manualshive.com logo in svg

Advanced Card ACR89U-A2, Reference Manual

Share
Download
Advanced Card ACR89U-A2 Reference Manual Download Page 4

 

ACR89U-A2 – Reference Manual

 

[email protected] 

Version 1.01 

www.acs.com.hk 

Page 4 of 57

 

 

 

1.0.  Introduction 

The ACR89U-A2 Handheld Smart Card Reader with NFC tag support is a  versatile dual interface 
smart card reader with PINpad, which can be used to access ISO 7816 MCU cards, ISO 14443 Type 
A and B, MIFARE®, FeliCa and ISO 18092 or NFC tags. It can operate in both office and field-based 
environments using it PC-linked and standalone modes, respectively. 

For PC-linked Mode, ACR89U-A2 acts as the intermediary device between the PC and the card. The 
reader, specifically to communicate with a contactless tag, MCU card, SAM card or device 
peripherals, will carry out a command issued from the PC. 

This manual describes the use of ACR89 software programming interface to control the built-in 
accessories of the ACR89 multi-functional card reader. Built-in accessories are defined to be the 
keypad, LCD display, LEDs, buzzer and real-time clock, embedded in ACR89. Such components are 
not controlled through the smart card reader library. In addition, this document provides a guide on 
implementing PC/SC APDU commands for device contactless tags. 

Summary of Contents for ACR89U-A2

Page 1: ...Subject to change without prior notice info acs com hk www acs com hk Reference Manual V1 01 ACR89U A2 Handheld Smart Card Reader ...

Page 2: ...ry 16 3 5 Extended Command Pipe Message Compatible with ACR89 18 3 5 1 Extended Command Pipe Bulk OUT Message 18 3 5 2 Commands Detail 19 3 5 3 Extended Command Pipe Bulk IN Message 26 3 5 4 Messages Detail 27 3 5 5 Extended Command Response Codes and Return States 30 3 6 CCID Interrupt IN Message 31 3 6 1 Message Summary 31 3 7 CCID Error and Status Code 32 4 0 Software Design 33 4 1 Contactless ...

Page 3: ...ble 4 ACR89 Extended Command Pipe Messages 18 Table 5 Extended Command Response Codes 30 Table 6 Extended Command Return States 30 Table 7 Extended Command Error Codes 30 Table 8 CCID Error and Status Code 32 Table 9 ISO 14443 Part 3 ATR Format 33 Table 10 ISO 14443 Part 4 ATR Format 35 Table 11 Direct Transmit Response Codes 39 Table 12 MIFARE 1K Memory Map 43 Table 13 MIFARE 4K Memory Map 43 Tab...

Page 4: ...Mode ACR89U A2 acts as the intermediary device between the PC and the card The reader specifically to communicate with a contactless tag MCU card SAM card or device peripherals will carry out a command issued from the PC This manual describes the use of ACR89 software programming interface to control the built in accessories of the ACR89 multi functional card reader Built in accessories are define...

Page 5: ...ugh USB as specified in the USB Specification 2 0 working in full speed mode i e 12 Mbps Pin Signal Function 1 VBUS 5 V power supply for the reader 2 D Differential signal transmits data between ACR89U A2 and PC 3 D Differential signal transmits data between ACR89U A2 and PC 4 GND Reference voltage level for power supply Table 1 USB Interface Wiring Note In order for the ACR89U A2 to function prop...

Page 6: ...ype through the proper command sent to the ACR89U A2 For MCU based cards the reader allows to select the preferred protocol T 0 or T 1 However this selection is only accepted and carried out by the reader through the PPS when the card inserted in the reader supports both protocol types Whenever an MCU based card supports only one protocol type T 0 or T 1 the reader automatically uses that protocol...

