ACR1281U ACR1281U Specification V1.04 Advanced Card Systems Ltd.
ACR1281U Revision History Rev Number Date Author V1.00 20-May-2010 Vincent Zhong Preliminary specification for ACR1281U V1.01 28-May-2010 V1.02 8-Oct-2010 1) Firmware Upgrade Instruction Added 2) Extended APDU Example Added 1) Added Counter Command V1.03 28-Oct-2010 Vincent Zhong/Nathan Li/Kit Au Vincent Zhong/Nathan Li/Kit Au Vincent Zhong/Nathan Li/Kit Au V1.04 8-Dec-2010 Advanced Card Systems Ltd. Vincent Zhong/Jessy Wei Notes 1) Modify the command of RC531 register write/read.
ACR1281U Index Introduction..........................................................................................................................................6 features.................................................................................................................................................6 Terms ...................................................................................................................................................
ACR1281U PICC Commands (T=CL Emulation) for MIFare 1K/4K MEMORY Cards ....................................29 2.1 Load Authentication Keys .......................................................................................................29 2.2.1 Authentication for MIFARE 1K/4K.....................................................................................31 2.3 Read Binary Blocks .................................................................................................................34 2.
ACR1281U 7. Memory Card – SLE4406/SLE4436/SLE5536/SLE6636.........................................................58 7.1 Select Card Type .....................................................................................................................58 7.2 Read Memory Card .................................................................................................................58 7.3 Write One Byte Memory Card .....................................................................................
ACR1281U INTRODUCTION The ACR1281U is a dual-interface reader (IFD and PCD) that supports both contact and contactless (PICC) smart cards. FEATURES • • • • • • • • • • • • • • • • One standard ICC landing type card acceptor. ISO 7816 Parts 1-4 Compliant for Contact Smart Card Interface. The ACR1281U supports contact memory cards (refer to appendix A). ISO 14443 Parts 1-4 Compliant for Contactless Smart Card Interface. A built-in antenna for PICC contactless access applications.
ACR1281U TERMS • • • • • • • • • • • • • • • • • • • • IFD: Interface Device. A terminal, communication device, or machine to which the integrated circuit(s) card is electrically connected during operation. PCD: Proximity Coupling Device. ISO 14443 Contactless Reader. ICC: Integrated Circuit(s) Card. Refer to a plastic card containing an integrated circuit, which is compatible with ISO 7816. PICC: Proximity Integrated Circuit(s) Card.
ACR1281U QUICK OVERVIEW OF THE ACR1281U READER 1. ACR1281U (with Contact Card Option) 2. ACR1281U (without Contact Card Option) Advanced Card Systems Ltd.
ACR1281U 3. ACR1281U ICC Interface 4. ACR1281U PICC Interface Advanced Card Systems Ltd.
ACR1281U Recommended ICAO E-Passport Placement ICAO E-Passport • In case the E-Passport is not accessible, try to place the E-Passport above the reader by 5~10mm. 5~10mm Advanced Card Systems Ltd.
ACR1281U 5. ACR1281U Firmware Upgrade Procedures 5.1 Upgrade by “FW” Key Step 1: Unplug the Reader Step 2: Open Casing Step 3: Press the “FW, and Hold it Step 4: Plug the Reader into PC’s USB Port Step 5: Release the “FW” key Step 6: Run Firmware Upgrade Application for Firmware Upgrade 5.2 Upgrade by APDU command Step 1: Plug the Reader into PC’s USB Port Step 2: Run Firmware Upgrade Application for Firmware Upgrade Step 3: Select the Reader Name and Connect, then Press “Load Patch” For firmware upgrade.
ACR1281U SYSTEM DESCRIPTION 1. The Reader Block Diagram LED & Buzzer RC531 NFC Interface Chip Built-In Antenna Contactless Interface Carrier = 13.56MHz PICC Contactless Card Advanced Card Systems Ltd.
