USING THE PASS-THROUGH COMMAND VERSION

Transcription

1 USING THE PASS-THROUGH COMMAND VERSION

2 TABLE OF CONTENTS 1 Overview Required Reading Document Scope Limitations Pass-Through Command Examples SLI-S Get Multiple Block Protection Status SLI-S Set EAS SLI-S Get Random Number MIFARE Ultralight C Read Block MIFARE Classic Read Block References Revision History:... 10

3 1 Overview 1.1 Required Reading This document assumes you have read and are familiar with the SkyeTek Protocol V3 Reference Guide and the SkyeTek Protocol V3 Basic Examples application note. 1.2 Document Scope This application note describes how to use the SkyeModule M2 s pass-through command which enables the host to directly issue tag commands which have not been yet implemented in the SkyeProtocol V Limitations Due to the nature of this command not all commands have been tested. Proprietary tag commands requiring strict timing requirements or bit aligned frames may not work properly using the pass through command. The pass-through command is only available in M2 firmware 06F9 or later.

4 2 Pass-Through Command Examples 2.1 SLI-S Get Multiple Block Protection Status The SLI-S tag supports proprietary lock features not directly supported in STPV3. Specifically the Get Multiple Block Protection Status command returns the protection statuses for a range of data addresses. The information returned allows determining whether a block of data is write password protected, read password protected, or locked etc. The SkyeProtocol V3 allows you to use the traditional SkyeProtocol V3 command Get Lock Status to check if a single block of memory is locked. If you needed the full information returned by the tag you could use the pass-through command to issue the proprietary command and read the tag s raw response. The following example shows how this command would be executed. STX Msg Len Cmd Tag Type Length CRC D * F500 The pass-through command is structured like any other SkyeProtocol V3 binary request except that the data field contains the byte-aligned data to be sent to the tag. Shown below is the data field for the request. Command Mfg Code UID Address Additional. Blocks 22 B F4A E The formatting of the data field was taken directly from the SLI-S tag datasheet. The flags field indicates high-speed mode and addressed operation. The command B8 is the SLI-S s proprietary Get Multiple Block Protection Status command. The manufacturer code of 04 is for NXP tags. The UID is sent least significant byte and most significant bit first resulting in 155F4A E0 instead of E A5F15. Lastly, the starting block address and number of additional blocks requested. Notice the tag command requires a start-of-frame and CRC calculations however these are handled automatically by the reader. After a successful operation the reader module will respond with the following. STX Msg Len Response Code Len CRC B * C79B The data field in the response contains the raw tag response.

5 Block protection Status (1) Block protection Status (2) Block protection Status (3) Block protection Status (4) This command was tested on a new tag and therefore no blocks were locked. Interpretation of the response data will require additional knowledge of the tags behavior. 2.2 SLI-S Set EAS STPV3 s command Set EAS works with the SLI-S tags however it provides an easy example of using non-addressed pass-through communication using ISO15693 tags. The command framing and data are shown below. STX Msg Len Cmd Tag Type Length CRC D * 71A5 The pass-through command is structured like the first example. The data field for the request is shown below. Command Mfg Code 02 A2 04 The formatting of the data field was taken directly from the SLI-S tag datasheet. The flags field indicates high-speed mode and non-addressed operation. The command A2 is the SLI-S s Set EAS command. The manufacturer code of 04 is for NXP tags. The UID is not present in non-addressed mode. After a successful operation the reader module will respond with the following. STX Msg Len Response Code Len CRC * 48D6 The data field in the response contains the raw tag response. For this example the exclusion of a tag error means that the EAS was not previously set and now has been set. 00

6 2.3 SLI-S Get Random Number This command is proprietary to NXP s SLI-S tags and has not yet been directly implemented in SkyeProtocol V3. This command is required to calculate authentication information needed for protected commands. We can issue the command to the tag using the STPV3 pass-through command. STX Msg Len Cmd Tag Type Length CRC B * 083C The pass-through command is structured like the first two examples. The data field for the request is shown below. Command Mfg Code UID 22 B F4A E0 The formatting of the data field was taken directly from the SLI-S tag datasheet. The flags field indicates high-speed mode and addressed operation. The command B2 is the SLI-S s Get Random Number command. The manufacturer code of 04 is for NXP tags. The UID is present addressed mode. After a successful operation the reader module will respond with the following. STX Msg Len Response Code Len CRC * 803C The data field in the response contains the raw tag response. For this example the data field is the random number requested from the tag. Random Number 0043B9 2.4 MIFARE Ultralight C Read Block Tags using ISO14443A protocol must be put into the ready state before issuing passthrough tags commands. The traditional SkyeProtocol V3 select tag commands can be used to accomplish this. In this example we will see how we can use the pass-through command to read memory from a tag. First, issue a select tag command with the tag type set to auto-detect. The module will return the UID of the tag in the reader s field.

7 Next put the tag into the ready state by selecting the tag with the UID and with the RF flag set. The RF flag instructs the reader module to keep the carrier frequency on after selecting the tag. This will ensure that the tag stays in the ready state and will respond to subsequent commands. Once the tag is in the ready state we can now use the passthrough command to issue a read memory to the tag. STX Msg Len Cmd Tag Type Length CRC C * 84BB The MIFARE read command requires sending the read command 03 followed by a byte indicating the block number to read. In this example we will read block 0. Command Block Number If the command is successful the module will echo the command code along with the tag s raw response data. STX Msg Len Response Code Len CRC * 4994 The data field in the response contains the raw tag response. This response includes the 16 bytes of data requested starting at block B5780E1ED2580A E MIFARE Classic Read Block Secure tags using ISO14443A protocol must be put into the ready state and authenticated before issuing any memory commands. The traditional SkyeProtocol V3 commands Select Tag and Authenticate Tag can be used to accomplish this. In this example we will see how we can use the pass-through command to read memory from a secure tag. First, issue a select tag command with the tag type set to auto-detect. The module will return the UID of the tag in the reader s field. Next put the tag into the ready state by selecting the tag with the UID and with the RF flag set. The RF flag instructs the reader module to keep the carrier frequency on after selecting the tag. This will ensure that the tag stays in the ready state and will respond to subsequent commands. The previous

8 command will respond with a session number if it was successful. In our example the session number is 01. We now use the Authenticate Tag command to authenticate to a specific memory page. In this example we will authenticate to block 1 using password FFFFFFFFFFFF. (See the application note titled Using Mifare Classic for addition information on using these tags.) Once we have authenticated to a block of memory we can now use the pass through command to request the data stored in block 1 of memory. The following shows the structure of the request and response packets. STX Msg Len Cmd Tag Type Session Length D 0C * 7AAE CRC The MIFARE read command requires sending the read command 03 followed by a byte indicating the block number to read. In this example we will read block 1. Command Block Number If the command is successful the module will echo the command code along with the tag s raw response data. STX Msg Len Response Code Len CRC * 7348 The data field in the response contains the raw tag response. This response includes the 16 bytes of data requested starting at block AABBCCDDEEFF

9 3 References [1] MF0ICU2 - MIFARE Ultralight C (v.3.2) Product short data sheet NXP [2] SL2 ICS53/SL2 ICS54 I-Code SLI-S (v3.0) Product data sheet NXP

10 4 Revision History: Revision Author Change Ryan Smith Initial Release