Proxmark3 community

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

ISO14443A Commands

Using a chip card reader mfrс522 for VISA paywave. where to find documentation on work with records?

->26 (REQA)
<-0400

->9320
<-B81900AA0B

->9370B81900AA0B (SELECT CARD)
<-28

<-E050  (RATS)
->137880820280318066B0840C016E0183009000

<-0200A4040007A0000000031010 (SELECT VISA)
->026F318407A0000000031010A526.....900000 (55 byte)

<-0300B2010C (read record 1)
->13704D57134402......43000   (63 bytes)

<-A2 (continue read???)
->0230303030.........900000 (22 byte)

If the command 0хA2 - continue reading to learn how to give it or not?

in another device  I use chip pn531. 0xA2 command was intercepted when pn531 read record 1
pn531 chip joined 2 pieces (63byte and 22 byte) and gave them one piece.
RATS comand  I do not ask to send pn531. he decided to send this command

thefkboss

Contributor

Registered: 2008-10-26

Posts: 198

Re: ISO14443A Commands

Visa books..... 4 books.....you can find the books in pirateba......

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: ISO14443A Commands

Any hint about books name ?

thefkboss

Contributor

Registered: 2008-10-26

Posts: 198

Re: ISO14443A Commands

I don't know if is legal??
I could upload....but 
I don't know if that could have legal problems to the forum.
Some moderator......

thefkboss

Contributor

Registered: 2008-10-26

Posts: 198

Re: ISO14443A Commands

EMV visa books

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: ISO14443A Commands

They seems to be freely available on the net.

Last edited by asper (2015-03-06 14:57:07)

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

Red line - APDU comand
Blue line - responce, decoding by www. emvlab. org/tlvutils/
Green line - ???

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: ISO14443A Commands

apdu command/status byte, if I remember it correct.

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: ISO14443A Commands

Can I ask you what is the way you logged data ? Snoop with pm3 ? Those "green" bytes seems the header of the incapsulated apdus (CLA INS P1 P2 P3)...

I think there is a problem in the arrows you used:

-> sent to the card
<- received from the card

like:

->26 (REQA)
<-0400

What we have next:

<-E050  (RATS)
->137880820280318066B0840C016E0183009000

E050 is sent by the card to the reader ?

EDIT: no Iceman, the status byte are 2 bytes at the end of the string (ex. 90 00) called also SW1 and SW2.

Ex: ->137880820280318066B0840C016E0183009000

Last edited by asper (2015-03-06 18:09:24)

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

" 0x02, 0x03, 0x0A, 0x0B...this is the Protocol Control Byte (called PCB), comes from ISO14443-4, in the Prologue field, indicates if the block is I, R or S, and if chaining is being used"    from forum http://e2e.ti.com/

The next question is where to get the Standard ISO14443-4 )))

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: ISO14443A Commands

Yes, I did not remember "protocol control byte" but this is what I meant.

Last edited by asper (2015-03-06 18:52:57)

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

to Asper: Can I ask you what is the way you logged data ? Snoop with pm3 ? Those "green" bytes seems the header of the incapsulated apdus (CLA INS P1 P2 P3)...

I use "Saleae Logic - 8-Channel USB Logic Analyzer"

with the direction of the arrow I really made a mistake...

answers from cards get from the buffer circuit  MFRC522

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: ISO14443A Commands

So you sniffed a contact, not a contactless communication ? Am I wrong ?

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

pn531 chip adds PCB(0x02 or 0x03) and glues packages (use A2 comand?).
I need to use MFRC522, but it is not so clever %)

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

I wrapped the antenna, and it is perfectly catches the signal)))

asper

Contributor

Registered: 2008-08-24

Posts: 1,409

Re: ISO14443A Commands

Can you make a picture of the wrapped antenna ? (I contacted you to the other ICQ account)

holiman

Contributor

Registered: 2013-05-03

Posts: 566

Re: ISO14443A Commands

I've been curious to play with paywave, but haven't seen any such cards here in sweden yet...
... and it's not like someone else will send me their credit card for experimentation either..

holiman

Contributor

Registered: 2013-05-03

Posts: 566

Re: ISO14443A Commands

@Sentinel - you don't use a proxmark for this ? How come?

iceman

Administrator

Registered: 2013-04-25

Posts: 9,537

Website

Re: ISO14443A Commands

Hasn't Peter Fillmore a branch filled with all EMV functions for Visa and Mastercard? https://github.com/peterfillmore/proxmark3

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

@ holiman - In the near future plan to buy proxmark .. because I'm tired of painting bits and bytes)))

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

parse command RATS according to standard 14443-4
-> E050  (RATS)

Chip buffer is limited(64byte), and it is, continue to see that the length of the record cut

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

The figure illustrates how the string  "0123456789ABCDEF"  transferred from the card to the reader, if the reader is limited budffer 7 bytes. In fact, the first constraint = 16 bytes (See previous picture)

Sentinel

Contributor

Registered: 2012-11-26

Posts: 191

Re: ISO14443A Commands

@ iceman - in the source code to which you sent the link, as described command PCB and ACK )))