ACR1281U 2. Communication Flow Chart of ACR1281U Host ACR1281U PCSC ICC Interface ACR1281U PCSC PICC Interface USB Interface (CCID) PCSC Layer T=CL &T=1 Emulation ACR1281U ISO 7816 Part1-4 ICC Interface ISO 14443 Part1-4 PICC Interface Physical Interface ICC And PICC Advanced Card Systems Ltd.
ACR1281U HARDWARE DESCRIPTION 1. USB Interface The ACR1281U is connected to a computer through USB as specified in the USB Specification 2.0. ACR1281U is working in Full speed mode, i.e. 12 Mbps. Pin 1 2 3 4 Signal VBUS DD+ GND Function +5V power supply for the reader (Max 200mA) Differential signal transmits data between ACR1281U and PC. Differential signal transmits data between ACR1281U and PC. Reference voltage level for power supply 2.
ACR1281U 3. Buzzer A monotone buzzer is used to show the “Card Insertion” and “Card Removal” events. Events 1. The reader powered up and initialization success. 2. Card Insertion Event (ICC or PICC) 3. Card Removal Event (ICC or PICC) Buzzer Beep Beep Beep 4. ICC Interface (Contact Smart Card) A landing type Smart Card Acceptor is used for providing reliable operations. The minimum life cycle of the acceptor is about 300K times of card insertion and removal. 5.
ACR1281U SOFTWARE DESCRIPTION 1. TAPDUDemoCard Demo App This program is used to demonstrate the PCSC functions of the ACR1281U readers. Operating Procedures: 1) Place a PICC on the top of the ACR1281U reader. 2) Press “1. Select Reader” and select the “ACS ACR1281Dual Reader PICC 0”. 3) Select “T1” in the connection-protocol. Press “2. Connect” to establish a connection between the card and reader. 4) Enter the APDU in text box “Message to the card” 5) Press “3. Transmit” to send the APDU to the card.
ACR1281U 1. Get Firmware Version Command = {E0 00 00 18 00} Response = {E1 00 00 00 “Frame Length” {Firmware Version}} In which, Firmware Version = 13 bytes; e.g. Response = E1 00 00 00 0D 41 43 52 31 32 38 31 55 5F 56 31 30 33 Firmware Version (HEX) = 41 43 52 31 32 38 31 55 5F 56 31 30 33 Firmware Version (ASCII) = “ACR1281U_V103 2.
ACR1281U 4. Buzzer Control Setting the Buzzer State: Command = {E0 00 00 28 01 “Duration”} Unit = 10mS 00 = Turn off 01 ~ FE = Duration FF = Turn o Response = {E1 00 00 00 01 “Status”} Reading the existing Buzzer State: Command = {E0 00 00 28 00} Response = {E1 00 00 00 01 “Status”} 5.
ACR1281U 6. Automatic PICC Polling Whenever the reader is connected to the PC, the PICC polling function will start the PICC scanning to determine if a PICC is placed on / removed from the built-antenna. We can send a command to disable the PICC polling function. The command is sent through the PCSC Escape command interface. To meet the energy saving requirement, special modes are provided for turning off the antenna field whenever the PICC is inactive, or no PICC is found.
ACR1281U 7. PICC Polling for specific PICC Types The PICC polling function can be configured to detect “ISO14443 Type A PICCs” or “ISO14443 Type B PICCs” or both. • • • • ISO 14443 Type A PICCs Only = { E0 00 00 20 01 01} ISO 14443 Type B PICCs Only = { E0 00 00 20 01 02 } ISO 14443 Type A and B PICCs = { E0 00 00 20 01 03} #default setting Read the existing status = { E0 00 00 20 00}; Response = {E1 00 00 00 01 “Status”} Hints: 1.
ACR1281U 10. Request Command Test This command is used for sending REQA/REQB by the reader to test antenna field and the response. • Command = {E0 00 00 26 02 “Command” “Speed”} • Response = {E1 00 00 00 “Length” “Data”} Command coding: REQA = 01 REQB = 02 WUPA = 03 WUPB = 04 Speed coding: 106k bps = 00 212k bps = 01 424k bps = 02 Length: No response: 00 ATQA: 02 ATQB: 0C Others: RFU Data: Response Data (ATQA/ATQB/Others) Hints: 1.
