Proxmark3 crystal oscillator offset
Measure how fast or slow your Proxmark3's 16 MHz crystal runs, against internet time.
- 1Connect
- 2Measure
- 3Result
Connect your Proxmark3
Plug your PM3 in to USB, not Bluetooth, and quit the pm3 client or anything else using it. This browser-based tool requires Chrome or Edge on a computer. See below for alternative options.
Keep this tab open in the foreground with the computer awake, stay on the same network, and leave the PM3's button alone.
starting
–Measuring needs the test firmware, which is Iceman master plus a command that reads the crystal-driven tick counter (source). Flash the test firmware with your own pm3 client, and flash your usual firmware back when you're done. Flashing the OS leaves the bootloader alone.
- PM3 Easy and other generic boards: hw-ticks-a8471ac1-pm3generic-fullimage.elf
- PM3 RDV4: hw-ticks-a8471ac1-pm3rdv4-fullimage.elf
./pm3-flash hw-ticks-a8471ac1-pm3generic-fullimage.elf
Run the command from your proxmark3 folder, with the image in that
folder. On an RDV4, use the RDV4 image's name.
pm3-flash finds the PM3's port itself. To go back, run
./pm3-flash-fullimage there as usual.
Measurement details
This computer relative to the time servers
About this plot
Each dot is one request to a time server and shows how far this computer's clock has moved relative to that server since the start of the run. The line only uses the fastest requests (blue for Akamai, orange for Cloudflare), and its slope shows the overall rate at which the computer's clock is moving away from internet time. A line falling 1 ms over 5 minutes means the computer's clock runs 3.3 ppm slow.
PM3 relative to this computer
About this plot
Each dot is one reading from the PM3's tick counter and shows how far the PM3's clock has moved relative to this computer since the start of the run. The slope shows how quickly the crystal is moving away from this computer's clock, and the scatter represents USB delays. The crystal's true offset (how fast or slow it runs in absolute terms) is this plot's slope plus the computer clock's slope from the other plot.
Command line (Python script)
pm3_crystal.py performs the same measurement using NTP. The script also needs the test firmware, and the pm3 client must be closed.
curl -LO https://mfcarroll.github.io/rfid-test-tools/proxmark3/crystal/pm3_crystal.py uv run pm3_crystal.py /dev/tty.usbmodemXXXX
uv installs pyserial automatically.
curl -LO https://mfcarroll.github.io/rfid-test-tools/proxmark3/crystal/pm3_crystal.py pipx run pm3_crystal.py /dev/tty.usbmodemXXXX
pipx installs pyserial automatically.
curl -LO https://mfcarroll.github.io/rfid-test-tools/proxmark3/crystal/pm3_crystal.py pip install pyserial python3 pm3_crystal.py /dev/tty.usbmodemXXXX
On macOS or Linux (on Linux the port is usually /dev/ttyACM0).
curl.exe -LO https://mfcarroll.github.io/rfid-test-tools/proxmark3/crystal/pm3_crystal.py py -m pip install pyserial py pm3_crystal.py COM5
In PowerShell or the Command Prompt.
Options
For developers
The test firmware adds CMD_HW_TICKS (0x011B) to the PM3's
protocol (branch feat/hw-ticks). The command reads the firmware's tick counter (TC0 and TC1
chained), which counts the master clock divided by 32. The PLL makes
the 48 MHz master clock from the crystal. The count therefore runs at
1.5 MHz. The 125 kHz LF carrier also comes from the crystal and is off
by the same ppm.
- The command takes one byte. 0 starts the count from zero, 1 reads the count, and 2 stops the tick counter.
- The reply is the count as a u32, little-endian. The count wraps every 47.7 minutes, and the page adds the wraps back.
- Other firmware commands use the same tick counter. The page sends no other command during a run, and stops a run whose count jumps.