manualshive.com logo in svg

ASC ACR1281U-C1, Application Programming Interface, Page: 58 / 96

Share
Download
ASC ACR1281U-C1 Application Programming Interface Download Page 58

 

ACR1281U-C1 – Application Programming Interface

 

[email protected] 

Version 1.08 

www.acs.com.hk 

Page 58 of 96

 

 

 

5.2.4.2. 

PICC Commands (T=CL Emulation) for MIFARE 1K/4K Memory Cards 

5.2.4.3. 

Load authentication keys 

This command loads  the authentication keys into the reader. The authentication keys are used to 
authenticate the specified sector of the MIFARE 1K/4K Memory Card. Two kinds of authentication key 
locations are provided, volatile and non-volatile key locations. 

 

Command 

Command 

Class  INS 

P1 

P2 

Le 

Data In 

Load Authentication Keys 

FFh 

82h 

Key 

Structure 

Key 

Number  

06h 

Key 

Where: 

Key Structure

   

 

(1 byte) 

 

00h 

= Key is loaded into the reader’s volatile memory 

 

20h 

= Key is loaded into the reader’s non-volatile memory 

 

Other = Reserved. 

Key Number

 

 

 

(1 byte) 

00h  –  1Fh

  = 

Non-volatile memory for storing keys. The keys are 

permanently stored in the reader and will not be erased even if the 
reader is disconnected from the PC. It can store up to 32 keys inside 
the reader non-volatile memory. 

20h  (Session Key)

  = 

Volatile memory for temporarily storing keys. 

The keys will be erased when the reader is disconnected from the 
PC. Only one volatile memory is provided. The volatile key can be 
used as a session key for different sessions. Default value = FF FF 
FF FF FF FFh. 

Key

 

 

 

 

(6 bytes) 

The key value loaded into the reader. 

E.g. {FF FF FF FF FF

 

FFh} 

 

Response 

Response 

Data Out 

Result 

SW1 

SW2 

Where: 

SW1 SW2

   

 

 

= 90 00h means the operation is completed successfully. 

= 63 00h means the operation failed. 

Summary of Contents for ACR1281U-C1

Page 1: ...Subject to change without prior notice info acs com hk www acs com hk Application Programming Interface V1 08 ACR1281U C1 USB Dual Interface Reader ...

Page 2: ... Read Update Register o All Atmel Memory Card functions o Read Interface Status Updated Sections 5 3 5 5 3 6 Set Read Default LED Buzzer Behaviors Updated Sections 5 3 10 5 3 11 Set Read Automatic PICC Polling Updated description for Set Read Antenna Field 1 01 2012 07 18 Updated Formatting 1 02 2013 01 23 Updated Formatting Updated Section 2 0 Features 1 03 2013 07 11 Updated Product Photo Added ...

Page 3: ...g commands under Section 5 3 o Set Auto PPS o Read Auto PPS o Set Antenna Field o Read Antenna Field Status o Set User Extra Guard Time Setting o Read User Extra Guard Time Setting o Set 616C Auto Handle Option Setting o Read 616C Auto Handle Option Setting Refresh Interface Status 1 05 2015 10 14 Updated Section 5 3 10 Set Automatic PICC Polling 1 06 2017 01 18 Updated Section 2 0 Features Added ...

Page 4: ...y Card ATMEL AT88SC1608 22 5 1 5 Memory Card SLE4418 SLE4428 SLE5518 SLE5528 26 5 1 6 Memory Card SLE4432 SLE4442 SLE5532 SLE5542 31 5 1 7 Memory Card SLE4406 SLE4436 SLE5536 SLE6636 37 5 1 8 Memory Card SLE4404 42 5 1 9 Memory Card AT88SC101 AT88SC102 AT88SC1003 46 5 2 Contactless Smart Card Protocol 54 5 2 1 ATR Generation 54 5 2 2 ATR Format for ISO 14443 Part 3 PICCs 54 5 2 3 ATR Format for IS...

Page 5: ...e Command Example 93 Appendix E Supported Card Types 94 Appendix F ACR128 Compatibility 95 List of Figures Figure 1 ACR1281U C1 Reader Block Diagram 9 Figure 2 ACR1281U C1 Architecture 9 List of Tables Table 1 USB Interface Wiring 10 Table 2 Buzzer Event 11 Table 3 LED Indicator 11 Table 4 Blown Fuse Code Values 52 Table 5 ISO 14443 Part 3 ATR Format 54 Table 6 ISO 14443 Part 4 ATR Format 56 Table...

Page 6: ...ion ACR1281U C1 acts as the intermediary device between the computer and the card The reader which communicates with a contactless tag MCU card SAM card or the device peripherals LED or buzzer will carry out a command issued from the computer It has three interfaces namely the PICC ICC and SAM interfaces which all follow the PC SC specifications The contact interface makes use of the APDU commands...

Page 7: ...d C 5 V 3 V and 1 8 V Supports CAC Common Access Card Supports PIV Personal Identity Verification Card Supports microprocessor cards with T 0 or T 1 protocol Supports memory cards Supports PPS Protocol and Parameters Selection Features Short Circuit Protection Supports extended APDU max 64 KBytes for T 1 max 512 10 Bytes for T 0 o SAM Interface One SAM Slot Supports ISO 7816 Class A SAM cards Appl...

