This project presents a system capable of capturing a passive tag's UID during a reader–tag interaction and retransmitting it to the reader with an extended operational range compared to standard RFID systems.
Low-frequency RFID systems operating at 125 kHz are widely used in various applications such as animal identification, access control and security systems, as well as facilities like pool or office entry keys. These systems rely on inductive coupling between a reader and a passive tag, where the reader generates a magnetic field that powers the tag, and the tag transmits its unique identifier (UID) using load modulation. A commonly used reader module in such systems is the RDM6300, which supports the EM4100 protocol. This protocol utilizes Manchester encoding and structured data frames to ensure reliable communication between the tag and the reader.
This project presents the design and implementation of a low-frequency RFID signal interception and emulation system based on the EM4100 protocol. The system was developed from discrete components and integrates both hardware and software design. A key aspect of the project was modifying the RDM6300 module to disable its transmission stage, allowing it to function as a passive sniffer that can capture tag IDs without interfering with the original communication.
The system operates in three main stages. In the first stage, the system performs sniffing by passively listening to the communication between a reader and a passive tag and capturing the transmitted UID. In the second stage the presence of a reader is detected using a rectifier circuit composed of a diode and capacitor, which senses the reader’s electromagnetic field as a sign to start transmitting the UID . In the third stage, the system transmits the captured ID back to the reader using active load modulation, implemented through a transistor that controls the antenna load.
An ESP32 microcontroller manages the data processing and signal generation, constructing a valid EM4100 frame and transmitting it using precise Manchester encoding. To enhance system performance, custom antenna coils were designed and built, followed by resonance tuning to optimize energy transfer.
Through iterative design and experimental optimization, the system achieved a communication range of approximately 17–18.5 cm, significantly exceeding the typical range of standard RFID systems. Overall, the project demonstrates a comprehensive approach combining theoretical understanding, circuit-level design, and embedded software implementation to realize a functional RFID interception and emulation system.
