Home

SCL01X - SCM Microsystems

1. 37 6 3 2 STORAGE CARD CMDS WRITE BINARY 39 6 33 STORAGE CARD CMDS LOAD rin nr rin 41 6 3 4 STORAGE CARD CMDS AUTHENTICATE 42 6 3 5 STORAGE CARD CMDS VALUE BLOCK 44 6 4 Set of APDU for ISO IEC14443 4 user tokens 45 Sn MEN Pug CORTE 45 64 2 user CORE ra Fr d E E 46 SOME l uu u kukaa qaa awa aaah 47 6 6 Setof APDU defined by SCM Microsystems 47 6 6 1 MIFARE DESFire Commands eene nennen nennen nennen 47 6 6 2 Commands for communicating with Forum Tags Type 1 47 6 6 3 Commands for communicating with Forum Tags 2 56 6 6 4 Commands for communication with Forum Tags 56 6 6 5 Commands for communicating with Forum Tags 4 58 6 6 6 PASS THROUGH rrr rrr rr n aii 59 6 6 7 Set of APDU for 14443 3 user tokens this needs to be updated as a new section below Set of APDU for ISO IEC14443 4 user tokens 59 B Escape OTIS occ
2. Example of the ATR built for contactless storage tokens Optional TLV Tag Application identifier MIFARE Classic 4K MIFARE Ultralight 38 scia Smartcard Commander 85 Smartcard Commander Tog Ele Edt Settings Help Ele Edt Settings Help Hardware System W System SCLOIO Contactless Reader 501010 Contactless Reader Ware Standard BD Mifare Ultralight d AR Lu PU card CPU card ATS 80 01 80 4F OC AD 00 00 03 06 03 00 02 00 00 00 00 69 ATS 3B 8F 80 01 80 0 00 00 03 06 03 00 03 00 00 00 00 68 Byte Value hex Meaning Byte Value hex Meaning TS 38 direct TS 3B direct TO oF 15 historical characters TO oF 15 historical characters TOL 80 protocol 0 TDI 80 protocol 0 01 protocolel 01 protocol l n 80 Category indicator byte n 80 Category indicator byte T2 AID presence indicator T2 4F AID presence indicator 13 oc Length of Following data 13 oc Length of Following data A000000306 RID PC SC Workgroup T4 T8 000000306 RID PC SC Workgroup Te 03 Card standard 150 14443 A part 3 19 03 Card standard ISO 14443 A part 3 0002 Card name Mifare Standard 4k 0003 Card name Mifare Ukra light 2 00 RFU T12 00 RFU 00 RFU 00 RFU 00 RFU 00 RFU 115 00 RFU 00 RFU Qs 69 Checksum 95 68 Checksum SCL01X REFERENCE MANUAL 27 5 3 4 3 fo
3. ol ihe manual u uuu uuu deerunt 13 22 000010 LOTH 13 2 3 Product version corresponding to the 13 2 4 Definition of various terms and 5 22 0 0 00 14 Zo Sn qasi 15 O ODA uuu u u S ER 16 3 General information about SCL01X 17 dd uei eee cederet va v arie 17 3 2 SCLD1X key Tes UU IRL 17 58 SOL01X ordering U serene NRA 18 34 SCL01X customizalian options hen ad 18 3 5 Contactless communication principles and SCLO1X usage recommendations 19 3 5 1 Fives p uuu ayasa qaqa 19 3 5 2 Bata IE caes xr ee eere te prev keen uqkay sawa 19 353 Hecomr ena3alionS ENTE 20 21 3 6 1 EE METRE pc ee 21 3 6 2 Applications provided by SCM 5 21 BU TREO 22 4 1 SCL01X high level 22 4 1 1 e 22 412 aciei tiere
4. Value Description Escape command code Switch RF Field ON Get current field state After the RF is turned off to turn the RF ON again card connect shall be done in direct mode If B1 of the input buffer is 0x00 or 1 the output buffer is Output buffer NULL If B1 of the input buffer is OXFF the output buffer is a BYTE buffer with 2 possible values Switch RF Field OFF Output buffer Description RF field is OFF 6 7 10 READER CNTLESS RAW CFG This escape command switches SCLO01X to raw mode When is in raw mode it only polls for one type of contactless card SCLO1X is by default not in this mode and therefore READER CNTLESS RAW XMIT would fail The input buffer contains 2 bytes Byte Value Description BO 097 Escape Function code B1 0x00 Type A wil be use for further transmissions in raw mode 0x01 Type B will be use for further transmissions in raw mode The output buffer is Output buffer NULL Once SCLO01X is raw mode commands be sent using READER CNTLESS RAW XMIT escape command SCL01X REFERENCE MANUAL 65 6 7 11 READER CNTLESS RAW XMIT This escape command can only be executed by the firmware once SCL01X is put in raw mode using the READER CNTLESS RAW CFG escape command This escape command can be used to send commands to smart card when SCLO1X is in raw mode The input buffer is Byte Value Description Escape Function code Wait Time Extens
5. 22 42 PL RTI 23 4 2 1 SOLUT X CUBIERBIOUS uuu ce eec ee eee ir eee p bet eit necs 23 4 2 2 LED c e ee c er e P eds 23 4 2 3 Sd cu 24 25 Bo 25 rr 25 E OON 25 E m 25 5 3 2 Supported operating 25 5 3 3 PC SC Part Amendment Supplemental Document for Contactless ICCs 26 534 PC SC 20 compliant ATR sr nare args 26 SN MN LU RTL DIEM 32 Bf COLD GOPBDIBIIGB i 32 542 PONIES PIS 32 Commands desci pO adem re eaa ke 33 Cm 33 ed Get UID Commis Ere rer Ee rrr ve 33 6 12 Escape command ARDU ee eee tere rege trunco e oer gne a 35 6 2 Setof APDU for ISO IEC14443 2 amp communications 36 ud Nm 36 D22 FOMA NETTES 36 O3 36 m 36 6 3 Setof APDU for contactless storage user 37 6 3 1 STORAGE CARD CMDS READ BINARY
6. System 3B 8C 80 01 04 43 FD 01 14 E4 00 7E 31 93 50 Byte Value hex Meaning TS 3B direct TO 8c 12 historical characters TDi 80 protocol 0 TD2 01 protocol 1 Historical Hex 04 43 FD 01 14 E4 00 7E 31 93 Historical ASCII 1 50 Checksum SCLO01X REFERENCE MANUAL 29 5 3 4 5 for ISO IEC 14443 4 user tokens The user token exposes its ATS or application information which is mapped to an ATR The table describes how this mapping is done Byte Value Designation Description 9 n indicates the number of historical bytes in following ATR 0 80 TD1 Nibble8 indicates no TA2 TB2 TC2 uM MN 0x01 Nibble8 indicates no NN 4 3 n Historical Type A the historical bytes from the ATS up to 15 bytes bytes or application Type B a Gyles information e Byte 0 through 3 application data from ATQB Byte 4 through 6 protocol info byte from ATQB e Byte 7 higest nibble is the MBLI maximum buffer length index from ATTRIB lowest nibble is 0x0 Example of the ATR built for an ISO14443 4 user tokens Type A dB SCM Smartcard Commander BEX File Edit Settings Help Hardware System amp SCLO10 Contactless Reader LJ Becton Passport Historical Hex 80 67 04 12 03 02 01 00 Historical ASCII 02200000 95 49 Checksum Type B dB SCM Sm
7. 0x00 as response means 848Kbps is disabled Enables 848Kbps Checks the status again and the answer 0x01 indicates 848Kbps is enabled ATR length 13 88 80 01 00 00 00 00 73 81 93 00 68 APDU FF CC 00 00 02 9D FF 54 12 9000 OK DataOut 00 1 byte s APDU FF CC 00 00 02 9D 01 5 12 9000 OK APDLI FF CC 00 00 02 9D FF A Sw12 9000 OK DataOut 01 1 byte s SCLO01X REFERENCE MANUAL 34 6 2 Set of APDU for ISO IEC14443 2 amp 3 communications 6 2 1 Description This command can be used to send raw data through the contactless interface Reader will not add transport protocol data to the raw data The entire data from the card including the crc bytes if any will be returned to the application CRC has to be managed manually by the application It must be added to the raw data by the user Contactless card s CRC will not be checked by the reader and will be transmitted in the PICC response data Note 1 Polling Polling sequence is not stopped automatically when using this command Between 2 commands the reader will go on checking if the card is still present This could impact some transaction were no additional sequence is supported in the middle of a transaction For example polling must be stopped before starting a secure session eg DES authentication and started after completing the secure session Note 2 CRC When sending the command the reader automatically add the CRC It
8. 5 3 4 1 Determining the technology of the user credential The ScardControl method of PC SC see http msdn microsoft com en us library aa379474 VS 85 aspx should be used to send the 0x90 IOCTL to SCL3711 in order to determine what type of technology is the user token based on The output buffer is a BYTE with the following meaning Technology Value MIFARE1K MIFARE4K 0x02 MIFARE Ultralight ISO14443 4A ISO14443 4B Once a user credential is selected the driver constructs an ATR from the fixed elements that identify the token Depending on the user technology this ATR can be analyzed as described hereunder SCLO01X REFERENCE MANUAL 26 5 3 4 2 ATR for contactless storage user tokens The ATR of the user token is composed as described in the table below In order to allow the application to identify the storage card properly it s Standard and Card name describing bytes must be interpreted according to the Part 3 Supplemental Document maintained by PC SC Tokens using technology like MIFARE are examples of such user tokens Byte Value Designation Description TO TD1 TD2 Ox8n n indicates the number of historical bytes in following ATR Nibble 0 indicates no TB3 TC3 Nibble 1 means T 1 4 9 n 0x80 A status indicator may be present in an optional TLV data object 2 0x80 Nibble8 indicates no TA2 TB2 TC2 Nibble 0 means 0 po m 4 n aD 000000000000
9. FeliCa I PUPI UID Length For FeliCa cards THEN EITHER B3 B12 PUPI UID bytes 0x00 byte padding used if length smaller than 10 NAD supported BIS Bit Rate Capability JN F 1 B3 B10 Request service command response time parameter see B11 JIS 6319 specification fo Request response command response time parameter 0 8 Bytes NFCID2 Authentication command response time parameter Read command response time parameter 70 SCLO01X REFERENCE MANUAL 71 95 Write command response time parameter Examples MIFARE Ultralight NR length 20 TR 8F 80 01 80 OC 0 00 00 03 06 03 00 03 00 00 00 00 68 APDU FF CC 00 00 01 DA 54 12 9000 OK DataOut 00 00 07 04 E4 D9 5B 02 80 00 00 00 00 00 00 04 OE 00 00 00 21 byte s MIFARE 1K ATRlength 20 ATR 3B 80 01 80 4F OC 00 00 03 06 03 00 01 00 00 00 00 64 APDU FF CC 00 00 01 DA 54712 9000 OK DataOut 00 00 04 FA 92 6C D6 00 00 00 00 00 00 00 00 00 04 OE 00 08 01 21 byte s MIFARE DESFire ATR length 6 ATR 3B 81 80 01 90 80 APDU Fcc 00 00 01 DA 54 12 9000 DataOut 00 01 07 04 7A 72 C9 92 26 80 00 00 00 01 00 77 08 00 20 01 21 byte s Topaz ATR length 7 ATR 3B 82 80 01 02 44 45 APDU FF CC 00 00 01 DA 59 12 9000 OK DataOut 00 1 byte s 15014443 4 ATR length 14 ATR 3B 89 80 01 80 67 04 12 03 02 01 00 49 APDU FF CC 00 00 01 DA 54712 9000
