diff --git a/armsrc/apps.h b/armsrc/apps.h
index 39ee32115..c8802dc1a 100644
--- a/armsrc/apps.h
+++ b/armsrc/apps.h
@@ -20,6 +20,7 @@
 #include <strings.h>
 #include "../common/crc32.h"
 #include "BigBuf.h"
+#include "../include/hitag2.h"
 
 extern const uint8_t OddByteParity[256];
 extern int rsamples;   // = 0;
@@ -116,9 +117,9 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc);
 void AcquireTiType(void);
 void AcquireRawBitsTI(void);
 void SimulateTagLowFrequency( uint16_t period, uint32_t gap, uint8_t ledcontrol);
-void SimulateTagLowFrequencyA(int period, int gap);
+//void SimulateTagLowFrequencyA(int period, int gap);
 
-void CmdHIDsimTAG(int hi, int lo, uint8_t ledcontrol);
+void CmdHIDsimTAG(int hi, int lo, int ledcontrol);
 void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol);
 void CmdEM410xdemod(int findone, int *high, int *low, int ledcontrol);
 void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol);
diff --git a/armsrc/epa.c b/armsrc/epa.c
index a04b76280..7bff9f198 100644
--- a/armsrc/epa.c
+++ b/armsrc/epa.c
@@ -15,6 +15,7 @@
 #include "epa.h"
 #include "../common/cmd.h"
 
+
 // Protocol and Parameter Selection Request
 // use regular (1x) speed in both directions
 // CRC is already included
diff --git a/armsrc/iso14443a.h b/armsrc/iso14443a.h
index 771a6f595..026049351 100644
--- a/armsrc/iso14443a.h
+++ b/armsrc/iso14443a.h
@@ -13,6 +13,7 @@
 #ifndef __ISO14443A_H
 #define __ISO14443A_H
 #include "../include/common.h"
+#include "../include/mifare.h"
 #include "mifaresniff.h"
 
 typedef struct {
diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 7b6fa97a7..98045d81f 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -82,8 +82,10 @@ void LFSetupFPGAForADC(int divisor, bool lf_field)
 
     // Connect the A/D to the peak-detected low-frequency path.
     SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
+	
     // Give it a bit of time for the resonant antenna to settle.
-    SpinDelay(50);
+	SpinDelay(150);
+	
     // Now set up the SSC to get the ADC samples that are now streaming at us.
     FpgaSetupSsc();
 }
@@ -465,7 +467,7 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
     DbpString("Now use tiread to check");
 }
 
-void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
+void SimulateTagLowFrequency(uint16_t period, uint32_t gap, uint8_t ledcontrol)
 {
     int i;
     uint8_t *tab = BigBuf_get_addr();
@@ -897,10 +899,20 @@ void CmdIOdemodFSK(int findone, int *high, int *low, int ledcontrol)
  * To compensate antenna falling times shorten the write times
  * and enlarge the gap ones.
  */
-#define START_GAP 250
-#define WRITE_GAP 160
-#define WRITE_0   144 // 192
-#define WRITE_1   400 // 432 for T55x7; 448 for E5550
+#define START_GAP 30*8 // 10 - 50fc 250
+#define WRITE_GAP 20*8 //  8 - 30fc
+#define WRITE_0   24*8 // 16 - 31fc 24fc 192
+#define WRITE_1   54*8 // 48 - 63fc 54fc 432 for T55x7; 448 for E5550
+
+//  VALUES TAKEN FROM EM4x function: SendForward
+//  START_GAP = 440;       (55*8) cycles at 125Khz (8us = 1cycle)
+//  WRITE_GAP = 128;       (16*8)
+//  WRITE_1   = 256 32*8;  (32*8) 
+
+//  These timings work for 4469/4269/4305 (with the 55*8 above)
+//  WRITE_0 = 23*8 , 9*8  SpinDelayUs(23*8); 
+
+#define T55xx_SAMPLES_SIZE		12000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
 
 // Write one bit to card
 void T55xxWriteBit(int bit)
@@ -908,7 +920,7 @@ void T55xxWriteBit(int bit)
     FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
     FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
     FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
-    if (bit == 0)
+	if (!bit)
         SpinDelayUs(WRITE_0);
     else
         SpinDelayUs(WRITE_1);
@@ -919,16 +931,11 @@ void T55xxWriteBit(int bit)
 // Write one card block in page 0, no lock
 void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
 {
-    //unsigned int i;  //enio adjustment 12/10/14
-    uint32_t i;
+	uint32_t i = 0;
 
-    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
-
-    // Give it a bit of time for the resonant antenna to settle.
-    // And for the tag to fully power up
-    SpinDelay(150);
+	// Set up FPGA, 125kHz
+	// Wait for config.. (192+8190xPOW)x8 == 67ms
+	LFSetupFPGAForADC(0, true);
 