Page 7: ...ach command sent to ACR89 has an associated ending response Some commands can also have intermediate responses 4 CCID Responses are sent on BULK IN endpoint All commands sent to ACR89 have to be sent synchronously i e bMaxCCIDBusySlots is equal to 1 for ACR89 The supported CCID features by ACR89 are indicated in its Class Descriptor Offset Field Size Value Description 0 bLength 1 36h Size of this ...

Page 8: ...e according to frequency and FI DI parameters Automatic PPS made by the ACR89 according to the current parameters Automatic IFSD Short APDU level exchange with ACR89 44 dwMaxCCIDMessageLength 4 00000110h Maximum message length accepted by ACR89 is 272 bytes 48 bClassGetResponse 1 FFh Echo class of APDU in Get Response command 49 bClassEnvelope 1 FFh Insignificant Short APDU exchange level 50 wLCDL...

Page 9: ...essage format standard of ACR89 reader This device shall support one CCID Class specific Request Class specific requests are sent via Control Pipe 3 2 1 Command Summary Stop any current processing command and return to a state where ACR89 is ready to accept a new command bmRequestType bRequest wValue wIndex wLength Data 00100001b ABORT 01h bSeq bSlot Interface 0000h None ...

Page 10: ...ber for this command 5 bSeq 1 Sequence number for command 6 bPowerSelect 1 Voltage that is applied to the ICC 00h Automatic Voltage Selection 01h 5 volts 02h 3 volts 03h 1 8 volts 7 abRFU 2 Reserved for future use The response to this message is the RDR_to_PC_DataBlock message and the data returned is the Answer To Reset ATR data 3 3 1 2 PC_to_RDR_IccPowerOff Deactivates the card slot Offset Field...

Page 11: ...will timeout the block after this number multiplied by the Block Waiting Time has expired 8 wLevelParameter 2 0000h RFU TPDU exchange level 10 abData Byte array Data block sent to the CCID Data is sent as is to the ICC TPDU exchange level The response to this message is the RDR_to_PC_DataBlock message 3 3 1 5 PC_to_RDR_GetParameters Gets the slot parameters Offset Field Size Value Description 0 bM...

Page 12: ...re for protocol T 1 The following values are reserved for future use 80h Structure for 2 wire protocol 81h Structure for 3 wire protocol 82h Structure for I2C protocol 8 abRFU 2 Reserved for future use 10 abProtocolDataStructure Byte array Protocol Data Structure Protocol Data Structure for Protocol T 0 dwLength 00000005h Offset Field Size Value Description 10 bmFindexDindex 1 B7 4 FI Index into t...

Page 13: ...rect b1 1 for inverse Note The CCID ignores this bit 12 BGuardTimeT1 1 Extra Guardtime 0 to 254 etu between two characters If value is FFh then guardtime is reduced by 1 etu 13 BWaitingIntegerT1 1 B7 4 BWI values 0 9 valid B3 0 CWI values 0 Fh valid 14 bClockStop 1 ICC Clock Stop Support 00h Stopping the Clock is not allowed 01h Stop with Clock signal Low 02h Stop with Clock signal High 03h Stop w...

Page 14: ... this command 3 1 DEVICE_VOID ACR89 is not initialized Table 3 PC_to_RDR_Escape Extended Response 3 3 1 9 PC_to_RDR_Secure RFU The command is reserved for future implementation This is a command message to allow entering the PIN for verification or modification on the card directly Offset Field Size Value Description 0 bMessageType 1 69h 1 DwLength 4 Size of extra bytes of this message 5 BSlot 1 I...

Page 15: ...tructure The response to this message is the RDR_to_PC_DataBlock Note Refer to standard CCID Session 4 1 11 for detail PIN Verification Data Structure and PIN Modification Data Structure 3 3 1 10 PC_to_RDR_Abort This command is used with the Control Pipe Abort request to tell the CCID to stop any current transfer at the specified slot and return to a state where the slot is ready to accept a new c...

