diff --git a/appveyor.yml b/appveyor.yml
index a97a65276..240724d80 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -1,5 +1,5 @@
 version: 3.0.1.{build}
-image: Visual Studio 2017
+image: Visual Studio 2019
 clone_folder: C:\ProxSpace\pm3
 init:
 - ps: >-
@@ -7,7 +7,6 @@ init:
 
     #Get-ChildItem Env:
 
-
     $releasename=""
 
     $env:APPVEYOR_REPO_COMMIT_SHORT = $env:APPVEYOR_REPO_COMMIT.Substring(0, 8)
@@ -23,11 +22,12 @@ init:
 
     Add-AppveyorMessage -Message "[$env:APPVEYOR_REPO_COMMIT_SHORT]$env:appveyor_repo_name($env:APPVEYOR_REPO_BRANCH)" -Category Information -Details "repository: $env:appveyor_repo_name branch: $env:APPVEYOR_REPO_BRANCH release: $releasename"
 
-
     # iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
 clone_script:
 - ps: >-
     Write-Host "Removing ProxSpace..." -NoNewLine
+    
+    $CloneTime=[System.Environment]::TickCount
 
     cd \
 
@@ -152,24 +152,15 @@ clone_script:
  
     ExecUpdate "update2"  "C:\ProxSpace\msys2\msys2_shell.cmd -mingw32 -defterm -no-start /dev/null"  "terminate?MSYS2"
     
+    Add-AppveyorMessage -Message "ProxSpace download and update took $(([System.Environment]::TickCount-$CloneTime) / 1000) sec" -Category Information
+    
     Write-Host "Update " -NoNewLine
     
     Write-Host "[ OK ]" -ForegroundColor Green
 install:
-- ps: >-
-    function Exec-External {
-              param(
-                [Parameter(Position=0,Mandatory=1)][scriptblock] $command
-              )
-              & $command
-              if ($LASTEXITCODE -ne 0) {
-                throw ("Command returned non-zero error-code ${LASTEXITCODE}: $command")
-              }
-            }
 build_script:
 - ps: >-
-    "C:\ProxSpace\msys2\usr\bin;C:\ProxSpace\msys2\mingw32\bin;C:\ProxSpace\gcc-arm-none-eabi\bin;$env:Path"
-
+    $env:Path="C:\ProxSpace\msys2\usr\bin;C:\ProxSpace\msys2\mingw32\bin;C:\ProxSpace\gcc-arm-none-eabi\bin;c:\Python38;c:\Python38\Scripts;$env:Path"
 
     $env:MINGW_HOME="C:\ProxSpace\msys2\mingw32"
 
@@ -185,9 +176,13 @@ build_script:
 
     cd C:\ProxSpace\pm3
 
+    Write-Host "---------- make ----------" -ForegroundColor Yellow
+    
+    $TestTime=[System.Environment]::TickCount
+
     #make
 
-    bash -c -i 'pwd;make clean;make V=1'
+    bash -c -i 'echo $PATH;pwd;make clean;make V=1'
 
 
     #some checks
@@ -198,206 +193,75 @@ build_script:
 
     }
 
-    if(!(Test-Path C:\ProxSpace\pm3\armsrc\obj\fullimage.elf)){
+    cd c:\ProxSpace\pm3
 
-    throw "ARM file fullimage.elf not exists."
+    bash -c -i 'make check'
 
+    $testspass = ($LASTEXITCODE -eq 0)
+    
+    $global:TestsPassed=$testspass
+
+    if ($testspass) {
+      Add-AppveyorTest -Name "make Tests" -Framework NUnit -Filename "make check" -Outcome Passed -Duration "$([System.Environment]::TickCount-$TestTime)"
+      Write-Host "make Tests [ OK ]" -ForegroundColor Green
+    } else {
+      Add-AppveyorTest -Name "make Tests" -Framework NUnit -Filename "make check" -Outcome Failed -Duration "$([System.Environment]::TickCount-$TestTime)"
+      Write-Host "make Tests [ ERROR ]" -ForegroundColor Red
+      throw "Tests error."
     }
+    
+    Write-Host "---------- btaddon ----------" -ForegroundColor Yellow
+    
+    $TestTime=[System.Environment]::TickCount
 
-    if(!(Test-Path C:\ProxSpace\pm3\client\resources\hardnested_tables\*.bin.bz2)){
-
-    throw "Files in client\resources\hardnested_tables is not exists."
-
-    }
-
-
-    #install
-
-    Write-Host "Installing..." -NoNewLine -ForegroundColor Yellow
-
-    New-Item -ItemType Directory -Force -Path C:\ProxSpace\pm3\Release\bin
-
-    bash -c -i 'make install DESTDIR=Release PREFIX='
-
-    # dll files
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\libgcc_s_dw2-1.dll C:\ProxSpace\pm3\Release\bin
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\libstdc++-6.dll C:\ProxSpace\pm3\Release\bin
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\libwinpthread-1.dll C:\ProxSpace\pm3\Release\bin
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\Qt5Core.dll C:\ProxSpace\pm3\Release\bin
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\Qt5Gui.dll C:\ProxSpace\pm3\Release\bin
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\Qt5Widgets.dll C:\ProxSpace\pm3\Release\bin
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\libreadline*.dll C:\ProxSpace\pm3\Release\bin
-
-    Copy-Item C:\ProxSpace\msys2\mingw32\bin\libtermcap-0.dll C:\ProxSpace\pm3\Release\bin
-
-    Write-Host "[ OK ]" -ForegroundColor Green
-
-
-    #archive and push
-
-    $releasename=""
-
-    if ($env:appveyor_repo_tag -match "true"){
-
-    $releasename=$env:APPVEYOR_REPO_TAG_NAME + "/"
-
-    }
-
-    $releasename+=$env:APPVEYOR_BUILD_VERSION + " [" + $env:APPVEYOR_REPO_COMMIT.Substring(0, 7) + "]"
-
-
-    Write-Host "Archive and publish release files ($releasename)..." -NoNewLine -ForegroundColor Yellow
-
-    cd C:\ProxSpace
-
-    7z a release.zip C:\ProxSpace\pm3\Release
-
-    Push-AppveyorArtifact release.zip -DeploymentName "$releasename"
-
-    Write-Host "[ OK ]" -ForegroundColor Green
-
-
-    Write-Host "Builded..." -ForegroundColor Yellow
-test_script:
-- ps: >-
-    $env:Path = "C:\ProxSpace\msys\bin;$env:Path"
+    bash -c -i 'pwd;make clean;make PLATFORM_EXTRAS=BTADDON'
 
     cd c:\ProxSpace\pm3
 
+    bash -c -i 'make check'
 
-    $global:TestsPassed=$true
+    $testspass = ($LASTEXITCODE -eq 0)
 
-
-    Function ExecTest($Name, $File, $Cmd, $CheckResult) {
+    $global:TestsPassed=(($global:TestsPassed) -and ($testspass))
     
-    #--- begin Job
-
-    $Job = Start-Job -ScriptBlock {
-      [bool]$res=$false
-      $TestTime=[System.Environment]::TickCount
-      $env:Path = "C:\ProxSpace\msys\bin;$env:Path"
-      Set-Location $using:PWD
-
-      $sb=[scriptblock]::Create("$using:Cmd")
-      #execute scriptblock
-      Write-host "Test [$using:Name] job: $using:Cmd"
-      $Cond=&$sb
-
-      if ($Cond -eq $null){
-      } ElseIf($using:CheckResult -ne $null) {
-        [String]$searchstr=""
-        if ($Cond -is [Object]){
-          ForEach($line in $Cond){
-            Write-host $line -ForegroundColor Gray
-            $searchstr += $line
-          }
-        }else{
-          Write-host "$Cond" -ForegroundColor Gray
-          $searchstr = $Cond
-        }
-        If($searchstr -like "*$using:CheckResult*") {
-          $res=$true
-        }
-        $Cond="*$using:CheckResult*"
-      } Else {
-        If (!($Cond -is [bool] -or $Cond -is [byte] -or $Cond -is [int16] -or $Cond -is [int32] -or $Cond -is [int64] -or $Cond -is [float])){
-            if ($Cond -is "String" -and $Cond -like "*passed*"){
-              $res= $true
-            }
-            if ($Cond -is "String" -and $Cond -like "*true*"){
-              $res= $true
-            }
-            ForEach($line in $Cond){
-              if ($line -like "*passed*"){
-                $res = $true
-                $Cond = $line
-                break
-              }
-            }
-        } Else {
-          $res=$Cond
-        }
-      }
-
-      If ($res) {
-        Write-host "Result[$using:Name]: $Cond" -ForegroundColor Green
-        Add-AppveyorTest -Name "$using:Name" -Framework NUnit -Filename "$using:File" -Outcome Passed -Duration "$([System.Environment]::TickCount-$TestTime)"
-      }Else {
-        Write-host "Result[$using:Name]: $Cond" -ForegroundColor Red
-        Add-AppveyorTest -Name "$using:Name" -Framework NUnit -Filename "$using:File" -Outcome Failed -Duration "$([System.Environment]::TickCount-$TestTime)" -ErrorMessage "command:$using:Cmd`nresult:$Cond"
-      }
-        return $res
+    if ($testspass) {
+      Add-AppveyorTest -Name "BTaddon Tests" -Framework NUnit -Filename "make check" -Outcome Passed -Duration "$([System.Environment]::TickCount-$TestTime)"
+      Write-Host "BTaddon Tests [ OK ]" -ForegroundColor Green
+    } else {
+      Add-AppveyorTest -Name "BTaddon Tests" -Framework NUnit -Filename "make check" -Outcome Failed -Duration "$([System.Environment]::TickCount-$TestTime)"
+      Write-Host "BTaddon Tests [ ERROR ]" -ForegroundColor Red
     }
+    
+    Write-Host "---------- make clean ----------" -ForegroundColor Yellow
+    
+    bash -c -i 'make clean'
+    
+    Write-Host "---------- cmake ----------" -ForegroundColor Yellow
+    
+    $TestTime=[System.Environment]::TickCount
 
-    #--- end Job
+    cmd.exe /c 'C:\ProxSpace\msys2\msys2_shell.cmd -mingw32 -defterm -no-start -c "mkdir -p client/build; cd client/build; cmake -G""MSYS Makefiles"" ..; make VERBOSE=1;"'
+    
+    Write-Host "---------- cmake tests ----------" -ForegroundColor Yellow
 
-      [bool]$res=$false
-      # Wait 180 sec timeout for Job
-      if(Wait-Job $Job -Timeout 180){
-        $Results = $Job | Receive-Job
-        if($Results -like "true"){
-          $res=$true
-        }
-      } else {
-        Write-host "Test [$Name] timeout" -ForegroundColor Red
-        Add-AppveyorTest -Name "$Name" -Framework NUnit -Filename "$File" -Outcome Failed -Duration 60000 -ErrorMessage "timeout"
-      }
-      Remove-Job -Force $Job
+    cd c:\ProxSpace\pm3
 
-      if(!$res){
-      Write-host "--------------------- tests fail" -ForegroundColor Red
-        $global:TestsPassed=$false
-      }
+    bash -c -i './tools/pm3_tests.sh --clientbin client/build/proxmark3.exe client'
+    
+    $testspass = ($LASTEXITCODE -eq 0)
+
+    $global:TestsPassed=(($global:TestsPassed) -and ($testspass))
+    
+    if ($testspass) {
+      Add-AppveyorTest -Name "cmake Tests" -Framework NUnit -Filename "make client/check" -Outcome Passed -Duration "$([System.Environment]::TickCount-$TestTime)"
+      Write-Host "cmake Tests [ OK ]" -ForegroundColor Green
+    } else {
+      Add-AppveyorTest -Name "cmake Tests" -Framework NUnit -Filename "make client/check" -Outcome Failed -Duration "$([System.Environment]::TickCount-$TestTime)"
+      Write-Host "cmake Tests [ ERROR ]" -ForegroundColor Red
     }
-
-
-    Write-Host "Running tests..." -ForegroundColor Yellow
-
-
-    #file test
-
-    ExecTest "proxmark3 exists" "proxmark3.exe" {Test-Path C:\ProxSpace\pm3\Release\bin\proxmark3.exe}
-
-    ExecTest "arm bootrom exists" "bootrom.elf" {Test-Path C:\ProxSpace\pm3\Release\share\proxmark3\firmware\bootrom.elf}
-
-    ExecTest "arm image exists" "fullimage.elf" {Test-Path C:\ProxSpace\pm3\Release\share\proxmark3\firmware\fullimage.elf}
-
-    ExecTest "arm recovery image exists" "proxmark3_recovery.bin" {Test-Path C:\ProxSpace\pm3\Release\share\proxmark3\firmware\proxmark3_recovery.bin}
-
-    ExecTest "hardnested tables exists" "hardnested" {Test-Path C:\ProxSpace\pm3\Release\share\proxmark3\resources\hardnested_tables\*.bz2}
-
-    ExecTest "release exists" "release.zip" {Test-Path C:\ProxSpace\release.zip}
-
-
-    #proxmark logic tests
-
-    ExecTest "proxmark help" "proxmark3 -h" {bash -lc 'cd ~/client;./proxmark3 -h 2>&1 | grep -q wait && echo passed || echo failed'}
-
-    ExecTest "proxmark help text ISO7816" "proxmark3 -t" {bash -lc 'cd ~/client;./proxmark3 -t 2>&1 | grep -q ISO7816 && echo passed || echo failed'}
-
-    ExecTest "proxmark help text hardnested" "proxmark3 -t" {bash -lc 'cd ~/client;./proxmark3 -t 2>&1 | grep -q hardnested && echo passed || echo failed'}
-
-
-    ExecTest "hf mf offline text" "hf mf" {bash -lc "cd ~/client;./proxmark3 -c 'hf mf'"} "at_enc"
-
-    #proxmark crypto tests
-
-    # Long tests:
-    #    ExecTest "hf mf hardnested" "hf mf hardnested" {bash -lc "cd ~/client;./proxmark3 -c 'hf mf hardnested t 1 000000000000'"} "found:"
-    #    ExecTest "hf mf iclass" "hf mf iclass" {bash -lc "cd ~/client;./proxmark3 -c 'hf iclass loclass t l'"} "verified ok"
-    #    ExecTest "emv test" "emv test" {bash -lc "cd ~/client;./proxmark3 -c 'emv test -i -l'"} "Test?s? ? OK"
-    # Short tests:
-    ExecTest "hf mf iclass" "hf mf iclass" {bash -lc "cd ~/client;./proxmark3 -c 'hf iclass loclass t'"} "OK!"
-    ExecTest "emv test" "emv test" {bash -lc "cd ~/client;./proxmark3 -c 'emv test -i'"} "Test?s? ? OK"
-
-
+    
+test_script:
+- ps: >-
     if ($global:TestsPassed) {
       Write-Host "Tests [ OK ]" -ForegroundColor Green
     } else {
@@ -409,4 +273,4 @@ on_success:
 on_failure:
 - ps: Write-Host "Build error." -ForegroundColor Red
 on_finish:
-- ps: # $blockRdp = $false; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
+- ps: # $blockRdp = $true; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
diff --git a/armsrc/BigBuf.c b/armsrc/BigBuf.c
index 6d272f571..f41801a26 100644
--- a/armsrc/BigBuf.c
+++ b/armsrc/BigBuf.c
@@ -19,7 +19,7 @@ extern uint8_t _stack_start, __bss_end__;
 // BigBuf is the large multi-purpose buffer, typically used to hold A/D samples or traces.
 // Also used to hold various smaller buffers and the Mifare Emulator Memory.
 // We know that bss is aligned to 4 bytes.
-static uint8_t* BigBuf = &__bss_end__;
+static uint8_t *BigBuf = &__bss_end__;
 
 /* BigBuf memory layout:
 Pointer to highest available memory: BigBuf_hi
diff --git a/armsrc/Standalone/lf_em4100rswb.c b/armsrc/Standalone/lf_em4100rswb.c
index ac470ce29..b1a246e28 100644
--- a/armsrc/Standalone/lf_em4100rswb.c
+++ b/armsrc/Standalone/lf_em4100rswb.c
@@ -256,7 +256,7 @@ static int ExecuteMode(int mode, int slot) {
         //default first mode is simulate
         case LF_RWSB_MODE_READ:
             Dbprintf("[=] >>  Read mode started  <<");
-            CmdEM410xdemod(1, &high[slot], &low[slot], 0);
+            CmdEM410xdemod(1, &high[slot], &low[slot]);
             LED_Update(mode, slot);
             Dbprintf("[=] >>  Tag found. Saving. <<");
             FlashLEDs(100, 5);
diff --git a/armsrc/Standalone/lf_em4100rwc.c b/armsrc/Standalone/lf_em4100rwc.c
index f69820513..0ae7e7444 100644
--- a/armsrc/Standalone/lf_em4100rwc.c
+++ b/armsrc/Standalone/lf_em4100rwc.c
@@ -161,7 +161,7 @@ void RunMod(void) {
                     state = 3;
                 } else if (button_pressed == BUTTON_SINGLE_CLICK) {
                     // Click - exit to select mode
-                    CmdEM410xdemod(1, &high[selected], &low[selected], 0);
+                    CmdEM410xdemod(1, &high[selected], &low[selected]);
                     FlashLEDs(100, 5);
 #ifdef WITH_FLASH
                     SaveIDtoFlash(selected, low[selected]);
diff --git a/armsrc/Standalone/lf_icehid.c b/armsrc/Standalone/lf_icehid.c
index 7ac91d126..d125b0c03 100644
--- a/armsrc/Standalone/lf_icehid.c
+++ b/armsrc/Standalone/lf_icehid.c
@@ -231,7 +231,8 @@ static uint32_t IceHIDDemod(void) {
     uint32_t hi2 = 0, hi = 0, lo = 0;
 