Page 8: ...ACR1281U C1 Application Programming Interface info acs com hk Version 1 08 www acs com hk Page 8 of 96 o RoHS 2 o REACH o Microsoft WHQL ...

Page 9: ...R1281U C1 Architecture 3 1 Reader Block Diagram Figure 1 ACR1281U C1 Reader Block Diagram 3 2 Communication between PC SC driver and ICC PICC and SAM The protocol being used between ACR1281U C1 and the PC is CCID All communications between ICC PICC and SAM are PC SC compliant Figure 2 ACR1281U C1 Architecture ...

Page 10: ...s 64 bytes Bulk IN For response to be sent from ACR1281U C1 to host data packet size is 64 bytes Interrupt IN For card status message to be sent from ACR1281U C1 to host data packet size is 8 bytes 4 2 Contact Smart Card Interface The interface between the ACR1281U C1 and the inserted smart card follows the specifications of ISO 7816 3 with certain restrictions or enhancements to increase the prac...

Page 11: ...contactless cards that are within the field ISO 14443 4 Type A ISO 14443 4 Type B and MIFARE cards are supported 4 4 User Interface 4 4 1 Buzzer A monotone buzzer is used to show the Card Insertion and Card Removal events Events Buzzer 1 The reader is powered up and successfully initialized Beep 2 Card Insertion Event ICC or PICC Beep 3 Card Removal Event ICC or PICC Beep Table 2 Buzzer Event 4 4 ...

Page 12: ...lect Card Type FFh A4h 00h 00h 01h 01h Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 1 2 Select page size This command chooses the page size to read in the card The default value is an 8 byte page write It resets to the default value whenever the card is removed or the reader is turned off Command Command Class INS P1 P2 Lc Page Size ...

Page 13: ... card This command reads the memory card s content from a specified address Command Command Class INS Byte Address MEM_L MSB LSB Read Memory Card FFh B0h Where Byte Address 2 bytes Memory address location of the memory card MEM_L 1 byte Length of data to be read from the memory card Response Response Byte 1 Byte N SW1 SW2 Result Where Byte 1 N Data read from memory card SW1 SW2 90 00h if the opera...

Page 14: ...fied address Command Command Class INS Byte Address MEM_L Byte 1 Byte N MSB LSB Write Memory Card FFh D0h Where Byte Address 2 bytes Memory address location of the memory card MEM_L 1 byte Length of data to be read from the memory card Byte 1 N Data to be written to the memory card Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully ...

Page 15: ...1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 2 2 Select page size This command chooses the page size to read in the card The default value is an 8 byte page write It resets to the default value whenever the card is removed or the reader is turned off Command Command Class INS P1 P2 Lc Page Size Select Page Size FFh 01h 00h 00h 01h Where Page Size 1 byte 03h 8 byte page...

Page 16: ...I2C card Byte Address 2 bytes Memory address location of the memory card MEM_L 1 byte Length of data to be read from the memory card Response Response Byte 1 Byte N SW1 SW2 Result Where Byte 1 N Data read from memory card SW1 SW2 90 00h if the operation is completed successfully 5 1 2 4 Write memory card This command writes the memory card s content to a specified address Command Command Class INS...

Page 17: ... Page 17 of 96 Byte Address 2 bytes Memory address location of the memory card MEM_L 1 Byte Length of data to be read from the memory card Byte 1 N Data to be written to the memory card Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully ...

Page 18: ...ype FFh A4h 00h 00h 01h 03h Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 3 2 Read memory card This command will read the Memory Card s Content from specified address Command Pseudo APDU Command Class INS P1 Byte Address MEM_L Read Memory Card FFh 00h Where INS 1 byte For reading zone 00b INS B0h For reading zone 01b INS B1h For readi...

Page 19: ...address Command Pseudo APDU Command Class INS P1 Byte Address MEM_L Byte 1 Byte N Write Memory Card FFh 00h Where INS 1 byte For reading zone 00b INS D0h For reading zone 01b INS D1h For reading zone 10b INS D2h For reading zone 11b INS D3h For reading fuse INS D4h Byte Address 1 byte Memory address location of the memory card MEM_L 1 byte Length of data to be written to the memory card Byte 1 N D...

Page 20: ... FFh 20h 00h 03h Where PW 0 PW 1 PW 2 Password to be sent to memory card P2 1 Byte 0000 00r pb Where the two bits r p indicates the password to compare r 0 Write password r 1 Read password p Password set number r p 01b for the secure code Response Response Data Out Result SW1 ErrorCnt Where SW1 90h ErrorCnt 1 byte Error Counter FFh indicates the verification is correct 00h indicates the password i...

Page 21: ...h 00h 00h 08h Where Q 0 7 8 bytes Host random number Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 3 6 Verify authentication This command verifies the memory card s authentication Command Pseudo APDU Command Class INS P1 P2 Lc Ch 0 Ch 1 Ch 7 Verify Authentication FFh 82h 00h 00h 08h Where Ch 0 7 8 bytes Host challenge Response Respons...

