How to get the tamper status of ST25TV02KC RFID chip?

[Larry Martin]

I'm working with ST25TV02KC-TFG3 in a tamper inlay. ReadConfiguration FID=03h, PID=06h returns the same value with the tamper contacts open or shorted. How should I be interpreting these results? The commands are being sent from a Feig CPR74 via their Transparent command. Traces are captured on proxmark.

OPEN
10/08/22 15:42:12.816 >> 02 00 19 FF BF 02 00 00 02 1F 22 A0 02 E0 31 1B 0B 00 08 02 E0 03 06 13 7B 
10/08/22 15:42:12.841 << 02 00 0E 00 BF 00 00 30 30 63 4F 9D 71 73 OK
 Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
 0 | 125952 | Rdr |22 a0 02 e0 31 1b 0b 00 08 02 e0 03 06 14 ea | ok | INVENTORY_READ
 130144 | 158816 | Tag |00 30 30 63 4f 9d | ok |
 
SHORT
10/08/22 15:58:05.552 >> 02 00 19 FF BF 02 00 00 02 1F 22 A0 02 E0 31 1B 0B 00 08 02 E0 03 06 13 7B 
10/08/22 15:58:05.603 << 02 00 0E 00 BF 00 00 30 30 63 4F 9D 71 73 OK
 Start | End | Src | Data (! denotes parity error) | CRC | Annotation
------------+------------+-----+-------------------------------------------------------------------------+-----+--------------------
 0 | 125952 | Rdr |22 a0 02 e0 31 1b 0b 00 08 02 e0 03 06 14 ea | ok | INVENTORY_READ
 130144 | 158816 | Tag |00 30 30 63 4f 9d | ok |

[Thomas Q.]

Hello Larry,

The ReadConfig command you are using to access the TD_STATUS register is correct, and the value of TD_LOOP displayed corresponds to the factory setting for the SHORT case (63h).

Referring to page 25 of the product datasheet :

[...]

The shortage status TD_LOOP is captured by ST25TV02KC-T each time that the device is powered- up

If the ST25TV02KC-T boots while the tamper loop is closed, the value of TD_LOOP returned remains 63h while the device is powered-on:

- if the tamper loop is open and the device was still powered-on since the last boot, the TD_LOOP value remains 63h

- if the tamper loop is open, the ST25TV02KC-T needs to be rebooted to return the TD_LOOP value corresponding to the open status (factory setting 6Fh)

Was the ST25TV02KC-T reset between the two ReadConfig requests of your log ?

Best regards,

Thomas

[Larry Martin]

Thomas, thank you for helping to sort that out for me. I missed the factory settings of 63h and 6Fh on page 24. A fresh inlay shows 30306Fh for TD_Status(03h,06h). So that's the SEAL event with the OPEN message. I think I can figure it out from here.