     // large enough to catch 2 sequences of largest format
-    size_t size = 50 * 128 * 2;  // 12800 bytes
+//    size_t size = 50 * 128 * 2;  // 12800 bytes
+    size_t size = MIN(12800, BigBuf_max_traceLen());
     //uint8_t *dest = BigBuf_malloc(size);
     uint8_t *dest = BigBuf_get_addr();
 
@@ -350,30 +351,32 @@ void RunMod(void) {
 
         uint32_t res;
 
-        // since we steal  12800 from bigbuffer, no need to sample it.
-        DoAcquisition_config(false, 28000);
+        // since we steal 12800 from bigbuffer, no need to sample it.
+        size_t size = MIN(28000, BigBuf_max_traceLen());
+        DoAcquisition_config(false, size);
         res = IceHIDDemod();
         if (res == PM3_SUCCESS) {
             LED_A_OFF();
             continue;
         }
 
-        DoAcquisition_config(false, 28000);
+        DoAcquisition_config(false, size);
         res = IceAWIDdemod();
         if (res == PM3_SUCCESS) {
             LED_A_OFF();
             continue;
         }
 
-        DoAcquisition_config(false, 20000);
-        res = IceEM410xdemod();
+        DoAcquisition_config(false, size);
+        res = IceIOdemod();
         if (res == PM3_SUCCESS) {
             LED_A_OFF();
             continue;
         }
 
-        DoAcquisition_config(false, 28000);
-        res = IceIOdemod();
+        size = MIN(20000, BigBuf_max_traceLen());
+        DoAcquisition_config(false, size);
+        res = IceEM410xdemod();
         if (res == PM3_SUCCESS) {
             LED_A_OFF();
             continue;
diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 81c6a233a..ad02eae2f 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -243,6 +243,16 @@ static uint32_t MeasureAntennaTuningLfData(void) {
     return (MAX_ADC_LF_VOLTAGE * (SumAdc(ADC_CHAN_LF, 32) >> 1)) >> 14;
 }
 
+void print_stack_usage(void) {
+    // pointer arithmetic is times 4. (two shifts to the left)
+    for (uint32_t *p = &_stack_start; ; ++p) {
+        if (*p != 0xdeadbeef) {
+            Dbprintf("  Max stack usage.........%d / %d bytes", (&_stack_end - p) << 2, (&_stack_end - &_stack_start) << 2);
+            break;
+        }
+    }
+}
+
 void ReadMem(int addr) {
     const uint8_t *data = ((uint8_t *)addr);
 
@@ -362,13 +372,9 @@ static void SendStatus(void) {
 #endif
     printConnSpeed();
     DbpString(_CYAN_("Various"));
-    // pointer arithmetic is times 4. (two shifts to the left)
-    for (uint32_t *p = &_stack_start; ; ++p) {
-        if (*p != 0xdeadbeef) {
-            Dbprintf("  Max stack usage.........%d / %d bytes", (&_stack_end - p) << 2, (&_stack_end - &_stack_start) << 2);
-            break;
-        }
-    }
+
+    print_stack_usage();
+
     Dbprintf("  DBGLEVEL................%d", DBGLEVEL);
     Dbprintf("  ToSendMax...............%d", ToSendMax);
     Dbprintf("  ToSendBit...............%d", ToSendBit);
@@ -784,9 +790,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             reply_mix(CMD_ACK, bits, 0, 0, 0, 0);
             break;
         }
-        case CMD_LF_HID_DEMOD: {
+        case CMD_LF_HID_WATCH: {
             uint32_t high, low;
-            CmdHIDdemodFSK(0, &high, &low, 1);
+            int res = lf_hid_watch(0, &high, &low);
+            reply_ng(CMD_LF_HID_WATCH, res, NULL, 0);            
             break;
         }
         case CMD_LF_HID_SIMULATE: {
@@ -818,19 +825,29 @@ static void PacketReceived(PacketCommandNG *packet) {
             CopyHIDtoT55x7(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes[0]);
             break;
         }
-        case CMD_LF_IO_DEMOD: {
+        case CMD_LF_IO_WATCH: {
             uint32_t high, low;
-            CmdIOdemodFSK(0, &high, &low, 1);
+            int res = lf_io_watch(0, &high, &low);
+            reply_ng(CMD_LF_IO_WATCH, res, NULL, 0);
             break;
         }
-        case CMD_LF_EM410X_DEMOD: {
+        case CMD_LF_EM410X_WATCH: {
             uint32_t high;
             uint64_t low;
-            CmdEM410xdemod(packet->oldarg[0], &high, &low, 1);
+            int res = lf_em410x_watch(0, &high, &low);
+            reply_ng(CMD_LF_EM410X_WATCH, res, NULL, 0);
             break;
         }
         case CMD_LF_EM410X_WRITE: {
-            WriteEM410x(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2]);
+            struct p {
+                uint8_t card;
+                uint8_t clock;
+                uint32_t high;
+                uint32_t low;
+            } PACKED;
+            struct p *payload = (struct p *)packet->data.asBytes;
+            int res = copy_em410x_to_t55xx(payload->card, payload->clock, payload->high, payload->low);
+            reply_ng(CMD_LF_EM410X_WRITE, res, NULL, 0);
             break;
         }
         case CMD_LF_TI_READ: {
@@ -932,10 +949,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             EM4xWriteWord(payload->address, payload->data, payload->password, payload->usepwd);
             break;
         }
-        case CMD_LF_AWID_DEMOD:  {
+        case CMD_LF_AWID_WATCH:  {
             uint32_t high, low;
-            // Set realtime AWID demodulation
-            CmdAWIDdemodFSK(0, &high, &low, 1);
+            int res = lf_awid_watch(0, &high, &low);
+            reply_ng(CMD_LF_AWID_WATCH, res, NULL, 0);
             break;
         }
         case CMD_LF_VIKING_CLONE: {
@@ -1431,7 +1448,20 @@ static void PacketReceived(PacketCommandNG *packet) {
 
 #ifdef WITH_HFSNIFF
         case CMD_HF_SNIFF: {
-            HfSniff(packet->oldarg[0], packet->oldarg[1]);
+            struct p {
+                uint32_t samplesToSkip;
+                uint32_t triggersToSkip;
+            } PACKED;
+            struct p *payload = (struct p *)packet->data.asBytes;
+
+            uint16_t len = 0;
+            int res = HfSniff(payload->samplesToSkip, payload->triggersToSkip, &len);
+
+            struct {
+                uint16_t len;
+            } PACKED retval;
+            retval.len = len;
+            reply_ng(CMD_HF_SNIFF, res, (uint8_t *)&retval, sizeof(retval));
             break;
         }
 #endif
@@ -2087,10 +2117,10 @@ void  __attribute__((noreturn)) AppMain(void) {
     SpinDelay(100);
     BigBuf_initialize();
 
-    for (uint32_t * p = &_stack_start; p < (uint32_t *)((uintptr_t)&_stack_end - 0x200); ++p) {
+    for (uint32_t *p = &_stack_start; p < (uint32_t *)((uintptr_t)&_stack_end - 0x200); ++p) {
         *p = 0xdeadbeef;
     }
-    
+
     if (common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
         /* Initialize common area */
         memset(&common_area, 0, sizeof(common_area));
@@ -2157,7 +2187,9 @@ void  __attribute__((noreturn)) AppMain(void) {
         WDT_HIT();
 
         if (_stack_start != 0xdeadbeef) {
-            Dbprintf("Stack overflow detected! Please increase stack size.");
+            Dbprintf("Stack overflow detected! Please increase stack size, currently %d bytes", (&_stack_end - &_stack_start) << 2);
+            Dbprintf("Unplug your device now.");
+            while (1);
         }
 
         // Check if there is a packet available
diff --git a/armsrc/appmain.h b/armsrc/appmain.h
index 6a650f163..594723983 100644
--- a/armsrc/appmain.h
+++ b/armsrc/appmain.h
@@ -39,5 +39,6 @@ void ToSendReset(void);
 void ListenReaderField(uint8_t limit);
 void StandAloneMode(void);
 void printStandAloneModes(void);
+void print_stack_usage(void);
 
 #endif
diff --git a/armsrc/hfsnoop.c b/armsrc/hfsnoop.c
index 770280b9b..177a1f99e 100644
--- a/armsrc/hfsnoop.c
+++ b/armsrc/hfsnoop.c
@@ -18,29 +18,21 @@
 #include "appmain.h"
 #include "cmd.h"
 
-static void RAMFUNC optimizedSniff(void) {
-    int n = BigBuf_max_traceLen() / sizeof(uint16_t); // take all memory
-
-    uint16_t *dest = (uint16_t *)BigBuf_get_addr();
-    uint16_t *destend = dest + n - 1;
-
-    // Reading data loop
-    while (dest <= destend) {
+static void RAMFUNC optimizedSniff(uint16_t *dest, uint16_t dsize) {
+    while (dsize > 0) {
         if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
             *dest = (uint16_t)(AT91C_BASE_SSC->SSC_RHR);
             dest++;
+            dsize -= sizeof(dsize);
         }
     }
-    //setting tracelen - important!  it was set by buffer overflow before
-    set_tracelen(BigBuf_max_traceLen());
 }
 
-void HfSniff(int samplesToSkip, int triggersToSkip) {
+int HfSniff(uint32_t samplesToSkip, uint32_t triggersToSkip, uint16_t *len) {
     BigBuf_free();
-    BigBuf_Clear();
+    BigBuf_Clear_ext(false);
 
-    Dbprintf("Skipping first %d sample pairs, Skipping %d triggers.\n", samplesToSkip, triggersToSkip);
-    int trigger_cnt = 0;
+    Dbprintf("Skipping first %d sample pairs, Skipping %d triggers", samplesToSkip, triggersToSkip);
 
     LED_D_ON();
 
@@ -57,37 +49,68 @@ void HfSniff(int samplesToSkip, int triggersToSkip) {
     FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SNOOP);
     SpinDelay(100);
 
-    uint16_t r = 0;
-    while (!BUTTON_PRESS() && !data_available()) {
+    *len = (BigBuf_max_traceLen() & 0xFFFE);
+    uint8_t *mem = BigBuf_malloc(*len);
+
+    uint32_t trigger_cnt = 0;    
+    uint16_t r = 0, interval = 0;
+
+    bool pressed = false;
+    while (pressed == false) {
         WDT_HIT();
 
+        // cancel w usb command.
+        if (interval == 2000) {
+            if (data_available())
+                break;
+
+            interval = 0;
+        } else {
+            interval++;
+        }
+
+        // check if trigger is reached
         if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
             r = (uint16_t)AT91C_BASE_SSC->SSC_RHR;
-            r = MAX(r & 0xff, r >> 8);
-            if (r >= 180) {  // 0xB4 ??
-                if (++trigger_cnt > triggersToSkip)
+
+            r = MAX(r & 0xFF, r >> 8);
+
+            // 180 (0xB4) arbitary value to see if a strong RF field is near.
+            if (r > 180) {
+               
+                if (++trigger_cnt > triggersToSkip) {
                     break;
+                }
             }
         }
+
+        pressed = BUTTON_PRESS();
     }
 
-    if (!BUTTON_PRESS()) {
-        int waitcount = samplesToSkip; // lets wait 40000 ticks of pck0
-        while (waitcount != 0) {
+    if (pressed == false) {
 
-            if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY))
-                waitcount--;
+        // skip samples loop
+        while (samplesToSkip != 0) {
+
+            if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
+                samplesToSkip--;
+            }
+        }
+
+        optimizedSniff((uint16_t*)mem, *len);
+
+        if (DBGLEVEL >= DBG_INFO)   {
+            Dbprintf("Trigger kicked in (%d >= 180)", r);
+            Dbprintf("Collected %u samples", *len);
         }
-        optimizedSniff();
-        Dbprintf("Trigger kicked! Value: %d, Dumping Samples Hispeed now.", r);
     }
 
     //Resetting Frame mode (First set in fpgaloader.c)
     AT91C_BASE_SSC->SSC_RFMR = SSC_FRAME_MODE_BITS_IN_WORD(8) | AT91C_SSC_MSBF | SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
-
-    DbpString("HF Sniffing end");
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     LED_D_OFF();
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    BigBuf_free();
+    return (pressed) ? PM3_EOPABORTED : PM3_SUCCESS;
 }
 
 void HfPlotDownload(void) {
diff --git a/armsrc/hfsnoop.h b/armsrc/hfsnoop.h
index 049536940..8ed263fa5 100644
--- a/armsrc/hfsnoop.h
+++ b/armsrc/hfsnoop.h
@@ -12,6 +12,8 @@
 #ifndef __HFSNOOP_H
 #define __HFSNOOP_H
 
-void HfSniff(int, int);
+#include "proxmark3_arm.h"
+
+int HfSniff(uint32_t samplesToSkip, uint32_t triggersToSkip, uint16_t *len);
 void HfPlotDownload(void);
 #endif
diff --git a/armsrc/i2c.c b/armsrc/i2c.c
index 82b4fdb10..23ae07f10 100644
--- a/armsrc/i2c.c
+++ b/armsrc/i2c.c
@@ -47,7 +47,7 @@ static void __attribute__((optimize("O0"))) I2CSpinDelayClk(uint16_t delay) {
 #define I2C_DELAY_2CLK    I2CSpinDelayClk(2)
 #define I2C_DELAY_XCLK(x) I2CSpinDelayClk((x))
 
-#define I2C_DELAY_100us   I2CSpinDelayClk( 100 / 3) 
+#define I2C_DELAY_100us   I2CSpinDelayClk( 100 / 3)
 #define I2C_DELAY_600us   I2CSpinDelayClk( 600 / 3)
 #define I2C_DELAY_10ms    I2CSpinDelayClk( 10 * 1000 / 3 )
 #define I2C_DELAY_30ms    I2CSpinDelayClk( 30 * 1000 / 3 )
@@ -440,7 +440,7 @@ int16_t I2C_BufferRead(uint8_t *data, uint8_t len, uint8_t device_cmd, uint8_t d
 
     // extra wait  500us (514us measured)
     // 200us  (xx measured)
-//    WaitUS(600);    
+//    WaitUS(600);
     I2C_DELAY_600us;
 
     bool bBreak = true;
diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index fd146c23e..3b7b096a4 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -889,7 +889,7 @@ bool prepare_tag_modulation(tag_response_info_t *response_info, size_t max_buffe
 
     // Make sure we do not exceed the free buffer space
     if (ToSendMax > max_buffer_size) {
-        Dbprintf("Out of memory, when modulating bits for tag answer:");
+        Dbprintf("ToSend buffer, Out-of-bound, when modulating bits for tag answer:");
         Dbhexdump(response_info->response_n, response_info->response, false);
         return false;
     }
@@ -988,7 +988,7 @@ bool SimulateIso14443aInit(int tagType, int flags, uint8_t *data, tag_response_i
                 counters[i] = le24toh(mfu_header->counter_tearing[i]);
 
                 if (mfu_header->counter_tearing[i][3] != 0x00) {
-                    tearings[i] = mfu_header->counter_tearing[i][3]; 
+                    tearings[i] = mfu_header->counter_tearing[i][3];
                 }
             }
 
@@ -2027,13 +2027,6 @@ int EmSendPrecompiledCmd(tag_response_info_t *p_response) {
                LastTimeProxToAirStart * 16 + DELAY_ARM2AIR_AS_TAG,
                (LastTimeProxToAirStart + p_response->ProxToAirDuration) * 16 + DELAY_ARM2AIR_AS_TAG,
                par);
-
-    if (DBGLEVEL >= DBG_EXTENDED) {
-        Dbprintf("response_info->response %02X", p_response->response);
-        Dbprintf("response_info->response_n %02X", p_response->response_n);
-        Dbprintf("response_info->par %02X", &(p_response->par));
-    }
-
     return ret;
 }
 
diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 03c6c5164..7e907da09 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -171,7 +171,7 @@ t55xx_configurations_t T55xx_Timing  = {
 #define T55XX_LONGLEADINGREFERENCE 4 // Value to tell Write Bit to send long reference
 
 // ATA55xx shared presets & routines
-static uint32_t GetT55xxClockBit(uint32_t clock) {
+static uint32_t GetT55xxClockBit(uint8_t clock) {
     switch (clock) {
         case 128:
             return T55x7_BITRATE_RF_128;
@@ -1224,32 +1224,52 @@ void CmdNRZsimTAG(uint8_t invert, uint8_t separator, uint8_t clk, uint16_t size,
 }
 
