I have been trying to authenticate MIFARE classic 4k contactless cards using Identive SDI010 Contactless Reader within Zebra ZXP SERIES 7 PRO printer. I can successfully load keys using below command
FF 82 00 60 06 FF FF FF FF FF FF
response - 9000
However authentication command always fails
FF 86 00 00 05 01 00 06 60 00
response - 6982 Security status not satisfied (not authenticated)
I also tried APDU commands from other similar posts but all are giving same response. What am I doing wrong here?
This commands worked for me.
FF 82 00 60 06 A0 A1 A2 A3 A4 A5
FF 86 00 00 05 01 00 03 60 01
I have the ZXP3. Using the Mifare 1K test app in the PCSC-Sharp library, this worked:
Load Authentication Keys: FF-82-00-60-06-FF-FF-FF-FF-FF-FF
SW1 SW2 = 90 00
General Authenticate: FF-86-00-00-05-01-00-08-60-00
SW1 SW2 = 90 00
I'm learning to use pico-imx6 on baseboard pico-dwarf. I copy the image to the eMMC on pico-imx6 using:
sudo dd if=pico-imx6_pico-dwarf_ubuntu-16.04_installer_hdmi_20160825.img
of=/dev/sd<partition> bs=1M && sync
The boot process is stuck. Here is the whole console message:
U-Boot SPL 2015.04-00021-g9a899f8 (Jul 19 2016 - 14:07:40)
Boot Device: MMC
Boot Device: MMC
reading u-boot.img
reading u-boot.img
U-Boot 2015.04-00021-g9a899f8 (Jul 19 2016 - 14:07:40)
CPU: Freescale i.MX6Q rev1.5 at 792 MHz
CPU: Temperature 43 C
Reset cause: POR
I2C: ready
DRAM: 1 GiB
MMC: FSL_SDHC: 0, FSL_SDHC: 1
*** Warning - bad CRC, using default environment
auto-detected panel HDMI
Display: HDMI (1024x768)
In: serial
Out: serial
Err: serial
Board: pico-imx6
Available baseboard: dwarf, hobbit, nymph
Can't find PMIC:PFUZE100
Failed to init PMIC
Wrong boot device!Net: FEC [PRIME]
Normal Boot
Hit any key to stop autoboot: 1 0
switch to partitions #0, OK
mmc0(part 0) is current device
reading uEnv.txt
213 bytes read in 9 ms (22.5 KiB/s)
Loaded environment from uEnv.txt
Importing environment from mmc ...
Running uenvcmd ...
reading zImage
5688264 bytes read in 284 ms (19.1 MiB/s)
Booting from mmc ...
baseboard is dwarf
reading imx6q-pico_dwarf.dtb
43768 bytes read in 18 ms (2.3 MiB/s)
Kernel image # 0x12000000 [ 0x000000 - 0x56cbc8 ]
## Flattened Device Tree blob at 18000000
Booting using the fdt blob at 0x18000000
Using Device Tree in place at 18000000, end 1800daf7
Starting kernel ...
Booting Linux on physical CPU 0x0
Linux version 4.1.15-00065-g1514894 (tapani#triceratops) (/opt/gcc-linaro-5.1-2015.08-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-gcc: /lib/libc.so.6: weak version `GLIBC_2.14' not found (required by /opt/gcc-linaro-5.1-2015.08-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf-gcc) gcc version 5.1.1 20150608 (Linaro GCC 5.1-2015.08) ) #7 SMP PREEMPT Thu Jun 23 18:07:43 CST 2016
CPU: ARMv7 Processor [412fc09a] revision 10 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine model: Technexion PICO-IMX6 Quad with dwarf board
Reserved memory: created CMA memory pool at 0x3c000000, size 320 MiB
Reserved memory: initialized node linux,cma, compatible id shared-dma-pool
Memory policy: Data cache writealloc
PERCPU: Embedded 12 pages/cpu #ab706000 s17344 r8192 d23616 u49152
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 260096
Kernel command line: console=ttymxc0,115200 root=/dev/mmcblk2p2 rootwait rw video=mxcfb0:dev=hdmi,1280x720M#60,bpp=32 fbmem=28M
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 700120K/1048576K available (7254K kernel code, 321K rwdata, 2352K rodata, 376K init, 430K bss, 20776K reserved, 327680K cma-reserved, 0K highmem)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
vmalloc : 0xc0800000 - 0xff000000 (1000 MB)
lowmem : 0x80000000 - 0xc0000000 (1024 MB)
pkmap : 0x7fe00000 - 0x80000000 ( 2 MB)
modules : 0x7f000000 - 0x7fe00000 ( 14 MB)
.text : 0x80008000 - 0x80969b78 (9607 kB)
.init : 0x8096a000 - 0x809c8000 ( 376 kB)
.data : 0x809c8000 - 0x80a185e0 ( 322 kB)
.bss : 0x80a1b000 - 0x80a86b48 ( 431 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Preemptible hierarchical RCU implementation.