10. For an NFC Forum tag type 1 that has the following memory content 88 SCM Smartcard Commander File Settings Help Cardtype Topaz card Memory size 120 Bytes Memory Model Static Unique ID 07 83 3C 00 00 02 25 Block Hex 0783 3C00 0002 2500 E110 0 00 0326 D102 2153 7091 0108 5501 7465 7374 2 64 6511 0104 5405 656E 2 55 5354 6573 7451 0301 6163 7400 FEOO 0000 0000 0000 0000 0000 0000 0000 0000 9 0000 0000 0000 0000 10 0000 0000 0000 0000 11 0000 0000 0000 0000 12 0000 0000 0000 0000 13 85555 AAAA 0000 0000 14 0160 0000 0000 0000 VID Bytes Bytes Internal Bytes Data Bytes Lock Bits Read Only Bytes The following 2 APDUs can be sent to retrieve the UID and read all the memory blocks ATR length 7 ATR 3B 82 80 01 02 44 45 APDU FF 50 00 00 00 54 12 9000 DataOut 11 48 07 83 00 6 byte s APDU FF 52 00 00 00 54 12 9000 OK DataOut 11 48 07 83 00 00 02 25 00 E1 10 OE 00 03 26 D1 02 21 53 70 91 01 08 55 01 74 65 73 74 2E 64 65 11 01 0 54 05 65 2D 55 53 54 65 73 74 51 03 01 61 63 74 SCL01X REFERENCE MANUAL 48 6 6 2 3 Read Byte READ Description This command reads a single EEPROM memory byte within the static memory model area of blocks 0x0 OxE Format Data CLA INS P1 P2 P3 Where P2 codes the address of the memory byte in the following way Bit numbers Description b7
11. 1 digit of the hexadecimal representation of a byte Example OxAS3 is represented in binary as 10100011 b The least significant nibble is Ox3 or 0011 b and the most significant nibble is OxA or 1010 b Peer to Peer Proximity Coupling Device Personal Computer Smart Card software interface to communicate between a PC and a smart card Proximity Integrated Chip Card PID Product ID Distance coverage 10 cm PUPI Pseudo unique PICC identifier Reserved for future use L Divider receive used to determine the baud rate between the reader to the card S A Radio Frequenc Smart card reader controller ASIC from SCM Microsystems Universal Serial Bus Vendor ID Binary notation of a number x z 0 1 The byte value YY is represented in hexadecimal SCL01X REFERENCE MANUAL 13 2 5 References Doc ref in Description Issuer the manual ISO IEC Identification cards Integrated circuit s cards ISO IEC 7816 4 with contacts Part 4 Interindustry commands for interchange ISO IEC 7816 4 1995 E ISO IEC Identification cards Contactless integrated ISO IEC 14443 4 circuit s cards Proximity cards Part 4 Transmission protocol ISO IEC 14443 4 2001 E ISO IEC Information technology Telecommunications ISO IEC 18092 and information exchange between systems Near Field Communication Interface and Protocol NFCIP 1 ISO IEC 18092 2004 E tag type 1 tag type 2 tag
12. 4 Set of APDU for ISO IEC14443 4 user tokens 6 4 1 TZCL Command Description SCLO1X can transfer directly ISO IEC7816 4 APDU to the PICC SCLO01X supports user tokens that have both the MIFARE and T CL partitions Depending the APDU sent by the host the reader switches to the corresponding mode MIFARE or T CL automatically and the command is processed accordingly 6 4 1 1 Format Description of the APDU commands can be found in ISO IEC 7816 4 specification 6 4 1 2 Response Data Out PICC answer as defined in ISO IEC 7816 44 SW1 SW2 As defined in ISO IEC 7816 4 6 4 1 3 Status Words Description See ISO IEC 7816 4 As defined in ISO IEC 7816 4 6 4 1 4 Example The following APDU sequence reads the first 256 bytes of the data group 1 as specified in ICAO LDS logical data structure for machine readable travel documents with open access It first selects the issuer application using its AID 0x00 0x00 0x02 0x47 0x10 0x01 then selects the DG1 file 0x01 0x01 and then does a read binary APDU 00 A4 04 OC 07 40 00 00 02 47 10 01 54 12 9000 OK APDU 00 A4 02 OC 02 01 01 54 12 9000 OK APDU 00 00 00 00 54 12 9000 OK DataOut 61 5B 5F 1F 58 50 3C 55 54 4F 45 52 49 4B 53 53 4F 4E 3C 3C 41 4E 4E 41 3C 4D 41 52 49 41 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 3C 4C 38 39 38 39 30 32 43 3C 3 SCL01X REFERENCE MANUAL 44 6 4 2 T CL user command Description Th
13. File Settings Help W System E 5 1010 Contactless Reader M Bar Pu card Mifare Ultralight Cardtype Mifare Ultralight Memory size 64 Byt Unique ID 04 E4 09 58 02 80 Block Hex ASCII C3AB b95p 0280 U 0048 0000 MR 0000 0000 FFFF FFFF yyyy 0000 0000 0000 0000 0000 0000 0000 9 0000 0000 VID Bytes OTP Bytes Internal Bytes Data Bytes Lock Bits Read Only Bytes Issuing the command SCLO01X REFERENCE MANUAL 38 ATR length 20 80 01 80 4F OC AO 00 00 03 06 03 00 03 00 00 00 00 68 APDLI FF D6 00 06 04 EE EE EE EE Sw12 9000 OK Results into the following memory mapping Mifare Ultralight Cardtype Mifare Ultralight Memory size 64 Bytes Unique ID 04 E4 09 5B 02 80 Block Hex D95B 0280 8048 0000 0000 0000 FFFF FFFF 0000 0000 EEEE EEEE 1111 0000 O000 0000 0000 0000 0000 VID Bytes OTP Bytes Internal Bytes Data Bytes Lock Bits Read Only Bytes SCL01X REFERENCE MANUAL 39 6 3 3 STORAGE CARD CMDS LOAD KEYS 6 3 3 1 Description Some type of user tokens like MIFARE Classic may require that an authentication happens before any data can be read or written To perform this authentication keys need to be loaded in the reader s mem
14. H ifdef cplusplus extern C endif define IOCTL_CCID_FSCAPE define CCID GET PUPI STATUS define CCID SET PUPI ON define CCID SET PUPI OFF define MINTIMEOUT ifdef cplusplus endif File Name T pupi CPP include windows h include winbase h include stdio h include conio h include winscard h include winerror h include T pupi H VOID main VOID SCARDCONTEXT SCARDHANDLE BYTE WORD DWORD ULONG ULONG SCARD CTL CODE 0xDAC OxFF9B 0 019 0 009 300 ContextHandle CardHandle OutByte InWord i ActiveProtocol protocol InBufLen ResLen ret SCLO01X REFERENCE MANUAL 76 SCARD READERSTATE Reader 1 please add the name of the used reader here or use SCardListReaders to find the right reader name char ReaderName SCM Microsystems Inc SCLO1X USB ContactlessReader 0 NULL BR KIRK KK RIK RR I K K Ck K K Ck Ck K K K K KOK K KOK K K KOK K KOK K KOK KOK KOK KOK KOK KOK KOK KOK KOK KOK KO KOK KO KOK Ck kk ke k k k k k ContextHandle 1 ret SCardEstablishContext SCARD SCOPE USER NULL NULL amp ContextHandle if ret SCARD 5 SUCCESS ret SCardConnect ContextHandle ReaderName 0 SCARD SHARE SHARED SCARD PROTOCOL TO SCARD PROTOCOL 1 amp CardHandle amp ActiveProtocol if ret SCARD S SUCCESS get actual PUPI status ON OFF InBufLe
15. NFC front end ensures the coding decoding framing modulation demodulation required for the RF communication It is controlled by the device controller through registers The matching circuitry provides the transmission and receiver paths adaptation for the antenna to function properly 4 1 2 Software architecture Applications can interface with the driver directly through the PC SC interface or Application through the SCM proprietary interface to the r 02 SCM API for P2P and NFC wrapper extra services The NFC wrapper simplifies the usage of the different Forum tags with the mm mc SCLO1X other SCM contactless s and SCM proprietray readers It provides a unique to Driver application developers which enables them EEUE eee to read and modify NDEF records without further knowledge of the underlying hardware and protocols Detailed information about the NFC wrapper can be found in SCM s Contactless SDK The SCL01X driver implements PC SC v2 0 API towards upper layers and uses SCM firmware commands encapsulated in CCID like protocol The SCLO1X firmware handles all the contactless related intelligence i e ISO IEC 14443 ISO IEC 18092 etc SCL01X REFERENCE MANUAL 21 4 2 Quick reference data 4 2 1 SCLO1X dimensions Item Characteristic Value 70 Grams External dimensions L 110 mm x W 65mm x H 8mm Cable length 1 Meter Default color Cool gray textured Default
16. an authentication session and after completing the session E g Mifare Plus AES or sector authentication Ultralight C AES authentication etc IMPORTANT NOTE Once the user token is detected once the polling is disabled the reader will not be able to detect any token removal and the application will still display as card present We need to enable the polling again in order to detect card removal Reader will not be able to detect new cards before the polling is enabled again This command must be used with care and application developers must ensure that polling is enable again as soon as it is not needed to have the polling disabled 6 7 22 2 Format Input buffer Byte Value Description BO OC Escape command code Enable Polling Disable Polling Gets Current state of polling Output buffer Byte Configuration Output buffer parameter value from input buffer 0x00or 0x01 or 0x01 NULL 0x00 polling enabled 0x01 0x01 polling disabled disabled SCL01X REFERENCE MANUAL 74 7 Annexes 7 1 Annex A Status words table 51 2 Sw2 Description INVALID INSTRUCTION BYTE CLASS NOT SUPPORTED AUTHENTICATION ERROR STATUS COMMAND FAILED STATUS SECUIRTY STATUS NOT MET CLASS BYTE INCORRECT FUNCTION NOT SUPPORTED WRONG PARAMETER P1 P2 SCLO01X REFERENCE MANUAL 75 7 2 Annex B Sample code using escape commands through Escape IOCTL File Name T pupi
17. b3 Block value between 0x0 and 0xE b2 Byte within the block value between 0 and 7 Response Data Swi SW2 1 byte of data 9000 Example For an NFC forum tag type 1 which has the following memory dump E 1 Sending the following sequence of APDU will read byte 0x01 of block 0x00 through 0x04 ATR length 7 ATR 3B 82 80 01 02 44 45 APDU FF 54 00 01 00 SW12 900 y OK DataOut 83 1 byte s APDU FF 54 00 09 00 54712 9000 OK DataOut 10 1 byte s APDU FF 54 00 11 00 5 12 9000 OK DataOut 53 1 byte s APDU FF 54 00 19 00 5412 9000 OK DataOut 65 1 byte s APDU FF 54 00 21 00 54 12 9000 OK DataOut 1 byte s SCL01X REFERENCE MANUAL 49 6 6 2 4 Write Erase Byte WRITE E Description This commands erases and then writes the value of an individual memory byte within the static memory model area of blocks Ox0 OxE 1 0 56 0 00 Byte 0x01 1 byte of data to be Address written Where P2 codes the address of the memory byte in the following way Bit numbers Description b7 b3 Block value between 0x0 and 0xE b2 Byte within the block value between 0 and 7 Response Data SW1 SW2 Byte value that has been written 0x90 0x00 Example For an NFC forum tag type 1 which has the following memory dump 0 SCH Smartcard Commander Joe x L AT