 // loop to get raw HID waveform then FSK demodulate the TAG ID from it
-void CmdHIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol) {
-    uint8_t *dest = BigBuf_get_addr();
+int lf_hid_watch(int findone, uint32_t *high, uint32_t *low) {
+
     size_t size;
     uint32_t hi2 = 0, hi = 0, lo = 0;
     int dummyIdx = 0;
     // Configure to go in 125kHz listen mode
     LFSetupFPGAForADC(LF_DIVISOR_125, true);
 
+    uint8_t *dest = BigBuf_get_addr();
+    BigBuf_Clear_keep_EM();
+    clear_trace();
+    set_tracing(false);
+
     //clear read buffer
     BigBuf_Clear_keep_EM();
 
-    while (!BUTTON_PRESS() && !data_available()) {
+    int res = PM3_SUCCESS;
+    uint16_t interval = 0;
+    while (BUTTON_PRESS() == false) {
 
         WDT_HIT();
-        if (ledcontrol) LED_A_ON();
+                 
+        // cancel w usb command.
+        if (interval == 4000) {
+            if (data_available()) {
+                res = PM3_EOPABORTED;
+                break;
+            }
+            interval = 0;
+        } else {
+            interval++;
+        }
 
         DoAcquisition_default(-1, false);
+
         // FSK demodulator
-        size = 50 * 128 * 2; //big enough to catch 2 sequences of largest format
+        // 50 * 128 * 2 - big enough to catch 2 sequences of largest format
+        size = MIN(12800, BigBuf_max_traceLen());
+        
         int idx = HIDdemodFSK(dest, &size, &hi2, &hi, &lo, &dummyIdx);
         if (idx < 0) continue;
 
         if (idx > 0 && lo > 0 && (size == 96 || size == 192)) {
             // go over previously decoded manchester data and decode into usable tag ID
             if (hi2 != 0) { //extra large HID tags  88/192 bits
-                Dbprintf("TAG ID: %x%08x%08x (%d)",
+                Dbprintf("TAG ID: " _GREEN_("%x%08x%08x") " (%d)",
                          hi2,
                          hi,
                          lo,
@@ -1311,25 +1331,40 @@ void CmdHIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol)
         hi2 = hi = lo = idx = 0;
     }
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    DbpString("HID fsk demod stopped");
-    if (ledcontrol) LED_A_OFF();
+    BigBuf_free();
+    LEDsoff();
+    return res;
 }
 
 // loop to get raw HID waveform then FSK demodulate the TAG ID from it
-void CmdAWIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol) {
+int lf_awid_watch(int findone, uint32_t *high, uint32_t *low) {
 
-    uint8_t *dest = BigBuf_get_addr();
     size_t size;
     int dummyIdx = 0;
 
+    uint8_t *dest = BigBuf_get_addr();
     BigBuf_Clear_keep_EM();
+    clear_trace();
+    set_tracing(false);
 
     LFSetupFPGAForADC(LF_DIVISOR_125, true);
 
-    while (!BUTTON_PRESS() && !data_available()) {
+    int res = PM3_SUCCESS;
+    uint16_t interval = 0;
+    while (BUTTON_PRESS() == false) {
 
         WDT_HIT();
-        if (ledcontrol) LED_A_ON();
+         
+        // cancel w usb command.
+        if (interval == 4000) {
+            if (data_available()) {
+                res = PM3_EOPABORTED;
+                break;
+            }
+            interval = 0;
+        } else {
+            interval++;
+        }
 
         DoAcquisition_default(-1, false);
         // FSK demodulator
@@ -1380,20 +1415,19 @@ void CmdAWIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol)
             uint32_t fac = bytebits_to_byte(dest + 9, 8);
             uint32_t cardnum = bytebits_to_byte(dest + 17, 16);
             uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen);
-            Dbprintf("AWID Found - BitLength: %d, FC: %d, Card: %d - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, fac, cardnum, code1, rawHi2, rawHi, rawLo);
+            Dbprintf("AWID Found - Bit length: " _GREEN_("%d") ", FC: " _GREEN_("%d") ", Card: " _GREEN_("%d") " - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, fac, cardnum, code1, rawHi2, rawHi, rawLo);
         } else {
             uint32_t cardnum = bytebits_to_byte(dest + 8 + (fmtLen - 17), 16);
             if (fmtLen > 32) {
                 uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen - 32);
                 uint32_t code2 = bytebits_to_byte(dest + 8 + (fmtLen - 32), 32);
-                Dbprintf("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x%08x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo);
+                Dbprintf("AWID Found - Bit length: " _GREEN_("%d") " -unknown bit length- (%d) - Wiegand: %x%08x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo);
             } else {
                 uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen);
-                Dbprintf("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo);
+                Dbprintf("AWID Found - Bit length: " _GREEN_("%d") " -unknown bit length- (%d) - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo);
             }
         }
         if (findone) {
-            if (ledcontrol) LED_A_OFF();
             *high = rawHi;
             *low = rawLo;
             break;
@@ -1401,26 +1435,40 @@ void CmdAWIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol)
     }
 
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    DbpString("AWID fsk demod stopped");
-    if (ledcontrol) LED_A_OFF();
+    BigBuf_free();
+    LEDsoff();
+    return res;
 }
 
-void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol) {
-    uint8_t *dest = BigBuf_get_addr();
+int lf_em410x_watch(int findone, uint32_t *high, uint64_t *low) {
 
     size_t size, idx = 0;
     int clk = 0, invert = 0, maxErr = 20;
     uint32_t hi = 0;
     uint64_t lo = 0;
 
+    uint8_t *dest = BigBuf_get_addr();
+    clear_trace();
+    set_tracing(false);
     BigBuf_Clear_keep_EM();
 
     LFSetupFPGAForADC(LF_DIVISOR_125, true);
 
-    while (!BUTTON_PRESS() && !data_available()) {
-
+    int res = PM3_SUCCESS;
+    uint16_t interval = 0;
+    while (BUTTON_PRESS() == false) {
         WDT_HIT();
-        if (ledcontrol) LED_A_ON();
+
+        // cancel w usb command.
+        if (interval == 4000) {
+            if (data_available()) {
+                res = PM3_EOPABORTED;
+                break;
+            }
+            interval = 0;
+        } else {
+            interval++;
+        }
 
         DoAcquisition_default(-1, false);
 
@@ -1428,14 +1476,14 @@ void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol)
 
         //askdemod and manchester decode
         int errCnt = askdemod(dest, &size, &clk, &invert, maxErr, 0, 1);
-        WDT_HIT();
-
         if (errCnt > 50) continue;
 
+        WDT_HIT();
+
         errCnt = Em410xDecode(dest, &size, &idx, &hi, &lo);
         if (errCnt == 1) {
             if (size == 128) {
-                Dbprintf("EM XL TAG ID: %06x%08x%08x - (%05d_%03d_%08d)",
+                Dbprintf("EM XL TAG ID: " _GREEN_("%06x%08x%08x") " - ( %05d_%03d_%08d )",
                          hi,
                          (uint32_t)(lo >> 32),
                          (uint32_t)lo,
@@ -1443,7 +1491,7 @@ void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol)
                          (uint32_t)((lo >> 16LL) & 0xFF),
                          (uint32_t)(lo & 0xFFFFFF));
             } else {
-                Dbprintf("EM TAG ID: %02x%08x - (%05d_%03d_%08d)",
+                Dbprintf("EM TAG ID: " _GREEN_("%02x%08x") " - ( %05d_%03d_%08d )",
                          (uint32_t)(lo >> 32),
                          (uint32_t)lo,
                          (uint32_t)(lo & 0xFFFF),
@@ -1452,7 +1500,6 @@ void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol)
             }
 
             if (findone) {
-                if (ledcontrol) LED_A_OFF();
                 *high = hi;
                 *low = lo;
                 break;
@@ -1463,33 +1510,46 @@ void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol)
     }
 
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    DbpString("EM man/ask demod stopped");
-    if (ledcontrol) LED_A_OFF();
+    BigBuf_free();
+    LEDsoff();
+    return res;
 }
 
-void CmdIOdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol) {
-
-    uint8_t *dest = BigBuf_get_addr();
+int lf_io_watch(int findone, uint32_t *high, uint32_t *low) {
 
     int dummyIdx = 0;
     uint32_t code = 0, code2 = 0;
-    uint8_t version = 0, facilitycode = 0, crc = 0;
-    uint16_t number = 0, calccrc = 0;
-
-    size_t size = BigBuf_max_traceLen();
+    uint8_t version = 0, facilitycode = 0;
+    uint16_t number = 0;
 
+    uint8_t *dest = BigBuf_get_addr();
     BigBuf_Clear_keep_EM();
+    clear_trace();
+    set_tracing(false);
 
     // Configure to go in 125kHz listen mode
     LFSetupFPGAForADC(LF_DIVISOR_125, true);
 
-    while (!BUTTON_PRESS() && !data_available()) {
+    int res = PM3_SUCCESS;
+    uint16_t interval = 0;
+    while (BUTTON_PRESS() == false) {
+
         WDT_HIT();
-        if (ledcontrol) LED_A_ON();
+         
+        // cancel w usb command.
+        if (interval == 4000) {
+            if (data_available()) {
+                res = PM3_EOPABORTED;
+                break;
+            }
+            interval = 0;
+        } else {
+            interval++;
+        }
 
         DoAcquisition_default(-1, false);
 
-        size = MIN(12000, BigBuf_max_traceLen());
+        size_t size = MIN(12000, BigBuf_max_traceLen());
 
         //fskdemod and get start index
         int idx = detectIOProx(dest, &size, &dummyIdx);
@@ -1529,18 +1589,9 @@ void CmdIOdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol) {
         facilitycode = bytebits_to_byte(dest + idx + 18, 8);
         number = (bytebits_to_byte(dest + idx + 36, 8) << 8) | (bytebits_to_byte(dest + idx + 45, 8)); //36,9
 
-        crc = bytebits_to_byte(dest + idx + 54, 8);
-        for (uint8_t i = 1; i < 6; ++i)
-            calccrc += bytebits_to_byte(dest + idx + 9 * i, 8);
-        calccrc &= 0xff;
-        calccrc = 0xff - calccrc;
+        Dbprintf("IO Prox " _GREEN_("XSF(%02d)%02x:%05d") " (%08x%08x) (%s)", version, facilitycode, number, code, code2);
 
-        const char *crcStr = (crc == calccrc) ? "ok" : "!crc";
-
-        Dbprintf("IO Prox XSF(%02d)%02x:%05d (%08x%08x)  [%02x %s]", version, facilitycode, number, code, code2, crc, crcStr);
-        // if we're only looking for one tag
         if (findone) {
-            if (ledcontrol) LED_A_OFF();
             *high = code;
             *low = code2;
             break;
@@ -1548,12 +1599,11 @@ void CmdIOdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol) {
         code = code2 = 0;
         version = facilitycode = 0;
         number = 0;
-        calccrc = 0;
     }
-
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    DbpString("IOProx fsk demod stopped");
-    if (ledcontrol) LED_A_OFF();
+    BigBuf_free();
+    LEDsoff();
+    return res;
 }
 
 /*------------------------------
@@ -2006,12 +2056,12 @@ void T55xx_ChkPwds(uint8_t flags) {
 
     DbpString("[+] T55XX Check pwds using flashmemory starting");
 
-    uint8_t ret = 0;
     // First get baseline and setup LF mode.
     // tends to mess up BigBuf
-    uint8_t  *buf           = BigBuf_get_addr();
-    uint32_t b1, baseline   = 0;
-    uint8_t  downlink_mode  = (flags >> 3) & 0x03;
+    uint8_t *buf = BigBuf_get_addr();
+    uint8_t ret = 0;
+    uint8_t downlink_mode = (flags >> 3) & 0x03;
+    uint32_t b1, baseline = 0;
 
     // collect baseline for failed attempt
     uint8_t x = 32;
@@ -2190,17 +2240,26 @@ void CopyVikingtoT55xx(uint8_t *blocks, uint8_t Q5) {
     reply_ng(CMD_LF_VIKING_CLONE, PM3_SUCCESS, NULL, 0);
 }
 
+int copy_em410x_to_t55xx(uint8_t card, uint8_t clock, uint32_t id_hi, uint32_t id_lo) {
+
 // Define 9bit header for EM410x tags
 #define EM410X_HEADER    0x1FF
 #define EM410X_ID_LENGTH 40
 
-void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo) {
+    uint32_t clockbits = 0;
+    if (card == 1) { //t55x7
+        clockbits = GetT55xxClockBit(clock);
+        if (clockbits == 0) {
+            Dbprintf("Invalid clock rate: %d", clock);
+            return PM3_EINVARG;
+        }
+    }
+
     int i;
     uint64_t id = EM410X_HEADER;
     uint64_t rev_id = 0; // reversed ID
     int c_parity[4];     // column parity
     int r_parity = 0;    // row parity
-    uint32_t clock = 0;
 
     // Reverse ID bits given as parameter (for simpler operations)
     for (i = 0; i < EM410X_ID_LENGTH; ++i) {
@@ -2250,33 +2309,29 @@ void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo) {
     // Add stop bit
     id <<= 1;
 
-    Dbprintf("Started writing %s tag ...", card ? "T55x7" : "T5555");
     LED_D_ON();
 
     // Write EM410x ID
     uint32_t data[] = {0, (uint32_t)(id >> 32), (uint32_t)(id & 0xFFFFFFFF)};
 
-    clock = (card & 0xFF00) >> 8;
+    // default to 64
     clock = (clock == 0) ? 64 : clock;
     Dbprintf("Clock rate: %d", clock);
-    if (card & 0xFF) { //t55x7
-        clock = GetT55xxClockBit(clock);
-        if (clock == 0) {
-            Dbprintf("Invalid clock rate: %d", clock);
-            return;
-        }
-        data[0] = clock | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT);
-    } else { //t5555 (Q5)
+
+    if (card == 1) { // T55x7
+        data[0] = clockbits | T55x7_MODULATION_MANCHESTER | (2 << T55x7_MAXBLOCK_SHIFT);
+    } else { // T5555 (Q5)
         data[0] = T5555_SET_BITRATE(clock) | T5555_MODULATION_MANCHESTER | (2 << T5555_MAXBLOCK_SHIFT);
     }
 
     WriteT55xx(data, 0, 3);
 
-    LED_D_OFF();
+    LEDsoff();
     Dbprintf("Tag %s written with 0x%08x%08x\n",
              card ? "T55x7" : "T5555",
              (uint32_t)(id >> 32),
              (uint32_t)id);
+    return PM3_SUCCESS;
 }
 
 //-----------------------------------
diff --git a/armsrc/lfops.h b/armsrc/lfops.h
index eb31e54a6..2d76bef48 100644
--- a/armsrc/lfops.h
+++ b/armsrc/lfops.h
@@ -35,13 +35,17 @@ void CmdASKsimTAG(uint8_t encoding, uint8_t invert, uint8_t separator, uint8_t c
 void CmdPSKsimTAG(uint8_t carrier, uint8_t invert, uint8_t clk, uint16_t size, uint8_t *bits, bool ledcontrol);
 void CmdNRZsimTAG(uint8_t invert, uint8_t separator, uint8_t clk, uint16_t size, uint8_t *bits, bool ledcontrol);
 
-void CmdHIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol);
-void CmdAWIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol); // Realtime demodulation mode for AWID26
-void CmdEM410xdemod(int findone, uint32_t *high, uint64_t *low, int ledcontrol);
-void CmdIOdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol);
+int lf_hid_watch(int findone, uint32_t *high, uint32_t *low);
+int lf_awid_watch(int findone, uint32_t *high, uint32_t *low); // Realtime demodulation mode for AWID26
+int lf_em410x_watch(int findone, uint32_t *high, uint64_t *low);
+int lf_io_watch(int findone, uint32_t *high, uint32_t *low);
+
 void CopyHIDtoT55x7(uint32_t hi2, uint32_t hi, uint32_t lo, uint8_t longFMT); // Clone an HID card to T5557/T5567
+
 void CopyVikingtoT55xx(uint8_t *blocks, uint8_t Q5);
-void WriteEM410x(uint32_t card, uint32_t id_hi, uint32_t id_lo);
+
+int copy_em410x_to_t55xx(uint8_t card, uint8_t clock, uint32_t id_hi, uint32_t id_lo);
+
 void T55xxResetRead(uint8_t flags);
 //id T55xxWriteBlock(uint32_t data, uint8_t blockno, uint32_t pwd, uint8_t flags);
 void T55xxWriteBlock(uint8_t *data);
diff --git a/armsrc/lfsampling.c b/armsrc/lfsampling.c
index f74101573..40ad29f93 100644
--- a/armsrc/lfsampling.c
+++ b/armsrc/lfsampling.c
@@ -132,6 +132,8 @@ void initSampleBufferEx(uint32_t *sample_size, bool use_malloc) {
     } else {
         if (*sample_size == 0) {
             *sample_size = BigBuf_max_traceLen();
+        } else {
+            *sample_size = MIN(*sample_size, BigBuf_max_traceLen());
         }
         data.buffer = BigBuf_get_addr();
     }
@@ -256,11 +258,11 @@ uint32_t DoAcquisition(uint8_t decimation, uint8_t bits_per_sample, bool avg, in
     uint32_t cancel_counter = 0;
     int16_t checked = 0;
 