Additional per-CPU info printed with stalls.
NR_IRQS:16 nr_irqs:16 16
L2C-310 erratum 769419 enabled
L2C-310 enabling early BRESP for Cortex-A9
L2C-310 full line of zeros enabled for Cortex-A9
L2C-310 ID prefetch enabled, offset 16 lines
L2C-310 dynamic clock gating enabled, standby mode enabled
L2C-310 cache controller enabled, 16 ways, 1024 kB
L2C-310: CACHE_ID 0x410000c7, AUX_CTRL 0x76070001
mxc_clocksource_init 3000000
Switching to timer-based delay loop, resolution 333ns
sched_clock: 32 bits at 3000kHz, resolution 333ns, wraps every 715827882841ns
clocksource mxc_timer1: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 637086815595 ns
Console: colour dummy device 80x30
Calibrating delay loop (skipped), value calculated using timer frequency.. 6.00 BogoMIPS (lpj=30000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 2048 (order: 1, 8192 bytes)
Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes)
CPU: Testing write buffer coherency: ok
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x10008280 - 0x100082d8
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
CPU2: thread -1, cpu 2, socket 0, mpidr 80000002
CPU3: thread -1, cpu 3, socket 0, mpidr 80000003
Brought up 4 CPUs
SMP: Total of 4 processors activated (24.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
cpuidle: using governor ladder
cpuidle: using governor menu
CPU identified as i.MX6Q, silicon rev 1.5
hw-breakpoint: found 5 (+1 reserved) breakpoint and 1 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 4 bytes.
imx6q-pinctrl 20e0000.iomuxc: initialized IMX pinctrl driver
imx-gpc 20dc000.gpc: no fsl,ldo-bypass found!
mxs-dma 110000.dma-apbh: initialized
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
2000000.aips-bus:usbphy_nop1 supply vcc not found, using dummy regulator
2000000.aips-bus:usbphy_nop2 supply vcc not found, using dummy regulator
i2c i2c-0: IMX I2C adapter registered
i2c i2c-0: can't use DMA
pca953x 1-0025: failed reading register
pca953x: probe of 1-0025 failed with error -5
i2c i2c-1: IMX I2C adapter registered
i2c i2c-1: can't use DMA
i2c i2c-2: IMX I2C adapter registered
i2c i2c-2: can't use DMA
Linux video capture interface: v2.00
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti#linux.it>
PTP clock support registered
imx-ipuv3 2400000.ipu: IPU DMFC NORMAL mode: 1(0~1), 5B(4,5), 5F(6,7)
imx-ipuv3 2800000.ipu: IPU DMFC NORMAL mode: 1(0~1), 5B(4,5), 5F(6,7)
mxc_mipi_csi2 21dc000.mipi_csi: i.MX MIPI CSI2 driver probed
mxc_mipi_csi2 21dc000.mipi_csi: i.MX MIPI CSI2 dphy version is 0x3130302a
MIPI CSI2 driver module loaded
Advanced Linux Sound Architecture Driver Initialized.
Bluetooth: Core ver 2.20
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
Switched to clocksource mxc_timer1
NET: Registered protocol family 2
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
UDP hash table entries: 512 (order: 2, 16384 bytes)
UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
CPU PMU: Failed to parse /soc/pmu/interrupt-affinity[0]
hw perfevents: enabled with armv7_cortex_a9 PMU driver, 7 counters available
imx rpmsg driver is registered.