18. in details interfaces and supported commands available for developers using SCLO1X in their applications 2 2 Target audience This document describes the technical implementation of SCLO1X The manual targets software developers It assumes knowledge about 13 56 MHz contactless technologies like ISO IEC 14443 and commonly used engineering terms Should you have questions you may send them to support scmmicro com 2 3 Product version corresponding to the manual This manual is related to the version indicated below and all further versions Item Version Windows 5 09 Driver SCL01X REFERENCE MANUAL 12 2 4 Definition of various terms and acronyms APDU Application Protocol Data Unit Answer to Reset defined 1507816 Answer to select defined in ISO IEC 14443 Group of 8 bits Chip Card Interface Device Card Identifier Contactless DU DFU Device Firmware Upgrade FeliCa Sony contactless technology standardized 15018092 technology underlying the Divider send used to determine the baud rate between the card to the reader Forum tag type 3 Jewel Topaz Innovision contactless technology technology underlying the Forum tag type 1 Light emitting diode The 15014443 Type A with extensions for security NXP Not applicable Node Address NFC Data Exchange Format data structure defined by the NFC Forum for NFC Forum tags Near Field Communication Nibble Group of 4 bits
19. is not needed to add it in the raw data that are sent to the chip In the PICC response data the reader will provide all the bytes that have been sent back by the PICC including the CRC 6 2 2 Format oxEF Length Raw data of data 6 2 3 Response Output buffer PICC response data 6 2 4 Example This command can be used to send commands to a MIFARE Ultralight The command for generating an 8 byte random number on MIFARE Ultralight C is 0 1 0x00 Sending the APDU OxFF OxEF 0x00 0x00 0x02 0x1A 0x00 will return OxAF followed by 8 byte random number and the crc bytes 1 Please note that when ever we initiate a authentication process from the application e g AES we have to disable polling and enable at the end of the session SCL01X REFERENCE MANUAL 35 6 3 Set of APDU for contactless storage user tokens 6 3 1 STORAGE CARD CMDS READ BINARY 6 3 1 1 Description Using this APDU application can read a memory block on user tokens based on technologies like MIFARE Classic 1K or 4K block size Ox10 bytes or MIFARE Ultra light block size 0x04 bytes 6 3 1 2 Scis CLA 5 P2 fore NCC MCN P2 indicates the block number from where to read e Le can be a short maximum value 255 or extended maximum value 65535 If Le 0x00 then all the bytes until the end of the file are read within the limit of 256 for a short Le field and 65536 for an extended Le fie
20. of the user token This command can be used for all supported technologies 6 1 1 2 I Class support The Get UID command supports iCLASS serial number 6 1 1 3 Format OxFF OxCA 0x00 0x00 Setting Le 0x00 can be used to request the full UID or PUPI is sent back e g for ISO14443A single 4 bytes double 7 bytes triple 10 bytes for ISO14443B 4 bytes PUPI 6 1 1 4 Response Bata Out 090595 6 1 T Status Words Description 0x62 0x82 End of UID reached before Le bytes Le is greater than UID length 0 6 OxXX Wrong Length OxXX is the exact value for Le Further error codes can be found in annex SCLO01X REFERENCE MANUAL 32 6 1 1 6 ISO14443 4A Examples ATR length 14 89 80 01 80 67 04 12 03 02 01 00 49 APDU FF CA 00 00 00 54 12 9000 OK DataOut 08 24 64 97 4 byte s 15014443 4 ATR length 13 ATR 3B 88 80 01 00 00 00 00 73 81 93 00 68 APDU FF CA 00 00 00 59 12 9000 OK DataOut FO 2C FF FF 4 byte s MIFARE 4K ATR length 20 80 01 80 40 00 00 03 06 03 00 02 00 00 00 00 69 APDU FF CA 00 00 00 59 12 9000 OK DataOut 04 49 86 7 4 byte s MIFARE Ultralight ATR length 20 80 01 80 4F 0 00 00 03 06 03 00 03 00 00 00 00 68 APDU FF CA 00 00 00 54 12 9000 OK DataOut 04 E4 09 5B 02 80 7 byte s NFC Forum tag type 1 ATR length 7 3B 82 80 01 02 44
21. type 3 tag type 4 Personal Computer Systems v2 01 User manual of the NFC wrapper This manual wrapper is part of SCM s Contactless SDK CCID Specification for Integrated Circuit s Cards USB IF Interface Devices 1 1 Universal Serial Bus Specification 2 0 USB IF SCLO01X REFERENCE MANUAL 14 2 6 Conventions Bits are represented by lower case b where followed by a numbering digit Bytes are represented by upper case B where followed by a numbering digit Bit number 5 Bit number 0 b7 b6 b5 b4 b3 b2 b1 bO lt 4 Most significant nibble lt Least significant nibble lt 41 Byte 8 bits 2 nibBlies 9 Byte number 2 Byte number 11 String of 12 bytes Example 163 decimal number is represented hexadecimal as OxA3 in binary as 10100011 b The least significant nibble of 0xA3 is 0x3 in hexadecimal 0011 b in binary The most significant nibble of xA3 is OxA in hexadecimal 1010 b in binary SCLO01X REFERENCE MANUAL 15 3 General information about SCLO1X 3 1 SCLO01X key benefits With its combination of a modern slim design and its state of the art multi protocol feature set SCL01X is the perfect desktop reader choice to support various contactless applications such as electronic ID payment amp public transportation schemes and to interact
22. 00 0000 0000 0000 0000 2000 0000 0000 0000 0000 0000 0000 0000 0000 D3F7 D3F7 D3F7 7 07 8840 NEV B NEV B B 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 mona nann nnan nnno AJB AJB OAIR lt l ID sytes Key Bite Data Bytes Internal Bytes Key B General Purpose Bytes Read Only Bytes To read the seventh block you have to issue the following command and get the following response APDU FF 00 06 10 54 12 9000 OK DataOut 63 72 6F 2E 63 6D 2F 73 63 6C 33 37 31 30 FE 16 byte s SCL01X REFERENCE MANUAL 37 6 3 2 STORAGE CARD CMDS WRITE BINARY 6 3 2 1 Description This APDU writes data to a memory address 6 3 2 2 Format CLA Data in S P1 P2 Lc OxFF 0xD6 Address Address OxXX Data MSB LSB Where e P2 indicate the memory block number where data should be written Lc 0x10 for MIFARE Classic 1 4 Lc 0x04 for MIFARE Ultralight 6 3 2 3 Response Data Out SW1 SW2 6 3 2 4 Status Words SW1 SW2 Description 0x90 NO ERROR Command not supported State of the non volatile memory unchanged 6 3 2 5 Example For a MIFARE Classic Ultralight card which has the following memory content Smartcard Commander Y BAX
23. 01x firmware Ver 1 12 and above where a user can store amp retrieve data from the reader This data is stored in the chip and hence data is retained even after un plug and re plug Note Please be informed that very frequent write should be avoided E2 supports only 100K writing Escape IOCTL 0xF0 can be used to read and write to this user configuration area Max of 249 bytes can be read and written and the sector has to be read and written as a whole 6 7 21 2 Format Byte Value Description OxFO Escape command code B1 0x01 Read the 249 bytes To read the contents set the InputBuffer of the escape IOCTL to OxFO 0x01 and send the escape IOCTL Response will be 249 bytes of data To write data set the InputBuffer of the escape IOCTL to OxFO 0x02 249 bytes data No response bytes are sent for this IOCTL The return value of ScardControl denotes whether the write has passed or not Note If complete data 249 bytes is not given during write operation then random data will be padded to the given data and then written If you want to modify only partial data in the reader read the entire 249 bytes modify the data you want and then write it back to the reader SCL01X REFERENCE MANUAL 73 6 7 22 READER DISABLE ENABLE POLLING 6 7 22 1 Description This escape command can be used to enable disable card polling by reader once a user token has been detected This IOCTL is primarily used to stop polling before starting
24. 1 byte RFU 1 byte TSN Response Data SW1 SW2 16 bytes of NFCID2 2 bytes of System Code 0x90 0x00 sent only if the RFU byte is 0 01 SCL01X REFERENCE MANUAL 55 6 6 4 2 Request Service Description On receiving this command an NFC Forum tag 3 type will respond with the area key version of the specified area and the service key version of the specified service TEES Data IL of 0x00 Service Code List services areas Area Code List Response Data SW1 SW2 8 bytes IDm No of Service or areas n 0x90 0x00 Service version or area version list 2 n 6 6 4 3 Request response Description When an NFC Forum tag type 3 receives this command it responds with its current mode 0 1 2 Format CLA 5 P2 Data eres oe Response Data SW1 SW2 8 bytes IDm Mode 0x90 0x00 6 6 4 4 Read Description When an NFC Forum tag type 3 receives this command it responds with the record value of the specified service Format Data CLA IN 0 46 Number of Number of Service Code List services blocks Block List Response Data SW1 SW2 8 bytes IDm Status Flag 1 Status Flag 0x90 0x00 2 No of blocks n Block data n 16 SCL01X REFERENCE MANUAL 56 6 6 4 5 Write Description When an NFC Forum tag type 3 receives this command it writes the records of the specified Service Er 0 48 Number of Number of m
25. 3 64 bit 5 3 3 PC SC Part 3 Amendment Supplemental Document for Contactless ICCs The commands specified under PC SC Part 3 specification amendment Supplemental Document for Contactless ICCs should be sent as escape IOCTL to the reader ScardTransmit cannot be used for this purpose For the list of commands and their explanation please refer to the PC SC specification First the command is formed as given in the PC SC specification command bytes becomes the input buffer for the escape IOCTL In order to start a transparent session the command format as given in the PC SC spec is OxFF 0xc2 0x00 0x00 0x02 0x81 0x00 0x00 This has to be sent through ScardControl as shown below The size of the output buffer depends on the commands that we send to the reader hence it is up to the application to allocate the required amount of buffer define CCID ESCAPE SCARD CODE 0xDAC IReturn SCardControl CardHandle IOCTL CCID ESCAPE amp lnBuff InBufLen amp OutBuff OutBuffLen amp ResLen gt InBuff OxC2 0x00 0x00 0x02 0x81 0x00 0x00 lt OutBuff 0xCO 0x03 0x00 0x90 0x00 0x90 0x00 5 3 4 PC SC 2 0 compliant ATR When a user token is placed on the reader initialization anti collision is The user token is automatically activated and an ATR is built as defined in the PC SC specification For NFC Forum tag types 1 and 3 there is no definition in PC SC 24 SCL01X REFERENCE MANUAL 25