-    while (!BUTTON_PRESS()) {
+    while (BUTTON_PRESS() == false) {
 
         // only every 1000th times, in order to save time when collecting samples.
         // interruptible only when logging not yet triggered
-        if ((checked == 1000) && (trigger_threshold > 0)) {
+        if ((checked == 2000) && (trigger_threshold > 0)) {
             if (data_available()) {
                 checked = -1;
                 break;
@@ -273,7 +275,6 @@ uint32_t DoAcquisition(uint8_t decimation, uint8_t bits_per_sample, bool avg, in
         WDT_HIT();
 
         if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
-//			AT91C_BASE_SSC->SSC_THR = 0x43;
             LED_D_ON();
         }
 
diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index 16860aeae..2850053e6 100644
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -1,3 +1,9 @@
+# Usage:
+#  mkdir build
+#  cd build
+#  cmake ..     (see below for options)
+#  make         (VERBOSE=1 if needed)
+#
 # MINGW:
 #  On ProxSpace 3.4:
 #    cmake -G"MSYS Makefiles" ..
@@ -5,7 +11,7 @@
 #    pacman -S mingw-w64-x86_64-cmake
 #    /mingw64/bin/cmake -G"MSYS Makefiles" ..
 #
-# Android cross-compilation:
+# Android cross-compilation: (ANDROID_ABI=arm64-v8a for a 64b version)
 # cmake \
 #    -DCMAKE_TOOLCHAIN_FILE=<path-to-your-android-ndk>/build/cmake/android.toolchain.cmake \
 #    -DANDROID_ABI=armeabi-v7a \
@@ -20,6 +26,8 @@ if(CMAKE_VERSION VERSION_LESS "3.7.0")
     set(CMAKE_INCLUDE_CURRENT_DIR ON)
 endif()
 
+find_package(PkgConfig)
+
 if (NOT SKIPQT EQUAL 1)
     if(APPLE AND EXISTS /usr/local/opt/qt5)
         # Homebrew installs Qt5 (up to at least 5.11.0) in
@@ -46,7 +54,6 @@ if (NOT SKIPQT EQUAL 1)
     endforeach()
 endif (NOT SKIPQT EQUAL 1)
 
-find_package(PkgConfig)
 if (NOT SKIPBT EQUAL 1)
     pkg_search_module(BLUEZ QUIET bluez)
 endif (NOT SKIPBT EQUAL 1)
@@ -58,7 +65,7 @@ endif (NOT SKIPPYTHON EQUAL 1)
 
 # If build on android cross, we need to init source and build.
 if (ANDROID)
-    set(CFLAGS_EXTERNAL_LIB CFLAGS=--target=${CMAKE_C_COMPILER_TARGET})
+    set(CFLAGS_EXTERNAL_LIB "CFLAGS=--target=${CMAKE_C_COMPILER_TARGET} -w")
     include(ExternalProject)
 endif (ANDROID)
 
@@ -72,9 +79,9 @@ if (NOT SKIPREADLINE EQUAL 1)
             URL                   http://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.0.tar.gz
             PREFIX                deps/ncurses
             DOWNLOAD_DIR          ${CMAKE_CURRENT_SOURCE_DIR}/deps/ncurses
-            CONFIGURE_COMMAND     ./configure CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} LD=${CMAKE_C_COMPILER} AR=${CMAKE_AR} RANLIB=${CMAKE_RANLIB} ${CFLAGS_EXTERNAL_LIB} --host=arm
+            CONFIGURE_COMMAND     ./configure CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} LD=${CMAKE_C_COMPILER} AR=${CMAKE_AR} RANLIB=${CMAKE_RANLIB} ${CFLAGS_EXTERNAL_LIB} --host=arm --disable-database  --with-fallbacks=ansi-generic,ansi-mini,color_xterm,dtterm,dumb,Eterm,Eterm-256color,Eterm-88color,eterm-color,gnome,gnome-256color,guru,hurd,iTerm.app,konsole,konsole-16color,konsole-256color,konsole-base,konsole-linux,konsole-solaris,konsole-vt100,kterm,kterm-color,linux,linux-16color,linux-basic,mac,mlterm,mlterm-256color,mrxvt,mrxvt-256color,mterm,mterm-ansi,mvterm,nsterm,nsterm-16color,nsterm-256color,pty,putty,putty-256color,putty-vt100,rxvt,rxvt-16color,rxvt-256color,rxvt-88color,rxvt-basic,rxvt-color,screen,screen-16color,screen-256color,simpleterm,st-16color,st-256color,st52,st52-color,stv52,tt,tt52,unknown,vt100,vt102,vte,vte-256color,xterm,xterm-16color,xterm-256color,xterm-88color,xterm-basic,xterm-bold,xterm-color,xterm-utf8,xterm-vt220,xterm-vt52,xterm1,xtermc,xtermm   --enable-termcap --without-ada --without-debug --without-dlsym --without-gpm --without-develop --without-tests --without-cxx-binding --with-termlib
             BUILD_IN_SOURCE       ON
-            BUILD_COMMAND         make -j2 libs
+            BUILD_COMMAND         make libs
             INSTALL_COMMAND       ""
             LOG_DOWNLOAD          ON
         )
@@ -86,13 +93,13 @@ if (NOT SKIPREADLINE EQUAL 1)
             DOWNLOAD_DIR          ${CMAKE_CURRENT_SOURCE_DIR}/deps/readline
             CONFIGURE_COMMAND     ./configure CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} LD=${CMAKE_C_COMPILER} AR=${CMAKE_AR} RANLIB=${CMAKE_RANLIB} ${CFLAGS_EXTERNAL_LIB} --host=arm --enable-static
             BUILD_IN_SOURCE       ON
-            BUILD_COMMAND         make -j2
+            BUILD_COMMAND         make
             INSTALL_COMMAND       ""
             LOG_DOWNLOAD          ON
         )
         ExternalProject_Add_StepTargets(readline configure build install)
         set(READLINE_INCLUDE_DIRS ${CMAKE_CURRENT_BINARY_DIR}/deps/readline/src/)
-        set(READLINE_LIBRARIES ${CMAKE_CURRENT_BINARY_DIR}/deps/readline/src/readline/libreadline.a ${CMAKE_CURRENT_BINARY_DIR}/deps/ncurses/src/ncurses/lib/libncurses.a)
+        set(READLINE_LIBRARIES ${CMAKE_CURRENT_BINARY_DIR}/deps/readline/src/readline/libreadline.a ${CMAKE_CURRENT_BINARY_DIR}/deps/ncurses/src/ncurses/lib/libtinfo.a)
     else (ANDROID)
         find_path(READLINE_INCLUDE_DIRS readline/readline.h)
         find_library(READLINE_LIBRARIES readline)
@@ -102,6 +109,19 @@ if (NOT SKIPREADLINE EQUAL 1)
     endif (READLINE_INCLUDE_DIRS AND READLINE_LIBRARIES)
 endif (NOT SKIPREADLINE EQUAL 1)
 
+if (NOT SKIPJANSSONSYSTEM EQUAL 1)
+    pkg_check_modules(PC_JANSSON QUIET jansson)
+    find_path(JANSSON_INCLUDE_DIRS
+            NAMES jansson.h
+            HINTS ${PC_JANSSON_INCLUDEDIR} ${PC_JANSSON_INCLUDE_DIRS})
+    find_library(JANSSON_LIBRARIES
+            NAMES jansson libjansson
+            HINTS ${PC_JANSSON_LIBDIR} ${PC_JANSSON_LIBRARY_DIRS})
+    if (JANSSON_INCLUDE_DIRS AND JANSSON_LIBRARIES)
+        set(JANSSON_FOUND ON)
+    endif (JANSSON_INCLUDE_DIRS AND JANSSON_LIBRARIES)
+endif (NOT SKIPJANSSONSYSTEM EQUAL 1)
+
 if(ANDROID)
     set(BZIP2_BUILD_DIR ${CMAKE_CURRENT_BINARY_DIR}/deps/bzip2/src/bzip2)
     ExternalProject_Add(bzip2
@@ -118,12 +138,18 @@ if(ANDROID)
     ExternalProject_Add_StepTargets(bzip2 configure build install)
     set(BZIP2_INCLUDE_DIRS ${CMAKE_CURRENT_BINARY_DIR}/deps/bzip2/src/bzip2)
     set(BZIP2_LIBRARIES ${CMAKE_CURRENT_BINARY_DIR}/deps/bzip2/src/bzip2/libbz2.a)
-else()
-    set(BZIP2_LIBRARIES bz2)
-endif(ANDROID)
-if (BZIP2_LIBRARIES)
     set(BZIP2_FOUND ON)
-endif (BZIP2_LIBRARIES)
+else()
+    find_package (BZip2 REQUIRED)
+endif(ANDROID)
+
+if (NOT SKIPWHEREAMISYSTEM EQUAL 1)
+    find_path(WHEREAMI_INCLUDE_DIRS whereami.h)
+    find_library(WHEREAMI_LIBRARIES whereami)
+    if (WHEREAMI_INCLUDE_DIRS AND WHEREAMI_LIBRARIES)
+        set(WHEREAMI_FOUND ON)
+    endif (WHEREAMI_INCLUDE_DIRS AND WHEREAMI_LIBRARIES)
+endif (NOT SKIPWHEREAMISYSTEM EQUAL 1)
 
 add_subdirectory(${PM3_ROOT}/client/deps deps)
 
@@ -309,6 +335,11 @@ if (NOT SKIPBT EQUAL 1)
     endif (BLUEZ_FOUND)
 endif(NOT SKIPBT EQUAL 1)
 
+if (JANSSON_FOUND)
+    set(ADDITIONAL_DIRS ${JANSSON_INCLUDE_DIRS} ${ADDITIONAL_DIRS})
+    set(ADDITIONAL_LNK ${JANSSON_LIBRARIES} ${ADDITIONAL_LNK})
+endif (JANSSON_FOUND)
+
 if (NOT SKIPPYTHON EQUAL 1)
     if (PYTHON3EMBED_FOUND)
         add_definitions(-DHAVE_PYTHON)
@@ -330,13 +361,17 @@ if (NOT SKIPREADLINE EQUAL 1)
         set(ADDITIONAL_LNK ${READLINE_LIBRARIES} ${ADDITIONAL_LNK})
     endif (READLINE_FOUND)
 endif(NOT SKIPREADLINE EQUAL 1)
+
 if (BZIP2_FOUND)
     set(ADDITIONAL_DIRS ${BZIP2_INCLUDE_DIRS} ${ADDITIONAL_DIRS})
     set(ADDITIONAL_LNK ${BZIP2_LIBRARIES} ${ADDITIONAL_LNK})
-else (BZIP2_FOUND)
-    message(FATAL_ERROR "Bzip2 not found")
 endif (BZIP2_FOUND)
 
+if (WHEREAMI_FOUND)
+    set(ADDITIONAL_DIRS ${WHEREAMI_INCLUDE_DIRS} ${ADDITIONAL_DIRS})
+    set(ADDITIONAL_LNK ${WHEREAMI_LIBRARIES} ${ADDITIONAL_LNK})
+endif (WHEREAMI_FOUND)
+
 message("===================================================================")
 if (SKIPQT EQUAL 1)
     message("GUI support:       skipped")
@@ -358,6 +393,16 @@ else (SKIPBT EQUAL 1)
     endif (BLUEZ_FOUND)
 endif(SKIPBT EQUAL 1)
 
+if (SKIPJANSSONSYSTEM EQUAL 1)
+    message("Jansson library:   local library forced")
+else (SKIPJANSSONSYSTEM EQUAL 1)
+    if (JANSSON_FOUND)
+        message("Jansson library:   system library found")
+    else (JANSSON_FOUND)
+        message("Jansson library:   system library not found, using local library")
+    endif (JANSSON_FOUND)
+endif (SKIPJANSSONSYSTEM EQUAL 1)
+
 if (SKIPPYTHON EQUAL 1)
     message("Python3 library:   skipped")
 else (SKIPPYTHON EQUAL 1)
@@ -379,6 +424,16 @@ else (SKIPREADLINE EQUAL 1)
         message("Readline library:  Readline not found, disabled")
     endif (READLINE_FOUND)
 endif(SKIPREADLINE EQUAL 1)
+
+if (SKIPWHEREAMISYSTEM EQUAL 1)
+    message("Whereami library:  local library forced")
+else (SKIPWHEREAMISYSTEM EQUAL 1)
+    if (WHEREAMI_FOUND)
+        message("Whereami library:  system library found")
+    else (WHEREAMI_FOUND)
+        message("Whereami library:  system library not found, using local library")
+    endif (WHEREAMI_FOUND)
+endif (SKIPWHEREAMISYSTEM EQUAL 1)
 message("===================================================================")
 
 add_executable(proxmark3
@@ -422,25 +477,30 @@ endif (NOT APPLE)
 
 
 find_library(pm3rrg_rdv4_cliparser REQUIRED)
-find_library(pm3rrg_rdv4_jansson REQUIRED)
 find_library(pm3rrg_rdv4_tinycbor REQUIRED)
 find_library(pm3rrg_rdv4_lua REQUIRED)
 find_library(pm3rrg_rdv4_mbedtls REQUIRED)
 find_library(pm3rrg_rdv4_reveng REQUIRED)
 find_library(pm3rrg_rdv4_hardnested REQUIRED)
-find_library(pm3rrg_rdv4_whereami REQUIRED)
+
+if (NOT JANSSON_FOUND)
+    find_library(pm3rrg_rdv4_jansson REQUIRED)
+    set(ADDITIONAL_LNK pm3rrg_rdv4_jansson ${ADDITIONAL_LNK})
+endif (NOT JANSSON_FOUND)
+if (NOT WHEREAMI_FOUND)
+    find_library(pm3rrg_rdv4_whereami REQUIRED)
+    set(ADDITIONAL_LNK pm3rrg_rdv4_whereami ${ADDITIONAL_LNK})
+endif (NOT WHEREAMI_FOUND)
 
 target_link_libraries(proxmark3 PRIVATE
         m
         pm3rrg_rdv4_mbedtls
         pm3rrg_rdv4_cliparser
-        pm3rrg_rdv4_jansson
         pm3rrg_rdv4_lua
         pm3rrg_rdv4_tinycbor
         pm3rrg_rdv4_amiibo
         pm3rrg_rdv4_reveng
         pm3rrg_rdv4_hardnested
-        pm3rrg_rdv4_whereami
         ${ADDITIONAL_LNK})
 
 if (NOT SKIPPTHREAD EQUAL 1)
diff --git a/client/deps/hardnested.cmake b/client/deps/hardnested.cmake
index 9efff1445..6ec4f0297 100644
--- a/client/deps/hardnested.cmake
+++ b/client/deps/hardnested.cmake
@@ -107,6 +107,7 @@ add_library(pm3rrg_rdv4_hardnested STATIC
         hardnested/hardnested_bruteforce.c
         $<TARGET_OBJECTS:pm3rrg_rdv4_hardnested_nosimd>
         ${SIMD_TARGETS})
+target_compile_options(pm3rrg_rdv4_hardnested PRIVATE -Wall -Werror -O3)
 set_property(TARGET pm3rrg_rdv4_hardnested PROPERTY POSITION_INDEPENDENT_CODE ON)
 target_include_directories(pm3rrg_rdv4_hardnested PRIVATE
         ../../common
diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index 007c32c8a..b1f43244b 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -1593,6 +1593,16 @@ static uint8_t getByte(uint8_t bits_per_sample, BitstreamOut *b) {
 }
 
 int getSamples(uint32_t n, bool verbose) {
+    return getSamplesEx(0, n, verbose);
+}
+
+int getSamplesEx(uint32_t start, uint32_t end, bool verbose) {
+
+    if (end < start) {
+        PrintAndLogEx(WARNING, "error, end (%u) is smaller than start (%u)", end, start);
+        return PM3_EINVARG;
+    }
+
     //If we get all but the last byte in bigbuf,
     // we don't have to worry about remaining trash
     // in the last byte in case the bits-per-sample
@@ -1600,13 +1610,16 @@ int getSamples(uint32_t n, bool verbose) {
     uint8_t got[pm3_capabilities.bigbuf_size - 1];
     memset(got, 0x00, sizeof(got));
 
-    if (n == 0 || n > pm3_capabilities.bigbuf_size - 1)
+    uint32_t n = end - start;
+
+    if (n <= 0 || n > pm3_capabilities.bigbuf_size - 1)
         n = pm3_capabilities.bigbuf_size - 1;
 