Bus freq driver module loaded
futex hash table entries: 1024 (order: 4, 65536 bytes)
VFS: Disk quotas dquot_6.6.0
VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
NFS: Registering the id_resolver key type
Key type id_resolver registered
Key type id_legacy registered
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
backlight_lcd supply power not found, using dummy regulator
backlight_lvds supply power not found, using dummy regulator
mxc_hdmi 20e0000.hdmi_video: Detected HDMI controller 0x13:0xa:0xa0:0xc1
fbcvt: 1280x720#60: CVT Name - .921M9
mxc_sdc_fb fb#0: registered mxc display driver hdmi
imx-ipuv3 2400000.ipu: IPU DMFC DP HIGH RESOLUTION: 1(0,1), 5B(2~5), 5F(6,7)
Console: switching to colour frame buffer device 160x45
mxc_hdmi 20e0000.hdmi_video: Error only one HDMI output support now!
mxc_sdc_fb fb#1: NO mxc display driver found!
imx-sdma 20ec000.sdma: no iram assigned, using external mem
imx-sdma 20ec000.sdma: no event needs to be remapped
imx-sdma 20ec000.sdma: loaded firmware 3.3
imx-sdma 20ec000.sdma: initialized
pfuze100-regulator 1-0008: unrecognized pfuze chip ID!
pfuze100-regulator: probe of 1-0008 failed with error -5
2020000.serial: ttymxc0 at MMIO 0x2020000 (irq = 26, base_baud = 5000000) is a IMX
console [ttymxc0] enabled
21e8000.serial: ttymxc1 at MMIO 0x21e8000 (irq = 303, base_baud = 5000000) is a IMX
21ec000.serial: ttymxc2 at MMIO 0x21ec000 (irq = 304, base_baud = 5000000) is a IMX
imx sema4 driver is registered.
[drm] Initialized drm 1.1.0 20060810
[drm] Initialized vivante 1.0.0 20120216 on minor 0
brd: module loaded
loop: module loaded
input: fxos8700 as /devices/soc0/soc/2100000.aips-bus/21a0000.i2c/i2c-0/0-001e/input/input0
fxos8700 device driver probe successfully
input: fxas2100x as /devices/soc0/soc/2100000.aips-bus/21a0000.i2c/i2c-0/0-0021/input/input1
fxas2100x 0-0021: fxas2100x device driver probe successfully
ahci-imx 2200000.sata: fsl,transmit-level-mV not specified, using 00000024
ahci-imx 2200000.sata: fsl,transmit-boost-mdB not specified, using 00000480
ahci-imx 2200000.sata: fsl,transmit-atten-16ths not specified, using 00002000
ahci-imx 2200000.sata: fsl,receive-eq-mdB not specified, using 05000000
ahci-imx 2200000.sata: SSS flag set, parallel bus scan disabled
ahci-imx 2200000.sata: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci-imx 2200000.sata: flags: ncq sntf stag pm led clo only pmp pio slum part ccc apst
scsi host0: ahci-imx
ata1: SATA max UDMA/133 mmio [mem 0x02200000-0x02203fff] port 0x100 irq 314
spi_imx 200c000.ecspi: probed
CAN device driver interface
2090000.flexcan supply xceiver not found, using dummy regulator
flexcan 2090000.flexcan: device registered (reg_base=c0a90000, irq=35)
2094000.flexcan supply xceiver not found, using dummy regulator
flexcan 2094000.flexcan: device registered (reg_base=c0a98000, irq=36)
2188000.ethernet supply phy not found, using dummy regulator
pps pps0: new PPS source ptp0
libphy: fec_enet_mii_bus: probed
fec 2188000.ethernet eth0: registered PHC device 0
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-pci: EHCI PCI platform driver
ehci-mxc: Freescale On-Chip EHCI Host driver
usbcore: registered new interface driver usb-storage
usbcore: registered new interface driver usbserial
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial support registered for generic
usbcore: registered new interface driver ftdi_sio
usbserial: USB Serial support registered for FTDI USB Serial Device
usbcore: registered new interface driver option
usbserial: USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver pl2303