26. 45 APDU FF CA 00 00 00 54 12 9000 OK DataOut 07 83 00 00 02 25 7 byte s NFC Forum tag type 3 ATR length 17 8C 80 01 04 43 FD 01 14 E4 00 7E 31 93 50 APDU FF 00 00 00 5412 9000 OK DataOut 01 14 E4 00 7E 31 8 byte s SCL01X REFERENCE MANUAL 33 6 1 2 Escape command APDU 6 1 2 1 Description This command be used to send escape commands to SCLO1X For description of escape commands please refer to the dedicated chapter in this manual 6 1 2 2 Format CLA INS P1 P2 P3 Data in Lc is the length of the escape command s input buffer See escape commands description later in this manual 6 1 2 3 Response Output buffer of the escape command 6 1 2 4 Example To get the ATS or ATQB of the ISO14443 4 based user token you can use this APDU to send the READER CNTLESS GET ATS ATQB 0x93 escape command ATR length 14 3B 89 80 01 80 67 04 12 03 02 01 00 49 Type A passport APDU FF CC 00 00 01 93 54 12 9000 OK DataOut OE 78 33 C4 02 80 67 04 12 03 02 01 00 14 byte s ATR length 13 ATR 3B 99 90 01 00 00 00 00 73 91 93 00 68 54 12 9000 DataOut 50 76 49 FF FF 00 00 00 00 73 81 93 12 byte s To get the reader status about support of 848Kbps you can use this APDU to send the READER CNTLESS 848KBPS 0x9D escape command By default the SCLO1X doesn t have 848Kbps enabled the following sequence Checks the status
27. CLO1X is a transparent reader designed to interface a personal computer host supporting PC SC interface with 13 56MHz user tokens like public transport cards contactless banking cards NFC forum tags electronic identification documents e g e passports e ID cards driving licenses etc Those user tokens can have several form factors like credit cards key fobs NFC mobile phones or USB dongles like SCT3511 that SCM Microsystems markets USB link RF link 13 56MHz PC SC interface 15014443 18092 NFC interface Host 1011 Tokens Application logic User personal data for given set of applications Application logic Interface device SCLO1X itself handles the communication protocol but not the application related to the token The application specific logic has to be implemented by software developers on the host 3 6 2 Applications provided by SCM Microsystems SCM Microsystems does not provide payment or transport applications SCM Microsystems provides a few applications for development and evaluation purposes that can function with SCLO1X They are available within gt B SCM Smartcard Commander the software development kit There are many tools s ss provided but the two main ones are EESTI SCL010 Contactless Reader 0 Topaz The forum tag reader writer is a standalone application that enables the user to read and write NFC forum compliant records into forum compatib
28. D to PICC 212Kbps from PICC to PCD 106Kbps from PCD to PICC 212Kbps in both directions 212Kbps from PICC to PCD 424Kbps from PCD to PICC 212Kbps from PICC to PCD 848Kbps from PCD to PICC 424Kbps from PICC to PCD 106Kbps from PCD to PICC 424Kbps from PICC to PCD 212Kbps from PCD to PICC 424Kbps in both directions 424Kbps from PICC to PCD 848Kbps from PCD to PICC 848Kbps from PICC to PCD 106Kbps from PCD to PICC 848Kbps from PICC to PCD 212Kbps from PCD to PICC 848Kbps from PICC to PCD 424Kbps from PCD to PICC 848Kbps in both directions SCL01X REFERENCE MANUAL 68 6 7 15 READER CNTLESS FORCE BAUDRATE PCSC REV2 This escape command can be used to force baud rate for Contactless cards The input buffer is Byte Value Description OxAD Escape command code B1 Apply the baud rate specified by the card B2 b0 DR 2 supported if bit is set to 1 Encoding of the baud rate to be forced if B1 value is Ox01 No need to send this b1 DR 4 supported if bit is set to 1 byte in case B1 has the value 00 b2 DR 8 supported if bit is set to 1 b3 shall be set to 0 1 is RFU b4 DS 2 supported if bit is set to 1 b5 DS 4 supported if bit is set to 1 b6 DS 8 supported if bit is set to 1 b7 1 if the same D is required for both communication directions b8 0 if different D is supported for each communication direction NULL If B1 0x00 The output buffer is Output buffer NULL A card connect has
29. DataOut OB 1 byte s APDU 54 00 00 54 12 9000 OK DataOut OB 1 byte s Value 0x 0x02 0x09 EIE SCL01X REFERENCE MANUAL 52 6 6 2 6 Read Segment RSEG Description This command reads out a complete segment or block of the memory a Topaz tag with dynamic memory model Please note that this command only function on those specific Topaz tags Er Data 0x5A 0x00 wass 0x00 Address P2 Segment Address b8 b5 0x0 OxF b4 b1 Response Data SW1 SW2 128 bytes of data 0x90 0x00 6 6 2 7 Read 8 bytes READ8 Description This command reads out a block of memory Format INS P1 P2 OxFF Ox5C 0x00 Block Address P2 Block Address b8 b1 General block 0x00 OxFF Response 8 bytes of data 0x90 0x00 SCL01X REFERENCE MANUAL 53 6 6 2 8 Write Erase 8 bytes WRITE E8 Description This command writes erases a memory block and then writes a value to it Format CLA INS P1 P2 P3 Data OxFF Ox5E 0x00 Block 0x08 8 bytes of data to be Address written P2 Block Address b8 b1 General block 0x00 OxFF Response SW1 SW2 8 bytes of data that have been written 0x90 0x00 6 6 2 9 Write No Erase 8 bytes WRITE NE8 Description The WRITE E8 command writes with no erase to a block of memory This command does not erase the value of the targeted block before writing the new data Using this comm
30. ER DISABLE ENABLE POLLING eres 75 nni uuu 76 7 1 Annex Status words table ente nter ke RE aee ER Era ndn 76 7 2 Annex Sample code using escape commands through Escape 77 7 3 Annex C Mechanical drawings eerte erecti en ntn enne dei 82 53 1 E ETE E ET 82 Eog Balom GaS EE 83 EPI 84 i gt 34 Shap on card 85 SCLO01X REFERENCE MANUAL 1 Legal information 1 1 Disclaimers The content published in this document is believed to be accurate SCM Microsystems does not however provide any representation or warranty regarding the accuracy or completeness of its content and regarding the consequences of the use of information contained herein If this document has the status Draft its content is still under internal review and yet to be formally validated SCM Microsystems reserves the right to change the content of this document without prior notice The content of this document supersedes the content of previous versions of the same document The document may contain application descriptions and or source code examples which are for illustrative purposes only SCM Microsystems gives no representation or warranty that such descriptions or examples are suitable for the application that the reader may want to use them f
31. ICROSYSTEMS SCM Microsystems Reference Manual version 2 1 SCL01X Multiprotocol contactless stationary reader Reference manual SCLO1X Multiprotocol Contactless Stationary Reader SCM Microsystems Oskar Messter Strasse 13 85737 Ismaning Germany Phone 49 89 9595 5000 Fax 49 89 9595 5555 Document history Date Version Description of change 26 10 2010 2 0 Initial version Typo corrections Add the Pass through command description Manual fro both SCLO10 and SCL011 products 15 03 2011 Following FW release 1 12 Addition of commands for Mifare plus Support Swtich Card to part 4 Transparent command Enable Disable polling CCID compliance iCLASS UID support in the Get UID Command Contact information http www scmmicro com products services smart card readers terminals contactless dual interface readers html For sales information please email sales scmmicro com Table of Contents UCET REDE 11 Ws e EE INTO LTD 11 E ees 11 1231 Section 15 21 Informatiori tO 1202 0 eene rene 11 1 22 Section 15 Subpart Section 15 226 11 JS MS TDI 11 1 4 NOAA cene eee ren er etin enne eee rea Ey 12 2 JniroducuonTo mWamul uuu ret hc eee bec 13 2 1
32. OK DataOut 00 01 04 08 66 41 4F 00 00 00 00 00 00 01 00 33 OC FE 00 20 04 21 byte s ISO14443 4B ATR length 13 ATR 3B 88 80 01 00 00 00 00 73 91 93 00 68 APDU FF CC 00 00 01 DA 54 12 9000 OK DataOut 01 01 04 CA 9D FF FF 00 00 00 00 00 00 01 00 73 09 00 00 00 21 byte s ISO14443 4A MIFARE AT Sength 19 ATR 80 01 4E 58 50 53 6D 61 72 74 65 49 44 30 2E 31 57 APDU FF CC 00 00 01 D SW12 9000 OK DataOut 00 02 04 00 89 OD 82 00 00 00 00 00 00 01 00 77 OC FE 00 38 00 21 byte s FeliCa 6 7 19 ATR length 17 ATR 3B 8C 80 01 04 43 FD 01 14 E4 00 7E 31 93 50 APDU FF CC 00 00 01 DA SW12 9000 OK DataOut 04 43 08 01 14 E4 00 7E 31 4B 02 4 49 93 16 byte s READER IS SCLO1x This escape message may be used to check if the connected device is an SCL01x device The input buffer contains the escape command code Input buffer The output buffer shall point to a BYTE buffer with following possible values Output buffer Description SCLO1x device connected NULL Device connected is not SCLO1x SCL01X REFERENCE MANUAL 72 6 7 20 READER SEND ATTRIB WITH INF This Escape command may be used to send application layer bytes to a type B card along with the ATTRIB command in the higher layer INF field The input buffer is Byte Value Description 6 7 21 USER_TRACEABILITY_DATA 6 7 21 1 Description A new feature is added in SCL
33. R length 7 The following sequence does ru i 154 12 9000 e AREAD of the byte 0x03 in block 0x07 DataOut 00 1 byte s A WRITE ERASE of the byte 0x03 in the block 0 07 with PDU FF 56 003801 0A 54 12 9000 OK value 0x0A DataOut DA 1 byte s READ of the byte 0x03 in block 0x07 APDU FF 54 00 00 54 12 9000 OK e A WRITE ERASE of the byte 0x03 in the block 0x07 with 28204 0A 1 byte s value 0x02 APDU FF 56 00 38 01 02 54 12 9000 OK e A READ of the byte 0x03 in block 0x07 DataOut 02 1 byte sy APDU FF 54 00 3B 00 SW12 9000 OK DataOut 02 1 byte s SCL01X REFERENCE MANUAL 50 6 6 2 5 Write No Erase Byte WRITE NE Description This command writes a byte value on an individual memory byte within the static memory model area of blocks 0 0 0 This command does not erase the value of the targeted byte before writing the new data Execution time of this command by NFC Forum tags type 1 is approximately half that of the normal write command WRITE E Using this command EEPROM bits can be set but not reset Format CLA INS P1 P2 P3 Data OxFF 0x58 0x00 Byte 0x01 1 byte of data to be Address written Where P2 codes the address of the memory byte in the following way Bit numbers Description b7 b3 Block value between 0x0 and 0xE b2 Byte within the block value between 0 and 7 Response Data SW1 SW2 Value of the memory byte aft
34. SCardEstablishContext failed with 81X ret printf npress any key to close the test tool Wn getch SCLO01X REFERENCE MANUAL 80 7 3 Annex C Mechanical drawings 7 3 1 Top casing 4 50 185 3e 81 SCLO01X REFERENCE MANUAL 7 3 2 Bottom casing 108 23 9 Cx e 0 I 29 5 cC n rn m m i SASS E ta c D C2 9 k or SCLO01X REFERENCE MANUAL 82 7 3 3 Cradle SECTIIN C C SCLO01X REFERENCE MANUAL 83 7 3 4 Snap on card holder 6 21 10 10 SECTION B B ew evel