Page 16: ... OUT message 7 bStatus 1 Slot status and error register as defined in Section 3 7 8 bError 1 Slot status and error register as defined in Section 3 7 9 bChainParameter 1 00h RFU TPDU exchange level 10 AbData Byte array This field contains the data returned by the CCID 3 4 1 2 RDR_to_PC_SlotStatus This message is sent by ACR89 in response to PC_to_RDR_IccPowerOff PC_to_RDR_GetSlotStatus PC_to_RDR_A...

Page 17: ...T 0 01h Structure for protocol T 1 The following values are reserved for future use 80h Structure for 2 wire protocol 81h Structure for 3 wire protocol 82h Structure for I2C protocol 10 abProtocolDataStructure Byte array Protocol Data Structure as summarized in standard CCID Session 5 2 3 3 4 1 4 RDR_to_PC_Escape This message is sent by ACR89 in response to PC_to_RDR_Escape message Offset Field Si...

Page 18: ...84h PC_to_ACR89_SetRTC 09h ACR89_to_PC_TimeStamp 84h PC_to_ACR89_Buzzer 0ah ACR89_to_PC_Echo 90h PC_to_ACR89_AccessEeprom 21h ACR89_to_PC_Datablock 81h PC_to_ACR89_SetLED 22h ACR89_to_PC_Echo 90h PC_to_ACR89_EraseSPIFlash 30h ACR89_to_PC_ExMemStatus b0h PC_to_ACR89_ProgramSPIFlash 33h ACR89_to_PC_MemoryStatus b0h PC_to_ACR89GetSPIFlash 34h ACR89_to_PC_MemoryPage b1h PC_to_ACR89_GetVersion 36h ACR8...

Page 19: ...splay b2 0 for key display disabled b2 1 for key display enabled When b2 1 b3 0 for key display as plaintext b3 1 for key display as B4 Key input timeout control b4 0 for timeout enabled b4 1 for timeout disabled B5 Secure key transfer b5 0 for plaintext transfer b5 1 for encrypted key transfer This bit is reserved for future implementation B6 0 1 disable enable control key b7 RFU 16 bTimeoutValue...

Page 20: ...es RFU The response to this command is the ACR89_to_PC_DisplayStatus message 3 5 2 4 PC_to_ACR89_DisplayMessage This command displays a string of characters from ACR89 build in font library The string will be displayed horizontally from the current cursor position ACR89 will automatically calculate the absolute coordinates from the character position and character size The cursor will move accordi...

Page 21: ...sition Hex 1 Start position column index 17 AbData Hex Var Bitmap data of a row of the graphic to be displayed The sum of wCmdLength and bColumnPosition cannot exceed the column number of LCD 128 Row 0 Row 1 BIT MAP BYTE 1 BIT MAP BYTE 2 LSB BIT MAP BYTE N MSB Row 7 0 1 2 127 Column Figure 3 PC_to_ACR89_DisplayGraphic Bitmap Format The response to this command is the ACR89_to_PC_DisplayStatus mess...

Page 22: ...ata in big endian 13 AbRfu Hex 2 0000h Reserved for future 15 bClearMode Hex 1 00h or 01h or 02h 00h Clear full screen 01h Clear the row located by the current position cursor 02h Clear some columns in a row starting from current position cursor All other values RFU 16 bNumber 1 For bClearMode 01h Number of rows to be cleared For bClearMode 02h Number of columns to be cleared Not significant other...

Page 23: ... Hex 1 Buzzer on duration in number of hundredth milliseconds Effective only when bBuzzerState field is 01h 00h Activate buzzer and do not turn off the buffer Other value Activate buzzer for number of hundredth milliseconds and then turn off the buzzer The response to this command is the ACR89_to_PC_Echo message 3 5 2 11 PC_to_ACR89_AccessEeprom This command allows user write or read data from the...