Page 22: ...W1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 4 2 Read memory card This command reads the memory card s content from a specified address Command Pseudo APDU Command Class INS Zone Address Byte Address MEM_L Read Memory Card FFh Where INS 1 byte For reading user zone INS B0h For reading configuration zone or reading fuse INS B1h Zone Address 1 byte 00000 A10 A9 A8b wher...

Page 23: ...te Address MEM_L Byte 1 Byte N Write Memory Card FFh Where INS 1 byte For reading user zone INS D0h For reading configuration zone or reading fuse INS D1h Zone Address 1 byte 00000 A10 A9 A8b where A10 is the MSB of zone address don t care for reading fuse Byte Address 1 byte A7 A6 A5 A4 A3 A2 A1 A0b is the memory address location of the memory card For reading fuse Byte Address 1000 0000b MEM_L 1...

Page 24: ...dicate the password to compare r 0 Write password r 1 Read password p2 p1 p0 Password set number r p2 p1 p0 0111b for the secure code Response Response Data Out Result SW1 ErrorCnt Where SW1 90h ErrorCnt 1 byte Error Counter FFh indicates the verification is correct 00h indicates the password is locked exceed maximum number of retries Other values indicate the current verification is failed 5 1 4 ...

Page 25: ... the operation is completed successfully 5 1 4 6 Verify authentication This command verifies the memory card s authentication Command Pseudo APDU Command Class INS P1 P2 Lc Ch 0 Ch 1 Ch 7 Verify Authentication FFh 82h 00h 00h 08h Where Ch 0 7 8 bytes Host challenge Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully ...

Page 26: ... 00h if the operation is completed successfully 5 1 5 2 Read memory card This command reads the memory card s content from a specified address Command Command Class INS Byte Address MEM_L MSB LSB Read Memory Card FFh B0h Where MSB Byte Address 1 byte 0000 00 A9 A8b is the memory address location of the memory card LSB Byte Address 1 byte A7 A6 A5 A4 A3 A2 A1 A0b is the memory address location of t...

Page 27: ... presentation error counter FFh indicates the verification is correct 00h indicates the password is locked exceeding the maximum number of retries Other values indicate the verification failed Dummy 1 Dummy 2 2 bytes Dummy data read from the card SW1 SW2 90 00h if the operation is completed successfully 5 1 5 4 Read protection bit This command reads the protection bit Command Command Class INS Byt...

Page 28: ...successfully The arrangement of the protection bits in the PROT bytes is as follows PROT 1 PROT 2 P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 P18 P17 Where Px is the protection bit of byte x in response data 0 byte is write protected 1 byte can be written 5 1 5 5 Write memory card This command writes the memory card s content to a specified address Command Command Class INS Byte Address...

Page 29: ...grammed to 0 Command Where MSB Byte Address 1 byte 0000 00 A9 A8b is the memory address location of the memory card LSB Byte Address 1 byte A7 A6 A5 A4 A3 A2 A1 A0b is the memory address location of the memory card MEM_L 1 byte Length of data to be written to the memory card Byte 1 N Byte values compared with the data in the card starting at the Byte Address Byte 1 is compared with the data at Byt...

Page 30: ...h a 1 bit in the presentation error counter and write the bit 0 2 Present the specified code to the card 3 Try to erase the presentation error counter Command Command Class INS P1 P2 MEM_L Code Byte 1 Byte 2 Present Code Memory Card FFh 20h 00h 00h 02h Where Code 3 bytes Secret code PIN Response Response Data Out Result 90h ErrorCnt Where ErrorCnt 1 byte Error Counter FFh indicates the verificatio...

Page 31: ...2 90 00h if the operation is completed successfully 5 1 6 2 Read memory card This command reads the memory card s content from a specified address Command Command Class INS P1 Byte Address MEM_L Read Memory Card FFh B0h 00h Where Byte Address 1 byte A7 A6 A5 A4 A3 A2 A1 A0b is the memory address location of the memory card MEM_L 1 byte Length of data to be read from the memory card Response Respon...

Page 32: ...card for SLE4442 and SLE5542 only This command reads the presentation error counter for the secret code Command Command Class INS P1 P2 MEM_L Read Presentation Error Counter FFh B1h 00h 00h 04h Response Response ErrCnt Dummy 1 Dummy 2 Dummy 3 SW1 SW2 Result Where ErrCnt 1 byte The value of the presentation error counter 07h indicates the verification is correct 00h indicates the password is locked...

Page 33: ...The arrangement of the protection bits in the PROT bytes is as follows PROT 1 PROT 2 P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 P18 P17 Where Px protection bit of bytes in the response data 0 byte is write protected 1 byte can be written 5 1 6 5 Write memory card This command writes the memory card s content to a specified address Command Command Class INS P1 Byte Address MEM_L Byte 1 ...

Page 34: ...it is irreversibly programmed to 0 Command Command Class INS P1 Byte Address MEM_L Byte 1 Byte N Write Protection Memory Card FFh D1h 00h Where Byte Address 1 byte 000A4 A3 A2 A1b 00h 1Fh is the protection memory address location of the memory card MEM_L 1 byte Length of data to be written to the memory card Byte 1 N Byte values compared with the data in the card starting at the Byte Address Byte ...

