Skip to content

Commit

Permalink
Including a sample DESFire tag dump and the command outputs that were…
Browse files Browse the repository at this point in the history
… used to create the tag data
  • Loading branch information
maxieds committed Oct 17, 2020
1 parent ff138a6 commit d1b8508
Show file tree
Hide file tree
Showing 3 changed files with 98 additions and 2 deletions.
28 changes: 26 additions & 2 deletions Doc/DESFireSupportReadme.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,34 @@ Support for DESFire tag emulation on the Chameleon Mini is complicated for at le
The firmware has been tested and known to work with the KAOS manufactured RevG Chameleon devices.
Unfortunately, formative RevE device support is not available due to the memory requirements to
run this firmware emulation. The device responds well using the ``libnfc``-based utility
``nfc-anticol``. More testing needs to be done to fine tune support for interfacing the Chameleon
``nfc-anticol``:
```bash
NFC reader: SCM Micro / SCL3711-NFC&RW opened

Sent bits: 26 (7 bits)
Received bits: 03 44
Sent bits: 93 20
Received bits: 88 23 77 00 dc
Sent bits: 93 70 88 23 77 00 dc 4b b3
Received bits: 04
Sent bits: 95 20
Received bits: 0b 99 bf 98 b5
Sent bits: 95 70 0b 99 bf 98 b5 2f 24
Received bits: 20
Sent bits: e0 50 bc a5
Received bits: 75 77 81 02 80
Sent bits: 50 00 57 cd

Found tag with
UID: 2377000b99bf98
ATQA: 4403
SAK: 20
ATS: 75 77 81 02 80
```
More testing needs to be done to fine tune support for interfacing the Chameleon
with live, in-the-wild DESFire tag readers in practice. It has been verified to work with the
Proxmark3 NFC devices:
```
```bash
[usb] pm3 --> hf 14a read
[+] UID: 4A D9 BA 11 B9 97 57
[+] ATQA: 44 03
Expand Down
72 changes: 72 additions & 0 deletions Dumps/DESFire_example.contents
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
>>> Select Application By AID:
-> 90 5a 00 00 03 00 00 00 | 00
<- 91 00

>>> Start AES Authenticate:
-> 90 aa 00 00 01 00 00
<- 35 a1 bf c7 9b e3 3b 29 | 35 9b 37 57 ed 35 88 b9 | 91 af
-- RNDA = f4 2d 68 bf bb 3e 87 12
-- RNDB = 0d 3e 90 75 5c 6d d5 22
-- CHAL = f4 2d 68 bf bb 3e 87 12 | 22 0d 3e 90 75 5c 6d d5
-> 90 af 00 00 10 72 15 a8 | 83 46 4c 69 f9 50 c4 7b | a8 e7 30 a7 68 00
<- 0d b4 4f 21 52 89 bc 84 | 25 3b ef bc 54 15 90 11 | 91 00
... AUTH OK! :)

>>> CreateApplication command:
-> 90 ca 00 00 05 01 00 34 | 0f 03 00
<- 91 00
>>> Select Application By AID:
-> 90 5a 00 00 03 01 00 34 | 00
<- 91 00

>>> Start AES Authenticate:
-> 90 aa 00 00 01 00 00
<- b0 82 2a 30 c2 b6 1f d0 | f9 68 33 c9 4b 26 24 20 | 91 af
-- RNDA = c3 70 32 58 4c 06 ef f2
-- RNDB = 2e 7d 6c 67 ae 32 cc f7
-- CHAL = c3 70 32 58 4c 06 ef f2 | f7 2e 7d 6c 67 ae 32 cc
-> 90 af 00 00 10 68 49 4a | c5 1d 75 02 f2 79 23 18 | b8 15 18 21 32 00
<- 6a 61 d5 7e 97 09 35 89 | 7d 10 87 d3 04 8e 20 47 | 91 00
... AUTH OK! :)

>>> CreateStdDataFile command:
-> 90 cd 00 00 07 00 00 0f | 00 04 00 00 00
<- 91 00

>>> CreateBackupDataFile command:
-> 90 cb 00 00 07 01 00 0f | 00 08 00 00 00
<- 91 00

>>> CreateValueFile command:
-> 90 cc 00 00 11 02 00 0f | 00 00 00 00 00 00 01 00 | 00 80 00 00 00 01 00
<- 91 00

>>> CreateLinearRecordFile command:
-> 90 c1 00 00 0a 03 00 0f | 00 04 00 00 0c 00 00 00
<- 91 00

>>> CreateCyclicRecordFile command:
-> 90 c0 00 00 0a 04 00 0f | 00 01 00 00 05 00 00 00
<- 91 00

>>> GetFileIds command:
-> 90 6f 00 00 00 00
<- 00 01 02 03 04 91 00
>>> DeleteFile command:
-> 90 df 00 00 01 01 00
<- 91 00
>>> GetFileIds command:
-> 90 6f 00 00 00 00
<- 00 02 03 04 91 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 00 00
<- 00 00 0f 00 04 00 00 91 | 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 02 00
<- 02 00 0f 00 00 00 00 00 | 00 01 00 00 80 00 00 00 | 01 91 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 03 00
<- 03 00 0f 00 04 00 00 0c | 00 00 00 00 00 91 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 04 00
<- 04 00 0f 00 01 00 00 05 | 00 00 00 00 00 91 00
Binary file added Dumps/DESFire_example.dmp
Binary file not shown.

0 comments on commit d1b8508

Please sign in to comment.