How MIFARE Uses Cookies

[Sébastien Pautet]

Hi guys,

As I told you, a basic selectApplication() (event 0000 application) was not working. I had a 0x0B error in return no matter what I tried.
And for some reasons, select a particular ISO (0x00 0xA4) as describe in documentation unlocked the commands (here's the statement that helped me) :

"This APDU selects an ISO Application by it’s ISO Application Identifier (AID). The ISO AID of DESFire is
”0xD2 76 00 00 85 01 00”. The full ISO AID has to be transmitted, partial selection is NOT supported.
Other ISO AIDs are not supported by DESFire."

After doing this, I was able to access the regular commands : selectApplication, authenticate, read data.

---

+ 1  |  - 0

[Sébastien Pautet]

Hi guys,

The getApplicationIDs() is actually locks from the settings, you are right.
But the thing is that I wasn't able to select even the 000000 application at the first place... I had that 0x0B error message that seems to be a communication issue.
And this is only after the ISO Select command (0x00 0xA4 ...) that looks to unlock the card and from there, I was able to select applications, authenticate and read data.
As if it was a key to open Desfire commands.

Seb

---

+ 1  |  - 0

[Sébastien Pautet]

Ok so... I finally managed that way :

"This APDU selects an ISO Application by it’s ISO Application Identifier (AID). The ISO AID of DESFire is
”0xD2 76 00 00 85 01 00”. The full ISO AID has to be transmitted, partial selection is NOT supported.
Other ISO AIDs are not supported by DESFire."

So I had to execute that command before any other moves :

byte[] cmd = new byte[]{(byte)0x00, (byte)0xA4, 0x04, 0x00, 0x07, (byte)0xD2, (byte)0x76, 0x00, 0x00,(byte)0x85, 0x01,0x00,0x00};
nfcReader.transceive(cmd);

Response : 0x00 0x90 (SUCCESS)

And from there I can do anything I used to do with EV1 :
selectApplication(APP_ID)
authenticate()
Etc...

As if now I have access to the card...
Do you have more details for me on this?

---

+ 1  |  - 0

[Sébastien Pautet]

Hi guys,

Ok I see...when using the Taplinx sample application I have exactly that message : "Unknow tag, tap again !"
So it doesn't seem to recognize the EV2 format.
I did force as an EV2 in the switch case, and try to list the apps :

desFireEV2.selectApplication(new byte[]{(byte)0x00,(byte)0x00,(byte)0x00});
desFireEV2.getApplicationIDS();

But it catch an error "Unknown Error"

So I did the same by forcing EV1 in the switch case :

desFireEV1.selectApplication(new byte[]{(byte)0x00,(byte)0x00,(byte)0x00});
desFireEV1.getApplicationIDS();

Same probleme here...
Notice that i can recover Random ID in both case though

Then I finally tried with raw command to select the App ID :

nfcReader.transceive(new byte[]{(byte)0x90, (byte)0x5A, (byte)0x00, (byte)0x00, (byte)0x00);

And in that case, I got that answer : 0x0B 0x91

I can't find what is the meaning of that answer :/

---

+ 1  |  - 0

[Sébastien Pautet]

Hi,

Thank you for your answer.
I did try on a Motorola and had no luck either...
So I guess I'm doing something wrong. We are moving from EV1 to EV2 and everything should be configured the same way but for some reason I cannot authenticate on EV2 (or even get the card type or version)
I did try with raw command (0x5A) to select the application but I have a 0x0B answer, can you tell me what does that mean ?

Thank you
Seb

---

+ 0  |  - 0

[Sébastien Pautet]

Hello,

I managed to authenticate on my side and got the Random A back from the card.
At this point, should I reset the IV for next operation ? if not what is the correct IV ?
I'm trying to read data right after authentication, but I keep having random byte as response.
I'm usign IV 16x00 and Session key for descryption.
Any suggestion ?

Thank you
Seb

---

+ 0  |  - 0

[Author]

Posts