RFID tags are all over the place.  They're used in building access control systems, passports, inventory tracking . . .   This instructable will show how you can use an Arduino and a few simple components (wire coil, transistor, capacitor, resistor) to make a device that can spoof an 125 KHz (low frequency) RFID tag.  This is version 1, so there are many enhancements that can be made, but this version is stupid simple, yet it works.  I did this in a few hours without much previous knowledge of RFID and without any fancy equipment (like a radio tuning hardware or an oscilloscope . . .I guess an oscilloscope is fancy, I need to pick up one of those).  

UPDATE: Here is a link to an Arduino Mini shield based on these instructions http://wiki.smallroom.net/doku.php?id=terd:projects:rfidspoofer . 

Step 1: Parts


*Some enamel coated solid core copper wire (I used the green spool from the 3 spool set Radio Shack carries).

*A NPN transistor, I used a 2N3904

*A 10 K Ohm Resistor

*A 10 nF capacitor (0.01 uF). I'm using a Metalized polyester film cap I got from Radio Shack, others should work though

*A toilet paper roll to wind the wire on

I tested my circuit using a Parallax RFID serial reader connected to a second Arduino
<p>So I was wondering how you came up with 133 windings around a toilet paper roll? It measures about 1.625&quot; in diameter, wire diameter is negligible, and using #26 wire (the green stuff, .0179&quot;), the calculator says about 68 windings. If it was close to your number I wouldn't ask, but they are not even remotely close. How did you come up with you number?</p>
<p>hi there thanks for the grate work i have a ? if you dont mind emailing me on systemcrash85@gmail.com i work for a company called armadale locksmiths </p>
<p>Also, these guys did it with a much smaller coil: http://wiki.smallroom.net/doku.php?id=terd:projects:rfidspoofer</p>
<p>Here is an arduino L/C/Freq meter that can help with calibration (like the PIC thing, but more readings &amp; also arduino-based) http://www.kerrywong.com/2010/10/16/avr-lc-meter-with-frequency-measurement/</p>
<p>This is neat but I can't get this code to work as-posted, it looks like the Manchester encoding is inverted from what it should be according to http://www.priority1design.com.au/em4100_protocol.html. (It damps the antenna when it should tune it and vice-versa.) If I change that it works fine with the cheap USB reader I've got. Maybe your reader is more accomodating than mine?</p>
<p>Is there a way to modify this to use it with 134.2khz tags?</p>
<p>I tried to make the circuit but for me it doesn't work. I used a coil from coilcraft (</p><p>4513TC-495XGLB ) with a 330 pF capacitor and a standard usb reader. </p><p>Can you help me with some adwice, please</p>
What does &quot;spoof&quot; mean? Forgive my ignorance. <br> <br>Don't bother, I went looking for it and found it in the Hacker's Dictionary: <br> <br>spoof vi. <br> <br> To capture, alter, and retransmit a communication stream in a way that misleads the recipient. As used by hackers, refers especially to altering TCP/IP packet source addresses or other packet-header data in order to masquerade as a trusted machine. This term has become very widespread and is borderline techspeak.
<p>It means &quot;To Protend to be something its not&quot; In this instance</p>
I have a related but similar question. Is it possible to hide the identifying information on an RFID card? Thanks in advance for any details you can provide!
I've just built this circuit and it works just fine, I was curious as to how you would go about calculating an actual RFID tag code for spoofing as well as the parity bits to go with? <br>I understand the code itself is in 10 binary segments each with a parity bit but I'm unsure on how to work out the parity for it. <br>
Check out step 3. Each hex number is represented by 4 binary digits then one even parity bit. In other words count how many of the 4 digits are 1s, if it's an even number the 5th bit is a 0, if it's odd then it's a one. Do the same for the column parity bits at the end, the but add up the ten columns.
Is it possible to replace the coil by an inductor of the same inductance? It has the same effects? <br>Thanks!
Can this be made to spoof transponder keys? I have a old ford that uses the ti transponder in the ignition. VAT bypass would cost me around 400$. If it could be done for under 100 with arduino it would be cool.
The only reason people would have something like those here in the US is that they were arrested for drunk driving. If you own the car, and are not REQUIRED to have the thing, why don't you just remove it? If you ARE required to have it, you could probably get in a lot of trouble for screwing around with it. I wouldn't, if I were you.
No, transponders don't work like this.
Hey! Looks like an awesome project, I'm planning to try it myself.<br><br>I don't have Radio Shack around here and don't want to order the wire set from them to Germany (shipping...). So I'm very, very interested in the wire's diameter (I'd love to see it in mm). Can you (or anyone else) tell me?<br><br>Thanks in advance!
I believe the green is 26 AWG.
Thank you very much!
Does the resistor value depend on the inductance or capacitance?