Page 35: ...1 bit in the presentation error counter and write bit 0 2 Present the specified code to the card 3 Try to erase the presentation error counter Command Command Class INS P1 P2 MEM_L Code Byte 1 Byte 2 Byte 3 Present Code Memory Card FFh 20h 00h 00h 03h Where Code 3 bytes Secret code PIN Response Response Data Out Result SW1 ErrorCnt Where ErrorCnt 1 byte Error Counter 07h indicates the verification...

Page 36: ...s the new secret code in the card The existing secret code must be presented to the card using the Present Code command prior to the execution of this command Command Command Class INS P1 P2 MEM_L Code Byte 1 Byte 2 Byte 3 Change Code Memory Card FFh D2h 00h 01h 03h Where Code 3 bytes Secret code PIN Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed succe...

Page 37: ... 07h Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 7 2 Read Memory Card This command reads the memory card s content from a specified address Command Command Class INS P1 Byte Address MEM_L Read Memory Card FFh B0h 00h Where Byte Address 1 byte Memory address location of the memory card MEM_L 1 byte Length of data to be read from the ...

Page 38: ...d can be used for writing personalization data and counter values to the card Backup bit is enabled to prevent data loss when card tearing occurs d Write with carry and backup enabled SLE4436 SLE5536 and SLE6636 only The byte value specified in the command is written to the specified address and the command is sent to the card to erase the next lower counter stage This mode can therefore only be u...

Page 39: ...o enable card personalization mode The following actions are executed 1 Search a 1 bit in the presentation error counter and write bit 0 2 Present the specified code to the card Command Where Addr 1 byte Byte address of the presentation counter in the card Code 3 bytes Secret code PIN Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully Command ...

Page 40: ...rst step is to send the Authentication Certificate to the card The second step is to get back two bytes of authentication data calculated by the card Step 1 Send authentication certificate to the card Command Where Key 1 byte Key to be used for the computation of the authentication certificate 00h Key 1 with no cipher block chaining 01h Key 2 with no cipher block chaining 80h Key 1 with cipher blo...

Page 41: ...data Get Response Command Command Class INS P1 P2 MEM_L Get Authentication Data FFh C0h 00h 00h 02h Response Response Cert SW1 SW2 Result Where Cert 2 bytes 16 bits of authentication data computed by the card The LSB of Byte 1 is the first authentication bit read from the card SW1 SW2 90 00h if the operation is completed successfully ...

Page 42: ...e Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 8 2 Read memory card This command reads the memory card s content from a specified address Command Command Class INS P1 Byte Address MEM_L Read Memory Card FFh B0h 00h Where Byte Address 1 byte Memory address location of the memory card MEM_L 1 byte Length of data to be read from the memory card ...

Page 43: ...location of the memory card MEM_L 1 byte Length of data to be written to the memory card Byte 1 N Data to be written to the memory card Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 8 4 Erase scratch pad memory card This command erases the data of the scratch pad memory of the inserted card All memory bits inside the scratch pad memor...

Page 44: ...error counter The Error User Counter can be erased when the submitted code is correct Command Command Class INS Error Counter LEN Byte Address MEM_L Code Byte 1 Byte 2 Verify User Code FFh 20h 04h 08h 02h Where Error Counter LEN 1 byte Length of presentation error counter in bits Byte Address 1 byte Byte address of the key in the card Code 1 byte User Code Response Response Data Out Result SW1 SW2...

Page 45: ...rror Counter cannot be erased Command Where Error Counter LEN 1 byte Length of presentation error counter in bits Byte Address 1 byte Byte address of the key in the card Code 4 bytes Memory Code Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 63 00h if there are no more retries left Note After SW1 SW2 90 00h has been received read back the ...

Page 46: ... 01h 09h Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 9 2 Read Memory Card This command reads the memory card s content from specified address Command Pseudo APDU Command Class INS P1 Byte Address MEM_L Read Memory Card FFh B0h 00h Where Byte Address 1 byte Memory address location of the memory card MEM_L 1 byte Length of data to be ...

Page 47: ...the memory card MEM_L 1 byte Length of data to be written to the memory card Byte 1 N Byte value to be written to the card Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 5 1 9 4 Erase non application zone This command erases the data in non application zones The EEPROM memory is organized into 16 bit words Although erases are performed on ...

Page 48: ...erase the data in Application Zone 1 AT88SC102 To erase the data in Application Zone 2 with EC2 Function Disabled AT88SC1003 To erase the data in Application Zone 1 AT88SC1003 To erase the data in Application Zone 2 with EC2 Function Disabled AT88SC1003 To erase the data in Application Zone 3 The following actions are executed for this command 1 Present the specified code to the card 2 Erase the p...

Page 49: ...he operation is completed successfully Note After SW1SW2 90 00h been received read back the data in Application Zone can check whether the Erase Application Zone with Erase is correct If all data in Application Zone is erased and equals to FFh the previous verification is success 5 1 9 6 Erase Application Zone with Write and Erase This command can be used in the following cases AT88SC101 To erase ...