     // Now start writting
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
@@ -965,26 +972,15 @@ void T55xxWriteBlock(uint32_t Data, uint32_t Block, uint32_t Pwd, uint8_t PwdMod
 void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
 {
     uint8_t *dest = BigBuf_get_addr();
-    //int m=0, i=0; //enio adjustment 12/10/14
-    uint32_t m=0, i=0;
-    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-    m = BigBuf_max_traceLen();
-    // Clear destination buffer before sending the command
-    memset(dest, 128, m);
-    // Connect the A/D to the peak-detected low-frequency path.
-    SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
-    // Now set up the SSC to get the ADC samples that are now streaming at us.
-    FpgaSetupSsc();
-
-    LED_D_ON();
-    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
-
-    // Give it a bit of time for the resonant antenna to settle.
-    // And for the tag to fully power up
-    SpinDelay(150);
-
-    // Now start writting
+    //uint16_t bufferlength = BigBuf_max_traceLen();
+	uint16_t bufferlength = T55xx_SAMPLES_SIZE;
+    uint32_t i = 0;
+	// Clear destination buffer before sending the command  0x80 = average.
+	memset(dest, 0x80, bufferlength);	   
+	
+	// Set up FPGA, 125kHz
+	// Wait for config.. (192+8190xPOW)x8 == 67ms
+	LFSetupFPGAForADC(0, true);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     SpinDelayUs(START_GAP);
 
@@ -1003,53 +999,40 @@ void T55xxReadBlock(uint32_t Block, uint32_t Pwd, uint8_t PwdMode)
         T55xxWriteBit(Block & i);
 
     // Turn field on to read the response
-    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
+	TurnReadLFOn();
 
     // Now do the acquisition
     i = 0;
     for(;;) {
         if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
             AT91C_BASE_SSC->SSC_THR = 0x43;
+			//AT91C_BASE_SSC->SSC_THR = 0xff;
+			LED_D_ON();
         }
         if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
             dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-            // we don't care about actual value, only if it's more or less than a
-            // threshold essentially we capture zero crossings for later analysis
-            //			if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
-            i++;
-            if (i >= m) break;
+			++i;
+			LED_D_OFF();
+			if (i >= bufferlength) break;
         }
     }
 
+	cmd_send(CMD_ACK,0,0,0,0,0);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
     LED_D_OFF();
-    DbpString("DONE!");
 }
 
 // Read card traceability data (page 1)
 void T55xxReadTrace(void){
     uint8_t *dest = BigBuf_get_addr();
-    int m=0, i=0;
+    //uint16_t bufferlength = BigBuf_max_traceLen();
+	uint16_t bufferlength = T55xx_SAMPLES_SIZE;
+	uint32_t i = 0;
 
-    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-    m = BigBuf_max_traceLen();
-    // Clear destination buffer before sending the command
-    memset(dest, 128, m);
-    // Connect the A/D to the peak-detected low-frequency path.
-    SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
-    // Now set up the SSC to get the ADC samples that are now streaming at us.
-    FpgaSetupSsc();
-
-    LED_D_ON();
-    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
-
-    // Give it a bit of time for the resonant antenna to settle.
-    // And for the tag to fully power up
-    SpinDelay(150);
-
-    // Now start writting
+	// Clear destination buffer before sending the command 0x80 = average
+	memset(dest, 0x80, bufferlength);  
+  
+	LFSetupFPGAForADC(0, true);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     SpinDelayUs(START_GAP);
 
@@ -1058,25 +1041,34 @@ void T55xxReadTrace(void){
     T55xxWriteBit(1); //Page 1
 
     // Turn field on to read the response
-    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
+	TurnReadLFOn();
 
     // Now do the acquisition
-    i = 0;
     for(;;) {
         if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
             AT91C_BASE_SSC->SSC_THR = 0x43;
+			LED_D_ON();
         }
         if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
             dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-            i++;
-            if (i >= m) break;
-        }
-    }
-
+			++i;
+			LED_D_OFF();
+		
+			if (i >= bufferlength) break;
+		}
+	}
+  
+	cmd_send(CMD_ACK,0,0,0,0,0);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
     LED_D_OFF();
-    DbpString("DONE!");
+}
+
+void TurnReadLFOn(){
+	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
+	// Give it a bit of time for the resonant antenna to settle.
+	//SpinDelay(30);
+	SpinDelayUs(8*150);
 }
 
 /*-------------- Cloning routines -----------*/
@@ -1800,9 +1792,14 @@ void EM4xLogin(uint32_t Password) {
 
 void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
 
+  	uint8_t *dest =  BigBuf_get_addr();
+	uint16_t bufferlength = BigBuf_max_traceLen();
+	uint32_t i = 0;
+
+	// Clear destination buffer before sending the command  0x80 = average.
+	memset(dest, 0x80, bufferlength);
+	
     uint8_t fwd_bit_count;
-    uint8_t *dest = BigBuf_get_addr();
-    int m=0, i=0;
 
     //If password mode do login
     if (PwdMode == 1) EM4xLogin(Pwd);
@@ -1811,9 +1808,6 @@ void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
     fwd_bit_count = Prepare_Cmd( FWD_CMD_READ );
     fwd_bit_count += Prepare_Addr( Address );
 