ACR1281U 12. Read and Update the RC531 Register • • • • Read the Register = {E0 00 00 19 “Register No”} Response = {E1 00 00 00 01 “Current Value”} Update the Register = {E0 00 00 1A “Register No” “New Value”} Response = {E1 00 00 00 00} 13. Go into Contactless EMV Terminal Loop • • Command = {0E 00 01 00 00} Response = {90“Current Value”} 14. Go into Contact EMV Terminal Loop • • Command = {0E 01 01 00 00} Response = {E1 00 00 00 01 “Current Value”} 15.
ACR1281U PICC INTERFACE DESCRIPTION 1. ATR Generation If the reader detects a PICC, an ATR will be sent to the PCSC driver for identifying the PICC. 1.1 ATR format for ISO 14443 Part 3 PICCs. Byte Value Designation (Hex) 0 3B Initial Header 1 8N T0 2 80 TD1 3 01 TD2 80 T1 Tk 3+N 4F 0C RID 4+N SS C0 .. C1 00 00 00 00 UU 4 To RFU TCK Description Higher nibble 8 means: no TA1, TB1, TC1 only TD1 is following.
ACR1281U 1.2 ATR format for ISO 14443 Part 4 PICCs. Byte Value Designation (Hex) 0 3B Initial Header 1 8N T0 2 80 TD1 3 01 TD2 4 to 3+N XX XX XX XX T1 Tk Description Higher nibble 8 means: no TA1, TB1, TC1 only TD1 is following. Lower nibble N is the number of historical bytes (HistByte 0 to HistByte N-1) Higher nibble 8 means: no TA2, TB2, TC2 only TD2 is following. Lower nibble 0 means T = 0 Higher nibble 0 means no TA3, TB3, TC3, TD3 following.
ACR1281U PICC COMMANDS FOR GENERAL PURPOSES 1. Get Data The “Get Data command” will return the serial number or ATS of the “connected PICC”. Table 1.1-1a: Get UID APDU Format (5 Bytes) Command Class INS Get Data FF CA P1 P2 Le 00 01 00 00 (Max Length) Table 2.1-1b: Get UID Response Format (UID + 2 Bytes) if P1 = 0x00 Response Data Out Result UID (LSB) UID (MSB) SW1 SW2 Table 2.1-1c: Get ATS of a ISO 14443 A card (ATS + 2 Bytes) if P1 = 0x01 Response Data Out Result ATS Table 2.
ACR1281U PICC COMMANDS (T=CL EMULATION) FOR MIFARE 1K/4K MEMORY CARDS 2.1 Load Authentication Keys The “Load Authentication Keys command” will load the authentication keys into the reader. The authentication keys are used to authenticate the particular sector of the Mifare 1K/4K Memory Card. Two kinds of authentication key locations are provided, volatile and non-volatile key locations respectively. Table 2.
ACR1281U // Load a key {FF FF FF FF FF FF} into the non-volatile memory location 0x05. APDU = {FF 82 20 05 06 FF FF FF FF FF FF} // Load a key {FF FF FF FF FF FF} into the volatile memory location 0x20. APDU = {FF 82 00 20 06 FF FF FF FF FF FF} Hints: 1. Basically, the application should know all the keys being used. It is recommended to store all the required keys to the non-volatile memory for security reasons.
ACR1281U 2.2.1 Authentication for MIFARE 1K/4K The “Authentication command” uses the keys stored in the reader to do authentication with the MIFARE 1K/4K card (PICC). Two types of authentication keys are used, TYPE_A and TYPE_B respectively. Table 2.2-1a: Load Authentication Keys APDU Format (6 Bytes) #Obsolete Command Class INS P1 P2 P3 Authentication FF 88 00 Block Number Key Type Table 2.