Also, I am using a Coilcraft .4mH transponder coil with a 4.05nF capacitor and I cannot even get the reader at school to recognize it, not even a rejection.<br><br>Any help?<br><br>Thanks
This would be a perfect project for the femtoduino, http://www.varesano.net/projects/hardware/Femtoduino. I could see this put along with a 3.7v lipoly 1s battery into a small tin and then just push the button to get it to spoof.
option(1) Yeap, I guess you could build a fake device/mod a stock one, which can either constantly transmit only 1's at the same signal shape, possibly emitting the signal at higher energy than the retail device or a signal pattern that makes the superposed bitstream invalid, or you could try to mod one to invert the pattern by inserting a simple NOT instruction in the microcode in order to have the logical negated signal / waveform cancelation (not sure how the term applies to squarewaves and not sure how the detector's edge detection method works). You could also make it self-powered to achieve a stronger transmission from your second device. <br>Or you can shield it around by mounting some sort of foil or other flexible metal mesh/sheet somehow onto the dog's skin. No better rapid ideas now :)<br><br>option(2): keep your dog at home/have your best friend doggysit him for the time you have to visit your boyfriend while cheating your rich CIA-employed husband ;)))
sketchsk3tch, nice job. But why delayMicroseconds() 256 instead of 208? 1/2400/2 = 208.3. I've tried it at 208 and it doesn't seem to work. It stops working for me at around a value of 215. I wonder if the Parallax is actually sending data at a slightly lower baud rate than 2400?
Ok, my bad. I assumed that because Parallax was emitting the serial data at 2400, the internal RFID part was also running at 2400. Googling seems to indicate that RF portion actually works at a slightly different rate as they are getting 64 cycles of the 128 kHz carrier together into a half bit.
do we have to change the circuit if we want to use bi-phase coding ?
&nbsp;I'm gonna make a shield for this!
Lol it could be the new line:<br>&quot;There's a shield for that!&quot;
LC METER Link, This will help with this project.<br><br>http://electronics-diy.com/lc_meter.php<br><br>Great Project! Love the simpleness here at Instructables!
Here is a Link for a Simple Meter that will help with this Process. It's an LC Meter it will Read VERY SMALL Amounts. <br>If you need to MAKE YOUR OWN COIL then this is the Meter for you.<br>Simple to Build Schematic and Instructions are located here:<br><br>http://electronics-diy.com/lc_meter.php <br><br>
Hi, nice work!!<br /> Now tell me, we could use some PIC or anyother device right?<br /> I wonder if we could use Bus Pirate + some script in Python or Perl?!?!?!?<br /> Thanks<br />
&nbsp;Anything that can power the transistor on and off with a 256 microsecond delay between them should work. &nbsp;So yeah, a PIC should work. &nbsp;I bet the Bus Pirate could as well. &nbsp;I've got one of those on order at Seeed, but I ordered it with their new logical analyzer so it won't ship until that does.
&nbsp;Shouldn't the sixth line &quot;11100&quot; be &quot;11101&quot;? &nbsp;(Zero-happy again? :-)<br /> <br />
&nbsp;You're right, thanks for pointing that out. &nbsp;It should be fixed now. &nbsp;Let me know if you notice anything else.
&nbsp;Or perhaps it should be &quot;11110&quot; to make the column party correct.
<a href="http://www.coilcraft.com/rfidind.cfm" rel="nofollow">Coilcraft</a> offers RFID transponder coils of different inductance and range. From inductance you can calculate the capacitor. They are much more compact than a TP-roll. Even smaller than an empty roll. ;-) They are not very expensive and Coilcraft supplies free samples.<br /> <br /> --<br /> Airspace V - international hangar flying!<br /> http://www.airspace-v.com/ggadgets for tools &amp; toys (MODIS&nbsp;image og the day will be repaired soon)<br />
&nbsp;Which Arduino board are you using? Or rather, which would be the most appropriate for this application on a budget? Thanks in advance<br /> --<br /> IBurn
&nbsp;That's an Arduino Duemilanove (ATmega 328). They're about $30 from SparkFun, $35 from the Makershed. If you wanted something cheaper, you could get an arduino clone of some kind, like the boarduino ($18?), but they get a little more complicated. You'll probably do best with a Duemilanove. Good luck.
Thank you for this! I've been looking all over for an Arduino based RFID spoofer, and now here it is! <br />
Normally, to peek people interest, it is recommended to put the video on the main page. Because that video is a resumer of your entire instructable.<br /> <br /> Also in your video, a better view of your computer screen would of been nice.<br /> A video of the screen capture (Camstudio)&nbsp; at the same time of the video would of been nicer.<br /> More work in the editing but that would of ensure more views on youtube and instructables.<br /> <br /> <br /> Keep it up, I like the idea.<br />
Isn't 10 nano farads .01 micro farads not .001?<br />
&nbsp;Thanks takatomon, you're right, I got 0 happy it looks like.

About This Instructable




More by sketchsk3tch:Moosetar (Zoltar) Fortune Teller Facebook Wall Robot Kid's Game to Arduino Enigma Machine 
Add instructable to: