How MIFARE Uses Cookies

[Iurii Ledentsov]

I found some info regarding direct APDU exchange. Trying to find correct CLA for SL1 now.
Apdu command:
Code Value Meaning
CLA ’00’ ISO CLA according to Secure Messaging Level (sl0-3)
INS ’A8’ Data Exchange
P1 ’00’ (Mandatory)
P2 ’00’ (Mandatory)
Lc Var Mifare Plus Native Command Length
Data Data Mifare Plus Native Command
Apdu Responce:
SW Meaning
9000 + Data Access permitted + Mifare Plus Card native answer
6982 Error in secure messaging (no session key established or Mifare key or PW not encrypted)

---

+ 0  |  - 0

[Iurii Ledentsov]

using NXP taginfo with NOKIA 8 android phone i got card data:
=============== IC INFO ================
IC manufacturer
NXP Semiconductors
IC type
ISO/IEC 14443 - probably personalized card
MIFARE application
No known MIFARE application found
=============== EXTRA ================
MIFARE memory size
4kb
-32 sectors of 4block and 8 sectors of 16 blocks
-256 blocks? with 16 bytes per blocks
ATS historical bytes detail
NXP IC information coding
=============== FULL SCAN ================
Technologies supported
MIFARE Classic compartible
ISO/IEC 7816-4 compartible
ISO/IEC 14443-4 (Type A) compartible
ISO/IEC 14443-3 (Type A) compartible
ISO/IEC 14443-2 (Type A) compartible
Detailed protocol information
ID 04:36:5D:E2:74:5D:80
ATQA 0x4400
SAK 0x38
ATS 0x0B78807102C1052F2F01BC00009F6501
...
Sector 32 (which I need to read from terminal)
[80] 1B FC 41 5E 78 81 BC 00
rW- 00 00 00 00 00 00 00 00
[81] 00 00 00 00 00 00 00 00
rWi 00 00 00 00 00 00 00 00
[82] 00 00 00 00 00 00 00 00
rW- 00 00 00 00 00 00 00 00
[83] 00 00 00 00 00 00 00 00
rW- 00 00 00 00 00 00 00 00
[84] 00 00 00 00 00 00 00 00
rW- 00 00 00 00 00 00 00 00
[85] 00 00 00 00 00 00 00 00
rWI 00 00 00 00 00 00 00 00
[86] 00 00 00 00 00 00 00 00
rWI 00 00 00 00 00 00 00 00
[87] 00 00 00 00 00 00 00 00
rWI 00 00 00 00 00 00 00 00
[88] 00 00 00 00 00 00 00 00
rWI 00 00 00 00 00 00 00 00
[89] 00 00 00 00 00 00 00 00
rWI 00 00 00 00 00 00 00 00
[8A] 00 00 00 00 00 00 00 00
rwi 00 00 00 00 00 00 00 00
[8B] 00 00 00 00 00 00 00 00
rwi 00 00 00 00 00 00 00 00
[8C] 00 00 00 00 00 00 00 00
rwi 00 00 00 00 00 00 00 00
[8D] 00 00 00 00 00 00 00 00
rwi 00 00 00 00 00 00 00 00
[8E] 00 00 00 00 00 00 00 00
rwi 00 00 00 00 00 00 00 00
[8F] FF:FF:FF:FF:FF:FF factory default key
WXW 5C:37:8A 00
XX:XX:XX:XX:XX:XX key unavailible

---

+ 0  |  - 0

[Iurii Ledentsov]

I'm absolutely sure that card is working in SL1 mode since it can be read using ordinary low-level CTLS commands for Mifare classic on ACR122.
Ok, there are some commands for the reader itself, but there is no description of Mifare low-level commands.
Reader docs describe its own commands format for sure, its serial package (Vivotech2/0-2byte_cmd-2byte_len-DATA-2byte_crc). where DATA:
high-level Mifare auth DATA = (block, key)
high-level Mifare read DATA = (start block|block quantity)
high-level Mifare write DATA = (start block|block quantity, data_bytes)
high-level Mifare epurse DATA = (debit/credit)
low-level CTLS_card DATA = (cmd,timeout,flag,crc, RAW_data) no description on RAW data content, except example (even there RAW_data bytes not described).
ISO_APDU_Exchange where DATA = (cla, ins, p1,p2)
----
If "Poll for Token" command detects a card of type 07 (ISO 14443-4 Type-A and Mifare), the reader will process according to the first command which will be received. e.g. Mifare/ISO_APDU. So I can access that dual card (mentioned above) using low-level CTLS_card command only (high-level Mifare commands result failed) and on standalone readers only. EMV bank applet is required ISO_APDU_Exchange. There is no problem or resetting NFC field and polling again, the problem is that Mifare applet cannot be accessed in Mifare mode on Vx680/Vx820 no matter high or low-level commands used.

So again, is there APDU mode described somewhere for such cards for reading Mifare applet or I'm just mistaking and must use only Mifare command to access it?

---

+ 0  |  - 0

[Iurii Ledentsov]

logs insertion failed. will try append again
logs using raw data
- PT Enable
send: ViVOtech2/0- 2C010001011D19
rcv: ViVOtech2/0- 2C0000001C9B
- Antenna On
send: ViVOtech2/0- 2801000101941F
rcv: ViVOtech2/0- 28000000D66A
- Poll for Token
send: ViVOtech2/0-2C02000200140C9A
rcv: ViVOtech2/0-2C00000807-04365DE2745D80C68B (found card type 07, uid=04365DE2745D80)
- PCD Single Command Exchange Protocol2, Load Mifare Key (PCD loadkey, 2986, 03, 03, RAW = key)
send: ViVOtech2/0-2C040013198629000003030F0F0F0F0F0F0F0F0F0F0F0F52DD
rcv: ViVOtech2/0-2C000005000000000014F0
- PCD Single Command Exchange Protocol2, Mifare Authentication Block 0 Field (PCD auth=0c, 2986, 03, 07, RAW = 60 00 UID(4byte))
send: ViVOtech2/0-2C04000D0C8629000003076080E2745D8021F5
rcv: ViVOtech2/0-2C000005000000000014F0
- PCD Single Command Exchange Protocol2, Read Block 1 Data (PCD TRANCIEVE =1E, TIMEOUT = 2986, FLAGS=03, CRCM=0F, RAW = 30 01)
send: ViVOtech2/0-2C0400091E86290000030F3080E3A7
rcv: ViVOtech2/0-2C00001500000000801BFC415E7881BC0000000000000000007002 OK
-----------
logs using high-level coms
- Poll for Token
Send: "ViVOtech2/0-2C02000200140C9A
Recieve: "ViVOtech2/0-2C0000080704365DE2745D80C68B
card type: 7
- highlevel mifare auth
Send: "ViVOtech2/0-2C0600088001FFFFFFFFFFFFF19A
Recieve: "ViVOtech2/0-2C0000001C9B
- high-level mifare read
Send: "ViVOtech2/0-2C0700027180D798
Recieve: "ViVOtech2/0-2C0A0000DB5A
Mifare READ-1 error: 4510 - failed

---

+ 0  |  - 0

[Author]

Posts