Page 24: ...Turn ON red color 10000001b Turn OFF green color 00000010b Ignore xxxx0000b 16 Slot1 LED Hex 1 Bit0 1 Selects Red color Bit1 1 Selects Green color Bit2 1 Selects Yellow color Bit7 0 OFF 1 ON 17 Slot2 LED Hex 1 Bit0 1 Selects Red color Bit1 1 Selects Green color Bit2 1 Selects Yellow color Bit7 0 OFF 1 ON The response to this command is ACR89_to_PC_Echo 3 5 2 13 PC_to_ACR89_EraseSPIFlash This comma...

Page 25: ...Field Name Type Size Value Description 10 bCmdCode Hex 1 34h Command Code 11 AbAddress Hex 4 xxxxxx00h Start address of flash page in little endian The response to this command is the ACR89_to_PC_MemoryPage message 3 5 2 16 PC_to_ACR89_GetVersion This command reads boot loader or application firmware version information Offset Field Name Type Size Value Description 10 bCmdCode Hex 1 36h Command Co...

Page 26: ...Session 4 2 2 4 The response format defined in this section will be the abData to be filled in the RDR_to_PC_Escape messages Similar to CCID message structure the response format consists of fixed length Response Header and variable length Response Data portion The response header is fixed to 5 bytes in length In contrast to CCID USB practice big endian will be adopted in extended response portion...

Page 27: ...CR89_DisplayRowGraphic and PC_to_ACR89_ClearDisplay commands Offset Field Name Size Value Description 10 BrespType 1 83h 11 wReturnCode 2 Command response code in big endian 13 wRespLength 2 0002h Size of response data in big endian 15 bRowPosition 1 00h to 07h Current cursor row position 16 bColumnPosition 1 00h to 7Fh Current cursor column position 3 5 4 3 ACR89_to_PC_TimeStamp This message is s...

Page 28: ...89 in response to PC_to_ACR89_GetSPIFlashPage commands Offset Field Name Size Value Description 10 bRespType 1 B1h 11 bReturnState 1 Command return state please refer to later section 12 bErrorCode 1 Error code please refer to later section 13 AbRFU 2 0000h 15 AbData 256 Data read from a flash page 271 bCheckSum Hex 1 Checksum of AbData Note There will be no AbData and bCheckSum parts when command...

Page 29: ...in response to PC_to_ACR89_AuthInfo commands Offset Field Name Size Value Description 10 bRespType 1 B4h 11 bReturnState 1 Command return state please refer to later section 12 bErrorCode 1 Error code please refer to later section 13 AbRFU 2 0000h 15 AbRomID 8 Unique ID 23 AbRFU 48 Note There will be no parts from offset 15 when command failed ...

Page 30: ...D FFFCh Extended command cannot be executed TIMEOUT FFFBh Timeout for executing the extended command SCRIPT_ERROR FFFAh Cannot execute the script Table 5 Extended Command Response Codes Return State Value Description CMD_OK 00h Command executes successfully CMD_FAIL 01h Command execution failed Table 6 Extended Command Return States Error Code Value Description COMMAND_NOT_SUPPORT 00h Command code...

Page 31: ...n ICC slot Offset Field Size Value Description 0 bMessageType 1 50h 1 bmSlotICCState This field is reported on byte granularity The size is 2 bits number of slots rounded up to the nearest byte Each slot has 2 bits The least significant bit reports the current state of the slot 0b no ICC present 1b ICC present The most significant bit reports whether the slot has changed state since the last RDR_t...

Page 32: ... talking to the ICC HW_ERROR FBh An all inclusive hardware error occurred BAD_ATR_TS F8h BAD_ATR_TCK F7h ICC_PROTOCOL_NOT_SUPPORTED F6h ICC_CLASS_NOT_SUPPORTED F5h PROCEDURE_BYTE_CONFLICT F4h DEACTIVATED_PROTOCOL F3h BUSY_WITH_AUTO_SEQUENCE F2h Automatic Sequence Ongoing PIN_TIMEOUT F0h PIN_CANCELLED EFh CMD_SLOT_BUSY E0h A second command was sent to a slot which was already processing a command A...