35. Service Code List services blocks 16 P2 Block List Block Data Response Data SW1 SW2 8 bytes IDm Status Flag 1 Status Flag 2 0x90 0x00 6 6 4 6 Request System Code Description lt gt Format CLA INS P2 P3 Data ere NN NC NN RN Response Data SW1 SW2 8 bytes IDm No of System Codes n 0x90 0x00 System Code List 2n 6 6 5 Commands for communicating with NFC Forum Tags Type 4 There is no need to define specific APDU commands as command T CL command already defined earlier can be used Please refer to NFC Forum tag type 4 specification for definition of the commands to be used SCL01X REFERENCE MANUAL 57 6 6 6 PASS THROUGH command Description This command can be used to send raw data to the user token SCL3711 will not add transport protocol data to the raw data e g PCB NAD CID etc Format CLA INS P2 Data Response Data PICC response data Example This command can be used to send commands to a MIFARE Ultralight C The command for generating an 8 byte random number on MIFARE Ultralight C is 0x1A 0x00 Sending the APDU OxFF OxEF 0x00 0x00 0x02 0x1A 0x00 Will return OxAF followed by 8 byte random number 6 6 7 Set of APDU for ISO IEC14443 3 user tokens this needs to be updated as a new section below Set of APDU for ISO IEC14443 4 user tokens Description This command can be used to send raw data to the user token Reader will not add tr
36. TLESS BAUDRATE Ox9E READER CNTLESS FORCE BAUDRATE PCSC REV2 OxAD READER LED CONTROL BY FW 0 2 READER GETPNPPARAMS OxD3 READER_GETSLOTINFO OxD9 READER GET CARD DETAILS OxDA READER 15 SCLO1X OxDB READER SEND ATTRIB WITH INF OxE2 READER GET CARD TYPE OxE3 READER_IS_COLLISION_DETECTED OxE4 FELICA_PASS_ THROUGH OxF3 USER_TRACEABILITY_AREA OxFO READER_DISABLE_ENABLE_POLLING OxAC Sample code to send escape commands can be found in annex SCL01X REFERENCE MANUAL 61 6 7 3 READER GETCARDINFO This escape command is used to get information about the card placed on the reader The SCLO1X returns an error if no card is placed on it The input buffer shall contain the escape command code Input buffer The output buffer contents are described below Output buffer Value Description Contactless card present Baud rate of card reader communication see READER_CNTLESS_BAUDRATE escape command 6 7 4 READER LED CONTROL BY FW This escape command may be used to enable or disable LED control by the firmware The input buffer is Byte Value Description B1 Disable LED control by FW Enable LED control by FW The output buffer is Output buffer NULL SCL01X REFERENCE MANUAL 62 6 7 5 READER LEDCONTROL This escape command is used to turn ON OFF the LED This escape command shall work only if LED control by firmware is disabled The input buffer shall contain 3 bytes Byte Value Description Escape comma
37. and EEPROM bits can be set but not reset Format Data CLA IN 0x60 0x00 Block 0x08 8 bytes of data to be Address written P2 Block Address b8 b1 General block 0x00 OxFF Response Data SW1 SW2 8 bytes of data 0x90 0x00 Example Sending the following command to an NFC Forum type 1 tag that has the value 0x01 0x02 0x03 0x04 0x00 0x00 0x00 0x00 in the first EEPROM block CLA IN Data OxFF 0x60 0x00 0x00 0x08 0x00 0x01 0x03 0x04 parapas Will give the answer Data SW1 SW2 0x01 0x03 0x03 0x04 0x90 0x00 0x05 0x06 0x07 0x08 SCL01X REFERENCE MANUAL 54 6 6 3 Commands for communicating with NFC Forum Tags Type 2 To interact with an NFC Forum tag type 2 the commands defined for memory storage cards are to be used STORAGE CMDS READ BINARY and STORAGE CMDS WRITE BINARY with block length of 0x04 Please refer to NFC Forum tag type 2 specification for definition of the commands to be used 6 6 4 Commands for communication with NFC Forum Tags Type 3 Proprietary APDUs defined for the following FeliCa non secure commands are described in this section SCLO1X does not support FeliCa secure commands e REQC e Request Service e Request Response e Read e Write 6 6 4 1 REQC Description This command is used to detect the presence of a NFC Forum tag type 3 in the field Format CLA IN S P1 P2 P3 OxFF 40 0x00 0x00 0x04 2 bytes of system code
38. ansport protocol data to the raw data The entire data from the card including the crc bytes if any will be returned to the application Polling must be stopped before starting a secure session eg DES authentication and started after completing the secure session Data 5 OxEF 0 00 Raw data of data Response Output buffer PICC response data Example This command can be used to send commands to a MIFARE Ultralight C The command for generating an 8 byte random number on MIFARE Ultralight C is 0x1A 0x00 Sending the APDU OxFF OxEF 0x00 0x00 0x02 0x1A 0x00 will return OxAF followed by 8 byte SCL01X REFERENCE MANUAL 58 random number and the crc bytes 1 Please note that when ever we initiate a authentication process from the application e g AES we have to disable polling and enable at the end of session SCL01X REFERENCE MANUAL 59 Special notes on Mifare Plus cards support When a Mifare plus card is in SO mode in order to customize the card the following steps needs to be done 1 First it has to be moved to part 4 mode using the command given under User command to manually switch card to Part 4 section Then we need to stop the polling of the card using the escape IOCTL READER DISABLE ENABLE POLLING Please note that when ever we initiate a authentication process from the application e g AES we have to disable polling and enable at the end of sessio
39. artcard Commander BEX File Edit Settings Help Hardware System SCLO10 Contactless Reader im Electronic Passport WIR ATS 3B 89 80 01 80 67 04 12 03 02 01 00 49 ATS 3B 88 80 01 00 00 00 00 73 81 93 00 68 Byte Value hex Meaning Byte Value hex Meaning TS 3B direct TS 3B direct 89 9 historical characters TO 88 8 historical characters 80 protocol 0 TDi 80 protocol TD2 01 protocol 1 TD2 01 protocol 1 Historical Hex 00 00 00 00 73 81 93 00 Historical ASCII 9eeesp e 95 68 Checksum SCLO01X REFERENCE MANUAL 30 5 4 Firmware 5 4 1 CCID Compliance The reader firmware is made CCID compliant from firmware Ver 1 11 and above hence it can be used with Microsoft CCID driver or Linux MAC open source CCID driver Windows CCID driver can be got through Windows update and open source CCID driver can be downloaded from the following location https alioth debian org frs group id 30105 In order to make the Linux open source CCID driver load for our device we have to add the VID PID of the device to the info plist file of the driver package Escape IOCTL s can be sent as it is with open source CCID driver under Linux MAC 5 4 1 1 CCID Error Codes Extensive error codes are reported on many conditions during all CCID responses Most of the error messages are reported by the CCID appropriately Some of the main error codes are HW ERROR e XFR PARITY ERROR The f
40. ce firmware upgrade DFU A tool for testing the installation of the PC SC driver A tool for testing the resource manager A tool called PC SC Diag capable of providing basic information about the reader and a card through PC SC stack The DFU utility comes with a specific driver for dynamic Device Firmware Upgrade DFU through the USB interface Operating systems supported by DFU tool Windows 2000 Windows 2003 Server 32 amp 64 bit oY e Windows XP 32 amp 64 bit Windows Vista 32 amp 64 bit Windows Server 2008 32 amp 64 bit 5 3 Driver 5 3 1 SCL01X listing SCL01X is listed by PC SC applications as SCM Microsystems Inc SCL01X Contactless Reader 5 3 2 Supported operating systems Operating systems supported by the driver e Windows 2000 e Windows 2003 Server 32 amp 64 bit e Windows XP 32 amp 64 bit 65 Windows Vista 32 amp 64 bit e Windows Server 2008 32 amp 64 bit Windows 7 32 bits Windows 7 64 bits SCL01X REFERENCE MANUAL e Mac OS 10 4 11 Mac OS 10 5 6 Mac OS 10 6 4 e Debian 5 0 Kernel version 2 6 26 32 bit Debian 5 0 Kernel version 2 6 26 64 bit Ubuntu 10 04 Kernel version 2 6 29 32 bit Ubuntu 10 04 Kernel version 2 6 29 64 bit Open Suse 11 2 Kernel version 2 6 27 32 bit Open Suse 11 2 Kernel version 2 6 27 64 bit Fedora 13 Kernel version 2 6 33 32 bit Fedora 13 Kernel version 2 6 3
41. draws power from USB bus DC Voltage 5V characteristics Max Current 300 Suspend current 230 Clock of the 24 device controller d Ew 13 56 MHz 50ppm requency Modulation 12 to 14 USB specification USB 2 0 FS Devise USB Speed Full Speed Device 12Mbit s Device Class Vendor 0x5291 5 1010 PID 0x5293 5 01 VID 0 04 PC SC 2 0 101 format tokens supported forum tag type 1 through SCM specific APDU forum tag type 2 through PC SC defined APDUs forum tag type 3 through SCM specific APDU forum tag type 4 through PC SC APDUs ISO IEC 14443 4 PICC type A and type B MIFARE Non Secure FeliCa Type B memory card PICC through SCM proprietary APDU Maximum baud rate 848 Kbps Multiple PICC in field Not supported Operating temperature range 0 to 50 C Operating humidity range Up to 95 RH non condensing Certifications USB CE FCC VCCI WEEE RoHS WHQL Radio Frequency for Japan 3 The LED indicates SCLO1X detects a user token in its field but it doesn t guaranty that communication can actually happen 22 SCLO01X REFERENCE MANUAL 23 5 Software modules 5 1 Installation SCM provides an installer for Windows and for MAC The installer can be used to install the driver as well as some utilities 5 2 Utilities The following utilities are available Atoolfor devi
42. e field of the reader load of the field increases which implies that less energy is available for each of them and that the system is detuned For this reason SCM Microsystems has implemented in its driver only 1 slot This means that in the event several user tokens are in the field of the SCLO1X only one will be active It is recommended to present only one user credential at a time in front of oS SCLO1X The communication between the reader and the user token is sensitive to the geometry of the system reader user token Parameters like the geometry and specially the relative size of the reader and user token antennas directly influence the inductive coupling and therefore the communication SCLO1X was primarily designed and optimized to function with user credentials of various technologies having the size of a credit card It may happen that SCLO1X is not capable of communicating with extremely large or extremely small antennas In order to optimize the coupling between the reader and the user token it is recommended to put both antennas as parallel as possible In order to optimize transaction speed between the reader and the card it is recommended to place the user token as close as possible to the reader This will increase the amount of energy supplied to the user credential which will then be able to use its microprocessor at higher speeds 8 S1 18 SCLO01X REFERENCE MANUAL 19 3 6 Applications 3 6 1 General S