-    if (verbose) PrintAndLogEx(INFO, "Reading " _YELLOW_("%u") " bytes from device memory", n);
+    if (verbose)
+        PrintAndLogEx(INFO, "Reading " _YELLOW_("%u") " bytes from device memory", n);
 
     PacketResponseNG response;
-    if (!GetFromDevice(BIG_BUF, got, n, 0, NULL, 0, &response, 10000, true)) {
+    if (!GetFromDevice(BIG_BUF, got, n, start, NULL, 0, &response, 10000, true)) {
         PrintAndLogEx(WARNING, "timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
@@ -2297,25 +2310,35 @@ static int CmdDataNDEF(const char *Cmd) {
 
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "data ndef",
-                  "Prints NFC Data Exchange Format (NDEF)",
-                  "Usage:\n\tdata ndef -d 9101085402656e48656c6c6f5101085402656e576f726c64\n");
+                  "Decode and print NFC Data Exchange Format (NDEF)",
+                  "Samples:\n"
+                  _YELLOW_("\tdata ndef -d 9101085402656e48656c6c6f5101085402656e576f726c64\n")
+                  _YELLOW_("\tdata ndef -d 0103d020240203e02c040300fe\n")
+                  );
 
     void *argtable[] = {
         arg_param_begin,
         arg_strx0("dD",  "data", "<hex>", "NDEF data to decode"),
+        arg_lit0("vV",  "verbose", "verbose mode"),
         arg_param_end
     };
-    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
     int datalen = 0;
     uint8_t data[MAX_NDEF_LEN] = {0};
     CLIGetHexWithReturn(ctx, 1, data, &datalen);
+    bool verbose = arg_get_lit(ctx, 2);
+
     CLIParserFree(ctx);
     if (datalen == 0)
         return PM3_EINVARG;
 
-    PrintAndLogEx(INFO, "Parsed NDEF Records");
-    return NDEFRecordsDecodeAndPrint(data, datalen);
+    int res = NDEFDecodeAndPrint(data, datalen, verbose);
+    if (res != PM3_SUCCESS) {
+        PrintAndLogEx(INFO, "Trying to parse NDEF records w/o NDEF header");
+        res = NDEFRecordsDecodeAndPrint(data, datalen);
+    }
+    return res;
 }
 
 static command_t CommandTable[] = {
diff --git a/client/src/cmddata.h b/client/src/cmddata.h
index abef8fde8..acda950a5 100644
--- a/client/src/cmddata.h
+++ b/client/src/cmddata.h
@@ -72,7 +72,10 @@ void setDemodBuff(uint8_t *buff, size_t size, size_t start_idx);
 bool getDemodBuff(uint8_t *buff, size_t *size);
 void save_restoreDB(uint8_t saveOpt);// option '1' to save DemodBuffer any other to restore
 int AutoCorrelate(const int *in, int *out, size_t len, size_t window, bool SaveGrph, bool verbose);
+
 int getSamples(uint32_t n, bool verbose);
+int getSamplesEx(uint32_t start, uint32_t end, bool verbose);
+
 void setClockGrid(uint32_t clk, int offset);
 int directionalThreshold(const int *in, int *out, size_t len, int8_t up, int8_t down);
 int AskEdgeDetect(const int *in, int *out, int len, int threshold);
diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 6b11a30da..26723ca6a 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -46,7 +46,8 @@ static int CmdHelp(const char *Cmd);
 
 static int usage_hf_search(void) {
     PrintAndLogEx(NORMAL, "Usage: hf search");
-    PrintAndLogEx(NORMAL, "Will try to find a HF read out of the unknown tag. Stops when found.");
+    PrintAndLogEx(NORMAL, "Will try to find a HF read out of the unknown tag.");
+    PrintAndLogEx(NORMAL, "Continues to search for all different HF protocols");
     PrintAndLogEx(NORMAL, "Options:");
     PrintAndLogEx(NORMAL, "       h               - This help");
     PrintAndLogEx(NORMAL, "");
@@ -64,18 +65,21 @@ static int usage_hf_sniff(void) {
     PrintAndLogEx(NORMAL, "       <skip triggers> - skip number of triggers");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "           hf sniff");
-    PrintAndLogEx(NORMAL, "           hf sniff 1000 0");
+    PrintAndLogEx(NORMAL, _YELLOW_("           hf sniff"));
+    PrintAndLogEx(NORMAL, _YELLOW_("           hf sniff 1000 0"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
 static int usage_hf_tune(void) {
     PrintAndLogEx(NORMAL, "Continuously measure HF antenna tuning.");
-    PrintAndLogEx(NORMAL, "Press button or Enter to interrupt.");
+    PrintAndLogEx(NORMAL, "Press button or `enter` to interrupt.");
     PrintAndLogEx(NORMAL, "Usage: hf tune [h] [<iter>]");
     PrintAndLogEx(NORMAL, "Options:");
     PrintAndLogEx(NORMAL, "       h             - This help");
     PrintAndLogEx(NORMAL, "       <iter>        - number of iterations (default: 0=infinite)");
+    PrintAndLogEx(NORMAL, "Examples:");
+    PrintAndLogEx(NORMAL, _YELLOW_("           hf tune 1"));
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
@@ -195,7 +199,7 @@ int CmdHFSearch(const char *Cmd) {
 int CmdHFTune(const char *Cmd) {
     char cmdp = tolower(param_getchar(Cmd, 0));
     if (cmdp == 'h') return usage_hf_tune();
-    int iter =  param_get32ex(Cmd, 0, 0, 10);
+    int iter = param_get32ex(Cmd, 0, 0, 10);
 
     PrintAndLogEx(INFO, "Measuring HF antenna, click " _GREEN_("pm3 button") " or press " _GREEN_("Enter") " to exit");
     PacketResponseNG resp;
@@ -241,15 +245,68 @@ int CmdHFTune(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+// Collects pars of u8,
+// uses 16bit transfers from FPGA for speed
+// Takes all available bigbuff memory
+// data sample to download?   Not sure what we can do with the data.
 int CmdHFSniff(const char *Cmd) {
     char cmdp = tolower(param_getchar(Cmd, 0));
     if (cmdp == 'h') return usage_hf_sniff();
 
-    int skippairs =  param_get32ex(Cmd, 0, 0, 10);
-    int skiptriggers =  param_get32ex(Cmd, 1, 0, 10);
+    struct {
+        uint32_t samplesToSkip;
+        uint32_t triggersToSkip;
+    } PACKED params;
+
+    params.samplesToSkip = param_get32ex(Cmd, 0, 0, 10);
+    params.triggersToSkip = param_get32ex(Cmd, 1, 0, 10);
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_HF_SNIFF, skippairs, skiptriggers, 0, NULL, 0);
+    SendCommandNG(CMD_HF_SNIFF, (uint8_t *)&params, sizeof(params));
+
+    for (;;) {
+
+        if (kbd_enter_pressed()) {
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(INFO, "User aborted");
+            break;
+        }
+
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(CMD_HF_SNIFF, &resp, 1000)) {
+
+            if (resp.status == PM3_EOPABORTED) {
+                PrintAndLogEx(INFO, "Button pressed, user aborted");
+                break;
+            }
+            if (resp.status == PM3_SUCCESS) {
+
+                struct r {
+                    uint16_t len;
+                } PACKED;
+                struct r *retval = (struct r *)resp.data.asBytes;
+            
+                PrintAndLogEx(INFO, "HF sniff (%u samples)", retval->len);
+
+                PrintAndLogEx(HINT, "Use `" _YELLOW_("data hpf") "` to remove offset");
+                PrintAndLogEx(HINT, "Use `" _YELLOW_("data plot") "` to view");
+                PrintAndLogEx(HINT, "Use `" _YELLOW_("data save") "` to save");
+
+                // download bigbuf_malloc:d.  
+                // it reserve memory from the higher end.
+                // At the moment, sniff takes all free memory in bigbuff. If this changes, 
+                // we can't start from beginning idx 0 but from that hi-to-start-of-allocated.
+                uint32_t start = pm3_capabilities.bigbuf_size - retval->len;
+                int res = getSamplesEx(start, start, false);
+                if (res != PM3_SUCCESS) {
+                    PrintAndLogEx(WARNING, "failed to download samples to client");
+                    return res;
+                }
+                break;
+            }
+        }
+    }
+    PrintAndLogEx(INFO, "Done.");
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 21086b70a..eb9670b70 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -4545,7 +4545,7 @@ static int CmdHF14AMfMAD(const char *Cmd) {
         // copy default NDEF key
         uint8_t akey[6] = {0};
         memcpy(akey, g_mifare_ndef_key, 6);
-        
+
         // user specified key
         if (keylen == 6) {
             memcpy(akey, key, 6);
@@ -4584,7 +4584,7 @@ static int CmdHF14AMfMAD(const char *Cmd) {
 
             for (int i = 0; i < madlen; i++) {
                 if (aaid == mad[i]) {
-           
+
                     uint8_t vsector[16 * 4] = {0};
                     if (mfReadSector(i + 1, keyB ? MF_KEY_B : MF_KEY_A, akey, vsector)) {
                         PrintAndLogEx(NORMAL, "");
@@ -4611,7 +4611,7 @@ static int CmdHF14AMfMAD(const char *Cmd) {
         for (int i = 0; i < 4; i ++)
             PrintAndLogEx(INFO, "[%d] %s", i, sprint_hex(&sector0[i * 16], 16));
     }
-    
+
     return PM3_SUCCESS;
 }
 
@@ -4669,7 +4669,7 @@ static int CmdHFMFNDEF(const char *Cmd) {
         PrintAndLogEx(HINT, "Try " _YELLOW_("`hf mf ndef -k `") " with your custom key");
         return PM3_ESOFT;
     }
-   
+
     bool haveMAD2 = false;
     int res = MADCheck(sector0, NULL, verbose, &haveMAD2);
     if (res != PM3_SUCCESS) {
diff --git a/client/src/cmdhfmfp.c b/client/src/cmdhfmfp.c
index 7fc0f0bf7..a3c9d195c 100644
--- a/client/src/cmdhfmfp.c
+++ b/client/src/cmdhfmfp.c
@@ -1400,7 +1400,7 @@ static int CmdHFMFPMAD(const char *Cmd) {
 
             for (int i = 0; i < madlen; i++) {
                 if (aaid == mad[i]) {
-           
+
                     uint8_t vsector[16 * 4] = {0};
                     if (mfReadSector(i + 1, keyB ? MF_KEY_B : MF_KEY_A, akey, vsector)) {
                         PrintAndLogEx(NORMAL, "");
@@ -1472,7 +1472,7 @@ static int CmdHFMFPNDEF(const char *Cmd) {
 
     if (verbose)
         PrintAndLogEx(INFO, "reading MAD v1 sector");
-    
+
     if (mfpReadSector(MF_MAD1_SECTOR, MF_KEY_A, (uint8_t *)g_mifarep_mad_key, sector0, verbose)) {
         PrintAndLogEx(ERR, "error, read sector 0. card don't have MAD or don't have MAD on default keys");
         PrintAndLogEx(HINT, "Try " _YELLOW_("`hf mfp ndef -k `") " with your custom key");
@@ -1487,7 +1487,7 @@ static int CmdHFMFPNDEF(const char *Cmd) {
     }
 
     if (haveMAD2) {
-        
+
         if (verbose)
             PrintAndLogEx(INFO, "reading MAD v2 sector");
 
diff --git a/client/src/cmdlfawid.c b/client/src/cmdlfawid.c
index 36658bbdf..c42c719f0 100644
--- a/client/src/cmdlfawid.c
+++ b/client/src/cmdlfawid.c
@@ -38,7 +38,7 @@ static int usage_lf_awid_watch(void) {
     PrintAndLogEx(NORMAL, "Usage:  lf awid watch");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf awid watch");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid watch"));
     return PM3_SUCCESS;
 }
 
@@ -54,8 +54,8 @@ static int usage_lf_awid_sim(void) {
     PrintAndLogEx(NORMAL, "    <card number> :  16|32-bit value card number");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf awid sim 26 224 1337");
-    PrintAndLogEx(NORMAL, "       lf awid sim 50 2001 13371337");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid sim 26 224 1337"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid sim 50 2001 13371337"));
     return PM3_SUCCESS;
 }
 
@@ -72,8 +72,8 @@ static int usage_lf_awid_clone(void) {
     PrintAndLogEx(NORMAL, "               Q5 :  optional - clone to Q5 (T5555) instead of T55x7 chip");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf awid clone 26 224 1337");
-    PrintAndLogEx(NORMAL, "       lf awid clone 50 2001 13371337");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid clone 26 224 1337"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid clone 50 2001 13371337"));
     return PM3_SUCCESS;
 }
 
@@ -92,9 +92,9 @@ static int usage_lf_awid_brute(void) {
     PrintAndLogEx(NORMAL, "       v                 :  verbose logging, show all tries");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf awid brute a 26 f 224");
-    PrintAndLogEx(NORMAL, "       lf awid brute a 50 f 2001 d 2000");
-    PrintAndLogEx(NORMAL, "       lf awid brute v a 50 f 2001 c 200 d 2000");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid brute a 26 f 224"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid brute a 50 f 2001 d 2000"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf awid brute v a 50 f 2001 c 200 d 2000"));
     return PM3_SUCCESS;
 }
 
@@ -180,11 +180,17 @@ static void verify_values(uint8_t *fmtlen, uint32_t *fc, uint32_t *cn) {
 // this read loops on device side.
 // uses the demod in lfops.c
 static int CmdAWIDWatch(const char *Cmd) {
-    uint8_t ctmp = tolower(param_getchar(Cmd, 0));
-    if (ctmp == 'h') return usage_lf_awid_watch();
+    uint8_t c = tolower(param_getchar(Cmd, 0));
+    if (c == 'h') return usage_lf_awid_watch();
+
+    PrintAndLogEx(SUCCESS, "Watching for AWID cards - place tag on antenna");
+    PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_AWID_DEMOD, NULL, 0);
-    return PM3_SUCCESS;
+    SendCommandNG(CMD_LF_AWID_WATCH, NULL, 0);
+    PacketResponseNG resp;
+    WaitForResponse(CMD_LF_AWID_WATCH, &resp);
+    PrintAndLogEx(INFO, "Done");
+    return resp.status;
 }
 
 //by marshmellow
diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c
index 7d432f39c..a94882cb6 100644
--- a/client/src/cmdlfem4x.c
+++ b/client/src/cmdlfem4x.c
@@ -45,13 +45,24 @@ static int usage_lf_em410x_demod(void) {
     PrintAndLogEx(NORMAL, "     maxerror            - set maximum allowed errors, default = 100.");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "           lf em 410x_demod        = demod an EM410x Tag ID from GraphBuffer");
-    PrintAndLogEx(NORMAL, "           lf em 410x_demod 32     = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32");
-    PrintAndLogEx(NORMAL, "           lf em 410x_demod 32 1   = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32 and inverting data");
-    PrintAndLogEx(NORMAL, "           lf em 410x_demod 1      = demod an EM410x Tag ID from GraphBuffer while inverting data");
-    PrintAndLogEx(NORMAL, "           lf em 410x_demod 64 1 0 = demod an EM410x Tag ID from GraphBuffer using a clock of RF/64 and inverting data and allowing 0 demod errors");
+    PrintAndLogEx(NORMAL, _YELLOW_("           lf em 410x_demod") "        = demod an EM410x Tag ID from GraphBuffer");
+    PrintAndLogEx(NORMAL, _YELLOW_("           lf em 410x_demod 32") "     = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32");
+    PrintAndLogEx(NORMAL, _YELLOW_("           lf em 410x_demod 32 1") "   = demod an EM410x Tag ID from GraphBuffer using a clock of RF/32 and inverting data");
+    PrintAndLogEx(NORMAL, _YELLOW_("           lf em 410x_demod 1") "      = demod an EM410x Tag ID from GraphBuffer while inverting data");
+    PrintAndLogEx(NORMAL, _YELLOW_("           lf em 410x_demod 64 1 0") " = demod an EM410x Tag ID from GraphBuffer using a clock of RF/64 and inverting data and allowing 0 demod errors");
     return PM3_SUCCESS;
 }
+static int usage_lf_em410x_watch(void) {
+    PrintAndLogEx(NORMAL, "Enables IOProx compatible reader mode printing details of scanned tags.");
+    PrintAndLogEx(NORMAL, "By default, values are printed and logged until the button is pressed or another USB command is issued.");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "Usage:  lf em 410x_watch");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "Examples:");
+    PrintAndLogEx(NORMAL, _YELLOW_("        lf em 410x_watch"));
+    return PM3_SUCCESS;
+}
+
 static int usage_lf_em410x_write(void) {
     PrintAndLogEx(NORMAL, "Writes EM410x ID to a T55x7 / T5555 (Q5) tag");
     PrintAndLogEx(NORMAL, "");
@@ -62,7 +73,7 @@ static int usage_lf_em410x_write(void) {
     PrintAndLogEx(NORMAL, "       <card>    - 0|1 T5555 (Q5) / T55x7");
     PrintAndLogEx(NORMAL, "       <clock>   - 16|32|40|64, optional, set R/F clock rate, defaults to 64");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf em 410x_write 0F0368568B 1       = write ID to t55x7 card");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 410x_write 0F0368568B 1") "       = write ID to t55x7 card");
     return PM3_SUCCESS;
 }
 static int usage_lf_em410x_ws(void) {
@@ -72,7 +83,7 @@ static int usage_lf_em410x_ws(void) {
     PrintAndLogEx(NORMAL, "Options:");
     PrintAndLogEx(NORMAL, "       h         - this help");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf em 410x_spoof");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 410x_spoof"));
     return PM3_SUCCESS;
 }
 static int usage_lf_em410x_sim(void) {
@@ -84,8 +95,8 @@ static int usage_lf_em410x_sim(void) {
     PrintAndLogEx(NORMAL, "       uid       - uid (10 HEX symbols)");
     PrintAndLogEx(NORMAL, "       clock     - clock (32|64) (optional)");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf em 410x_sim 0F0368568B");
-    PrintAndLogEx(NORMAL, "      lf em 410x_sim 0F0368568B 32");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 410x_sim 0F0368568B"));
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 410x_sim 0F0368568B 32"));
     return PM3_SUCCESS;
 }
 static int usage_lf_em410x_brute(void) {
@@ -98,10 +109,10 @@ static int usage_lf_em410x_brute(void) {
     PrintAndLogEx(NORMAL, "       d (2000)      - pause delay in milliseconds between UIDs simulation, default 1000 ms (optional)");
     PrintAndLogEx(NORMAL, "       c (32)        - clock (32|64), default 64 (optional)");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf em 410x_brute ids.txt");
-    PrintAndLogEx(NORMAL, "      lf em 410x_brute ids.txt c 32");
-    PrintAndLogEx(NORMAL, "      lf em 410x_brute ids.txt d 3000");
-    PrintAndLogEx(NORMAL, "      lf em 410x_brute ids.txt d 3000 c 32");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 410x_brute ids.txt"));
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 410x_brute ids.txt c 32"));
+    PrintAndLogEx(NORMAL, _YELLOW_( "      lf em 410x_brute ids.txt d 3000"));
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf em 410x_brute ids.txt d 3000 c 32"));
     return PM3_SUCCESS;
 }
 