ACR1281U Table 2.2-1b: Load Authentication Keys Response Format (2 Bytes) Response Data Out Result SW1 SW2 Table 2.2-1c: Load Authentication Keys Response Codes Results SW1 SW2 Meaning Success 90 00 Error 63 00 The operation is completed successfully. The operation is failed. MIFARE 1K Memory Map. Sectors (Total 16 sectors. Each sector consists of 4 consecutive blocks) Sector 0 Sector 1 .. ..
ACR1281U Examples: // To authenticate the Block 0x04 with a {TYPE A, non-volatile, key number 0x05}. // PC/SC V2.01, Obsolete APDU = {FF 88 00 04 60 05}; // To authenticate the Block 0x04 with a {TYPE A, non-volatile, key number 0x05}. // PC/SC V2.07 APDU = {FF 86 00 00 05 01 00 04 60 05} Hints: MIFARE Ultralight does not need to do any authentication. The memory is free to access. Advanced Card Systems Ltd.
ACR1281U 2.3 Read Binary Blocks The “Read Binary Blocks command” is used for retrieving a multiple of “data blocks” from the PICC. The data block/trailer block must be authenticated first before executing the “Read Binary Blocks command”. Table 2.3-1a: Read Binary APDU Format (5 Bytes) Command Class INS P1 Read Binary Blocks FF B0 00 P2 Le Block Number Number of Bytes to Read Block Number (1 Byte): The starting block.
ACR1281U 2.4 Update Binary Blocks The “Update Binary Blocks command” is used for writing a multiple of “data blocks” into the PICC. The data block/trailer block must be authenticated first before executing the “Update Binary Blocks command”. Table 2.3-1a: Update Binary APDU Format (Multiple of 16 + 5 Bytes) Command Class INS P1 P2 Lc Update Binary Blocks FF D6 00 Block Number Number of Bytes to Update Data In Block Data (Multiple of 16 Bytes) Block Number (1 Byte): The starting block to be updated.
ACR1281U 2.5 Value Block Related Commands The data block can be used as value block for implementing value-based applications. 2.5.1 Value Block Operation The “Value Block Operation command” is used for manipulating value-based transactions. E.g. Increment a value of the value block etc. Table 2.5.1-1a: Value Block Operation APDU Format (10 Bytes) Command Class INS P1 P2 Lc Value Block Operation FF D7 00 Block Number 05 Data In VB_OP VB_Value (4 Bytes) {MSB ..
ACR1281U 2.5.2 Read Value Block The “Read Value Block command” is used for retrieving the value from the value block. This command is only valid for value block. Table 2.5.2-1a: Read Value Block APDU Format (5 Bytes) Command Class INS P1 P2 Read Value Block FF B1 00 Le Block Number 00 Block Number (1 Byte): The value block to be accessed. Table 2.5.2-1b: Read Value Block Response Format (4 + 2 Bytes) Response Data Out Result Value {MSB ..
ACR1281U 2.5.3 Restore Value Block The “Restore Value Block command” is used to copy a value from a value block to another value block. Table 2.5.3-1a: Restore Value Block APDU Format (7 Bytes) Command Class INS P1 P2 Value Block Operation FF D7 00 Source Block Number Lc 02 Data In 03 Target Block Number Source Block Number (1 Byte): The value of the source value block will be copied to the target value block. Target Block Number (1 Byte): The value block to be restored.
ACR1281U Examples: // Store a value “1” into block 0x05 APDU = {FF D7 00 05 05 00 00 00 00 01} // Read the value block 0x05 APDU = {FF B1 00 05 00} Advanced Card Systems Ltd.
ACR1281U // Copy the value from value block 0x05 to value block 0x06 APDU = {FF D7 00 05 02 03 06} // Increment the value block 0x05 by “5” APDU = {FF D7 00 05 05 01 00 00 00 05} Advanced Card Systems Ltd.
ACR1281U MEMORY CARD ACCESS 1. Memory Card – 1,2,4,8,16 kbit I2C card 1.1 Select Card Type This command powers down and up the selected card inserted in the card reader and performs a card reset. • Command format Pseudo-APDU • CLA INS P1 P2 Lc Card Type FF H A4 H 00 H 00 H 01 H 01 H Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 1.2 Select Page Size This command will choose the page size to read the smart card. The default value is 8-byte page write.