43. eader ReaderName 0 ret SCardGetStatusChange ContextHandle MINTIMEOUT Reader 1 printf nATR for i20 i Reader cbAtr i printf 2 Reader rgbAtr i set actual PUPI status OFF printf ndisable PUPI InBufLen 2 InWord CCID_SET_PUPI_OFF ret SCardControl CardHandle IOCTL CCID ESCAPE amp InWord InBufLen amp OutByte 1 amp ResLen ret SCardDisconnect CardHandle SCARD RESET CARD ret SCardConnect ContextHandle ReaderName 0 SCARD SHARE SHARED SCARD PROTOCOL TO SCARD PROTOCOL 1 amp CardHandle amp ActiveProtocol get actual PUPI status ON OFF InBufLen 2 InWord CCID GET PUPI STATUS ret SCardControl CardHandle IOCTL CCID ESCAPE amp InWord InBufLen amp OutByte 1 amp ResLen printf Get PUPI status 1 2x ret OutByte Reader 0 dwCurrentState SCARD STATE UNAWARE Reader 0 dwEventState SCARD STATE UNAWARE SCL01X REFERENCE MANUAL 79 Reader 0 szReader ReaderName 0 ret SCardGetStatusChange ContextHandle MINTIMEOUT Reader 1 printf NnATR y for i20 i Reader cbAtr 1 printf 2x Reader rgbAtr i DEIDUE eee LA CU a ee LA UU ADU D US E in ret SCardDisconnect CardHandle SCARD RESET CARD else printf Nn SCardConnect failed with 0x 81X ret ret SCardReleaseContext ContextHandle else printf Nn
44. ens For a description of DESFire commands please contact NXP Semiconductors 6 6 1 1 Format Data CLA INS P1 P2 P3 Response Data Out DESFire response data SW1 SW2 6 6 2 Commands for communicating with NFC Forum Tags Type 1 Commands for Static and Dynamic Memory Models e Read Identification RID e Read All Blocks 0 Eh RALL e Read Byte READ e Write Erase Byte WRITE E e Write No Erase Byte WRITE NE Commands for Dynamic Memory Model SCL01X REFERENCE MANUAL 46 e Read Segment RSEG e Read 8 Bytes READ8 e Write Erase 8 Bytes WRITE E8 e Write No Erase 8 Bytes WRITE NE8 6 6 2 1 Read Identification RID Description This command is used to retrieve the tag s identification Format CLA INS P1 P2 P3 Data Response Data SW1 SW2 HRO UIDO UID1 UID2 UID3 0x90 0x00 Where and HR1 are the 2 bytes Header ROM which identify the tag through UID3 are the first 3 bytes of the tag s UID Topaz tags have a 7 bytes long UID which can be fully fetched using the Get UID APDU described earlier in this manual SCLO01X REFERENCE MANUAL 47 6 6 2 2 Read All Blocks RALL Description The RALL command reads out the two header ROM bytes and the whole of the static memory blocks 0x0 0xE Format CLA INS P1 P2 P3 Data ae co e n Response Data SW1 SW2 HR0 HR1 120 bytes Blocks 0 E 0x90 0x00 Example
45. er execution 0x90 0x00 SCLO01X REFERENCE MANUAL 51 Example For an NFC forum tag type 1 which has the following memory dump HE SCM Smartcard Commander Woe Card type Topaz card Memory size 120 Bytes Memory Model Static Unique ID 07 83 3C 00 00 02 25 Block Hex 8783 3COO 0002 2500 1 110 0 00 0326 D102 2 2153 7091 0108 5501 3 7465 7374 2E64 6511 4 010A 5405 656E 2055 5 5354 6573 7451 0301 6 6163 7400 0000 7 0000 0002 0000 0000 8 0000 0000 0000 0000 9 0000 0000 0000 0000 10 0000 0000 0000 0000 11 0000 0000 0000 0000 12 0000 0000 0000 0000 1 95555 AAAA 0000 0000 14 0160 0000 0000 0000 VID Bytes OTP Bytes Internal Bytes Data Bytes Lock Bits Read Only Bytes The following sequence does e AREAD of the byte 0x03 in block 0x07 A WRITE NO ERASE of the byte 0x03 in the block 0x07 with value 0x09 e AREAD of the byte 0x03 in block 0x07 One can notice that the value of the byte after the WRITE NO ERASE is not 0x09 but 0x0B because the memory value before the operation was 0x02 The memory result of a WRITE NO ERASE command is the logical OR of the value before the operation and the value written description Value binary Memory value before 0000001 0 b Value written 00001001 b ATR length 7 NS 3B 82 80 01 02 44 45 APDU 54 00 00 5412 9000 OK DataOut 02 1 byte s FF 58 00 01 09 5 12 9000
46. essor to function To send data to the user token the reader modulates the amplitude of the field There are several amplitude modulation and data encoding rules defined in ISO IEC 14443 and ISO IEC 18092 The reader should refer to those standards for further details To answer to the reader the integrated circuit card of the user token modulates its way of loading impedance the field generated by the reader Here also further details can be found in ISO IEC 14443 and ISO IEC 18092 1 In the ISO IEC 14443 standard the reader is called the proximity coupling device PCD In the ISO IEC 14443 standard the user token is called proximity integrated chip card PICC SCL01X REFERENCE MANUAL 3 5 3 Recommendations The communication between the reader and the user token is sensitive to the presence of material or objects interfering with the magnetic field generated by the reader The presence of conductive materials like metal in the vicinity of the reader and the user token can severally degrade the communication and even make it impossible The magnetic field of the reader generates Eddy or Foucaults currents in the conductive materials the field is literally absorbed by that kind of material It is recommended for proper communication to avoid putting SCLO1X in close c proximity of conductive materials The presence of multiple user tokens in the field also interferes with the communication When several user tokens are in th
47. f the document contains source code examples they are provided for illustrative purposes only and subject to the following restrictions You MAY at your own risk use or modify the source code provided in the document in applications you may develop You MAY distribute those applications ONLY in form of compiled applications SCL01X REFERENCE MANUAL 10 You MAY copy or distribute parts of or the entire source code without prior written consent from SCM Microsystems You MAY NOT combine or distribute the source code provided with Open Source Software or with software developed using Open Source Software in a manner that subjects the source code or any portion thereof to any license obligations of such Open Source Software If the document contains technical drawings related to SCM Microsystems products they are provided for documentation purposes only SCM Microsystems does not grant you any license to its designs 1 4 Trademarks MIFARE is a registered trademark of NXP Semiconductors BV FeliCa is a registered trademark of Sony Corporation Jewel and Topaz are trademarks of Innovision Research and Technology Plc Windows is a trademark of Microsoft Corporation SCLO01X REFERENCE MANUAL 11 2 Introduction to the manual 2 1 Objective of the manual This manual provides an overview of the hardware and software features of the SCLO1X contactless reader hereafter referred to as SCLO1X This manual describes
48. ion Is CRC specified No of bits per command Command length Command The output buffer contains the response to the command The following example uses the raw mode to send a REQB command First we have to switch the SCL01X into raw mode for type B communication Byte Value Description B will be used Then we can send the following bytes to obtain the ATQB response of any type B user token in the field Byte Value Description BO READER CNTLESS RAW XMIT code 0x05 FWI FWlissetto5 000 set to 5 Enable Lun EEE will be calculated by the RF front end of SCL01X B Number of bits to be sent in the command Command length in bytes command s anticollision prefix byte r REQB command s application family identifier REQB command parameter with slot number setas 1 ATR length 13 88 80 01 00 00 00 00 73 81 93 00 68 APDU FF CC 00 00 02 97 01 5 12 9000 OK 00 00 08 98 05 01 00 03 05 00 01 Sw12 9000 OK DataOut 50 51 63 FF FF 00 00 00 00 73 81 93 12 byte s SCL01X REFERENCE MANUAL 66 6 7 12 READER CNTLESS DISABLE PPS By default 5 01 does automatic PPS i e it switches the RF communication speed to the highest possible supported by the card This escape command can be used to switch ON OFF automatic PPS When automatic PPS is OFF then 106Kbps only is available The input buffer i
49. is command can be used to send raw data to the user token 6 4 2 1 Format Data CLA INS P1 P2 P3 6 4 2 20 Response Data Out PICC response data SW1 SW2 6 4 2 3 Status Words Description User should refer to the status words defined by the PICC manufacturer for a description of the status words 6 4 2 4 Example Let s consider the Select command defined in 1507816 4 This command being ISO can be sent to the user token in 2 different ways Using the T CL command Using the T CL user command Here are the 2 answers for the select command ATR length 1 ATR 3B 89 80 01 4D 54 43 4F 53 73 01 01 01 3C APDU 00 A4 00 00 Sw12 9000 OK APDU FF FE 00 00 04 00 A4 00 00 SW12 9000 OK The T CL command is nevertheless more useful for sending commands which are not defined in ISO7816 SCL01X REFERENCE MANUAL 45 6 5 Switch card to Part 4 This user command is mainly targeted at Mifare plus SO cards Mifare plus card at SO level gets detected as Mifare memory card In order to personalize these cards first it needs to be switched to Part 4 mode For this purpose this user command needs to be issued using ScardTransmit function Command sample and response is given below Format CLA 5 P1 P2 P3 Response Output buffer 0x90 0x00 6 6 Set of APDU defined by SCM Microsystems 6 6 1 MIFARE DESFire Commands Description This command can be used to send commands to DESFire based user tok
50. ld 6 3 1 3 Response Data Out Data SW1 SW2 6 3 1 4 Status words 2 Description 0x00 La RR ERROR 0x81 Loci o part of the returned data may be corrupted 0x82 WARNING end of file reached before Le bytes where read Length incorrect 0x00 CLA byte incorrect 0x81 Command not supported 0x86 Command not allowed Ox6A Function not supported File not found addressed blocks or bytes do not exist 0 6 0 00 Wrong P1 P2 parameters Wrong Le OxXX is the correct value Security status not satisfied SCLO01X REFERENCE MANUAL 36 6 3 1 5 Example For a MIFARE Classic 1K card which has the following memory content Mifare Standard Card type Mifare Standard Memory size 1024 Bytes Uniaue ID BE 6D D6 Block Block Block Dlock KeyA KeyA KeyB Keyp AC AC Sector ASCII Read Write Inc Dec Read Write Read Write Read Write 0400 4649 0652 4540 1000 AID NEV O3EL O3E1 03 1 O3E1 O3EL O3El AB NEV NEV 03 1 O31 0951 O3E1 1 03 1 O9E1 1 AIB B NEV AOAL A2A3 AJAS 7877 BBCI NEV B AIB 1 032D D102 2853 7091 O10B 5402 656 4 46 4320 4465 6D6F 5101 1555 0373 626 6D69 AIB 6372 6 2 636 6D2F 7363 6 33 3731 AJB DIE D3F7 DIF 7 07 8840 929 999 2777 NEV B NEV B B 2 0000 0000 0000 0000 0000 0000 0000 0000 0000 00