@@ -426,16 +437,23 @@ int AskEm410xDemod(const char *Cmd, uint32_t *hi, uint64_t *lo, bool verbose) {
         return PM3_ESOFT;
     return AskEm410xDecode(verbose, hi, lo);
 }
-/*
+
 // this read loops on device side.
 // uses the demod in lfops.c
-static int CmdEM410xRead_device(const char *Cmd) {
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    uint8_t findone = (cmdp == '1') ? 1 : 0;
-    SendCommandMIX(CMD_LF_EM410X_DEMOD, findone, 0, 0, NULL, 0);
-    return PM3_SUCCESS;
+static int CmdEM410xWatch(const char *Cmd) {
+    uint8_t c = tolower(param_getchar(Cmd, 0));
+    if (c == 'h') return usage_lf_em410x_watch();
+    
+    PrintAndLogEx(SUCCESS, "Watching for EM410x cards - place tag on antenna");
+    PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM410X_WATCH, NULL, 0);
+    PacketResponseNG resp;
+    WaitForResponse(CMD_LF_EM410X_WATCH, &resp);
+    PrintAndLogEx(INFO, "Done");
+    return resp.status;
 }
-*/
+
 //by marshmellow
 //takes 3 arguments - clock, invert and maxErr as integers
 //attempts to demodulate ask while decoding manchester
@@ -595,30 +613,6 @@ static int CmdEM410xBrute(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-/* Function is equivalent of lf read + data samples + em410xread
- * looped until an EM410x tag is detected
- *
- * Why is CmdSamples("16000")?
- *  TBD: Auto-grow sample size based on detected sample rate.  IE: If the
- *       rate gets lower, then grow the number of samples
- *  Changed by martin, 4000 x 4 = 16000,
- *  see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
- *
- *  EDIT -- capture enough to get 2 complete preambles at the slowest data rate known to be used (rf/64) (64*64*2+9 = 8201) marshmellow
-*/
-static int CmdEM410xWatch(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
-    do {
-        if (kbd_enter_pressed()) {
-            PrintAndLogEx(WARNING, "\naborted via keyboard!\n");
-            break;
-        }
-        lf_read(false, 12288);
-
-    } while (CmdEM410xRead("") != PM3_SUCCESS);
-    return PM3_SUCCESS;
-}
-
 //currently only supports manchester modulations
 static int CmdEM410xWatchnSpoof(const char *Cmd) {
 
@@ -636,29 +630,26 @@ static int CmdEM410xWrite(const char *Cmd) {
     char cmdp = tolower(param_getchar(Cmd, 0));
     if (cmdp == 0x00 || cmdp == 'h') return usage_lf_em410x_write();
 
-    uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
-    int card = 0xFF; // invalid card value
-    uint32_t clock1 = 0; // invalid clock value
-
-    sscanf(Cmd, "%" SCNx64 " %d %d", &id, &card, &clock1);
+    uint64_t id = param_get64ex(Cmd, 0, -1, 16);
+    uint8_t card = param_get8ex(Cmd, 1, 0xFF, 10);
+    uint8_t clock1 = param_get8ex(Cmd, 2, 0, 10);
 
     // Check ID
     if (id == 0xFFFFFFFFFFFFFFFF) {
-        PrintAndLogEx(ERR, "Error! ID is required.\n");
+        PrintAndLogEx(ERR, "error, ID is required\n");
+        usage_lf_em410x_write();
         return PM3_EINVARG;
     }
     if (id >= 0x10000000000) {
-        PrintAndLogEx(ERR, "Error! Given EM410x ID is longer than 40 bits.\n");
+        PrintAndLogEx(ERR, "error, given EM410x ID is longer than 40 bits\n");
+        usage_lf_em410x_write();
         return PM3_EINVARG;
     }
 
     // Check Card
-    if (card == 0xFF) {
-        PrintAndLogEx(ERR, "Error! Card type required.\n");
-        return PM3_EINVARG;
-    }
-    if (card < 0) {
-        PrintAndLogEx(ERR, "Error! Bad card type selected.\n");
+    if (card > 1) {
+        PrintAndLogEx(FAILED, "error, bad card type selected\n");
+        usage_lf_em410x_write();
         return PM3_EINVARG;
     }
 
@@ -668,29 +659,51 @@ static int CmdEM410xWrite(const char *Cmd) {
 
     // Allowed clock rates: 16, 32, 40 and 64
     if ((clock1 != 16) && (clock1 != 32) && (clock1 != 64) && (clock1 != 40)) {
-        PrintAndLogEx(ERR, "Error! Clock rate" _YELLOW_("%d")" not valid. Supported clock rates are 16, 32, 40 and 64.\n", clock1);
+        PrintAndLogEx(ERR, "error, clock rate" _RED_("%d")" not valid");
+        PrintAndLogEx(INFO, "supported clock rates: " _YELLOW_("16, 32, 40, 60") "\n", clock1);
+        usage_lf_em410x_write();
         return PM3_EINVARG;
     }
 
     if (card == 1) {
-        PrintAndLogEx(SUCCESS, "Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock1);
+        PrintAndLogEx(SUCCESS, "Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", _GREEN_("T55x7"), id, clock1);
         // NOTE: We really should pass the clock in as a separate argument, but to
         //   provide for backwards-compatibility for older firmware, and to avoid
         //   having to add another argument to CMD_LF_EM410X_WRITE, we just store
         //   the clock rate in bits 8-15 of the card value
-        card = (card & 0xFF) | ((clock1 << 8) & 0xFF00);
     } else if (card == 0) {
-        PrintAndLogEx(SUCCESS, "Writing %s tag with UID 0x%010" PRIx64 "(clock rate: %d)", "T5555", id, clock1);
-        card = (card & 0xFF) | ((clock1 << 8) & 0xFF00);
-    } else {
-        PrintAndLogEx(FAILED, "Error! Bad card type selected.\n");
-        return PM3_ESOFT;
+        PrintAndLogEx(SUCCESS, "Writing %s tag with UID 0x%010" PRIx64 "(clock rate: %d)", _GREEN_("T5555"), id, clock1);
     }
+    
+    struct {
+        uint8_t card;
+        uint8_t clock;
+        uint32_t high;
+        uint32_t low;
+    } PACKED params;
 
-    SendCommandMIX(CMD_LF_EM410X_WRITE, card, (uint32_t)(id >> 32), (uint32_t)id, NULL, 0);
-    PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 410x_read`") " to verify");
-    return PM3_SUCCESS;
+    params.card = card;
+    params.clock = clock1;
+    params.high = (uint32_t)(id >> 32);
+    params.low = (uint32_t)id;
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM410X_WRITE, (uint8_t *)&params, sizeof(params));
+
+    PacketResponseNG resp;
+    WaitForResponse(CMD_LF_EM410X_WRITE, &resp);
+    switch(resp.status) {
+        case PM3_SUCCESS: {
+            PrintAndLogEx(SUCCESS, "Done");
+            PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 410x_read`") " to verify");
+            break;
+        }
+        default: {
+            PrintAndLogEx(WARNING, "Something went wrong");
+            break;
+        }
+    }
+    return resp.status;
 }
 
 //**************** Start of EM4x50 Code ************************
@@ -1001,7 +1014,7 @@ int EM4x50Read(const char *Cmd, bool verbose) {
             PrintAndLogEx(INFO, "%03d | %08x", block, Code[block]);
         }
         PrintAndLogEx(INFO, "----+--------------");
-        PrintAndLogEx( (AllPTest) ? SUCCESS : WARNING, "Parities checks | %s", (AllPTest) ? _GREEN_("Passed") : _RED_("Fail"));
+        PrintAndLogEx((AllPTest) ? SUCCESS : WARNING, "Parities checks | %s", (AllPTest) ? _GREEN_("Passed") : _RED_("Fail"));
 
         if (AllPTest == false) {
             PrintAndLogEx(HINT, "Try cleaning the read samples with " _YELLOW_("'data askedge'"));
diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 5c88c881b..83a97c41d 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -264,13 +264,17 @@ static int CmdHIDRead(const char *Cmd) {
 // this read loops on device side.
 // uses the demod in lfops.c
 static int CmdHIDWatch(const char *Cmd) {
-    uint8_t ctmp = tolower(param_getchar(Cmd, 0));
-    if (ctmp == 'h') return usage_lf_hid_watch();
+    uint8_t c = tolower(param_getchar(Cmd, 0));
+    if (c == 'h') return usage_lf_hid_watch();
+
+    PrintAndLogEx(SUCCESS, "Watching for HID Prox cards - place tag on antenna");
+    PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_HID_DEMOD, NULL, 0);
-    PrintAndLogEx(SUCCESS, "Watching for new HID cards - place tag on antenna");
-    PrintAndLogEx(INFO, "Press pm3-button to stop reading new cards");
-    return PM3_SUCCESS;
+    SendCommandNG(CMD_LF_HID_WATCH, NULL, 0);    
+    PacketResponseNG resp;
+    WaitForResponse(CMD_LF_HID_WATCH, &resp);
+    PrintAndLogEx(INFO, "Done");
+    return resp.status;
 }
 
 static int CmdHIDSim(const char *Cmd) {
diff --git a/client/src/cmdlfio.c b/client/src/cmdlfio.c
index e93a7cde3..92f914059 100644
--- a/client/src/cmdlfio.c
+++ b/client/src/cmdlfio.c
@@ -36,7 +36,7 @@ static int usage_lf_io_watch(void) {
     PrintAndLogEx(NORMAL, "Usage:  lf io watch");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        lf io watch");
+    PrintAndLogEx(NORMAL, _YELLOW_("        lf io watch"));
     return PM3_SUCCESS;
 }
 
@@ -52,7 +52,7 @@ static int usage_lf_io_sim(void) {
     PrintAndLogEx(NORMAL, "    <card number> :  16bit value card number (decimal)");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf io sim 26 101 1337");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf io sim 26 101 1337"));
     return PM3_SUCCESS;
 }
 
@@ -69,18 +69,24 @@ static int usage_lf_io_clone(void) {
     PrintAndLogEx(NORMAL, "               Q5 :  optional - clone to Q5 (T5555) instead of T55x7 chip");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf io clone 26 101 1337");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf io clone 26 101 1337"));
     return PM3_SUCCESS;
 }
 
 // this read loops on device side.
 // uses the demod in lfops.c
 static int CmdIOProxWatch(const char *Cmd) {
-    uint8_t ctmp = tolower(param_getchar(Cmd, 0));
-    if (ctmp == 'h') return usage_lf_io_watch();
+    uint8_t c = tolower(param_getchar(Cmd, 0));
+    if (c == 'h') return usage_lf_io_watch();
+
+    PrintAndLogEx(SUCCESS, "Watching for IO Prox cards - place tag on antenna");
+    PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_IO_DEMOD, NULL, 0);
-    return PM3_SUCCESS;
+    SendCommandNG(CMD_LF_IO_WATCH, NULL, 0);
+    PacketResponseNG resp;
+    WaitForResponse(CMD_LF_IO_WATCH, &resp);
+    PrintAndLogEx(INFO, "Done");
+    return resp.status;
 }
 
 //by marshmellow
diff --git a/client/src/cmdlfpyramid.c b/client/src/cmdlfpyramid.c
index ed2895ecb..03a9a751c 100644
--- a/client/src/cmdlfpyramid.c
+++ b/client/src/cmdlfpyramid.c
@@ -1,5 +1,7 @@
 //-----------------------------------------------------------------------------
 //
+// by marshmellow
+//
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
 // the license.
@@ -62,11 +64,14 @@ static int usage_lf_pyramid_sim(void) {
     return PM3_SUCCESS;
 }
 
-//by marshmellow
-//Pyramid Prox demod - FSK RF/50 with preamble of 0000000000000001  (always a 128 bit data stream)
-//print full Farpointe Data/Pyramid Prox ID and some bit format details if found
 static int CmdPyramidDemod(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
+    return demodPyramid();
+}
+
+//Pyramid Prox demod - FSK RF/50 with preamble of 0000000000000001  (always a 128 bit data stream)
+//print full Farpointe Data/Pyramid Prox ID and some bit format details if found
+int demodPyramid(void) {
     //raw fsk demod no manchester decoding no start bit finding just get binary from wave
     uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0};
     size_t size = getFromGraphBuf(bits);
@@ -350,11 +355,6 @@ int getPyramidBits(uint32_t fc, uint32_t cn, uint8_t *pyramidBits) {
     return PM3_SUCCESS;
 }
 
-int demodPyramid(void) {
-    return CmdPyramidDemod("");
-}
-
-// by marshmellow
 // FSK Demod then try to locate a Farpointe Data (pyramid) ID
 int detectPyramid(uint8_t *dest, size_t *size, int *waveStartIdx) {
     //make sure buffer has data
diff --git a/client/src/cmdlfsecurakey.c b/client/src/cmdlfsecurakey.c
index 108e9125c..4b01afe2d 100644
--- a/client/src/cmdlfsecurakey.c
+++ b/client/src/cmdlfsecurakey.c
@@ -34,13 +34,17 @@ static int usage_lf_securakey_clone(void) {
     PrintAndLogEx(NORMAL, "  b <raw hex>     : raw hex data. 12 bytes max");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf securakey clone 7FCB400001ADEA5344300000");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf securakey clone b 7FCB400001ADEA5344300000"));
     return PM3_SUCCESS;
 }
 
-//see ASKDemod for what args are accepted
 static int CmdSecurakeyDemod(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
+    return demodSecurakey();
+}
+
+//see ASKDemod for what args are accepted
+int demodSecurakey(void) {
 
     //ASK / Manchester
     bool st = false;
@@ -212,7 +216,3 @@ int detectSecurakey(uint8_t *dest, size_t *size) {
     return (int)startIdx;
 }
 
-int demodSecurakey(void) {
-    return CmdSecurakeyDemod("");
-}
-
diff --git a/client/src/cmdlfvisa2000.c b/client/src/cmdlfvisa2000.c
index a90e5ddce..91ad70490 100644
--- a/client/src/cmdlfvisa2000.c
+++ b/client/src/cmdlfvisa2000.c
@@ -41,7 +41,7 @@ static int usage_lf_visa2k_clone(void) {
     PrintAndLogEx(NORMAL, "      <Q5>       : specify write to Q5 (t5555 instead of t55x7)");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf visa2000 clone 112233");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf visa2000 clone 112233"));
     return PM3_SUCCESS;
 }
 
@@ -55,7 +55,7 @@ static int usage_lf_visa2k_sim(void) {
     PrintAndLogEx(NORMAL, "      <card ID>  : Visa2k card ID");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        lf visa2000 sim 112233");
+    PrintAndLogEx(NORMAL, _YELLOW_("        lf visa2000 sim 112233"));
     return PM3_SUCCESS;
 }
 