usbserial: USB Serial support registered for pl2303
usbcore: registered new interface driver qcserial
usbserial: USB Serial support registered for Qualcomm USB modem
usbcore: registered new interface driver sierra
usbserial: USB Serial support registered for Sierra USB modem
usbcore: registered new interface driver usb_serial_simple
usbserial: USB Serial support registered for carelink
usbserial: USB Serial support registered for zio
usbserial: USB Serial support registered for funsoft
usbserial: USB Serial support registered for flashloader
usbserial: USB Serial support registered for google
usbserial: USB Serial support registered for vivopay
usbserial: USB Serial support registered for moto_modem
usbserial: USB Serial support registered for novatel_gps
usbserial: USB Serial support registered for hp4x
usbserial: USB Serial support registered for suunto
usbserial: USB Serial support registered for siemens_mpi
2184800.usbmisc supply vbus-wakeup not found, using dummy regulator
2184200.usb supply vbus not found, using dummy regulator
ci_hdrc ci_hdrc.1: EHCI Host Controller
ci_hdrc ci_hdrc.1: new USB bus registered, assigned bus number 1
ci_hdrc ci_hdrc.1: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mousedev: PS/2 mouse device common for all mice
ads7846 spi1.0: touchscreen, irq 202
input: ADS7846 Touchscreen as /devices/soc0/soc/2000000.aips-bus/2000000.spba-bus/200c000.ecspi/spi_master/spi1/spi1.0/input/input2
edt_ft5x06 1-0038: touchscreen probe failed
edt_ft5x06: probe of 1-0038 failed with error -5
read mpl3115 chip id 0xc4
input: mpl3115 as /devices/virtual/input/input4
mpl3115 device driver probe successfully
snvs_rtc 20cc000.snvs:snvs-rtc-lp: rtc core: registered 20cc000.snvs:snvs-r as rtc0
i2c /dev entries driver
mxc_v4l2_output v4l2_out: V4L2 device registered as video16
mxc_v4l2_output v4l2_out: V4L2 device registered as video17
usbcore: registered new interface driver uvcvideo
USB Video Class driver (1.1.1)
imx2-wdt 20bc000.wdog: timeout 60 sec (nowayout=0)
Bluetooth: HCI UART driver ver 2.3
Bluetooth: HCI UART protocol H4 registered
Bluetooth: HCI UART protocol BCSP registered
usbcore: registered new interface driver btusb
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
/soc/aips-bus#02100000/usdhc#02190000: voltage-ranges unspecified
sdhci-esdhc-imx 2190000.usdhc: could not get ultra high speed state, work on normal mode
sdhci-esdhc-imx 2190000.usdhc: Got CD GPIO
sdhci-esdhc-imx 2190000.usdhc: No vmmc regulator found
sdhci-esdhc-imx 2190000.usdhc: No vqmmc regulator found
mmc0: SDHCI controller on 2190000.usdhc [2190000.usdhc] using ADMA
/soc/aips-bus#02100000/usdhc#02194000: voltage-ranges unspecified
sdhci-esdhc-imx 2194000.usdhc: could not get ultra high speed state, work on normal mode
sdhci-esdhc-imx 2194000.usdhc: assigned as wifi host
sdhci-esdhc-imx 2194000.usdhc: No vqmmc regulator found
mmc1: SDHCI controller on 2194000.usdhc [2194000.usdhc] using ADMA
/soc/aips-bus#02100000/usdhc#02198000: voltage-ranges unspecified
sdhci-esdhc-imx 2198000.usdhc: could not get ultra high speed state, work on normal mode
sdhci-esdhc-imx 2198000.usdhc: Got CD GPIO
sdhci-esdhc-imx 2198000.usdhc: No vmmc regulator found
sdhci-esdhc-imx 2198000.usdhc: No vqmmc regulator found
mmc2: SDHCI controller on 2198000.usdhc [2198000.usdhc] using ADMA
mxc_vpu 2040000.vpu_fsl: VPU initialized
mxc_vdoa 21e4000.vdoa: i.MX Video Data Order Adapter(VDOA) driver probed
Galcore version 5.0.11.41671
ata1: SATA link down (SStatus 0 SControl 300)
ahci-imx 2200000.sata: no device found, disabling link.
