OK I'm getting real excited now, the prox is built and it was high time I tested it, but for that I needed some antennas.At first I used a piece of wirewrap "green wire" and rolled a 5 turn aircoil 43mm diameter, then experimentally played around with adding or removing a turn while issuing the tune command to get a voltage reading. It mostly sat around 1.3V except when I let the coil turns lose and unravelled and the coil looked like a deformed spring the voltage jumped to over 10V but that was not really an option for an antenna. I then returned to the 43mm diameter coil with 4 turns and taped the coil with sellotape to keep it together then started deforming it to see what difference that made. It looks like I got lucky as squashing it to an elongated and slighlty rectangular shape moved the voltage to about 16V.
This is how I ended up with this shape. It used to be straighter but the coil has been through a lot. It's soldered direct to the test pads as somebody forgot to order the mating hirose connector 
when buying the parts...
The picture below is a typical setup where a RFID snapper card is sandwitched between the proxmark3 antenna and a snapper feeder (card reader, the black thing that looks like a USB flash key)
While in this close proximity, I issue the hi14asnoop command on the prox, then drive the snapper feeder with some python script for example issuing four consecutive list card commands in my python shell, like so:
>>> b.snapper_send_data(PN5XX_LIST_TAG)
sent: 0000FF04FCD44A0100E100
recv: 0000FF14ECD54B010104002004086B64BE08578002011000092600
>>> b.snapper_send_data(PN5XX_RF_OFF)
sent: 0000FF04FCD4320100F900
recv: 0000FF02FED533F800
>>> b.snapper_send_data(PN5XX_LIST_TAG)
sent: 0000FF04FCD44A0100E100
recv: 0000FF14ECD54B01010400200408DC78E708578002011000097800
>>> b.snapper_send_data(PN5XX_RF_OFF)
sent: 0000FF04FCD4320100F900
recv: 0000FF02FED533F800
>>> b.snapper_send_data(PN5XX_LIST_TAG)
sent: 0000FF04FCD44A0100E100
recv: 0000FF14ECD54B01010400200408E743D10857800201100009B800
>>> b.snapper_send_data(PN5XX_RF_OFF)
sent: 0000FF04FCD4320100F900
recv: 0000FF02FED533F800
>>> b.snapper_send_data(PN5XX_LIST_TAG)
sent: 0000FF04FCD44A0100E100
recv: 0000FF14ECD54B0101040020040841B32908578002011000099600
>>> b.snapper_send_data(PN5XX_RF_OFF)
sent: 0000FF04FCD4320100F900
recv: 0000FF02FED533F800
Then stopping the snoop (press the prox button) and issuing the hi14alist command we can see what the prox snooped. Note that the card's UID changes every time, so it moves through UIDs 086B64BE, 08DC78E7, 08E743D1, 0841B329 and these UIDs in the snooped prox output match the returned values in the python debug output.
>>>> hi14alist
recorded activity:
ETU :rssi: who bytes
---------+----+----+-----------
+ 0: 0: TAG 04 00
+ 1304: : 93 20
+ 64: 0: TAG 08 6b 64 be b9
+ 3471: : 93 70 08 6b 64 be b9 55 34
+ 64: 0: TAG 20 fc 70
+ 1488: : e0 50 bc a5
+ 88: 0: TAG 08 57 80 02 01 10 00 09 94 da
+ 828164: : 26
+ 5142: : 26
+ 64: 0: TAG 04 00
+ 1304: : 93 20
+ 64: 0: TAG 08 dc 78 e7 4b
+ 3472: : 93 70 08 dc 78 e7 4b ac f2
+ 64: 0: TAG 20 fc 70
+ 1488: : e0 50 bc a5
+ 88: 0: TAG 08 57 80 02 01 10 00 09 94 da
+ 612070: : 26
+ 5142: : 26
+ 1368: : 93 20
+ 64: 0: TAG 08 e7 43 d1 7d
+ 3472: : 93 70 08 e7 43 d1 7d 84 67
+ 64: 0: TAG 20 fc 70
+ 1488: : e0 50 bc a5
+ 88: 0: TAG 08 57 80 02 01 10 00 09 94 da
+ 578188: : 26
+ 5144: : 26
+ 64: 0: TAG 04 00
+ 1303: : 93 20
+ 3536: : 93 70 08 41 b3 29 d3 ab fc
+ 64: 0: TAG 20 fc 70
Finally for completeness I took Roel's idea of using a toilet paper roll, cut a slice and wound 150 turns of 0.125mm wire on it. I knew people had success in the past with around 100 turns so I started high and removed turns to get the tuning right. With 150 turns I used to get 45V on 125khz and about 20V on 136khz and as I removed turns these numbers moved closer to each other. There isn't much point going higher than 40V as the zenners will clip the voltage so I removed enough turns (lost count) until tune reported 29V at 125khz and 30V at 136khz. The picture below shows the final coil, sellotape is holding the coil to the TP roll 
and in the picture it's not actually soldered to the board as it's a little cumbersome to carry that around so I only fit it when needed. Currently I'm not doing any LF work so this coil isn't needed but it has successfully read some HID tags I have (in raw data mode).
]]>