@@ -86,6 +86,10 @@ static uint8_t visa_parity(uint32_t id) {
     return par;
 }
 
+static int CmdVisa2kDemod(const char *Cmd) {
+    (void)Cmd; // Cmd is not used so far
+    return demodVisa2k();
+}
 /**
 *
 * 56495332 00096ebd 00000077 —> tag id 618173
@@ -98,9 +102,7 @@ static uint8_t visa_parity(uint32_t id) {
 *
 **/
 //see ASKDemod for what args are accepted
-static int CmdVisa2kDemod(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
-
+int demodVisa2k(void) {
     save_restoreGB(GRAPH_SAVE);
 
     //CmdAskEdgeDetect("");
@@ -153,7 +155,7 @@ static int CmdVisa2kDemod(const char *Cmd) {
         save_restoreGB(GRAPH_RESTORE);
         return PM3_ESOFT;
     }
-    PrintAndLogEx(SUCCESS, "Visa2000 Tag Found: Card ID %u,  Raw: %08X%08X%08X", raw2,  raw1, raw2, raw3);
+    PrintAndLogEx(SUCCESS, "Visa2000 Tag Found: Card ID " _GREEN_("%u") " Raw: %08X%08X%08X", raw2,  raw1, raw2, raw3);
     return PM3_SUCCESS;
 }
 
@@ -260,7 +262,4 @@ int detectVisa2k(uint8_t *dest, size_t *size) {
     return (int)startIdx;
 }
 
-int demodVisa2k(void) {
-    return CmdVisa2kDemod("");
-}
 
diff --git a/client/src/cmdmain.c b/client/src/cmdmain.c
index 2664ed3a1..0ca9826d8 100644
--- a/client/src/cmdmain.c
+++ b/client/src/cmdmain.c
@@ -248,8 +248,9 @@ static int CmdPref(const char *Cmd) {
 }
 
 static command_t CommandTable[] = {
-    {"help",    CmdHelp,      AlwaysAvailable,         "This help. Use '<command> help' for details of a particular command."},
-    {"auto",    CmdAuto,      IfPm3Present,           "Automated detection process for unknown tags"},
+
+    {"--------",CmdHelp,      AlwaysAvailable,         "----------------------- " _CYAN_("sub") " -----------------------"},
+
     {"analyse", CmdAnalyse,   AlwaysAvailable,         "{ Analyse utils... }"},
     {"data",    CmdData,      AlwaysAvailable,         "{ Plot window / data buffer manipulation... }"},
     {"emv",     CmdEMV,       AlwaysAvailable,         "{ EMV ISO-14443 / ISO-7816... }"},
@@ -258,15 +259,17 @@ static command_t CommandTable[] = {
     {"lf",      CmdLF,        AlwaysAvailable,         "{ Low frequency commands... }"},
     {"mem",     CmdFlashMem,  IfPm3Flash,              "{ Flash Memory manipulation... }"},
     {"reveng",  CmdRev,       AlwaysAvailable,         "{ CRC calculations from RevEng software }"},
-    {"sc",      CmdSmartcard, AlwaysAvailable,          "{ Smart card ISO-7816 commands... }"},
+    {"smart",   CmdSmartcard, AlwaysAvailable,         "{ Smart card ISO-7816 commands... }"},
     {"script",  CmdScript,    AlwaysAvailable,         "{ Scripting commands }"},
     {"trace",   CmdTrace,     AlwaysAvailable,         "{ Trace manipulation... }"},
     {"usart",   CmdUsart,     IfPm3FpcUsartFromUsb,    "{ USART commands... }"},
     {"wiegand", CmdWiegand,   AlwaysAvailable,         "{ Wiegand format manipulation... }"},
-    {"",        CmdHelp,      AlwaysAvailable,         ""},
+    {"--------",CmdHelp,      AlwaysAvailable,         "----------------------- " _CYAN_("sub") " -----------------------"},
+    {"auto",    CmdAuto,      IfPm3Present,           "Automated detection process for unknown tags"},
+    {"help",    CmdHelp,      AlwaysAvailable,         "This help. Use " _YELLOW_("'<command> help'") " for details of a particular command."},
     {"hints",   CmdHints,     AlwaysAvailable,         "Turn hints on / off"},
-    {"pref",    CmdPref,      AlwaysAvailable,         "Edit preferences"},
     {"msleep",  CmdMsleep,    AlwaysAvailable,         "Add a pause in milliseconds"},
+    {"pref",    CmdPref,      AlwaysAvailable,         "Edit preferences"},
     {"rem",     CmdRem,       AlwaysAvailable,         "Add a text line in log file"},
     {"quit",    CmdQuit,      AlwaysAvailable,         ""},
     {"exit",    CmdQuit,      AlwaysAvailable,         "Exit program"},
diff --git a/client/src/cmdscript.c b/client/src/cmdscript.c
index 4fb87cc27..89301e1f4 100644
--- a/client/src/cmdscript.c
+++ b/client/src/cmdscript.c
@@ -36,8 +36,7 @@
 // Partly ripped from PyRun_SimpleFileExFlags
 // but does not terminate client on sys.exit
 // and print exit code only if != 0
-static int Pm3PyRun_SimpleFileNoExit(FILE *fp, const char *filename)
-{
+static int Pm3PyRun_SimpleFileNoExit(FILE *fp, const char *filename) {
     PyObject *m, *d, *v;
     int set_file_name = 0, ret = -1;
     m = PyImport_AddModule("__main__");
@@ -86,7 +85,7 @@ static int Pm3PyRun_SimpleFileNoExit(FILE *fp, const char *filename)
     }
     Py_DECREF(v);
     ret = 0;
-  done:
+done:
     if (set_file_name && PyDict_DelItemString(d, "__file__"))
         PyErr_Clear();
     Py_XDECREF(m);
diff --git a/client/src/comms.c b/client/src/comms.c
index df4c404df..5976cfcc1 100644
--- a/client/src/comms.c
+++ b/client/src/comms.c
@@ -349,7 +349,7 @@ __attribute__((force_align_arg_pointer))
         // main thread will kill and restart this thread.
         if (commfailed) {
             if (conn.last_command != CMD_HARDWARE_RESET) {
-                PrintAndLogEx(WARNING, "Communicating with Proxmark3 device " _RED_("failed"));
+                PrintAndLogEx(WARNING, "\nCommunicating with Proxmark3 device " _RED_("failed"));
             }
             __atomic_test_and_set(&comm_thread_dead, __ATOMIC_SEQ_CST);
             break;
diff --git a/client/src/emv/cmdemv.c b/client/src/emv/cmdemv.c
index 2f754ffc4..57f898425 100644
--- a/client/src/emv/cmdemv.c
+++ b/client/src/emv/cmdemv.c
@@ -1455,7 +1455,7 @@ static int CmdEMVScan(const char *Cmd) {
     // current path + file name
     if (MergeJSON) {
 
-        root = json_load_file( (char*)filename, 0, &error);
+        root = json_load_file((char *)filename, 0, &error);
         if (!root) {
             PrintAndLogEx(ERR, "Json error on line %d: %s", error.line, error.text);
             return PM3_EFILE;
@@ -1750,15 +1750,15 @@ static int CmdEMVScan(const char *Cmd) {
 
     if (MergeJSON == false) {
         // create unique new name
-        char *fname = newfilenamemcopy((char*)filename, ".json");
+        char *fname = newfilenamemcopy((char *)filename, ".json");
         if (fname == NULL) {
             return PM3_EMALLOC;
         }
-        strcpy((char*)filename, fname);
+        strcpy((char *)filename, fname);
         free(fname);
     }
 
-    res = json_dump_file(root, (char*)filename, JSON_INDENT(2));
+    res = json_dump_file(root, (char *)filename, JSON_INDENT(2));
     if (res) {
         PrintAndLogEx(ERR, "Can't save the file: %s", filename);
         return PM3_EFILE;
diff --git a/client/src/emv/emv_pk.c b/client/src/emv/emv_pk.c
index ee354e24d..1a783ef12 100644
--- a/client/src/emv/emv_pk.c
+++ b/client/src/emv/emv_pk.c
@@ -504,19 +504,19 @@ struct emv_pk *emv_pk_get_ca_pk(const unsigned char *rid, unsigned char idx) {
     bool isok = emv_pk_verify(pk);
 
     PrintAndLogEx(INFO, "Verifying CA PK for %02hhx:%02hhx:%02hhx:%02hhx:%02hhx IDX %02hhx %zu bits.  ( %s )",
-           pk->rid[0],
-           pk->rid[1],
-           pk->rid[2],
-           pk->rid[3],
-           pk->rid[4],
-           pk->index,
-           pk->mlen * 8,
-           (isok) ? _GREEN_("ok") : _RED_("failed")
-           );
+                  pk->rid[0],
+                  pk->rid[1],
+                  pk->rid[2],
+                  pk->rid[3],
+                  pk->rid[4],
+                  pk->index,
+                  pk->mlen * 8,
+                  (isok) ? _GREEN_("ok") : _RED_("failed")
+                 );
 
     if (isok) {
         return pk;
-    } 
+    }
 
     emv_pk_free(pk);
     return NULL;
diff --git a/client/src/fileutils.c b/client/src/fileutils.c
index ceeca97e5..e222e54da 100644
--- a/client/src/fileutils.c
+++ b/client/src/fileutils.c
@@ -1369,17 +1369,17 @@ static int convert_plain_mfu_dump(uint8_t **dump, size_t *dumplen, bool verbose)
 }
 
 static int convert_old_mfu_dump(uint8_t **dump, size_t *dumplen, bool verbose) {
-/*  For reference
-typedef struct {
-    uint8_t version[8];
-    uint8_t tbo[2];
-    uint8_t tearing[3];
-    uint8_t pack[2];
-    uint8_t tbo1[1];
-    uint8_t signature[32];
-    uint8_t data[1024];
-} PACKED old_mfu_dump_t;
-*/
+    /*  For reference
+    typedef struct {
+        uint8_t version[8];
+        uint8_t tbo[2];
+        uint8_t tearing[3];
+        uint8_t pack[2];
+        uint8_t tbo1[1];
+        uint8_t signature[32];
+        uint8_t data[1024];
+    } PACKED old_mfu_dump_t;
+    */
 
     // convert old format
     old_mfu_dump_t *old_mfu_dump = (old_mfu_dump_t *)*dump;
@@ -1404,8 +1404,8 @@ typedef struct {
 
     memcpy(mfu_dump->data, old_mfu_dump->data, sizeof(mfu_dump->data));
     mfu_dump->pages = old_data_len / 4 - 1;
-    
-    // Add PACK to last block of memory. 
+
+    // Add PACK to last block of memory.
     memcpy(mfu_dump->data + (mfu_dump->pages * 4 + MFU_DUMP_PREFIX_LENGTH), old_mfu_dump->pack, 2);
 
     if (verbose) {
diff --git a/client/src/mifare/desfire_crypto.c b/client/src/mifare/desfire_crypto.c
index 0ec6bd70d..7260f4731 100644
--- a/client/src/mifare/desfire_crypto.c
+++ b/client/src/mifare/desfire_crypto.c
@@ -882,7 +882,7 @@ void mifare_cypher_blocks_chained(desfiretag_t tag, desfirekey_t key, uint8_t *i
 }
 
 void desfire_crc32(const uint8_t *data, const size_t len, uint8_t *crc) {
-    crc32_ex(data,len,crc);
+    crc32_ex(data, len, crc);
 }
 
 void desfire_crc32_append(uint8_t *data, const size_t len) {
diff --git a/client/src/mifare/mad.c b/client/src/mifare/mad.c
index 9a8e20353..badc4b813 100644
--- a/client/src/mifare/mad.c
+++ b/client/src/mifare/mad.c
@@ -173,7 +173,7 @@ int MADCheck(uint8_t *sector0, uint8_t *sector10, bool verbose, bool *haveMAD2)
     if (sector0 == NULL)
         return PM3_EINVARG;
 
-    uint8_t GPB = sector0[3 * 16 + 9];   
+    uint8_t GPB = sector0[3 * 16 + 9];
     if (verbose)
         PrintAndLogEx(SUCCESS, "%14s " _GREEN_("0x%02x"), "GPB", GPB);
 
@@ -304,7 +304,7 @@ int MAD1DecodeAndPrint(uint8_t *sector, bool swapmad, bool verbose, bool *haveMA
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "---------------- " _CYAN_("Listing") " ----------------");
-            
+
     PrintAndLogEx(INFO, " 00 MAD v1");
     uint32_t prev_aid = 0xFFFFFFFF;
     for (int i = 1; i < 16; i++) {
@@ -326,10 +326,10 @@ int MAD1DecodeAndPrint(uint8_t *sector, bool swapmad, bool verbose, bool *haveMA
 
 int MAD2DecodeAndPrint(uint8_t *sector, bool swapmad, bool verbose) {
     open_mad_file(&mad_known_aids, verbose);
-    
+
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "------------ " _CYAN_("MAD v2 details") " -------------");
-    
+
     int res = madCRCCheck(sector, true, 2);
     if (verbose) {
         if (res == PM3_SUCCESS)
@@ -347,7 +347,7 @@ int MAD2DecodeAndPrint(uint8_t *sector, bool swapmad, bool verbose) {
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "---------------- " _CYAN_("Listing") " ----------------");
-            
+
     PrintAndLogEx(INFO, " 16 MAD v2");
 
     uint32_t prev_aid = 0xFFFFFFFF;
diff --git a/client/src/mifare/ndef.c b/client/src/mifare/ndef.c
index 2aab01634..9e480cde4 100644
--- a/client/src/mifare/ndef.c
+++ b/client/src/mifare/ndef.c
@@ -418,7 +418,7 @@ int NDEFRecordsDecodeAndPrint(uint8_t *ndefRecord, size_t ndefRecordLen) {
         }
 
         PrintAndLogEx(NORMAL, "");
-        PrintAndLogEx(SUCCESS, "Record " _YELLOW_("%zu"), counter);
+        PrintAndLogEx(SUCCESS, _CYAN_("Record") " " _YELLOW_("%zu"), counter);
         PrintAndLogEx(INFO, "-----------------------------------------------------");
         ndefRecordDecodeAndPrint(&ndefRecord[len], NDEFHeader.RecLen);
 
@@ -436,7 +436,7 @@ int NDEFDecodeAndPrint(uint8_t *ndef, size_t ndefLen, bool verbose) {
 
     size_t indx = 0;
 
-    PrintAndLogEx(INFO, "");
+    PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("NDEF parsing") " ----------------");
     while (indx < ndefLen) {
 