ahci-imx 2200000.sata: pass ahci_imx..hotplug=1 to enable hotplug
mmc2: MAN_BKOPS_EN bit is not set
mmc2: new DDR MMC card at address 0001
mmcblk2: mmc2:0001 M62704 3.53 GiB
mmcblk2boot0: mmc2:0001 M62704 partition 1 2.00 MiB
mmcblk2boot1: mmc2:0001 M62704 partition 2 2.00 MiB
mmcblk2rpmb: mmc2:0001 M62704 partition 3 512 KiB
mmcblk2: p1 p2
caam 2100000.caam: Entropy delay = 3200
caam 2100000.caam: Instantiated RNG4 SH0
caam 2100000.caam: Instantiated RNG4 SH1
caam 2100000.caam: device ID = 0x0a16010000000000 (Era -524)
caam 2100000.caam: job rings = 2, qi = 0
caam algorithms registered in /proc/crypto
caam_jr 2101000.jr0: registering rng-caam
platform caam_sm: blkkey_ex: 4 keystore units available
platform caam_sm: 64-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: 64-bit black key:
platform caam_sm: [0000] a3 2a 9f cb c3 13 f0 3a
platform caam_sm: [0008] 71 8d 72 06 c9 c3 2c 85
platform caam_sm: 128-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: [0008] 08 09 0a 0b 0c 0d 0e 0f
platform caam_sm: 128-bit black key:
platform caam_sm: [0000] 7d 5f f0 af 6c c4 86 fa
platform caam_sm: [0008] a5 d0 a7 ad 8a 5d 8b 41
platform caam_sm: 192-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: [0008] 08 09 0a 0b 0c 0d 0e 0f
platform caam_sm: [0016] 10 11 12 13 14 15 16 17
platform caam_sm: 192-bit black key:
platform caam_sm: [0000] 2a d9 5e 25 46 6f 38 e6
platform caam_sm: [0008] 6b 6a 09 de 54 9b 6a 94
platform caam_sm: [0016] 1e bf 95 1c 4f 7d 31 6c
platform caam_sm: [0024] 43 ad 35 e2 23 aa 22 c8
platform caam_sm: 256-bit clear key:
platform caam_sm: [0000] 00 01 02 03 04 0f 06 07
platform caam_sm: [0008] 08 09 0a 0b 0c 0d 0e 0f
platform caam_sm: [0016] 10 11 12 13 14 15 16 17
platform caam_sm: [0024] 18 19 1a 1b 1c 1d 1e 1f
platform caam_sm: 256-bit black key:
platform caam_sm: [0000] bd 06 a3 11 dc 56 89 a7
platform caam_sm: [0008] 03 c6 73 c0 35 62 3d 67
platform caam_sm: [0016] 44 09 00 8a 3c 55 3b 74
platform caam_sm: [0024] 8f ae 27 01 f5 e9 3a 1e
platform caam_sm: 64-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 128-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 196-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 256-bit unwritten blob:
platform caam_sm: [0000] 00 00 00 00 00 00 00 00
platform caam_sm: [0008] 00 00 00 00 00 00 00 00
platform caam_sm: [0016] 00 00 00 00 00 00 00 00
platform caam_sm: [0024] 00 00 00 00 00 00 00 00
platform caam_sm: [0032] 00 00 00 00 00 00 00 00
platform caam_sm: [0040] 00 00 00 00 00 00 00 00
platform caam_sm: [0048] 00 00 00 00 00 00 00 00
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 64-bit black key in blob:
platform caam_sm: [0000] 06 be 96 1c b0 00 b7 0b
platform caam_sm: [0008] 25 3e a9 9f 39 00 ff 31
platform caam_sm: [0016] 53 1f a2 7f 06 fa 19 d6
platform caam_sm: [0024] 21 8b 9a 56 2d 89 2d e1
platform caam_sm: [0032] 16 ba 17 5f 6d b4 d8 92
platform caam_sm: [0040] f8 d6 74 e3 fc 17 77 0f
platform caam_sm: [0048] 2c 1a 81 f9 26 bd 7b 17
platform caam_sm: [0056] 00 00 00 00 00 00 00 00
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 128-bit black key in blob:
platform caam_sm: [0000] d5 39 28 ca 0d df d6 90
platform caam_sm: [0008] 3c 96 9e 14 9b 0f f2 a4
platform caam_sm: [0016] 84 03 c0 ca 58 de 2e df
platform caam_sm: [0024] 9c 8a 3d 50 e1 26 f3 f9
platform caam_sm: [0032] 5c 69 39 07 e9 13 e8 74
platform caam_sm: [0040] 7f 62 33 86 40 7c 04 78
platform caam_sm: [0048] 2d 7e e9 45 aa e5 48 6c
platform caam_sm: [0056] 0c 1d 0a 52 1a 99 61 08
platform caam_sm: [0064] 00 00 00 00 00 00 00 00
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 192-bit black key in blob:
platform caam_sm: [0000] d1 d9 50 5d bf 8d f0 82
platform caam_sm: [0008] e8 d1 d6 5b 9b d3 04 b1
platform caam_sm: [0016] 26 5e 32 df 3e 08 68 be
platform caam_sm: [0024] 00 21 92 26 0f d6 e7 f2
platform caam_sm: [0032] dc 49 d0 de 37 28 6a 6b