ACR1281U Pseudo-APDU CLA INS Byte Address MSB FF H MEM_L LSB B0 H Byte Address Memory address location of the memory card. MEM_L Length of data to be read from the memory card. • Response data format BYTE 1 … … BYTE x Data read from memory card SW1, SW2 = 90 00 if no error BYTE N SW1 SW2 1.4 Write Memory Card • Command format Pseudo-APDU CLA INS Byte Address MSB FF H MEM_L Byte 1 Memory address location of the memory card.
ACR1281U Pseudo-APDU • CLA INS P1 P2 Lc Card Type FF H A4 H 00 H 00 H 01 H 02 H Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 2.2 Select Page Size This command will choose the page size to read the smart card. The default value is 8-byte page write. It will reset to default value whenever the card is removed or the reader is powered off.
ACR1281U = 1011 000* b for 1024kbit ICC card, where * is the MSB of the 17 bit addressing Byte Address Memory address location of the memory card. MEM_L Length of data to be read from the memory card. • Response data format BYTE 1 • • BYTE x SW1, SW2 … … BYTE N SW1 SW2 Data read from memory card = 90 00 if no error 2.4 Write Memory Card • Command format Pseudo-APDU CLA INS Byte Address MSB MEM_L Byte 1 .... ....
ACR1281U Pseudo-APDU • CLA INS P1 P2 Lc Card Type FF H A4 H 00 H 00 H 01 H 03 H Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 3.2 Read Memory Card • Command format Pseudo-APDU CLA INS P1 FF H Byte Address MEM_L 00 H = B0 for reading zone 00 b INS = B1 for reading zone 01 b = B2 for reading zone 10 b = B3 for reading zone 11 b = B4 for reading fuse Byte Address Memory address location of the memory card. MEM_L Length of data to be read from the memory card.
ACR1281U = D1 for writing zone 01 b = D2 for writing zone 10 b = D3 for writing zone 11 b = D4 for writing fuse Byte Address Memory address location of the memory card. MEM_L Length of data to be written to the memory card. MEM_D Data to be written to the memory card. • Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 3.
ACR1281U 3.5 Initialize Authentiction • Command format Pseudo-APDU CLA INS P1 P2 Lc FF H 84 H 00 H 00 H 08 H Q(0) Q(1) … Q(7) Ch(0) Ch(1) … Ch(7) Host random number, 8 bytes. Response data format Q(0),Q(1)…Q(7) • SW1 • SW1, SW2 SW2 = 90 00 if no error 3.6 Verify Authentication • Command format Pseudo-APDU CLA INS P1 P2 Lc FF H 82 H 00 H 00 H 08 H Host challenge, 8 bytes. Response data format Ch(0),Ch(1)…Ch(7) • SW1 • SW1, SW2 SW2 = 90 00 if no error 4.
ACR1281U SW1 • SW1, SW2 SW2 = 90 00 if no error 4.2 Read Memory Card • Command format Pseudo-APDU CLA INS Zone Address Byte Address MEM_L FF H = B0 for reading user zone INS = B1 for reading configuration zone or reading fuse Zone Address = 0000 0A10A9A8 b, where A10 is the MSB of zone address = don’t care for reading fuse Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card. = 1000 0000 b for reading fuse Length of data to be read from the memory card.
ACR1281U Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card. = 1000 0000 b for writing fuse MEM_L Length of data to be written to the memory card. Byte x Data to be written to the memory card. • Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 4.4 Verify Password • Command format Pseudo-APDU CLA INS P1 P2 Lc FF H 20 H 00 H 00 H 04 H Data RP Pw(0),Pw(1),Pw(2) Passwords to be sent to memory card.