Page 50: ...101 96h AT88SC102 9Ch AT88SC1003 5Ch Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 63 00 if there is no more retry chance Note After SW1SW2 90 00 has been received read back the data in Application Zone can check whether the Erase Application Zone with Write and Erase is correct If all data in Application Zone is erased and equals to FFh ...

Page 51: ...sed when the submitted code is correct Command Pseudo APDU Command Class INS Error Counter LEN Byte Address MEM_L CODE Byte 1 Byte 2 Verify Security Code FFh 20h 08h 0Ah 02h Where Error Counter LEN 1 byte Length of presentation error counter in bits Byte Address 1 byte Byte address of the key in the card CODE 2 bytes Security Code Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if t...

Page 52: ...pin Should be 01h always State of RST Pin 1 byte State of the RST pin Please refer to below table for the correct value Fuse Bit Addr High Fuse Bit Addr Low State of RST Pin AT88SC101 Manufacturer Fuse 05h 80h 01h EC_EN Fuse 05h C9h 01h Issuer Fuse 05h E0h 01h AT88SC102 Manufacturer Fuse 05h B0h 01h EC2EN Fuse 05h F9h 01h Issuer Fuse 06h 10h 01h AT88SC1003 Manufacturer Fuse 03h F8h 00h EC2EN Fuse ...

Page 53: ... Programming Interface info acs com hk Version 1 08 www acs com hk Page 53 of 96 Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h if the operation is completed successfully 63 00 if there is no more retry chance ...

Page 54: ... number of historical bytes HistByte 0 to HistByte N 1 2 80 TD1 Higher nibble 8 means no TA2 TB2 TC2 only TD2 is following Lower nibble 0 means T 0 3 01 TD2 Higher nibble 0 means no TA3 TB3 TC3 TD3 following Lower nibble 1 means T 1 4 to 3 N 80 T1 Category indicator byte 80 means A status indicator may be present in an optional COMPACT TLV data object 4F Tk Application identifier Presence Indicato...

Page 55: ...00 00 00 6Ah ATR Initial Header T0 TD1 TD2 T1 Tk Length RID Standard Card Name RFU TCK 3Bh 8Fh 80h 01h 80h 4Fh 0Ch A0 00 00 03 06h 03h 00h 01h 00 00 00 00h 6Ah Where Length YY 0Ch RID A0 00 00 03 06h PC SC Workgroup Standard SS 03h ISO 14443A Part 3 Card Name C0 C1 00 01h MIFARE 1K 00 02h MIFARE 4K 00 03h MIFARE Ultralight 00 26h MIFARE Mini FF 28h JCOP 30 FF SAK undefined tags ...

Page 56: ...ecification ISO 14443B Byte1 4 Byte5 7 Byte8 Application Data from ATQB Protocol Info Byte from ATQB Higher nibble MBLI from ATTRIB command Lower nibble RFU 0 XX XX XX Tk 4 N UU TCK Exclusive oring of all the bytes T0 to Tk Table 6 ISO 14443 Part 4 ATR Format Example 1 Consider the ATR from MIFARE DESFire as follows DESFire ATR 3B 81 80 01 80 80h 6 bytes of ATR Note Use the APDU FF CA 01 00 00h to...

Page 57: ...1h for ISO 14443 A cards only Response Data Out Result ATS SW1 SW2 Response Code Results SW1 SW2 Meaning Success 90 00h The operation is completed successfully Warning 62 82h End of UID ATS reached before Le bytes Le is greater than UID Length Error 6C XX Wrong length wrong number Le XX encodes the exact number if Le is less than the available UID length Error 63 00h The operation failed Error 6A ...

Page 58: ... reader s volatile memory 20h Key is loaded into the reader s non volatile memory Other Reserved Key Number 1 byte 00h 1Fh Non volatile memory for storing keys The keys are permanently stored in the reader and will not be erased even if the reader is disconnected from the PC It can store up to 32 keys inside the reader non volatile memory 20h Session Key Volatile memory for temporarily storing key...

Page 59: ...atile keys are stored in EEPROM that is relatively slower than the Internal RAM 3 It is not recommended to use the non volatile key locations 00 1Fh to store any temporary key that will be changed frequently The non volatile keys are supposed to be used for storing any key value that will not change frequently If the key value is supposed to be changed from time to time store the key value to the ...

Page 60: ...ey Number 1 byte 00h 1Fh Non volatile memory for storing keys The keys are permanently stored in the reader and will not be erased even if the reader is disconnected from the PC It can store up to 32 keys inside the reader non volatile memory 20h Session Key Volatile memory for temporarily storing keys The keys will be erased when the reader is disconnected from the PC Only 1 volatile memory is pr...

Page 61: ...locks 3 blocks 16 bytes per block Trailer Block 1 block 16 bytes Sector 32 80h 8Eh 8Fh Sector 33 90h 9Eh 9Fh Sector 38 E0h EEh EFh Sector 39 F0h FEh FFh Table 8 MIFARE 4K Memory Map Example 1 To authenticate Block 04h with the following characteristics Key A key number 00h from PC SC V2 01 Obsolete APDU FF 88 00 04 60 00h Example 2 Similar to the previous example to authenticate Block 04h with the...