51. le tags It is an easy to use tool to configure rapidly forum tag demonstrations e Smart card commander version 1 1 provides forum record parsing functionality of NDEF records in XML format as well as scripting functionality which can be very useful for developers to develop and debug their applications SCLO01X REFERENCE MANUAL 20 4 SCLO01X characteristics 4 1 SCLO1X high level architecture 4 1 1 Block diagram The link between and the host to which it is connected is the USB interface providing both the power and the communication channel Device controller filter To host STC3ASIC SCM with Are Matching circuitry embedded flash power amplifier LED Antenna SCLO1X has a device controller which is SCM s STC3 ASIC This ASIC has several interfaces available In SCLO1X implementation 2 peripherals are connected to the device controller e Status indicator LED front end that handles the RF communication The ASIC embeds flash memory that is programmed during the manufacturing of SCLO1X devices This flash contains the firmware developed by SCM Microsystems to handle all the RF communication protocols and the PC SC communication protocol with the host The flash can be upgraded once the device is deployed on the field hence enabling firmware upgrades to add and potentially patch features The
52. logo SCM logo SCLO10 BARCODE 128 X 2116Y Y WWM N INN ININ S N22116Y YWWMNNNNN P N 905073 Default label SCLO10 example 2 This mua acoapt aset adi fal ray caste codes operat Made Singapore by SCM Micreeysterss Weight 32 Grams External Cradle dimensions L 83mm x W 80mm x H 40 mm Default color Cool gra Weight 7 Grams External dimensions L 72mm x W 65mm x H 11 6 mm Default color Translucent black Drawing with dimensions of the SCL01X and accessories can be found in annex Snap on card holder 4 2 2 LED behavior The LED behavior of the SCLO1X is given below Ie 01 states LED Indication GREEN After plug in Driver is not installed or driver is installed but either some files related to SCLO1X or OS resource manager is deleted missing where there is a situation the reader cannot work Just after plug in with drivers already installed ON Firmware upgrade running ON Just after DFU operation ON Suspend hibernate state OFF OFF SCL01X REFERENCE MANUAL Reader powered PICC present in the RF field 500ms ON 500ms OFF PICC token powered communication 500ms ON 500ms OFF PICC present but powered down 500ms ON 500ms OFF Reader card errors 100ms ON 100ms OFF repeats for 5s 4 2 3 Other data Parameter Value Description High bus powered 01
53. n Then we have to use T CL user command given under section 6 3 2 to initiate and complete the authentication process This user command can be used to send all proprietary commands defined in the card specification At the end of communication with the card we need to start the polling again using READER DISABLE ENABLE POLLING IOCTL This is very important else card tracking will not work SCL01X REFERENCE MANUAL 60 6 7 Escape commands 6 7 1 Sending escape commands to SCL01X A developer can use 2 methods to send escape commands to SCLO1X e SCardControl method defined in PC SC SCardTransmit method defined in PC SC API in conjunction with the escape command APDU defined earlier in this manual 6 7 2 Escape command codes Escape commands can be used by an application to configure SCLO1X to function in a mode that is not its default configured mode or to get specific information To put the SCLO1X back into its default mode either the SCLO1X has to be unplugged and plugged again or the application can send again the same escape command The following escape commands are supported by SCLO1X Escape command Code READER GETCARDINFO 0x11 READER LEDCONTROL 0x19 READER CNTLESS GET ATS ATQB 0x93 READER CNTLESS GET TYPE 0x94 READER CNTLESS SET TYPE 0x95 READER CNTLESS RF SWITCH 0x96 READER CNTLESS RAW CFG 0x97 READER CNTLESS RAW XMIT 0x98 READER DISABLE PPS 0x99 READER CNTLESS 848KBPS 0 9 READER CN
54. n 2 InWord CCID GET PUPI STATUS ret SCardControl CardHandle IOCTL CCID ESCAPE amp InWord InBufLen amp OutByte 1 amp ResLen printf Get PUPI status 1 2x ret OutByte Reader 0 dwCurrentState SCARD STATE UNAWARE Reader 0 dwEventState SCARD STATE UNAWARE Reader 0 szReader ReaderName 0 SCLO01X REFERENCE MANUAL 77 ret 1 printf nATR for 1 0 i Reader cbAtr 5 printf set actual PUPI status printf nenable PUPI InBufLen 25 InWord CCID SET PUPI ON ret SCardControl CardHa SCardGetStatusChange ContextHandle MINTIMEOUT Reader i 2x Reader gt rgbAtr i ON ndle IOCTL_CCID_ESCAPE amp InWord InBufLen amp OutByte 1 amp ResLen ret SCardDisconnect Card ret SCardConnect Contex Handle SCARD RESET CARD tHandle ReaderName 0 SCA SCA RD_SHARE_SHARED RD PROTOCOL SCARD_PROTOCOL_T1 amp CardHandle amp AC get actual PUPI status InBufLen 25 InWord tiveProtocol ON OFF CCID GET PUPI STATUS ret SCardControl CardHandle IOCTL CCID ESCAPE amp InWord InBufLen amp OutByte 1 amp ResLen SCLO01X REFERENCE MANUAL 78 oe printf Get PUPI status 1 2x ret OutByte Reader 0 dwCurrentState SCARD STATE UNAWARE Reader 0 dwEventState SCARD STATE UNAWARE Reader 0 szR
55. nd code LED number LED ON LED OFF The output buffer is Output buffer NULL 6 7 6 READER CNTLESS GET ATS This escape command enables the host to retrieve the ATS for Type A T2 CL or the ATQB for Type B cards The input buffer contains the escape command code Input buffer 0x93 The output buffer contains the ATS bytes or the ATQB bytes depending on the type of PICC placed on the reader 6 7 7 READER CNTLESS GET TYPE This escape command retrieves the type of the card which SCLO1X is configured to poll for The input buffer shall contain the escape command code Input buffer The output buffer shall point to a BYTE buffer which will contain the type value coded as Value Description Type A type SCL01X REFERENCE MANUAL 63 6 7 8 READER CNTLESS SET TYPE This escape command configures the type of cards SCL01X will poll for Using this command can improve the polling efficiency of SCLO1X for applications where only type A or only type B cards are expected The default is Type A type B FeliCa 0x1B The input buffer shall contain 2 bytes Description The output buffer is Output buffer NULL SCL01X REFERENCE MANUAL 64 6 7 9 READER CNTLESS RF SWITCH This escape command can be used to retrieve set the RF state of SCLO1X The default RF field state is ON The input buffer shall contain 2 bytes
56. ock 2 authenticates against sector 1 reads block 5 ATR 20 ATR 3B 80 01 80 4F 0 00 00 03 06 03 00 01 00 00 00 00 6A FF 82 00 60 06 40 41 A2 44 5 54 12 9000 APDU FF 86 00 00 05 01 00 02 60 00 5 12 9000 APDU FF BO 00 02 10 54 12 9000 OK DataOut 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 16 byte s APDU FF 82 00 60 06 D3 F7 D3 7 03 F7 54 12 9000 OK APDU FF 86 00 00 05 01 00 05 60 00 54 12 9000 OK APDU 00 05 10 54 12 9000 OK DataOut 43 20 44 65 6D 6F 51 01 15 55 03 73 63 6D 6D 69 16 byte s SCL01X REFERENCE MANUAL 42 6 3 5 STORAGE CARD CMDS VALUE BLOCK 6 3 5 1 Description This APDU is used to interact with MIFARE Classic e purse applications Please refer to MIFARE Classic documentation available from NXP Semiconductors for further details on MIFARE classic memory mapping and commands 6 3 5 2 Format CLA 5 P1 oro Bee Where P2 code the address of the block number addressed Where the data field is structured as follow Byte Value Description Increment Decrement B E Block number B2 B5 Value LSB first 6 3 5 8 Response Data Out SW1 SW2 6 3 24 Status Words Description 6 3 5 5 Example CLA INS P1 P2 Lc Data in Will increment block number 0x1E MIFARE Classic based user token by a value of 0x01 SCL01X REFERENCE MANUAL 43 6
57. ollowing sub sections discuss when and why these error codes are returned 5 4 1 1 1 HW ERROR This error code is returned when a hardware short circuit condition is detected during application of power to the card or if any other internal hardware error is detected This error code has been defined in the error code table 6 2 2 of the CCID specification 5 4 1 1 2 XFR PARITY ERROR This error code is returned when a parity error condition is detected This error will be reported in the response to a PC to RDR XfrBlock message This error code has been defined in the error code table 6 2 2 of the CCID specification 5 4 2 Automatic PPS Automatic PPS is implemented in SCLO1X s firmware This means that by default SCLO1X switches to the maximum communication speed indicated by the card during its selection Automatic PPS can be disabled using escape messages as explained later in this manual When Auto PPS is disabled discussed in escape messages section the reader works at the default baud rate of 106kbps In PC SC 2 0 compliant driver an escape command has been introduced to force baud rate The maximum speed supported by SCLO1X is 848Kbps by default with 254 bytes frame size Using escape messages as explained later in this manual it is possible to change this SCL01X REFERENCE MANUAL 31 6 Commands description 6 1 Generic APDU 6 1 1 Get UID Command 6 1 1 1 Description GET UID will retrieve the UID or SNR or PUPI
58. or Should you notice problems with the provided documentation please provide your feedback to support scmmicro com 1 2 FCC 1 2 1 Section 15 21 Information to user Changes or modifications not expressly approved by the party responsible for compliance could void the user s authority to operate the equipment 1 2 2 Section 15 Subpart C Section 15 225 Note This equipment has been tested and found to comply with the limits for a Class C digital device pursuant to part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference in a residential installation This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular installation If this equipment does cause harmful interference to radio or television reception which can be determined by turning the equipment off and on the user is encouraged to try to correct the interference by one or more of the following measures Reorient or relocate the receiving antenna Increase the separation between the equipment and receiver Connect the equipment into an outlet on a circuit different from that to which the receiver is connected Consult the dealer or an experienced radio TV technician for help 1 3 Licenses I