@@ -445,7 +445,7 @@ int NDEFDecodeAndPrint(uint8_t *ndef, size_t ndefLen, bool verbose) {
             case 0x00: {
                 indx++;
                 uint16_t len = ndefTLVGetLength(&ndef[indx], &indx);
-                PrintAndLogEx(SUCCESS, "-- NDEF NULL block.");
+                PrintAndLogEx(SUCCESS, "--- " _CYAN_("NDEF NULL block") " ---");
                 if (len)
                     PrintAndLogEx(WARNING, "NDEF NULL block size must be 0, got %d bytes", len);
                 indx += len;
@@ -454,20 +454,21 @@ int NDEFDecodeAndPrint(uint8_t *ndef, size_t ndefLen, bool verbose) {
             case 0x01: {
                 indx++;
                 uint16_t len = ndefTLVGetLength(&ndef[indx], &indx);
-                PrintAndLogEx(INFO, "-- NDEF Lock Control.");
+                PrintAndLogEx(SUCCESS, "--- " _CYAN_("NDEF Lock Control") " ---");
                 if (len != 3) {
                     PrintAndLogEx(WARNING, "NDEF Lock Control block size must be 3 instead of %d.", len);
                 } else {
-                    uint8_t PagesAddr = (ndef[indx] >> 4) & 0x0f;
-                    uint8_t ByteOffset = ndef[indx] & 0x0f;
+                    uint8_t pages_addr = (ndef[indx] >> 4) & 0x0f;
+                    uint8_t byte_offset = ndef[indx] & 0x0f;
                     uint8_t Size = ndef[indx + 1];
                     uint8_t BytesLockedPerLockBit = (ndef[indx + 2] >> 4) & 0x0f;
-                    uint8_t BytesPerPage = ndef[indx + 2] & 0x0f;
-                    PrintAndLogEx(SUCCESS, "PagesAddr. number of pages: %d", PagesAddr);
-                    PrintAndLogEx(SUCCESS, "ByteOffset. number of bytes: %d", ByteOffset);
-                    PrintAndLogEx(SUCCESS, "Size. size in bits of the lock area: %d. bytes approx: %d", Size, Size / 8);
-                    PrintAndLogEx(SUCCESS, "BytesPerPage. number of bytes per page: %d", BytesPerPage);
-                    PrintAndLogEx(SUCCESS, "BytesLockedPerLockBit. number of bytes that each dynamic lock bit is able to lock: %d", BytesLockedPerLockBit);
+                    uint8_t bytes_per_page = ndef[indx + 2] & 0x0f;
+                    PrintAndLogEx(SUCCESS, " Pages addr (number of pages) : %d", pages_addr);
+                    PrintAndLogEx(SUCCESS, "Byte offset (number of bytes) : %d", byte_offset);
+                    PrintAndLogEx(SUCCESS, "Size in bits of the lock area : %d. bytes approx: %d", Size, Size / 8);
+                    PrintAndLogEx(SUCCESS, "       Number of bytes / page : %d", bytes_per_page);
+                    PrintAndLogEx(SUCCESS, "Bytes Locked Per LockBit.");
+                    PrintAndLogEx(SUCCESS, "   number of bytes that each dynamic lock bit is able to lock: %d", BytesLockedPerLockBit);
                 }
                 indx += len;
                 break;
@@ -475,18 +476,18 @@ int NDEFDecodeAndPrint(uint8_t *ndef, size_t ndefLen, bool verbose) {
             case 0x02: {
                 indx++;
                 uint16_t len = ndefTLVGetLength(&ndef[indx], &indx);
-                PrintAndLogEx(INFO, "-- NDEF Memory Control.");
+                PrintAndLogEx(SUCCESS, "--- " _CYAN_("NDEF Memory Control") " ---");
                 if (len != 3) {
                     PrintAndLogEx(WARNING, "NDEF Memory Control block size must be 3 instead of %d.", len);
                 } else {
-                    uint8_t PagesAddr = (ndef[indx] >> 4) & 0x0f;
-                    uint8_t ByteOffset = ndef[indx] & 0x0f;
+                    uint8_t pages_addr = (ndef[indx] >> 4) & 0x0f;
+                    uint8_t byte_offset = ndef[indx] & 0x0f;
                     uint8_t Size = ndef[indx + 1];
-                    uint8_t BytesPerPage = ndef[indx + 2] & 0x0f;
-                    PrintAndLogEx(SUCCESS, "PagesAddr. number of pages: %d", PagesAddr);
-                    PrintAndLogEx(SUCCESS, "ByteOffset. number of bytes: %d", ByteOffset);
-                    PrintAndLogEx(SUCCESS, "Size. size in bits of the reserved area: %d. bytes approx: %d", Size, Size / 8);
-                    PrintAndLogEx(SUCCESS, "BytesPerPage. number of bytes per page: %d", BytesPerPage);
+                    uint8_t bytes_per_page = ndef[indx + 2] & 0x0f;
+                    PrintAndLogEx(SUCCESS, " Pages addr (number of pages) : %d", pages_addr);
+                    PrintAndLogEx(SUCCESS, "Byte offset (number of bytes) : %d", byte_offset);
+                    PrintAndLogEx(SUCCESS, "Size in bits of the reserved area : %d. bytes approx: %d", Size, Size / 8);
+                    PrintAndLogEx(SUCCESS, "       Number of bytes / page : %d", bytes_per_page);
                 }
                 indx += len;
                 break;
@@ -494,28 +495,36 @@ int NDEFDecodeAndPrint(uint8_t *ndef, size_t ndefLen, bool verbose) {
             case 0x03: {
                 indx++;
                 uint16_t len = ndefTLVGetLength(&ndef[indx], &indx);
-                PrintAndLogEx(SUCCESS, "Found NDEF message (%d bytes)", len);
-
-                int res = NDEFRecordsDecodeAndPrint(&ndef[indx], len);
-                if (res != PM3_SUCCESS)
-                    return res;
+                PrintAndLogEx(SUCCESS, "--- " _CYAN_("NDEF Message") " ---");
+                if (len == 0) {
+                    PrintAndLogEx(SUCCESS, "Found NDEF message w zero length");                    
+                } else {
+                    PrintAndLogEx(SUCCESS, "Found NDEF message (%d bytes)", len);
 
+                    int res = NDEFRecordsDecodeAndPrint(&ndef[indx], len);
+                    if (res != PM3_SUCCESS)
+                        return res;
+                }
+                
                 indx += len;
                 break;
             }
             case 0xfd: {
                 indx++;
                 uint16_t len = ndefTLVGetLength(&ndef[indx], &indx);
-                PrintAndLogEx(SUCCESS, "-- NDEF proprietary info. Skipped %d bytes.", len);
+                PrintAndLogEx(SUCCESS, "--- " _CYAN_("Proprietary info") " ---");
+                PrintAndLogEx(SUCCESS, "  Can't decode, skipping %d bytes", len);
                 indx += len;
                 break;
             }
             case 0xfe: {
-                PrintAndLogEx(SUCCESS, "-- NDEF Terminator. Done.");
+                PrintAndLogEx(SUCCESS, "NDEF Terminator detected");
                 return PM3_SUCCESS;
             }
             default: {
-                PrintAndLogEx(ERR, "unknown tag 0x%02x", ndef[indx]);
+                if (verbose)
+                    PrintAndLogEx(ERR, "unknown tag 0x%02x", ndef[indx]);
+
                 return PM3_ESOFT;
             }
         }
diff --git a/client/src/proxmark3.c b/client/src/proxmark3.c
index e13c79591..d820e297d 100644
--- a/client/src/proxmark3.c
+++ b/client/src/proxmark3.c
@@ -117,23 +117,23 @@ static void prompt_compose(char *buf, size_t buflen, const char *promptctx, cons
     snprintf(buf, buflen - 1, PROXPROMPT_COMPOSE, promptdev, promptctx);
 }
 
-#ifdef HAVE_READLINE
 static int check_comm(void) {
     // If communications thread goes down. Device disconnected then this should hook up PM3 again.
     if (IsCommunicationThreadDead() && session.pm3_present) {
+        PrintAndLogEx(INFO, "Running in " _YELLOW_("OFFLINE") " mode. Use "_YELLOW_("\"hw connect\"") " to reconnect\n");
         prompt_dev = PROXPROMPT_DEV_OFFLINE;
+#ifdef HAVE_READLINE
         char prompt[PROXPROMPT_MAX_SIZE] = {0};
         prompt_compose(prompt, sizeof(prompt), prompt_ctx, prompt_dev);
         char prompt_filtered[PROXPROMPT_MAX_SIZE] = {0};
         memcpy_filter_ansi(prompt_filtered, prompt, sizeof(prompt_filtered), !session.supports_colors);
         rl_set_prompt(prompt_filtered);
         rl_forced_update_display();
+#endif
         CloseProxmark();
-        PrintAndLogEx(INFO, "Running in " _YELLOW_("OFFLINE") " mode. Use "_YELLOW_("\"hw connect\"") " to reconnect\n");
     }
     return 0;
 }
-#endif
 
 // first slot is always NULL, indicating absence of script when idx=0
 static FILE *cmdscriptfile[MAX_NESTED_CMDSCRIPT + 1] = {0};
@@ -293,13 +293,17 @@ check_script:
                         printprompt = true;
 
                 } else {
+#ifdef HAVE_READLINE
+                    rl_event_hook = check_comm;
+#else
+                    check_comm();
+#endif
                     prompt_ctx = PROXPROMPT_CTX_INTERACTIVE;
                     char prompt[PROXPROMPT_MAX_SIZE] = {0};
                     prompt_compose(prompt, sizeof(prompt), prompt_ctx, prompt_dev);
                     char prompt_filtered[PROXPROMPT_MAX_SIZE] = {0};
                     memcpy_filter_ansi(prompt_filtered, prompt, sizeof(prompt_filtered), !session.supports_colors);
 #ifdef HAVE_READLINE
-                    rl_event_hook = check_comm;
                     cmd = readline(prompt_filtered);
 #else
                     printf("%s", prompt_filtered);
@@ -477,7 +481,6 @@ static void set_my_user_directory(void) {
                 free(cwd_buffer);
                 return;
             }
-            PrintAndLogEx(NORMAL, "Len... %d", pathLen);
         }
 
         if (!error) {
diff --git a/client/src/ui.c b/client/src/ui.c
index 04e002950..e84d4203c 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -22,10 +22,6 @@
 #include <stdarg.h>
 #include <stdlib.h>
 
-#ifdef HAVE_READLINE
-#include <readline/readline.h>
-#endif
-
 #include <complex.h>
 #include "util.h"
 #include "proxmark3.h"  // PROXLOG
diff --git a/common/lfdemod.c b/common/lfdemod.c
index 89910488d..e952ed59c 100644
--- a/common/lfdemod.c
+++ b/common/lfdemod.c
@@ -1541,7 +1541,7 @@ static uint16_t cleanAskRawDemod(uint8_t *bits, size_t *size, int clk, int inver
     if ((pos > cl_2 - cl_4 - 1) && (pos <= clk + cl_4 + 1)) {
         bits[bitCnt++] = invert ^ 1;
     }
-    
+
     // sample counts,   like clock = 32.. it tries to find  32/4 = 8,  32/2 = 16
     for (size_t i = pos; i < *size; i++) {
         if (bits[i] >= high && waveHigh) {
diff --git a/common_arm/ldscript.common b/common_arm/ldscript.common
index c1fb5e848..610e5c0b4 100644
--- a/common_arm/ldscript.common
+++ b/common_arm/ldscript.common
@@ -9,7 +9,7 @@ ms of the GNU GPL, version 2 or,
 -----------------------------------------------------------------------------
 */
 
-stacksize = DEFINED(stacksize) ? stacksize : 6K;
+stacksize = DEFINED(stacksize) ? stacksize : 8488;
 commonareasize = 0x20;
 
 /* AT91SAM7S256 has 256k Flash and 64k RAM */
diff --git a/doc/md/Development/Makefile-vs-CMake.md b/doc/md/Development/Makefile-vs-CMake.md
index 6c2432c70..98a7b0dde 100644
--- a/doc/md/Development/Makefile-vs-CMake.md
+++ b/doc/md/Development/Makefile-vs-CMake.md
@@ -16,8 +16,7 @@ At the moment both are maintained because they don't perfectly overlap yet.
 | verbose | V=1 | VERBOSE=1 |   |
 | warnings management | yes (1) | **no** | (1) cf Makefile.defs |
 | compilation | in place | in build dir | |
-| user `CFLAGS`/`LDFLAGS` | honored (1) | **no/auto?** | (1) also `LDLIBS` and `INCLUDES_CLIENT` as envvars for more tuning |
-| `PKG_CONFIG_ENV` | yes | **no/auto?** | |
+| user `CFLAGS`/`LDFLAGS` | envvars honored (1) | envvars honored (2) | (1) also `LDLIBS` and `INCLUDES_CLIENT` for more tuning (2) only at first cmake call |
 | Mingw gnu printf | `_ISOC99_SOURCE` | `_ISOC99_SOURCE` | and in cbor.h: `__attribute__((format (__MINGW_PRINTF_FORMAT, 2, 3)))`|
 | C++ | c++11 | gnu++14 | |
 | dep amiibo | in_deps | in_deps |   |
@@ -27,28 +26,28 @@ At the moment both are maintained because they don't perfectly overlap yet.
 | bluez detection | pc | pkg_search_module |   |
 | `SKIPBT` | yes | yes |   |
 | dep bzip2 | sys | sys |   |
-| bzip2 detection | **none** | **none**, Android:gitclone | |
+| bzip2 detection | **none** | find_package, Android:gitclone | |
 | dep cliparser | in_deps | in_deps |   |
 | dep hardnested | in_deps | in_deps |   |
-| hardn arch autodetect | (1) | (2) | (1) uname -m == 86 or amd64; gcc -E -mavx512f? +-AVX512 (2) CMAKE_SYSTEM_PROCESSOR == x86 or x86_64 or i686 or AMD64 (always incl. AVX512) |
+| hardn arch autodetect | `uname -m` =? 86 or amd64; `$(CC) -E -mavx512f`? +AVX512` |  `CMAKE_SYSTEM_PROCESSOR` =? x86 or x86_64 or i686 or AMD64 (1) | (1) currently it always includes AVX512 on Intel arch |
 | `cpu_arch` | yes | **no/auto?** | e.g. `cpu_arch=generic` for cross-compilation
-| dep jansson | sys / in_deps | **in_deps only** |   |
-| jansson detection | pc | **none** |   |
-| `SKIPJANSSONSYSTEM` | yes | **no** |   |
+| dep jansson | sys / in_deps | sys / in_deps |   |
+| jansson detection | pc | pc/find* |   |
+| `SKIPJANSSONSYSTEM` | yes | yes |   |
 | dep lua | sys / in_deps(1) | **in_deps only**(2) | (1) manual def of `LUAPLATFORM` for mingw/macosx/linux (2) manual, different?, for Android too |
 | lua detection | pc | **none** |   |
 | `SKIPLUASYSTEM` | yes | **no** |   |
-| lualibs/pm3_cmd.lua | yes | **add_custom_command used?** |
-| lualibs/mfc_default_keys.lua | yes | **add_custom_command used?** |
-| dep lz4 |  |  | (in_common) not yet used, future |
+| lualibs/pm3_cmd.lua | yes | add_custom_command **but unused** | |
+| lualibs/mfc_default_keys.lua | yes | add_custom_command **but unused** | |
+| dep lz4 |  |  | (in_common) not yet used, future. See `get_lz4.sh` for upstream fetch & patch |
 | dep libm | sys | sys | |
-| libm detection | none | **none/auto?** | |
+| libm detection | **none** | **none** (1) | (1) cf https://cmake.org/pipermail/cmake/2019-March/069168.html ? |
 | dep mbedtls | in_common | in_common | no sys lib: missing support for CMAC in def conf (btw no .pc available) |
 | dep python3 | opt, sys, <3.8 & 3.8 | opt, sys, <3.8 & 3.8 |   |
 | python3 detection | pc | pkg_search_module | |
 | `SKIPPYTHON`  | yes | yes |   |
 | dep pthread | sys | sys |  |
-| pthread detection | **none** | **none** |   |
+| pthread detection | **none** | **none** (1) | (1) cf https://stackoverflow.com/questions/1620918/cmake-and-libpthread ? |
 | `SKIPPTHREAD` | yes | yes | e.g. for termux |
 | dep Qt | opt, sys, Qt5 & Qt4 | opt, sys, Qt5 |  |
 | Qt detection | pc(qt5)/pc(qt4)/`QTDIR`(1) (2) | find_package(qt5) (3) | (1) if `QTDIR`: hardcode path (2) OSX: pkg-config hook for Brew (3) OSX: add search path|
@@ -59,9 +58,9 @@ At the moment both are maintained because they don't perfectly overlap yet.
 | dep reveng | in_deps | in_deps | |
 | `SKIPREVENGTEST` | yes(1) | **no**(2) | (1) e.g. if cross-compilation (2) tests aren't compiled/ran with cmake |
 | dep tinycbor | in_deps | in_deps |   |
-| dep whereami | sys / in_deps | **in_deps only** |   |
-| whereami detection | **search /usr/include/whereami.h** | **none** | no .pc available |
-| `SKIPWHEREAMISYSTEM` | yes | **no** |   |
+| dep whereami | sys / in_deps | sys / in_deps |   |
+| whereami detection | **search /usr/include/whereami.h** | find* | no .pc available |
+| `SKIPWHEREAMISYSTEM` | yes | yes |   |
 | version | mkversion | mkversion | |
 | install | yes (1) | **no** | (1) supports `DESTDIR`, `PREFIX`, `UDEV_PREFIX`. Installs resources as well, `INSTALL*RELPATH` |
 | deb | no | partial? | |
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index d8336bd65..125db9a7f 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -386,7 +386,7 @@ typedef struct {
 #define CMD_DOWNLOADED_BIGBUF                                             0x0208
 #define CMD_LF_UPLOAD_SIM_SAMPLES                                         0x0209
 #define CMD_LF_SIMULATE                                                   0x020A
-#define CMD_LF_HID_DEMOD                                                  0x020B
+#define CMD_LF_HID_WATCH                                                  0x020B
 #define CMD_LF_HID_SIMULATE                                               0x020C
 #define CMD_LF_SET_DIVISOR                                                0x020D
 #define CMD_LF_SIMULATE_BIDIR                                             0x020E
@@ -400,8 +400,8 @@ typedef struct {
 #define CMD_LF_PCF7931_WRITE                                              0x0223
 #define CMD_LF_EM4X_READWORD                                              0x0218
 #define CMD_LF_EM4X_WRITEWORD                                             0x0219
-#define CMD_LF_IO_DEMOD                                                   0x021A
-#define CMD_LF_EM410X_DEMOD                                               0x021C
+#define CMD_LF_IO_WATCH                                                   0x021A
+#define CMD_LF_EM410X_WATCH                                               0x021C
 #define CMD_LF_EM4X50_INFO                                                0x0240
 #define CMD_LF_EM4X50_WRITE                                               0x0241
 #define CMD_LF_EM4X50_WRITE_PASSWORD                                      0x0242
@@ -411,7 +411,7 @@ typedef struct {
 #define CMD_LF_ASK_SIMULATE                                               0x021F
 #define CMD_LF_PSK_SIMULATE                                               0x0220
 #define CMD_LF_NRZ_SIMULATE                                               0x0232
-#define CMD_LF_AWID_DEMOD                                                 0x0221
+#define CMD_LF_AWID_WATCH                                                 0x0221
 #define CMD_LF_VIKING_CLONE                                               0x0222
 #define CMD_LF_T55XX_WAKEUP                                               0x0224
 #define CMD_LF_COTAG_READ                                                 0x0225