Page 62: ...ad write Data36 Data37 Data38 Data39 13 Data read write Data40 Data41 Data42 Data43 14 Data read write Data44 Data45 Data46 Data47 15 Table 9 MIFARE Ultralight Memory Map 5 2 4 3 2 Read binary blocks This command retrieves multiple data blocks from the PICC The data block trailer must be authenticated first before executing the Read Binary Blocks command Command Command Class INS P1 P2 Le Read Bin...

Page 63: ...0 04 10h Example 2 Read 240 bytes starting from the binary block 80h MIFARE 4K Block 80h to Block 8Eh 15 blocks APDU FF B0 00 80 F0 5 2 4 3 3 Update binary blocks This command writes multiple data blocks into the PICC The data block trailer block must be authenticated first before executing the Update Binary Blocks command Command Command Class INS P1 P2 Le Data In Update Binary Blocks FFh D6h 00h...

Page 64: ...block 04h of MIFARE 1K 4K with Data 00 01 0Fh APDU FF D6 00 04 10 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0Fh Example 2 Update the binary block 04h of MIFARE Ultralight with Data 00 01 02 03h APDU FF D6 00 04 04 00 01 02 03h 5 2 4 3 4 Value block operation Increment Decrement Store This command manipulates value based transactions e g increment a value block etc Command Command Class INS P1 P...

Page 65: ...2 Decimal 1 00 00 00 01h VB_Value MSB LSB 00h 00h 00h 01h Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h means the operation is completed successfully 63 00h means the operation failed 5 2 4 3 5 Read value block This command retrieves the value from the value block This command is only valid for value blocks Command Command Class INS P1 P2 Le Read Value Block FFh B1h 00h Block Numb...

Page 66: ...ecimal 1 00 00 00 01h VB_Value MSB LSB 00h 00h 00h 01h Response Response Data Out Result SW1 SW2 Where SW1 SW2 90 00h means the operation is completed successfully 63 00h means the operation failed 5 2 4 3 6 Copy value block This command copies a value from a value block to another value block Command Command Class INS P1 P2 Lc Data In Copy Value Block FFh D7h 00h Source Block Number 02h 03h Targe...

Page 67: ... D7 00 05 05 01 00 00 00 05h 5 2 4 4 Access PC SC compliant tags ISO 14443 4 Basically all ISO 14443 4 compliant cards PICCs can understand the ISO 7816 4 APDUs The ACR1281U C1 reader only needs to communicate with the ISO 14443 4 compliant cards through exchanging ISO 7816 4 APDUs and responses ACR1281U C1 will handle the ISO 14443 Parts 1 4 Protocols internally The MIFARE Classic 1K 4K MIFARE Mi...

Page 68: ...Ah In which The Application Data of ATQB 00 00 00 00h protocol information of ATQB 33 81 81h It is an ISO 14443 4 Type B tag Step 2 Send an APDU Get Challenge 00 84 00 00 08h 1A F7 F3 1B CD 2B A9 58 90 00h Note For ISO 14443 4 Type A tags the ATS can be obtained by using the APDU FF CA 01 00 00h Example ISO 7816 4 APDU To read 8 bytes from an ISO 14443 4 Type B PICC ST19XR08E APDU 80 B2 80 00 08h ...

Page 69: ...tomatically 5 3 1 Get firmware version This command gets the reader s firmware version Command Command Class INS P1 P2 Lc Get Firmware Version E0h 00h 00h 18h 00h Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h Number of Bytes to be Received Firmware Version Example Response E1 00 00 00 0F 41 43 52 31 32 38 31 55 5F 56 35 30 33 2E 31 Firmware Version HEX 41 43 52 31 32 38 31 5...

Page 70: ...command controls the LED output Command Command Class INS P1 P2 Lc Data In LED Control E0h 00h 00h 29h 01h LED Status Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 01h LED Status Where LED Status 1 byte LED Status Description Description Bit 0 Red LED 1 ON 0 OFF Bit 1 Green LED 1 ON 0 OFF Bit 2 7 RFU RFU ...

Page 71: ... This command checks the existing LED status Command Command Class INS P1 P2 Lc LED Status E0h 00h 00h 29h 00h Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 01h LED Status Where LED Status 1 byte LED Status Description Description Bit 0 Red LED 1 ON 0 OFF Bit 1 Green LED 1 ON 0 OFF Bit 2 7 RFU RFU ...

Page 72: ...of 96 5 3 4 Buzzer Control This command controls the buzzer output Command Command Class INS P1 P2 Lc Data In Buzzer Control E0h 00h 00h 28h 01h Buzzer on Duration Where Buzzer on Duration 1 byte 01 FFh Duration unit 10 ms Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 01h 00h ...

Page 73: ...ICC Polling Status LED To show the PICC polling status 1 Enable 0 Disable Bit 2 RFU RFU Bit 3 RFU RFU Bit 4 Card Insertion and Removal Events Buzzer To make a beep whenever a card insertion or removal event is detected for both ICC and PICC 1 Enable 0 Disable Bit 5 Contactless Chip Reset Indication Buzzer To make a beep when the contactless chip is reset 1 Enable 0 Disable Bit 6 Exclusive Mode Sta...

