Using PN512 to communicate with Mifare Desfire EV1 card

[quyenemic]

Hi all,

I'm using PN512 to communicate with Desfire EV1.
At first, I used RD710 and MifareDiscover to create an application (AID = 100000) and FileID = 0x02 (free access, plain).
Then, I can use my embedded system with PN512 to implement some commands as: anticollision cascade 1, cascade 2, rats, pps...
But i can not implement the command SelectApplication (0x5A...), GetApplication (0x6A), Get_Version...
I've checked i found that, the commands has been transmitted to PICC, but there is no answer from PICC...
Please give me some suggestions.
Thank you very much.

Best regards,
Trong Quyen

---

+ 0  |  - 0

[Renke]

Dear Trong Quyen,

have you implemented the T=CL protocol (ISO/IEC 14443-4)?
The MIFARE DESfire card supports the ISO/IEC 14443-4, which requires the correct use of I-blocks, R-blocks and S-blocks.
Typically command and data is transferred as "payload inside an I-block", i.e. as "information field".

BTW: You can "simulate" this with the MFDiscover and the RD710, using the exchange of data fields in the ISO/IEC 14443 Layer 3 tab and / or the ISO/IEC 14443 layer 4 tab.

BR,
Renke

---

+ 0  |  - 0

[quyenemic]

Hi Renke,

Thank for your feedback.
I've used my embedded sytem PN512 to communicate with Desfire EV1 successfully with: REQA, CL1, CL2, RATS, PSS..
It means that my config for PN512 is OK.
However, I can not implement the native commands as: SelectApplication, GetVersion....
My code is:
void PICC_Select(void)
{
Write_PN512(0x0A,0x80); // Flush FIFO
Write_PN512(0x09,0x5A); // Native command, select PICC
Write_PN512(0x09,0x00);
Write_PN512(0x09,0x00);
Write_PN512(0x09,0x00);
//
Write_PN512(0x12,0x00); // Disable TX,RX CRC
Write_PN512(0x13,0x00);
Write_PN512(0x0D,0x80); // Transmit
//
Read_PN512(0x0A); // check response from PICC: get 0x00 -> It means there is no answer from PICC? It should be 1
}

Now, I'm using the native commands set of Desfire (MF3ICD40) instead of Desfire EV1 (MF3ICD41).
Is it OK? I dont't find the native commands set of Desfire EV1 in Internet.
Could you help me about the native commands set of Desfire EV1?

Beas regards,
Trong Quyen

---

+ 0  |  - 0

[Renke]

Dear Trong Quyen,

as I guessed and have mentioned in my previous entry: you need to implement the protocol. The MIFARE DESFire is ISO/IEC 14443-4 compliant, and therfore requires the use of the protocol as described in the part 4 of the ISO/IEC 14443.

To give an example: the protocol uses a standard I-block to transfer a command to the 14443 card. The I-Block contains the PCB (Protocol Control Byte = must) and optionally a CID and / or NAD. Without using CID (assuming that in the RATS no CID has been assigned), at least the PCB + payload + 2 byte CRC must be sent.
Payload in you case is e.g. a MIFARE DESfire command.
Then the card understands the payload (i.e. the MIFARE DESFire understands the command) and act accdordingly (i.e. returns the response).

Please refer to the ISO standard for more details. Alternatively NXP provides a reader library, which can be used with the PN512, too. (NXP also provides trainings related to these topics.)

The datasheet of the MIFARE DESFire card must be requested from NXP.

BR,
Renke

---

+ 0  |  - 0

[quyenemic]

Dear Renke,

My code is:
void RATS(void)
{
PN512_Write(0x0A,0x80);
PN512_Write(0x09,0xE0);
PN512_Write(0x09,0x50); // Reader buffer size is 64 bytes (FIFO)
PN512_Write(0x12,0x80);
PN512_Write(0x13,0x80);
PN512_Write(0x0D,0x80);
//
PN512_Read(0x06);
PN512_Read(0x0A);
PN512_Read(0x09); // Read ATS
PN512_Read(0x09);
PN512_Read(0x09);
PN512_Read(0x09);
PN512_Read(0x09);
PN512_Read(0x09);
}
void PPS(void)
{
PN512_Write(0x0A,0x80);
PN512_Write(0x09,0xD0);
PN512_Write(0x09,0x11);
PN512_Write(0x09,0x00);
PN512_Write(0x12,0x80);
PN512_Write(0x13,0x80);
PN512_Write(0x0D,0x80);
//
PN512_Read(0x06);
PN512_Read(0x0A);
PN512_Read(0x09);
}
void AID_Select(void)
{
PN512_Write(0x0A,0x80);
PN512_Write(0x12,0x80); // Enable TX, RX CRC
PN512_Write(0x13,0x80);
PN512_Write(0x1D,0x00); // Enable parity
PN512_Write(0x09,0x5A); // Native select PICC
PN512_Write(0x09,0x00); // AID=000000
PN512_Write(0x09,0x00);
PN512_Write(0x09,0x00);
//
PN512_Write(0x01,0x0C); // Transceive
PN512_Write(0x0D,0x80); // Transmit
//
PN512_Read(0x06); // Status register
PN512_Read(0x0A); // FIFOLevel = 0x00 -> there is no anser from PICC, it should be 1
PN512_Read(0x09); // FIFO=0x77, It should be 0x00 (response of SelectApplication native command
}
void RFID_Desfire(void)
{
PN512_Config();
Mifare_REQA();
Mifare_ATQ();
Mifare_Anticoll_1();
Respond_SNR_1();
Mifare_Select_1();
Respond_SAK();
Mifare_Anticoll_2();
Respond_SNR_2();
Mifare_Select_2();
Respond_SAK();
RATS(); // E0 50
PPS(); // D0 11 00
delay_ms(100);
// all functions above are Ok
// only fail in this function, no response from PICC
AID_Select();
}

I've also simulated successfully by exchange of RD710 with all commands (functions) above. I can select the application and read out plain file data.
But with the same commands, PN512 can not select the application. There is no answer from PICC.