59. ory using this command 6 3 3 2 Format CLA 5 P1 P2 Lc Data in Where P2 can have the following values please refer to MIFARE documentation from NXP for further details on what is key A and Key B 0x60to use the Key A 0x61 to use the Key B 6 3 3 3 Response Data Out SW1 SW2 6 3 3 4 Status Words Description SW1 SW2 ET 0x69 Reader key not supported Secured transmission not supported Non volatile memory not available Key number not valid Key length not correct SCL01X REFERENCE MANUAL 40 6 3 4 STORAGE CARD CMDS AUTHENTICATE 6 3 4 4 Description This command enables to perform authentication for user tokens based on MIFARE Classic 1K or 4K Before this command can be successfully executed the STORAGE_CARD_CMDS_LOAD_KEY command must have been executed 6 3 4 2 Format CLA 5 P1 Where the data field is structured as follow Byte Value Description o QR D 5 ET B3 Key A Information about memory structure of MIFARE Classic must be requested from Semiconductors 6 3 4 3 Response Data Out SW1 SW2 6 3 4 4 Status Words SW1 SW2 Description WARNING no further info 0x69 Security status not satisfied Referenced key not usable Key type not known SCLO01X REFERENCE MANUAL 41 6 3 4 5 Example For a MIFARE Classic 1K card which has the following memo
60. r an Forum tag type 1 user token Topaz Byte Value Designation Description TO TD1 present 2 historical bytes in following ATR 2 0x80 TD1 Nibble 8 indicates no TA2 TB2 TC2 and TD2 present Nibble 0 means 0 3 0x01 TD2 Nibble 0 indicates no TB3 Nibble 1 means 1 Card Mode NFC TAG operating at Passive 106 baud rate e ox TCK XOR of all previous bytes Example of the ATR built for a Topaz tag 88 SCM Smartcard Commander BAX File Edit Settings Help Hardware System SCLO10 Contactless Reader Topaz BE NFC ATS 3B 82 80 01 02 44 45 Byte value hex Meaning TS 3B direct TO 82 2 historical characters 80 protocol TD2 01 protocol 1 Historical Hex 0244 Historical ASCII D 95 45 Checksum SCL01X REFERENCE MANUAL 28 5 3 4 4 ATR for a NFC Forum tag type 3 user token FeliCa Byte Value Designation Description 0 TD1 present 12 historical bytes in following ATR 2 0x80 T Nibble8 indicates no TA2 TB2 TC2 and TD2 present mor m ee pales 3 0x01 T Nibble 1 means 1 rate Nibble8 indicates no TA3 TB3 TC3 e op IF Maximum frame size of felica card DE Felica card Identifier 8 bytes Write Timeout indicated by card XOR of all previous bytes Example of the ATR built for a FeliCa user token D1 D2 S K 19 SCM Smartcard Commander Joey File Edit Settings Help Hardware
61. ry mapping ESCM Smartcard Commander 29 Settings Help 5 010 Contactless Reader miare Standard CENE AMOR NFC Tag ATR CPU card k Mifare Standard Cardtype Mifare Standard Memory size 1024 Bytes Unique ID FA 92 6C D6 Block Block Block Block KeyA KeyB KeyB AC Sector Hex ASCII Read Write Inc Dec Read Write Read Write Read Write 92 6606 0288 0400 4649 8632 4530 0000 Soo AB NEV la OFOO 1 O3E1 1 O3E1 O3E1 O3E1 O3E1 NEV NEV 1 1 1 O3E1 1 1 O3E1 O3E1 8 4 68 4 8 4 6 44 B NEV NEV 0 1 A4A5 7877 88 1 9999 A 22222 NEV B NEV B B 1 0320 D102 2853 7091 O10B 5402 656E 4E46 M Sp T enNF 4320 4465 6D6F 5101 1555 0373 636D 6069 DemoO U scmmi AJB AJB 6372 6F2E 636F 6D2F 7363 6C33 3731 30FE cro com scl3710p AJB AJB D3E7 D3F7 D3F7 7F07 8840 9999 0 0 709999 NV B NEV B B 2 0000 0000 0000 0000 0000 0000 0000 O000 1111 1111 1111 1111 1111 1111 1111 1111 AIB 1 Data Bytes Internal Bytes Key General Purpose Bytes Read Only Bytes Reading sector 0 or sector 1 of this card requires authentication with key A or key B The following example authenticates with key A of sector 0 reads bl
62. s Byte Value Description Escape command code B1 Disable Auto PPS Enable Auto PPS The output buffer is Output buffer NULL 6 7 13 READER CNTLESS 848KBPS This escape command can be used to enable disable 848kbps support by SCLO1X as well as query whether 848kbps is currently enabled or disabled by SCLO1 X The RF communication with a user token will only switch to 848Kbps provided the user token supports this baudrate and provided automatic PPS is ON The input buffer shall contain 2 bytes Byte Value Description Escape command code Enable 848Kbps support Get current status on 848Kbps support Disable 848Kbps support If B1 of the input buffer is 0x00 or 1 then the output buffer is Output buffer NULL If B1 of the input buffer is OxFF the output buffer is a BYTE buffer with following possible values Output buffer Description 848Kbps is disabled 848Kbps is enabled SCL01X REFERENCE MANUAL 67 6 7 14 READER CNTLESS BAUDRATE This escape command can be used to get the actual operating baud rate of card reader communication The input buffer shall contain the escape message value Input buffer The output buffer shall point to a BYTE buffer with following possible values Output buffer Description 106Kbps in both directions 106Kbps from PICC to PCD 212Kbps from PCD to PICC 106Kbps from PICC to PCD 424Kbps from PCD to PICC 106Kbps from PICC to PCD 848Kbps from PC
63. t be used anymore 3 4 SCLO01X customization options Upon request SCM can customize The color of the casing The logo The product label USB strings Terms and conditions apply please contact your local SCM representative or send an email to sales scmmicro com SCLO01X REFERENCE MANUAL 17 3 5 Contactless communication principles and 5 01 usage recommendations SCLO1X is a contactless reader designed to communicate with user tokens User tokens are made of a contactless User tokens integrated circuit card connected to an ZS O antenna E N E NN User tokens can take several form factors R 11 e Credit card sized smart card e Key fob SCL010 mobile phone etc Communication between SCL01X and user tokens uses magnetic field inductive coupling The magnetic field is generated by SCLO1X has a carrier frequency of 13 56MHz 3 5 1 Power supply When the user token is put in the magnetic field of the reader its antenna couples with the reader and an induction current appears in the antenna thus providing power to the integrated circuit The generated current is proportional to the magnetic flux going through the antenna of the user token 3 5 2 Data exchange The carrier frequency of the magnetic field is used as a fundamental clock signal for the communication between the reader and the card It is also use as a fundamental clock input for the integrated circuit microproc
64. to be done after this escape command is sent to switch baudrate to the value set by the user If user tries to force a higher baudrate on a Type A card which does not support higher baudrates communication will occur at 106 kbps only If the same was tried on a type B card then card connect will fail To successfully connect to the card again the user has to connect at the baud rate specified by the card by sending the escape command OxADOO and then do a card connect SCL01X REFERENCE MANUAL 69 6 7 16 READER GETPNPPARAMS This escape command is used to retrieve the VID PID serial number and PNP string The input buffer contains the escape command code Input buffer The output buffer contents are described below Byte Description B19 Bx PNP String up to 127 bytes 6 7 17 READER_GETSLOTINFO This escape command is used to retrieve the slot information The input buffer contains the escape command code Input buffer The output buffer is Byte Value Description Only 1 slot supported on SCLO1X Slot number Contactless slot SCL01X REFERENCE MANUAL 6 7 18 READER GET CARD DETAILS This escape command is used to get details about the PICC placed on the reader The input buffer contains the escape command code Input buffer The output buffer is Value Description Type A card FeliCa 212 FeliCa 424 Memory card TCL card Dual interface card
65. uu Uu 62 6 7 1 Sending escape commands to 5 0 2 62 552 Escapecomnmmand 0066 oe eme eere rechercher e Ene nae re ERE 62 573 READER QGETOARDINFQO u UU I ri ir a 63 6 7 4 READER LED CONTROL BY 63 5 55 READER LEDCONTROL rra a dor i ra i ior 64 6 7 6 READER CNTLESS GET ATS 2 2 2 22 2 64 5 7 7 READER CNTLESS GET eren nori rr a ion 64 6 7 8 READER CNTLESS SET TYPE nri i i a n rr e e 65 6 7 9 READER CNTLESS SWITCH 4 rre rrr or a i 66 6 7 10 READER CNTLESS RAW CFG isse rrr nn i i a 66 67 11 READER GCNTLESS RAW 67 6 7 12 READER GNILESS DISABLE nene er rene re 68 67 13 READER CNTLESS 9 68 6 7 14 READER CNTLESS BAUDRBIATE 2 o ore e e ri 69 6 7 15 READER CNTLESS FORCE POSCO REV2 70 8 7 16 READER GETPNPPARPANS u ore reir re 71 8 7 17 BEADER GEISLOTIBEO crc er ert erar den ue ex ee vi n vuv rera crea os 71 6 718 READER GEI CARD DETAILS tr eer re ei 72 5 7 15 READER 15 SGLDIK uuu uu Lu 73 l nO o D m gt m JJ SEND ATTRIB WITH U tees 74 7 USER TRACEABILITY uu eee tn ates 74 6 7 22 READ
66. with NFC enabled devices As for all SCM Microsystems products SCLO1X is designed to offer best in class interoperability with various formats of tokens cards dongles watches or NFC mobile phones Its infield upgradeable firmware makes SCLO1X a secure and future proof investment providing both flexibility and fast time to market for new applications as well as minimum risk linked to contactless technology standards evolution As a latest generation product SCLO1X can be supported by SCM s middleware that resides above the PC SC API and offers better portability of applications and abstraction of smart card related details that need to be handled by applications developed on top of the PC SC API 3 2 SCLO01X key features Multi protocol 13 56MHz contactless reader o 18014443 type A amp B MIFARE o Topaz NFC Forum tag type 1 o NFC Peer to peer communication will be available through FW upgrade e PC SC v2 0 compliant e Infield upgradeable firmware Unique serial number which enables that SCLO1X can be plugged into any USB slot on a PC without having to re install the driver SCLO01X REFERENCE MANUAL 16 3 3 SCL01X ordering information Item number number 5 SCLO1X 905205 4 Snap on card holder 112302LF It is important to note that those accessories are incompatible with each other GR Jf i e when the snap on card holder is fitted on the SCLO1X the cradle canno

SCL01X - SCM Microsystems

Contents

Download Pdf Manuals

Related Search

Related Contents