platform caam_sm: [0040] b1 0c 4a c0 e2 14 ec 4e
platform caam_sm: [0048] ff 94 c9 4e a9 ba fd 05
platform caam_sm: [0056] 4c 8b 74 0c 03 97 88 5a
platform caam_sm: [0064] 90 27 d9 12 d0 ee 6e e1
platform caam_sm: [0072] 00 00 00 00 00 00 00 00
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: 256-bit black key in blob:
platform caam_sm: [0000] ab 93 8a 3c 32 aa 34 37
platform caam_sm: [0008] 78 3f b8 c3 15 d4 6e a4
platform caam_sm: [0016] 9f 81 fe 86 7e 87 83 20
platform caam_sm: [0024] bf c1 9b 1f c9 57 81 a1
platform caam_sm: [0032] 4c 77 06 3b b7 c5 95 2b
platform caam_sm: [0040] ad b8 8b a5 f8 73 af 63
platform caam_sm: [0048] 29 75 af cd 94 af de 23
platform caam_sm: [0056] d8 17 4d f6 d0 25 5e 18
platform caam_sm: [0064] c7 98 8b 8d 7d e5 87 58
platform caam_sm: [0072] 41 c0 15 1f 3d 9d 57 b2
platform caam_sm: [0080] 00 00 00 00 00 00 00 00
platform caam_sm: [0088] 00 00 00 00 00 00 00 00
platform caam_sm: restored 64-bit black key:
platform caam_sm: [0000] cb 88 25 99 dc 5d 71 6c
platform caam_sm: [0008] 73 98 67 3b 7b 29 46 e3
platform caam_sm: restored 128-bit black key:
platform caam_sm: [0000] 7d 5f f0 af 6c c4 86 fa
platform caam_sm: [0008] a5 d0 a7 ad 8a 5d 8b 41
platform caam_sm: restored 192-bit black key:
platform caam_sm: [0000] 2a d9 5e 25 46 6f 38 e6
platform caam_sm: [0008] 6b 6a 09 de 54 9b 6a 94
platform caam_sm: [0016] 1b 1c 37 33 ca 77 7b ca
platform caam_sm: [0024] 49 4a 21 13 9c 58 77 af
platform caam_sm: restored 256-bit black key:
platform caam_sm: [0000] bd 06 a3 11 dc 56 89 a7
platform caam_sm: [0008] 03 c6 73 c0 35 62 3d 67
platform caam_sm: [0016] 44 09 00 8a 3c 55 3b 74
platform caam_sm: [0024] 8f ae 27 01 f5 e9 3a 1e
snvs-secvio 20cc000.caam-snvs: can't get snvs clock
snvs-secvio 20cc000.caam-snvs: violation handlers armed - non-secure state
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
sgtl5000 0-000a: sgtl5000 revision 0x11
fsl-asrc 2034000.asrc: driver registered
sgtl5000 0-000a: Using internal LDO instead of VDDD
imx-sgtl5000 sound: sgtl5000 <-> 2028000.ssi mapping ok
imx-audio-hdmi sound-hdmi: hdmi-hifi <-> soc:hdmi_audio#00120000 mapping ok
NET: Registered protocol family 26
nf_conntrack version 0.5.0 (16059 buckets, 64236 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
can: controller area network core (rev 20120528 abi 9)
NET: Registered protocol family 29
can: raw protocol (rev 20120528)
can: broadcast manager protocol (rev 20120528 t)
can: netlink gateway (rev 20130117) max_hops=1
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
rfkill-bcm43xx bt_rfkill: bt_rfkill device registered.
Key type dns_resolver registered
imx6q-pcie 1ffc000.pcie: phy link never came up
imx6q-pcie 1ffc000.pcie: failed to initialize host
imx6q-pcie: probe of 1ffc000.pcie failed with error -22
snvs_rtc 20cc000.snvs:snvs-rtc-lp: setting system clock to 1970-01-01 00:41:24 UTC (2484)
wlreg_on: disabling
usb_otg_vbus: disabling
ALSA device list:
#0: audio-sgtl5000
#1: imx-hdmi-soc
EXT4-fs (mmcblk2p2): couldn't mount as ext3 due to feature incompatibilities
EXT4-fs (mmcblk2p2): couldn't mount as ext2 due to feature incompatibilities
EXT4-fs (mmcblk2p2): mounted filesystem with ordered data mode. Opts: (null)
VFS: Mounted root (ext4 filesystem) on device 179:2.
devtmpfs: mounted
Freeing unused kernel memory: 376K (8096a000 - 809c8000)
INIT: version 2.88 booting
[9;0]
INIT: Entering runlevel: 5
EXT4-fs (mmcblk2p2): re-mounted. Opts: data=ordered
[9;0]
[9;0][9;60]=== Auto Start ==
random: nonblocking pool is initialized
Content of uEnv.txt:
displayinfo=video=mxcfb0:dev=hdmi,1280x720M#60,bpp=32 fbmem=28M
mmcargs=setenv bootargs console=${console},${baudrate} root=${mmcroot} ${displayinfo}
bootcmd_mmc=run loadimage;run mmcboot;
uenvcmd=run bootcmd_mmc
I am trying to emulate an NFC Forum Type 2 tag (Mifare Ultralight) containing an NDEF message with the ACR1252U and then read it out with an Android device.