Page 33: ...wing Lower nibble 0 means T 0 3 01h TD2 Higher nibble 0 means no TA3 TB3 TC3 TD3 following Lower nibble 1 means T 1 4 To 3 N 80h T1 Category indicator byte 80 means a status indicator may be present in an optional COMPACT TLV data object 4Fh Tk Application identifier Presence Indicator 0Ch Length RID Registered Application Provider Identifier RID A0 00 00 03 06h SSh Byte for standard C0h C1h Bytes...

Page 34: ...57 Where Length YY 0Ch RID A0 00 00 03 06h PC SC Workgroup Standard SS 03h ISO 14443A Part 3 Card Name C0 C1 00 01h MIFARE 1K 00 02h MIFARE 4K 00 03h MIFARE Ultralight 00 26h MIFARE Mini F0 04h Topaz and Jewel F0 11h FeliCa 212K F0 12h FeliCa 424K FF 28h JCOP 30 FF SAK undefined tags ...

Page 35: ...e ISO 14443 4 specification ISO 14443B The higher layer response from the ATTRIB response ATQB Refer to the ISO 14443 3 specification XX XX XXh Tk 4 N UUh TCK Exclusive oring of all the bytes T0 to Tk Table 10 ISO 14443 Part 4 ATR Format Example 1 Consider the ATR from MIFARE DESFire as follows MIFARE DESFire ATR 3B 81 80 01 80 80h 6 bytes of ATR Note Use the APDU FF CA 01 00 00h to distinguish th...

Page 36: ... the relevant target This byte also contains the More Information MI bit bit 6 When the MI bit is set to 1 this indicates that the host controller wants to send more data which is all the data contained in the DataOUT array This bit is only valid for a TPE target DataOut 0 262 Bytes An array of raw data from 0 up to 262 bytes to be sent to the target by the contactless chip MaxTg Maximum number of...

Page 37: ...rgeted by the device IC and is used to pre select the PICCs before the ATQB This field is mandatory Polling Method This field is optional It indicates the approach to be used in the ISO IEC 14443 3B initialization If bit 0 1 Probabilistic approach option 1 in the ISO IEC 14443 3B initialization If bit 0 0 Timeslot approach option 2 in the ISO IEC 14443 3B initialization If this field is absent the...

Page 38: ...bTg The number of initialized Targets minimum 0 maximum 2 targets TargetDatai The i in TargetDatai refers to 1 or 2 This contains the information about the detected targets and depends on the baud rate selected The following information is given for one target it is repeated for each target initialized NbTg times 106 Kbps Type A Tg SENS_RES10 2 bytes SEL_RES 1 byte NFCIDLength 1 byte NFCID1 NFCIDL...

Page 39: ...y the reader Results SW1 SW2 Meaning Success 90 00h The operation is completed successfully Error 63 00h The operation has failed Time Out Error 63 01h The TAG does not response Checksum Error 63 27h The checksum of the Response is wrong Parameter Error 63 7Fh The TAG Command is wrong Table 11 Direct Transmit Response Codes ...

Page 40: ... Bytes if P1 01h Response Data Out Result ATS SW1 SW2 Get Data Response Code Results SW1 SW2 Meaning Success 90 00h The operation is completed successfully Warning 62 82h End of UID ATS reached before Le bytes Le is greater than UID Length Error 6C XXh Wrong length wrong number Le XX encodes the exact number if Le is less than the available UID length Error 63 00h The operation has failed Error 6A...

Page 41: ... Class INS P1 P2 Lc Data In Load Authentication Keys FFh 82h Key Structure Key Number 06h Key 6 bytes Where Key Structure 1 Byte 00h Key is loaded into the reader s volatile memory Other Reserved Key Number 1 Byte 00h 01h Key Location The keys will be removed once the reader is disconnected from the PC Key 6 Bytes The key value loaded into the reader E g FF FF FF FF FF FFh Load Authentication Keys...