Page 74: ...LED To show the activations status of the ICC interface 1 Enable 0 Disable Bit 1 PICC Polling Status LED To show the PICC polling status 1 Enable 0 Disable Bit 2 RFU RFU Bit 3 RFU RFU Bit 4 Card Insertion and Removal Events Buzzer To make a beep whenever a card insertion or removal event is detected for both ICC and PICC 1 Enable 0 Disable Bit 5 Contactless Chip Reset Indication Buzzer To make a b...

Page 75: ...ter Command Command Class INS P1 P2 Lc Data In Initialize Cards Insertion Counter E0h 00h 00h 09h 04h ICC Cnt LSB ICC Cnt MSB PICC Cnt LSB PICC Cnt MSB Where ICC Cnt LSB 1 byte ICC Insertion Counter LSB ICC Cnt MSB 1 byte ICC Insertion Counter MSB PICC Cnt LSB 1 byte PICC Insertion Counter LSB PICC Cnt MSB 1 byte PICC Insertion Counter MSB Response Response Class INS P1 P2 Le Result E1h 00h 00h 00...

Page 76: ...lue Command Command Class INS P1 P2 Lc Read Cards Insertion Counter E0h 00h 00h 09h 00h Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 04h ICC Cnt LSB ICC Cnt MSB PICC Cnt LSB PICC Cnt MSB Where ICC Cnt LSB 1 byte ICC Insertion Counter LSB ICC Cnt MSB 1 byte ICC Insertion Counter MSB PICC Cnt LSB 1 byte PICC Insertion Counter LSB PICC Cnt MSB 1 byte PICC Insertion Counter MSB...

Page 77: ...alue Command Command Class INS P1 P2 Lc Update Cards Insertion Counter E0h 00h 00h 0Ah 00h Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 04h ICC Cnt LSB ICC Cnt MSB PICC Cnt LSB PICC Cnt MSB Where ICC Cnt LSB 1 byte ICC Insertion Counter LSB ICC Cnt MSB 1 byte ICC Insertion Counter MSB PICC Cnt LSB 1 byte PICC Insertion Counter LSB PICC Cnt MSB 1 byte PICC Insertion Counter ...

Page 78: ...ent in power saving mode Command Command Class INS P1 P2 Lc Data In Set Automatic PICC Polling E0h 00h 00h 23h 01h Polling Setting Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 01h Polling Setting Where Polling Setting 1 byte Default value 8Fh Polling Setting Description Description Bit 0 Auto PICC Polling 1 Enable 0 Disable Bit 1 Turn off Antenna Field if no PICC found 1 En...

Page 79: ...n Power Saving Mode is about 60 mA while the Idle Current Consumption in Non Power Saving mode is about 130 mA Idle Current Consumption PICC is not activated 3 The reader will activate the ISO 14443A 4 mode of the ISO 14443A 4 compliant PICC automatically Type B PICC will not be affected by this option 4 The JCOP30 card comes with two modes ISO 14443A 3 MIFARE 1K and ISO 14443A 4 modes The applica...

Page 80: ...S P1 P2 Le Data Out Result E1h 00h 00h 00h 01h Polling Setting Where Polling Setting 1 byte Default value 8Fh Polling Setting Description Description Bit 0 Auto PICC Polling 1 Enable 0 Disable Bit 1 Turn off Antenna Field if no PICC found 1 Enable 0 Disable Bit 2 Turn off Antenna Field if the PICC is inactive 1 Enable 0 Disable Bit 3 RFU RFU Bit 5 4 PICC Polling Interval for PICC Bit 5 Bit 4 0 0 2...

Page 81: ...any PICC is within the detection range of the reader This command can be used if the automatic PICC polling function is disabled Command Command Class INS P1 P2 Lc Data In Manual PICC Polling E0h 00h 00h 22h 01h 0Ah Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 01h Status Where Status 1 byte 00h PICC is detected FFh No PICC is detected ...

Page 82: ... Data In Set the PICC Operating Parameter E0h 00h 00h 20h 01h Operating Parameter Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 01h Operating Parameter Where Operating Parameter 1 byte Default value 03h Operating Parameter Parameter Description Option Bit 0 ISO 14443 Type A The tag types to be detected during PICC Polling 1 Detect 0 Skip Bit 1 ISO 14443 Type B 1 Detect 0 Ski...

Page 83: ... Command Class INS P1 P2 Lc Read the PICC Operating Parameter E0h 00h 00h 20h 00h Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 01h Operating Parameter Where Operating Parameter 1 byte Operating Parameter Parameter Description Option Bit 0 ISO 14443 Type A The tag types to be detected during PICC Polling 1 Detect 0 Skip Bit 1 ISO 14443 Type B 1 Detect 0 Skip Bit 2 7 RFU RFU ...

Page 84: ... Class INS P1 P2 Lc Data In Set Exclusive Mode E0h 00h 00h 2Bh 01h New Mode Configuration Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 02h Mode Configuration Current Mode Configuration Where Exclusive Mode 1 byte 00h Share Mode ICC and PICC interfaces can work at the same time 01h Exclusive Mode PICC is disabled when Auto Polling and Antenna Power Off when ICC is inserted D...

