6.2.8 Password authentication
(PWD_AUTH) command
The protected memory area can be accessed
only after successful password verification via
the PWD_AUTH command.
The PWD_AUTH command takes the
password as parameter and, if successful,
returns the password authentication
acknowledge, PACK.
Figure 25 below shows the password
authentication sequence.
Figure 25 – Password authentication sequence
After successful authentication, the password can be changed by writing the new password to memory page
0xE5.
Note that a read access to page 0xE5 always return 0x00000000, i.e. it is not possible to read out the current
PIN code.
6.3 Using TWN4 as USB NFC reader
Elatec RFID Systems provides a PC software called “Director” as part of their software sup- port package. At
the time of writing, this was available from this address: https://www.elatec-rfid.com/en/download-
center/contact-form-twn4-devpack-sdk/
Figure 26 below shows the user interface of this software.
Figure 26 – User interface of TWN4 Director
By using this software, it is easily possible to generate the required serial commands that have to be sent via
CDC / Virtual COM port to TWN4 and understand the structure of the response that will be received back.
6.3.1 Useful commands
The following commands are especially useful:
1.SearchTag(maximum ID bytes)
Used to search for a connected tag and identify type and ID of such tag. This should always be used as first
operation ahead of any read / write / authenticate actions. Example: SearchTag(32)
2.NTAG_PwdAuth(32 bit password as hex bytes, 16 bit password_ack as hex bytes)
Used to authenticate access to the protected memory area
Example: NTAG_PwdAuth(0x00 0x00 0xE2 0x15, 0x00 0x00)
3.NTAG_Read(page)
Used to read one page of data
Example: NTAG_Read(0x04)
4.NTAG_Write(page, data)
Used to write one page of data
Example: NTAG_Write(0x40, 0x12 0x34 0x56 0x78)
5.NTAG_Write(0xE5, PIN Code)
Used to set a new pin code by writing to page 0xE5
Example: NTAG_Write(0xE5, 0x12 0x34 0x56 0x78)
6.3.2 Translation into binary data
In order to use these commands within a user application, they have to be translated into raw data. This can be
done by enabling the “Show Raw Data” feature in the command log of the Director software as shown in Figure
27 below.
Figure 27 – Enabling raw data display
This raw data can then be transmitted to TWN4 via a virtual COM port. TWN4 will respond to the request with
the corresponding response as shown in Figure 28 below.
Figure 28 – Binary data exchange
6.4 Configuration memory organization
The SR-SBP2801-BLE-E configuration
memory is divided into the following areas:
1.Public data
2.Protected data
In addition to that, SR-SBP2801-BLE-E
maintains a private configuration memory
region used to store default parameters and
confidential information which is not
accessible to the user.
Figure 29 below shows the configuration
memory structure used by SR-SBP2801-BLE-
E.
Figure 29 – Configuration memory structure