Page 42: ...This is the memory block to be authenticated Key Type 1 Byte 60h Key is used as a TYPE A key for authentication 61h Key is used as a TYPE B key for authentication Key Number 1 Byte 00h 01h Key Location Note For MIFARE Classic 1K Card it has 16 sectors and each sector consists of 4 consecutive blocks Ex Sector 00 consists of Blocks 00h 01h 02h and 03h Sector 01h consists of Blocks 04h 05h 06h and 0...

Page 43: ... Memory Map Sectors Total of 32 sectors Each sector consists of 4 consecutive blocks Data Blocks 3 blocks 16 bytes per block Trailer Block 1 block 16 bytes Sector 0 00h 02h 03h Sector 1 04h 06h 07h Sector 30 78h 7Ah 7Bh Sector 31 7Ch 7Eh 7Fh Sectors Total of 8 sectors Each sector consists of 16 consecutive blocks Data Blocks 15 blocks 16 bytes per block Trailer Block 1 block 16 bytes Sector 32 80h...

Page 44: ...0 1 2 3 Page Serial Number SN0 SN1 SN2 BCC0 0 Serial Number SN3 SN4 SN5 SN6 1 Internal Lock BCC1 Internal Lock0 Lock1 2 OTP OPT0 OPT1 OTP2 OTP3 3 Data read write Data0 Data1 Data2 Data3 4 Data read write Data4 Data5 Data6 Data7 5 Data read write Data8 Data9 Data10 Data11 6 Data read write Data12 Data13 Data14 Data15 7 Data read write Data16 Data17 Data18 Data19 8 Data read write Data20 Data21 Data...

Page 45: ...k Number 1 Byte The block to be accessed Number of Bytes to Read 1 Byte Maximum 16 bytes Read Binary Block Response Format N 2 Bytes Response Data Out Result 0 N 16 SW1 SW2 Read Binary Response Codes Results SW1 SW2 Meaning Success 90 00h The operation is completed successfully Error 63 00h The operation has failed Example 1 Read 16 bytes from the binary block 04h MIFARE 1K or 4K APDU FF B0 00 04 ...

Page 46: ...for MIFARE 1K 4K Where Block Number 1 byte This is the starting block to be updated Number of Bytes to Update 1 byte 16 bytes for MIFARE 1K 4K 4 bytes for MIFARE Ultralight Block Data 4 or 16 bytes The data to be written in to binary block blocks Update Binary Block Response Codes 2 Bytes Results SW1 SW2 Meaning Success 90 00h The operation is completed successfully Error 63 00h The operation has ...

Page 47: ...block The block will then be converted to a value block 01h Increment the value of the value block by the VB_Value This command is only valid for value block 02h Decrement the value of the value block by the VB_Value This command is only valid for value block VB_Value 4 Bytes The value of this data which is a signed long integer 4 bytes is used for value manipulation Example 1 Decimal 4 FFh FFh FF...

Page 48: ...umber 04h Where Block Number 1 byte The value block to be accessed Read Value Block Response Format 4 2 bytes Response Data Out Result Value MSB LSB SW1 SW2 Where Value 4 bytes This is the value returned from the card The value is a signed long integer 4 bytes Example 1 Decimal 4 FFh FFh FFh FCh Value MSB LSB FFh FFh FFh FC Example 2 Decimal 1 00h 00h 00h 01h Value MSB LSB 00h 00h 00h 01h Read Val...

Page 49: ... Target Block Number 1 Byte This is the value block to be restored The source and target value blocks must be in the same sector Copy Value Block Response Format 2 Bytes Response Data Out Result SW1 SW2 Copy Value Block Response Codes Results SW1 SW2 Meaning Success 90 00h The operation is completed successfully Error 63 00h The operation has failed Example 1 Store a value 1 into block 05h APDU FF...

