far more sensitive than the design you have.

Last edited:
Thanks for your help. I really appreciate you help.
Do you think is it possible to attach huge antenna to this chip?
And can i possibly connect with you later through some chat?

Yes, you can connect a large coil if you can work out or find by trial and error a coil of the same inductance.

Whether it would work to read a card is another matter, it's not a standard application with that type of device.

Doing a quick experiment with an online coil inductance calculator, 11 turns of 1mm diameter wire at 1.5m diameter is around 470uH

You would either have to adjust the diameter or use the lower value and add capacitance to get it resonant.
However, whatever you use to support the coil would also have some effect on the tuning, so you really need an oscilloscope to set it up.
Start with too many turns then remove one at a time. If resonance gets too high, add a capacitor to set it exactly.

Whether it would read a card or not and how critical the card orientation would be if it did, are other things again.
eg. If the coil was vertical and the card was flat or on edge, rather than being in the same plane, it seems unlikely to work even if it works with the card upright.

You may also want to take a look at this Wiki ... https://en.wikipedia.org/wiki/Resonant_inductive_coupling

Without changing the original circuit, you can introduce a larger coil "tuned" to 125kHz to increase your sensitivity.

I collaborated with a friend of mine who is a Pen tester (Security Penetration Tester) to build an RFID radio in 2014 using a similar method of inductive coupling/lensing to exploit the vulnerability of RFID on a business or hotel door reader.

I was a speaker in Las Vegas BSides and again at IWS-7. ( Information Warfare Summit ) involving long range RFID sniffing where we were able to achieve 15 feet from a passive 125kHz RFID tag. This particular approach is different and more of a security problem than just reading a tag by close proximity. What we are doing different, is listening to the "door reader" when a tag is brought towards it during normal access reads. During this stage, when the tag is modulating the door reader, the door reader becomes a radio transmitter that we can pick off at a considerable distance. Audibly we can "hear" the signal a good 25 or more feet away, however the noise floor is great enough we can't decipher it just yet ( more R&D required ) unless we are closer ,,, more like 10-15 feet. Keep in mind our detector coil was only about 2 inches in diameter. The real security problem here is that no matter what, we can "see" BOTH sides of the negotiation, meaning that the supposed smart RFID cards that require any kind of handshaking can be broken using this technique or similar. The fact that we were doing this with 125kHz tags is irrelevant, and for the presentation was just proof of concept. This same technique can be applied to any RFID tag.

Status
Not open for further replies.