How to get the tamper status of ST25TV02KC RFID chip?

[Larry Martin]

I'm working with ST25TV02KC-TFG3 in a tamper inlay. ReadConfiguration FID=03h, PID=06h returns the same value with the tamper contacts open or shorted. How should I be interpreting these results? The commands are being sent from a Feig CPR74 via their Transparent command. Traces are captured on proxmark.

OPEN
10/08/22 15:42:12.816  >>  02 00 19 FF BF 02 00 00 02 1F 22 A0 02 E0 31 1B 0B 00 08 02 E0 03 06 13 7B 
10/08/22 15:42:12.841  <<  02 00 0E 00 BF 00 00 30 30 63 4F 9D 71 73   OK
      Start |        End | Src | Data (! denotes parity error)                                           | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
          0 |     125952 | Rdr |22  a0  02  e0  31  1b  0b  00  08  02  e0  03  06  14  ea               |  ok | INVENTORY_READ
     130144 |     158816 | Tag |00  30  30  63  4f  9d                                                   |  ok |
 
SHORT
10/08/22 15:58:05.552  >>  02 00 19 FF BF 02 00 00 02 1F 22 A0 02 E0 31 1B 0B 00 08 02 E0 03 06 13 7B 
10/08/22 15:58:05.603  <<  02 00 0E 00 BF 00 00 30 30 63 4F 9D 71 73   OK
      Start |        End | Src | Data (! denotes parity error)                                           | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
          0 |     125952 | Rdr |22  a0  02  e0  31  1b  0b  00  08  02  e0  03  06  14  ea               |  ok | INVENTORY_READ
     130144 |     158816 | Tag |00  30  30  63  4f  9d                                                   |  ok |

[Thomas Q. · Accepted solution]

Hello Larry,

The ReadConfig command you are using to access the TD_STATUS register is correct, and the value of TD_LOOP displayed corresponds to the factory setting for the SHORT case (63h).

Referring to page 25 of the product datasheet :

[...]

The shortage status TD_LOOP is captured by ST25TV02KC-T each time that the device is powered- up

If the ST25TV02KC-T boots while the tamper loop is closed, the value of TD_LOOP returned remains 63h while the device is powered-on:

- if the tamper loop is open and the device was still powered-on since the last boot, the TD_LOOP value remains 63h

- if the tamper loop is open, the ST25TV02KC-T needs to be rebooted to return the TD_LOOP value corresponding to the open status (factory setting 6Fh)

Was the ST25TV02KC-T reset between the two ReadConfig requests of your log ?

Best regards,

Thomas

[Larry Martin]

Thomas, thank you for helping to sort that out for me. I missed the factory settings of 63h and 6Fh on page 24. A fresh inlay shows 30306Fh for TD_Status(03h,06h). So that's the SEAL event with the OPEN message. I think I can figure it out from here.