-    m = BigBuf_max_traceLen();
-    // Clear destination buffer before sending the command
-    memset(dest, 128, m);
     // Connect the A/D to the peak-detected low-frequency path.
     SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
     // Now set up the SSC to get the ADC samples that are now streaming at us.
@@ -1829,10 +1823,12 @@ void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode) {
         }
         if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY) {
             dest[i] = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-            i++;
-            if (i >= m) break;
-        }
-    }
+			++i;
+			if (i >= bufferlength) break;
+		}
+	}
+  
+	cmd_send(CMD_ACK,0,0,0,0,0);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
     LED_D_OFF();
 }
diff --git a/client/cmdlft55xx.c b/client/cmdlft55xx.c
index f35edaa46..c023d57f6 100644
--- a/client/cmdlft55xx.c
+++ b/client/cmdlft55xx.c
@@ -65,8 +65,12 @@ int CmdReadBlk(const char *Cmd)
 	int invert = 0;
 	int clk = 0;
 	int block = -1;
+	int errCnt;
+	size_t bitlen;
+	//int decodedBitlen;
+	uint32_t blockData;
 	uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};
-
+	
 	sscanf(Cmd, "%d", &block);
 	
 	if ((block > 7) | (block < 0)) {
@@ -78,21 +82,21 @@ int CmdReadBlk(const char *Cmd)
 	SendCommand(&c);
 	if ( !WaitForResponseTimeout(CMD_ACK,NULL,1500) ) {
 		PrintAndLog("command execution time out");
-		return 1;
+		return 2;
 	}
 	
-	CmdSamples("");
+	CmdSamples("12000");
 
-	size_t bitlen = getFromGraphBuf(bits);
+	bitlen = getFromGraphBuf(bits);
 	
-	int errCnt = askrawdemod(bits, &bitlen, &clk, &invert);
+	errCnt = askrawdemod(bits, &bitlen, &clk, &invert);
 	
 	//throw away static - allow 1 and -1 (in case of threshold command first)
 	if ( errCnt == -1 || bitlen < 16 ){  
 		PrintAndLog("no data found");
 		if (g_debugMode) 
 			PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
-		return 0;
+		return 3;
 	}
 	if (g_debugMode) 
 		PrintAndLog("Using Clock: %d - invert: %d - Bits Found: %d", clk, invert, bitlen);
@@ -100,6 +104,23 @@ int CmdReadBlk(const char *Cmd)
 	//move bits back to DemodBuffer
 	setDemodBuf(bits, bitlen, 0);
 	printBitStream(bits,bitlen);
+	
+	// bits has the manchester encoded data.
+	errCnt = manrawdecode(bits, &bitlen);	
+	if ( errCnt == -1 || bitlen < 16 ){  
+		PrintAndLog("no data found");
+		if (g_debugMode) 
+			PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
+		return 4;
+	}
+
+	blockData = PackBits(0, 32, bits);
+
+	if ( block < 0)
+		PrintAndLog(" Decoded     : 0x%08X  %s", blockData, sprint_bin(bits,32) );
+	else
+		PrintAndLog(" Block %d    : 0x%08X  %s", block, blockData, sprint_bin(bits,32) );
+	
 	return 0;
 }
 
@@ -391,9 +412,7 @@ int ManchesterDemod(int blockNum){
 	uint8_t  bits[LF_BITSSTREAM_LEN] = {0x00};
 	uint8_t * bitstream = bits;
 	
-	//manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);	
 	manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);	
-    //blockData = PackBits(offset, sizebyte, bitstream);
 	blockData = PackBits(offset, sizebyte, bits);
 
 	if ( blockNum < 0)
@@ -524,7 +543,7 @@ static command_t CommandTable[] =
   {"trace",  CmdReadTrace,   0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},
   {"info",   CmdInfo,        0, "[1] Read T55xx configuration data (page 0/ blk 0)"},
   {"dump",   CmdDump,        0, "[password] Dump T55xx card block 0-7. optional with password"},
-  {"fsk",    CmdIceFsk,      0, "FSK demod"},
+  //{"fsk",    CmdIceFsk,      0, "FSK demod"},
   {"man",    CmdIceManchester,      0, "Manchester demod (with SST)"},
   {NULL, NULL, 0, NULL}
 };
diff --git a/client/ui.c b/client/ui.c
index b31f1ead5..10ae13106 100644
--- a/client/ui.c
+++ b/client/ui.c
@@ -213,8 +213,6 @@ int manchester_decode( int * data, const size_t len, uint8_t * dataout,  size_t
  
  int ManchesterConvertFrom1(const int * data, const size_t len, uint8_t * dataout,int dataoutlen, int clock, int startIndex){
 
-	PrintAndLog(" Path B");
- 
 	int i,j, bitindex, lc, tolerance, warnings;
 	warnings = 0;
 	int upperlimit = len*2/clock+8;