To archive this, I enter the card emulation mode for Mifare Ultralight with:
E0 00 00 40 03 01 00 00
response: E1 03 01 01 01
The Android app "Nfc Tools" is identifying it as Mifare Ultralight now.
Then I write an NDEF message to the emulated card using the command:
e0 00 00 60 13 01 01 00 0f 03 0c d1 01 08 54 05 64 65 2d 44 45 68 69 fe
response: e1 00 00 00 03 0f 90 00
Unfortunately an Android device (Sony Xperia Z1 Compact) is unable to read the NDEF message.
So is the ACR1252U able to emulate a Type 2 tag with an NDEF message or am I just missing something?
I found a solution:
My NDEF format was wrong. This is a working NDEF message withLock Control TLV + NDEF Message TLV (with NDEF message) + Terminator TLV:
0103a010440318d10114540564652d444548656c6c6f20576f726c64203a29fe
The NDEF message contains one Text record (LANG = "de-DE", TEXT = "Hello World :)")
The write command of the ACR1252U also needs to be passed the Capability Container (CC), so one need to add the CC bytes to the message:
e1 10 06 00
So a complete command for the ACR1252U to emulate an NFC Forum Type 2 tag with the NDEF text record "Hello World :)" would look like this:
e0 00 00 60 28 01 01 00 24 e1 10 06 00 01 03 a0 10 44 03 18 d1 01 14 54 05 64 65 2d 44 45 48 65 6c 6c 6f 20 57 6f 72 6c 64 20 3a 29 fe
To read out the emulator you can use the app "NFC TagInfo by NXP".
have fun :)
I am developing an application which reads NFC card from the reader.
I know the code for reading binary block like this:
FF B0 00 04 10
04 for the block 4 and 10 for 16 bytes data. My card has the data "TEST009996".
I run 5 code for read binary blocks from 4-8 like this:
FF B0 00 04 10
FF B0 00 05 10
FF B0 00 06 10
FF B0 00 07 10
FF B0 00 08 10
I got the following results:
T☻enTEÉ ☺
T☻enTEST00É
T☻enTEST009996É
enTEST009996■ 6É
ST009996■ 6 É
or in hexadecimal:
01 03 A0 10 44 03 11 D1 01 0D 54 02 65 6E 48 43 90 00
44 03 11 D1 01 0D 54 02 65 6E 48 43 49 44 30 30 90 00
01 0D 54 02 65 6E 48 43 49 44 30 30 39 39 39 36 90 00
65 6E 48 43 49 44 30 30 39 39 39 36 FE 00 00 36 90 00
49 44 30 30 39 39 39 36 FE 00 00 36 00 00 00 00 90 00
Should I create an algorithm to cut the result to get the data? Are there any better ways?
Source:
http://downloads.acs.com.hk/drivers/en/API-ACR122U-2.02.pdf
It seems that your tag is an NFC Forum Type 2 Tag (find the NFC Forum Type 2 Tag Operation specification on the NFC Forum website). As you mention MIFARE this could, for instance, be a MIFARE Ultralight, MIFARE Ultralight C or NTAG tag.
A block on a Type 2 Tag consists of 4 bytes. The read command reads 4 blocks at a time. So the read command gives you 4 blocks (4 bytes each) starting at a given block offset plus a status word for the read command (0x9000 for success). In your case you get:
Read(4, 16): 0103A010 440311D1 010D5402 656E4843 9000
Read(5, 16): 440311D1 010D5402 656E4843 49443030 9000
Read(6, 16): 010D5402 656E4843 49443030 39393936 9000
Read(7, 16): 656E4843 49443030 39393936 FE000036 9000
Read(8, 16): 49443030 39393936 FE000036 00000000 9000
Consequently, the memory of your tag looks like this:
0103A010
440311D1
010D5402
656E4843
49443030
39393936
FE000036
00000000
A Type 2 Tag (btw. in order to make sure that this tag actually conforms to the Type 2 Tag Operation Specification you would also need to read the capability container which is located in block 3) contains a series of tag-length-value (TLV) structures:
01 (Tag: Lock Control TLV)
03 (Length: 3 bytes)
A0 10 44 (Value: Information on position and function of lock bytes)
03 (Tag: NDEF Message TLV)
11 (Length: 17 bytes)
D1010D5402656E48434944303039393936 (Value: NDEF message)
FE (Tag: Terminator TLV; has no length field)
So your tag contains the NDEF message
D1010D5402656E48434944303039393936
This translates to
D1 (Header byte of record 1)
- Message begin is set (= first record of an NDEF message)
- Message end is set (= last record of an NDEF message)
- Short record flag is set (= Payload length field consists of 1 byte only)
- Type Name Format = 0x1 (= Type field contains an NFC Forum well-known type)
01 (Type length: 1 byte)
0D (Payload length: 13 bytes)
54 (Type: "T")
02656E48434944303039393936 (Payload field)
The payload field of a NFC Forum Text record decodes like this:
02 (Status byte: Text is UTF-8 encoded, Language code has a length of 2 bytes)
656E (Language code: "en")
48434944303039393936 (Text: "TEST009996")
I'm trying to get my ACR122 (usb) device to emulate a passive NFC tag, but am having difficulty getting the communication to occur properly. I'm hoping someone can see what I'm doing wrong here and help point me in the correct direction.