ACR1281U Byte Address Memory address location of the memory card. Q(0),Q(1)…Q(7) Host random number, 8 bytes. • Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 4.6 Verify Authentication • Command format Pseudo-APDU Byte Address INS P1 P2 Lc FF H 82 H 00 H 00 H 08 H … Q1(7) Host challenge, 8 bytes. Response data format SW1 • Q1(0) Q1(1) Memory address location of the memory card. Q1(0),Q1(1)…Q1(7) • CLA SW1, SW2 SW2 = 90 00 if no error 5.
ACR1281U 5.2 Read Memory Card • Command format Pseudo-APDU CLA INS Byte Address MSB FF H MEM_L LSB B0 H MSB Byte Address = 0000 00A9A8 b is the memory address location of the memory card. LSB Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card. Length of data to be read from the memory card. MEM_L • Response data format BYTE 1 • • BYTE x SW1, SW2 … … BYTE N SW1 SW2 Data read from memory card = 90 00 if no error 5.
ACR1281U Pseudo-APDU CLA INS Byte Address MSB FF H MEM_L LSB B2 H MSB Byte Address = 0000 00A9A8 b is the memory address location of the memory card. LSB Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card. Length of protection bits to be read from the card, in multiples of 8 bits. MEM_L Maximum value is 32.
ACR1281U Data to be written to the memory card. Byte x • Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 5.6 Write Protection Memory Card Each of the bytes specified in the command is internally in the card compared with the byte stored at the specified address and if the data match, the corresponding protection bit is irreversibly programmed to ‘0’. • Command format Pseudo-APDU CLA INS Byte Address MSB FF H MEM_L Byte 1 .... ....
ACR1281U Pseudo-APDU CLA INS P1 P2 MEM_L CODE Byte 1 FF H CODE • 20 H 00 H 00 H Byte 2 02 H Two bytes secret code (PIN) Response data format SW1 SW2 ErrorCnt 90 H • • SW1 = 90 SW2 (ErrorCnt) = Error Counter. FF indicates the verification is correct. 00 indicates the password is locked (exceed maximum number of retries). Other values indicate the current verification is failed. 6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542 6.
ACR1281U BYTE 1 • • • • … … BYTE N PROT 1 PROT3 PROT 4 SW1 SW2 BYTE x Data read from memory card PROT y Bytes containing the protection bits from protection memory SW1, SW2 = 90 00 if no error The arrangement of the protection bits in the PROT bytes is as follows: PROT 1 P8 • • • PROT 2 P7 P6 P5 P4 PROT 2 P3 P2 P1 P16 P15 P14 P13 … P12 P11 P10 P9 .. .. .. .. .. ..
ACR1281U PROT 1 PROT 2 PROT3 PROT 4 SW1 SW2 PROT y Bytes containing the protection bits from protection memory SW1, SW2 = 90 00 if no error The arrangement of the protection bits in the PROT bytes is as follows: • • • • PROT 1 P8 • • • P7 P6 P5 P4 PROT 2 P3 P2 P1 P16 P15 P14 P13 P12 … P11 P10 P9 .. .. .. .. .. .. P18 P17 Px is the protection bit of BYTE x in the response data ‘0’ byte is write protected ‘1’ byte can be written 6.
ACR1281U Byte Address = 000A4 A3A2A1A0 b (00 H to 1F H) is the protection memory address location of the memory card. MEM_L Length of data to be written to the memory card. Byte x Byte values to be compared with the data in the card starting at Byte Address. BYTE 1 is compared with the data at Byte Address; BYTE N is compared with the data at (Byte Address+N-1). • Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 6.
ACR1281U Pseudo-APDU CLA INS P1 P2 MEM_L CODE Byte 1 FF H • D2 H 00 H 01 H Byte 3 Response data format SW1 • Byte 2 03 H SW1, SW2 SW2 = 90 00 if no error 7. Memory Card – SLE4406/SLE4436/SLE5536/SLE6636 7.1 Select Card Type This command powers down and up the selected card inserted in the card reader and performs a card reset.
ACR1281U BYTE 1 • • BYTE x SW1, SW2 … … BYTE N SW1 SW2 Data read from memory card = 90 00 if no error 7.3 Write One Byte Memory Card To write one byte to the specified address of the inserted card. The byte is written to the card with LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0.
