NFC0541 read Mifare Classic 1K
I’m using NFC05A1 and the STMF4xx-Nucle-Polling project.
I’d like to interact with a Mifare classic card 1K.
I am aware Stm won’t provide any code that would deal with encryption and this is not what I’m asking for.
The issue I encounter is about the first step after SELECT : this is a clear text message, starting with 30 then the sector number. What I expect is the card answering with a nonce.
The issue I encounter is I receive a ‘framing problem’ or ‘timeout’ error message.
Here are the first four requests, which are working fine I think, the fifth one does not.
* Request 1:
Answer to rfalISO14443ATransceiveShortFrame (with RFAL_14443A_SHORTFRAME_CMD_REQA as a command) is : 04 00.
* Request 2:
Then there is another rfalISO14443ATransceiveShortFrame instruction this time with RFAL_14443A_SHORTFRAME_CMD_WUPA
*Request 3:
Then a rfalNfcaSelReq structure is set :
selReq (rfalNfcaSelReq structure)
selReq.selCmd = 93
selReq.selPar =20
rfalNfcaTxRetry( ret, rfalISO14443ATransceiveAnticollisionFrame( (uint8_t*)&selReq, &bytesTxRx, &bitsTxRx, &bytesRx, RFAL_NFCA_FDTMIN ), ((devLimit==0)?RFAL_NFCA_N_RETRANS:0), RFAL_NFCA_T_RETRANS );
Request answer : the request result consists in
the card Uid D0 74 CC A4, (correct uid)
and the bcc CC
*Request 4:
Then another request is a SELECT.
selReq.selCmd =93;
selReq.selPar= 70;
selReq.nfcid1[0]= D0
selReq.nfcid1[1]=74;
selReq.nfcid1[2]=CC;
selReq.nfcid1[3]=A4;
selReq.bcc=CC;
rfalNfcaTxRetry( ret, rfalTransceiveBlockingTxRx( (uint8_t*)&selReq, sizeof(rfalNfcaSelReq), (uint8_t*)selRes, sizeof(rfalNfcaSelRes), &bytesRx, RFAL_TXRX_FLAGS_DEFAULT, RFAL_NFCA_FDTMIN ), ((devLimit==0)?RFAL_NFCA_N_RETRANS:0), RFAL_NFCA_T_RETRANS );
Its results can be found within selRes :
Sak: 08
So far, the device is a Mifare Classic (sak 08) , this device is device[0] and its uid is known.
*Request 5 : this is where there is an issue.
Ask the card to access sector 00.
As Mr Michael Roland suggested in this post :
lenTx = 0;
bufferTx[lenTx++] = 0x30;
bufferTx[lenTx++] = 0x00; // sector
lenRxMax = 16;
lenRx = 0;
status = rfalTransceiveBlockingTxRx(&bufferTx[0], lenTx, &bufferRx[0], lenRxMax, &lenRx, RFAL_TXRX_FLAGS_DEFAULT, rfalConvMsTo1fc(5));
Answer
status value : 9
Another attempt with different flags.
status = rfalTransceiveBlockingTxRx(&bufferTx[0], lenTx, &bufferRx[0], lenRxMax, &lenRx,
RFAL_TXRX_FLAGS_CRC_TX_AUTO | RFAL_TXRX_FLAGS_CRC_RX_REMV | RFAL_TXRX_FLAGS_NFCIP1_OFF | RFAL_TXRX_FLAGS_AGC_ON | RFAL_TXRX_FLAGS_PAR_RX_REMV | RFAL_TXRX_FLAGS_PAR_TX_AUTO | RFAL_TXRX_FLAGS_NFCV_FLAG_AUTO, RFAL_NFCA_T_RETRANS);
Same answer
status value : 9
ERR_FRAMING = 9, /*!< Framing error */
I’ve added some logs within rfalTransceiveBlockingRx to have a look at the states :
platformLog("gRFAL.state %d\r\n", gRFAL.state);
do{
rfalWorker();
platformLog("gRFAL.TxRx.state %d\r\n", gRFAL.TxRx.state);
}
Logs for the successful requests (REQA, SEL) are :
gRFAL.state 3
gRFAL.TxRx.state 83 (RFAL_TXRX_STATE_RX_WAIT_RXS)
gRFAL.TxRx.state 90 (RFAL_TXRX_STATE_RX_FAIL)
gRFAL.TxRx.state 0 (RFAL_TXRX_STATE_IDLE)
status is 0 ERR_NONE
Logs for the last read request are :
gRFAL.state 3
gRFAL.TxRx.state 83(RFAL_TXRX_STATE_RX_WAIT_RXS)
gRFAL.TxRx.state 84 (RFAL_TXRX_STATE_RX_WAIT_RXE)
gRFAL.TxRx.state 84
gRFAL.TxRx.state 84
gRFAL.TxRx.state 84
gRFAL.TxRx.state 84
gRFAL.TxRx.state 84
gRFAL.TxRx.state 90(RFAL_TXRX_STATE_RX_FAIL)
gRFAL.TxRx.state 0(RFAL_TXRX_STATE_IDLE)
status is 9 ERR_FRAMING /*!< Framing error */
Many thanks in advance,
Olivier