Page 50: ...PDU Format Command Class INS P1 P2 Lc Data In Le ISO 7816 Part 4 Command Length of the Data In Expected length of the Response Data ISO 7816 4 Response Format Data 2 bytes Response Data Out Result Response Data SW1 SW2 Common ISO 7816 4 Response Codes Results SW1 SW2 Meaning Success 90 00h The operation is completed successfully Error 63 00h The operation has failed Typical sequence may be 1 Prese...

Page 51: ...k Version 1 01 www acs com hk Page 51 of 57 Example ISO 7816 4 APDU To read 8 bytes from an ISO 14443 4 Type B PICC ST19XR08E APDU 80 B2 80 00 08h Class 80h INS B2h P1 80h P2 00h Lc None Data In None Le 08h Answer 00 01 02 03 04 05 06 07h 9000 ...

Page 52: ...uously Once the tag is found and detected the corresponding ATR will be sent to the PC Step 1 Connect the ACR89U PICC Interface with T 1 protocol Step 2 Access the PICC by exchanging APDUs Step N Disconnect the ACR89U PICC Interface Shut down the application Remarks The antenna can be switched off in order to save the power Turn off the antenna power FF 00 00 00 04 D4 32 01 00h Turn on the antenna...

Page 53: ...e Status Code 91 AFh is defined in MIFARE DESFire specification Please refer to the MIFARE DESFire specification for more details Example 2 MIFARE DESFire Frame Level Chaining ISO 7816 wrapping mode In this example the application has to do the Frame Level Chaining To get the version of the MIFARE DESFire card Step 1 Send an APDU 90 60 00 00 00h to get the first frame INS 60h Answer 04 01 01 00 02...

Page 54: ...to get the first frame INS 60h Answer AF 04 01 01 00 02 18 05h 1805 Step 2 Send an APDU AFh to get the second frame INS AFh Answer AF 04 01 01 00 06 18 05h 1805 Step 3 Send an APDU AFh to get the last frame INS AFh Answer 00 04 52 5A 19 B2 1B 80 8E 36 54 4D 40 26 04h 2604 Note In MIFARE DESFire Native Mode the status code 90 00h will not be added to the response if the response length is greater t...

Page 55: ...10 06 8 byte NFC ID 01 09 01 01 80 00h 1D 07 8 byte NFC ID 00 00 01 00 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AAh 90 00h Or Step 2 Read the memory block using Pseudo APDU FF 00 00 00 13 D4 40 01 10 06 8 byte NFC ID 01 09 01 01 80 00h In which 13h is the length of the Pseudo Data D4 40 01 80 00h D4 40 01h is the Data Exchange Command D5 41 00 1D 07 8 byte NFC ID 00 00 01 00 AA 55 AA 55 AA 55 AA ...

Page 56: ... address 08 Block 1 Byte 0 without using Pseudo APDU 01 08h 18h 90 00h In which Response Data 18h Or Step 2 Read the memory address 08h Block 1 Byte 0 using Pseudo APDU FF 00 00 00 05 D4 40 01 01 08h In which 05h is the length of the Pseudo APDU Data D4 40 01 01 08h D4 40 01h is the Data Exchange Command 01 08h is the data to be sent to the tag D5 41 00 18h 90 00h In which Response Data 18h Tip To...

Page 57: ...age 57 of 57 Figure 5 Topaz Memory Map Memory Address Block No 8 Byte No Example 1 Memory Address 08h 1 x 8 0 Block 1 Byte 0 Data0 Example 2 Memory Address 10h 2 x 8 0 Block 2 Byte 0 Data8 MIFARE MIFARE Classic MIFARE DESFire and MIFARE Ultralight are trademarks of NXP B V ...

Reviews:

No comments

Brands by name

Popular brands

Load more brands