ACR1281U 02 : write with backup enabled (SLE4436, SLE5536 and SLE6636 only) 03 : write with carry and with backup enabled (SLE4436, SLE5536 and SLE6636 only) BYTE • Byte value to be written to the card Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 7.4 Present Code Memory Card To submit the secret code to the memory card to enable the card personalization mode.
ACR1281U The authentication has to be performed in two steps. The first step is to send the Authentication Certificate to the card. The second step is to get back two bytes of authentication data calculated by the card.
ACR1281U 8. Memory Card – SLE4404 8.1 Select Card Type This command powers down and up the selected card inserted in the card reader and performs a card reset. • Command format Pseudo-APDU • CLA INS P1 P2 Lc Card Type FF H A4 H 00 H 00 H 01 H 08 H Response data format SW1 • SW1, SW2 SW2 = 90 00 if no error 8.2 Read Memory Card • Command format Pseudo-APDU CLA INS P1 FF H B0 H 00 H Byte Address MEM_L Byte Address = Memory address location of the memory card.
ACR1281U Pseudo-APDU CLA INS P1 Byte Address FF H D0 H 00 H MEM_L Byte 1 Byte Address = Memory address location of the memory card. MEM_L Length of data to be written to the memory card. BYTE Byte value to be written to the card • .... Byte N Response data format SW1 • .... SW1, SW2 SW2 = 90 00 if no error 8.4 Erase Scratch Pad Memory Card To erase the data of the scratch pad memory of the inserted card.
ACR1281U Pseudo-APDU CLA FF H Error Counter LEN Byte Address CODE • INS Error Counter LEN Byte Address MEM_L 04 H 08 H 02 H 20 H Byte 2 Length of presentation error counter in bits. Byte address of the key in the card. 2 bytes User Code Response data format SW1 • CODE Byte 1 SW1, SW2 SW2 = 90 00 if no error. = 63 00 if there is no more retry chance Note: After SW1SW2 = 90 00 has been received, read back the User Error Counter can check whether the VERIFY_USER_CODE is correct.
ACR1281U Note: After SW1SW2 = 0x9000 has been received, read back the Application Area can check whether the VERIFY_MEMORY_CODE is correct. If all data in Application Area is erased and equals to “FF”, the previous verification is success. 9. Memory Card – AT88SC101 / AT88SC102 / AT88SC1003 9.1 Select Card Type This command powers down and up the selected card inserted in the card reader and performs a card reset.
ACR1281U 9.3 Write Memory Card To write data to the specified address of the inserted card. The byte is written to the card with LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0. The byte at the specified card address is not erased prior to the write operation and, hence, memory bits can only be programmed from '1' to '0'. • Command format Pseudo-APDU CLA INS P1 Byte Address FF H D0 H 00 H MEM_L Byte 1 Byte Address = Memory address location of the memory card.
ACR1281U SW1 • SW1, SW2 SW2 = 90 00 if no error 9.
ACR1281U • SW1, SW2 = 90 00 if no error. Note: After SW1SW2 = 90 00 has been received, read back the data in Application Zone can check whether the Erase Application Zone with Erase is correct. If all data in Application Zone is erased and equals to “FF”, the previous verification is success. 9.
ACR1281U 9.7 Verify Security Code To submit Security Code (2 bytes) to the inserted card. Security Code is to enable the memory access of the card. The following actions are executed: - present the specified code to the card - search a '1' bit in the presentation error counter and write the bit to '0' - erase the presentation error counter. The Security Code Attempts Counter can be erased when the submitted code is correct.
ACR1281U State of the RST pin. Please refer to below table for the correct value.
ACR1281U BASIC PROGRAM FLOW FOR CONTACTLESS APPLICATIONS Step 0. Start the application. The reader will do the PICC Polling and scan for tags continuously. Once the tag is found and detected, the corresponding ATR will be sent to the PC. Step 1. Connect the “ACR1281U Interface” with T=1 protocol. Step 2. Access the PICC by exchanging APDUs. Step 2. Access the PICC by exchanging APDUs. .. Step N. Disconnect the “ACR1281U Interface”. Shut down the application. Advanced Card Systems Ltd.