The response on this other question ACR122 - Card Emulation pointed to a document at http://code.google.com/p/nfcip-java/source/browse/trunk/nfcip-java/doc/ACR122_PN53x.txt but when we follow this to the letter it doesn't behave as expected.
We're using an Samsung Galaxy S3 Android 4.3 device for testing, and are seeing the below behaviour:
Transmit (TgInitAsTarget)
....'......4V#.. FF 00 00 00 27 D4 8C 00 08 00 12 34 56 40 01 FE
................ A2 A3 A4 A5 A6 A7 C0 C1 C2 C3 C4 C5 C6 C7 FF FF
...wfUD3"... AA 99 88 77 66 55 44 33 22 11 00 00
Receive
..%....7.5<...w. D5 8D 25 1E D4 00 08 37 D9 35 3C BF D5 AE 77 9C
...2Ffm......... 00 00 00 32 46 66 6D 01 01 11 03 02 00 13 04 01
... 96 90 00
Transmit (GetData)
....... FF 00 00 00 02 D4 86
Receive
..).. D5 87 29 90 00
The TgInitAsTarget command appears to be working, returning a mode of 0x25 which we understand means "Active mode, DEP, 424kbps".
But then "GetData" command is immediately failing, returning status code 0x29 "The PN532 configured as target has been released by its initiator".
We've tried altering the TgInitAsTarget command with different modes (instead of the 0x00 "All" mode), trying the following which all still return 0x29 for the following GetData command:
Mode 0x01 "Passive", resulting in response mode of 0x04 "DEP"
Mode 0x02 "DEP", resulting in response mode of 0x25 (same as the "All")
Mode 0x03 "DEP Passive" resulting in response mode of 0x04 "DEP"
It appears in all cases as if the Android is not maintaining the connection, although I am not familiar with the NFC DEP protocols enough to know what I'm doing wrong here. I've read the PN532 chip reference, and it seems to indicate that I'm doing everything correctly.
I've also tried a Windows Phone NFC device, and it encounters the same problem and same error code on GetData.
Any help from anyone who is familiar with NFC would be greatly appreciated.
Dave
For getting the ACR122 (or rather the PN532 NFC controller chip inside it) into card emulation mode, you would do about the following:
ReadRegister:
> FF000000 08 D406 6305 630D 6338
< D507 xx yy zz 9000
Update register values:
xx = xx | 0x004; // CIU_TxAuto |= InitialRFOn
yy = yy & 0x0EF; // CIU_ManualRCV &= ~ParityDisable
zz = zz & 0x0F7; // CIU_Status2 &= ~MFCrypto1On
WriteRegister:
> FF000000 11 D408 6302 80 6303 80 6305 xx 630D yy 6338 zz
< D509 9000
SetParameters:
> FF000000 03 D412 30
< D513 9000
TgInitAsTarget
> FF000000 27 D48C 05 0400 123456 20 000000000000000000000000000000000000 00000000000000000000 00 00
< D58D xx ... 9000
Where xx should be equal to 0x08.
Communicate using a sequence of TgGetData and TgSetData commands:
> FF000000 02 D486
< D587 xx <C-APDU> 9000
Where xx is the status code (should be 0x00 for success) and C-APDU is the command sent from the reader.
> FF000000 yy D48E <R-APDU>
< D587 xx 9000
Where yy is 2 + the length of the R-APDU (response) and xx is the status code (should be 0x00 for success).