Page 85: ...mmand Command Class INS P1 P2 Lc Read Exclusive Mode E0h 00h 00h 2Bh 00h Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 02h Mode Configuration Current Mode Configuration Where Exclusive Mode 1 byte 00h Share Mode ICC and PICC interfaces can work at the same time 01h Exclusive Mode PICC is disabled when Auto Polling and Antenna Power Off when ICC is inserted Default ...

Page 86: ...ass INS P1 P2 Le Data Out Result E1h 00h 00h 00h 02h Max Speed Current Speed Where Max Speed Maximum Speed 1 byte Current Speed Current Speed 1 byte 00h 106 Kbps default setting equal to No Auto PPS 01h 212 Kbps 02h 424 Kbps 03h 848 Kbps Notes 1 Normally the application should know the maximum connection speed of the PICCs being used The environment also affects the maximum achievable speed The re...

Page 87: ...current auto PPS setting Command Command Class INS P1 P2 Lc Read Auto PPS E0h 00h 00h 24h 00h Response Response Class INS P1 P2 Le Data Out Result E1h 00h 00h 00h 02h Max Speed Current Speed Where Max Speed Maximum Speed 1 byte Current Speed Current Speed 1 byte 00h 106 Kbps default setting equal to No Auto PPS 01h 212 Kbps 02h 424 Kbps 03h 848 Kbps ...

Page 88: ...ons Step 0 Start the application The reader will do the PICC polling and scan for tags continuously Once the tag is found and detected the corresponding ATR will be sent to the computer Step 1 Connect the ACR1281U PICC Interface with T 1 protocol Step 2 Access the PICC by exchanging APDUs Step N Disconnect the ACR1281U PICC Interface Shut down the application ...

Page 89: ...MIFARE DESFire specification Please refer to MIFARE DESFire specification for more details Example 2 MIFARE DESFire Frame Level Chaining ISO 7816 wrapping mode In this example the application has to do the Frame Level Chaining To get the version of the DESFire card Step 1 Send an APDU 90 60 00 00 00h to get the first frame INS 60h Answer 04 01 01 00 02 18 05 91 AFh 91AFh Step 2 Send an APDU 90 AF ...

Page 90: ...nswer AF 04 01 01 00 02 18 05h 1805h Step 2 Send an APDU AFh to get the second frame INS AFh Answer AF 04 01 01 00 06 18 05h 1805h Step 3 Send an APDU AFh to get the last frame INS AFh Answer 00 04 52 5A 19 B2 1B 80 8E 36 54 4D 40 26 04h 2604h Note In MIFARE DESFire Native Mode the status code 90 00h will not be added to the response if the response length is greater than 1 If the response length ...

Page 91: ...C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE 0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF9000h Example 2 APDU length 775 bytes APDU Command 80D20000000300000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F 202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F40414243444546 4748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C...

Page 92: ...FF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF00010203040 5060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2 C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152 535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F70717273747576777879 7A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA 0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4...

Page 93: ...puter Step 2 Open the PCSCDirectCommand exe Step 3 Connect the reader in Direct mode The ATR will be displayed if a card is present or No ATR retrieved ATRLen 0 will be displayed if no card Step 4 Enter Command 2079 Enter Data 18 00 APDU for Get Firmware Version Press Enter to send to reader and then check the response Note PCSCDirectCommand exe is not available in the Software Development Kit SDK...

Page 94: ... GET_READER_INFORMATION correspond with the respective card type Card Type Code Card Type 00h Auto select T 0 or T 1 communication protocol 01h I2C memory card 1k 2k 4k 8k and 16k bits 02h I2C memory card 32k 64k 128k 256k 512k and 1024k bits 03h RFU 04h RFU 05h Infineon SLE4418 and SLE4428 06h Infineon SLE4432 and SLE4442 07h Infineon SLE4406 SLE4436 and SLE5536 08h Infineon SLE4404 09h RFU ...

Page 95: ...activated PICC 1F 03 Data 3 bytes Not supported 2 Transceiver Setting 20 04 06 Data 3 bytes Not supported 3 PICC Setting 2A 0C Data 12 bytes Not supported 4 PICC T CL Data Exchange Error Handling 2C 02 Data 1 byte Not supported 5 Read Register 19 01 Reg No Not supported 6 Update Register 1A 02 Reg No Value Not supported 7 PICC Polling for Specific Types 20 02 Data 1 byte FF 20 01 Data 1 byte 8 Buz...

Page 96: ... Buzzer Bit 6 Exclusive Mode Status Buzzer Bit 7 Card Operation Blinking LED 10 Set Read Automatic PICC Polling Set 23 01 Data 1 byte Read 23 00 Data Bit 0 Auto PICC Polling Bit 1 Turn off Antenna Field if no PICC is found Bit 2 Turn off Antenna Field if the PICC is inactive Bit 3 Activate the PICC when detected Bit 4 5 PICC Poll Interval for PICC Bit 6 Test Mode Bit 7 Enforce ISO 14443A Part 4 Se...

Reviews:

No comments