Do you think, I've missed some steps after RATS, PPS?

Best regards,
Trong Quyen

---

+ 0  |  - 0

[Renke]

Dear Trong Quyen,

yes, you are missing the protocol.

What I can see from your code:

You have activated the protocol using CID = 0 (no CID).
You send a PPS, requesting not to change the bit rate: why do you do that? It is not only needless, but even not allowed according to the ISO/IEC 14443.
So simply remove the PPS (even though the MIFARE DESfire accepts it).

Then in the following (first) command you need to use the I-Block format of the ISO14443-4, as I mentioned above: PCB + Payload + CRC
In you specific case the first PCB is 02 (hex). So you must send:

02 5A 00 00 00 + 2 bytes CRC (CRC is done automatically by the PN512, if enabled)

If you use the RD710 in 14443 Layer 4 communication, the MIFAREDiscover does this 14443-4 protocol, and you only see the payload. Try the same in 14443 Layer 3 communication (which does not do the 14443-4 protocol), and you see the same behavior like with the PN512 board...

For details regarding the protocol, please refer to the ISO/IEC 14443 documents. This is neither MIFARE DESFire related nor PN512 related.

BR,
Renke

---

+ 0  |  - 0

[quyenemic]

Hi Renke,

Thank for your help.
Now, I can implement the SelectApplication function.
I’ll need your more help about RFID, SAM AV1,2 on next time.
Thank you once more time.

Best regards,
Trong Quyen

---

+ 0  |  - 0

[wangxiao3952]

Hi Renke and quyenemic, I found this post interesting as I am currently working on pn512 to get a MIFARE reader/writer, and I have problems.

Thank you first for any help.

I have two pn512 cards, I can configure one as PCD and another as PICC, then send and receive bytes. But When I use a MIFARE card and one pn512 as PCD, I can not receive anything from the card. The pn512 is periodically sending 0x26 REQA command.


The register set of pn512 is what I found in
pn512SetReg(0x0C,0x10);
pn512SetReg(0x12,0x80);
pn512SetReg(0x13,0x80);
pn512SetReg(0x14,0x83);
pn512SetReg(0x15,0x77);
pn512SetReg(0x18,0x55);
pn512SetReg(0x19,0x4D);
// pn512SetReg(0x1C,0x62);
// pn512SetReg(0x23,0x6F);
pn512SetReg(0x24,0x26);
// pn512SetReg(0x25,0x8F);
pn512SetReg(0x26,0x59);
pn512SetReg(0x27,0xF4);
pn512SetReg(0x28,0x3F);
pn512SetReg(0x29,0x11);,

The function I written for the PCD is
pn512Init();
pn512SetReg(PN512_REG_COMMAND,PN512_REG_COMMAND_SOFT_RESET);//RST
while(pn512GetReg(PN512_REG_COMMAND)&0x0F);//Wait IDLE

unsigned char f1=0, f2=0, f3=0, f4=0, f5=0, f6=0,res=0,er1 = 0, er2 = 0,wai=0;
pn512SetMod(PN512_MODE_ISO14443A);
while(1)
{
PN512_CLEAR_FIFO;
f1=pn512GetReg(PN512_REG_FIFO_LV);
PN512_SET_FIFO_BYTE(ISO_14443_REQA);
f2=pn512GetReg(PN512_REG_FIFO_LV);
//PN512_SET_COMMAND_TRANSMIT;
PN512_SET_COMMAND_TRANSCEIVE;
PN512_TRIGGER_TRANSCEIVE;
f6=pn512GetReg(PN512_REG_BIT_FRAME);
if(f3=pn512GetReg(PN512_REG_FIFO_LV)){
f4=pn512GetReg(PN512_REG_FIFO);
f5=pn512GetReg(PN512_REG_FIFO);
f6=pn512GetReg(PN512_REG_FIFO);
break;
}
}

The Macros are defined as
#define PN512_REG_COMMAND 0x01
#define PN512_REG_BIT_FRAME 0x0D
#define PN512_REG_FIFO 0x09
#define PN512_REG_FIFO_LV 0x0A

#define PN512_CLEAR_FIFO (pn512SetReg(PN512_REG_FIFO_LV,PN512_REG_FIFO_CLEAR))

#define PN512_SET_COMMAND_RECEIVE (pn512SetReg(PN512_REG_COMMAND,PN512_REG_COMMAND_RECEIVE))

#define PN512_SET_COMMAND_TRANSMIT (pn512SetReg(PN512_REG_COMMAND,PN512_REG_COMMAND_TRANSMIT))

#define PN512_SET_COMMAND_TRANSCEIVE (pn512SetReg(PN512_REG_COMMAND,PN512_REG_COMMAND_TRANSCEIVE))

#define PN512_TRIGGER_TRANSCEIVE (pn512SetReg(PN512_REG_BIT_FRAME,0x80))

---

+ 0  |  - 0

[Author]

Posts