ACR1281U 1. How to access PCSC Compliant Tags (ISO14443-4)? Basically, all ISO 14443-4 complaint cards (PICCs) would understand the ISO 7816-4 APDUs. The ACR1281U Reader just has to communicate with the ISO 14443-4 complaint cards through exchanging ISO 7816-4 APDUs and Responses. ACR1281U will handle the ISO 14443 Parts 1-4 Protocols internally. MIFARE 1K, 4K, MINI and Ultralight tags are supported through the T=CL emulation. Just simply treat the MIFARE tags as standard ISO14443-4 tags.
ACR1281U Typical sequence may be: - Present the Tag and Connect the PICC Interface - Read / Update the memory of the tag Step 1) Connect the Tag Step 2) Send an APDU, Get Challenge. << 00 84 00 00 08 >> D1 04 32 5A 9C E9 FF 0D [90 00] Hint: For ISO14443-4 Type A tags, the ATS can be obtained by using the APDU “FF CA 01 00 00” Advanced Card Systems Ltd.
ACR1281U For Example: ISO7816-4 APDU // To read 8 bytes from an ISO 14443-4 Type B PICC (ST19XR08E) APDU ={80 B2 80 00 08} Class = 0x80 INS = 0xB2 P1 = 0x80 P2 = 0x00 Lc = None Data In = None Le = 0x08 Answer: 01 02 03 04 05 06 07 08 [$9000] Advanced Card Systems Ltd.
ACR1281U 2. How to access DESFIRE Tags (ISO14443-4)? The DESFIRE supports ISO7816-4 APDU Wrapping and Native modes. Once the DESFire Tag is activated, the first APDU sent to the DESFire Tag will determine the “Command Mode”. If the first APDU is “Native Mode”, the rest of the APDUs must be in “Native Mode” format. Similarly, If the first APDU is “ISO7816-4 APDU Wrapping Mode”, the rest of the APDUs must be in “ISO7816-4 APDU Wrapping Mode” format. Example 1: DESFIRE ISO7816-4 APDU Wrapping.
ACR1281U Example 2: DESFIRE Frame Level Chaining (ISO 7816 wrapping mode) // In this example, the application has to do the “Frame Level Chaining”. // To get the version of the DESFIRE card. Step 1: Send an APDU {90 60 00 00 00} to get the first frame. INS=0x60 Answer: 04 01 01 00 02 18 05 91 AF [$91AF] Step 2: Send an APDU {90 AF 00 00 00} to get the second frame. INS=0xAF Answer: 04 01 01 00 06 18 05 91 AF [$91AF] Step 3: Send an APDU {90 AF 00 00 00} to get the last frame.
ACR1281U Example 4: DESFIRE Frame Level Chaining (Native Mode) // In this example, the application has to do the “Frame Level Chaining”. // To get the version of the DESFIRE card. Step 1: Send an APDU {60} to get the first frame. INS=0x60 Answer: AF 04 01 01 00 02 18 05[$1805] Step 2: Send an APDU {AF} to get the second frame. INS=0xAF Answer: AF 04 01 01 00 06 18 05[$1805] Step 3: Send an APDU {AF} to get the last frame.
ACR1281U 3.
ACR1281U 5363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A 5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F 808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4 A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4 C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4 E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF Response: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425 2627
ACR1281U APPENDIX A: SUPPORTED CARD TYPES The following table summarizes the card type returned by GET_READER_INFORMATION correspond with the respective card type.
ACR1281U TECHNICAL SPECIFICATION Universal Serial Bus Interface Power source........................................ From USB Speed ................................................... 12 Mbps (Full Speed) Supply Voltage...................................... Regulated 5V DC Supply Current ..................................... 200mA (max); 100mA (normal) Contactless Smart Card Interface Standard ............................................... ISO 14443 A & B Parts 1-4 Protocol .............................
waring Note: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications.