What is the Proper Select sequence for ISO14443A with CR95HF?

[Mac Nickerson]

Posted on July 11, 2017 at 18:56

I am using an arduino using SPI to communicate with a CR95HF.

I can ready the device ID and can detect a Mifare classic card in the RF field.

The problem I have is that I'm unable to select the card and have it respond with the SAK and CRC. All I get is an 87 response from the CR95HF.

Below is the data exchange.

To CR95HF>>>

From CR95HF <<<

>>> 00 04 02 26 07 (Detect card)

<<< 80 05 04 00 28 00 00   (Card response - no collision bit set)

>>> 00 04 03 93 20 08   (start Collision loop to get UID for select)

<<< 80 08 5B 48 66 3F 4A 28 00 00 (card responds with full UID)

>>> 00 04 07 93 70 5B 48 66 3F 08 46 7B (SEL)

<<< 87 00 (timeout?)

What am I missing here?

[Peter Boringer]

Posted on July 12, 2017 at 12:03

Dear Mac,

IT seems that the Tag doesn't recognize the command and thus doesn't answer so a timeout at the CR95HF expired.

Please check your select command, for my understanding the tag on the Req A. command  answer its UID :  

5B 48 66 3F 4A

So the sel. command might include it. I suggest to try:

                                   00 04 08 93 70 5B 48 66 3F 4A 28

CR95 send receive    00 04

length of data to send         08

SEL command                         93 70

UID                                                    5B 48 66 3F 4A

Transmission flag                                                        28

 Hope it will help

Regards                                                                                                                                                            

[Mac Nickerson]

Posted on July 12, 2017 at 18:36

The 4A byte is the BCC of the data, so thats required.

thanks for the help.

here is the output of my test framework

>>> 00 04 02 26 07

<<< 80 05 04 00 28 00 00

readCard Response: 0x80

Data Length: 0x5

<<< 80 05 04 00 28 00 00

Recieved Card Data:

7 bytes- 80 05 04 00 28 00 00

ATQA: 0x4

Flags: 101000

Append CRC

Significant bytes: 8

Anticollision loop Start

>>> 00 04 03 93 20 08

<<< 80 08 5B 48 66 3F 4A 28 00 00

AntiCol Response: 0x80

Data Length: 0x08 (8)

Rcvd: 80 08 5B 48 66 3F 4A 28 00 00

No more collisions

Selecting UID: 5B 48 66 3F

>>> 00 04 08 93 70 5B 48 66 3F 4A 28

<<< 80 06 08 B6 DD 08 00 00

AntiCol-SEL Response: 0x80

Data Length: 0x6

SAK: 08

CRC: B6 DD

<<< 80 06 08 B6 DD 08 00 00

Anticollision loop End

AntiCol Data:

6 bytes- 80 06 08 B6 DD 08

[Mac Nickerson]

Posted on July 12, 2017 at 17:36

Thanks, however the UID is only 4 bytes, 5B 48 66 3F. so, I set the response to what you suggested without the 4A and I get the same results.

[Peter Boringer]

Hello Mac,

By starting collision loop you will get the UID in 4 bytes + the BCC so you will have to use all those bytes for the sel command but at the end you have to add the CRCA calculation.

Please try the below command:

00 04 0A 93 70 5B 48 66 3F 4A DD 13 08 (SEL) same command as

00 04 08 93 70 5B 48 66 3F 4A 28 but with CRC enabled

DD13 = CRC A calculation of the command 93 70 5B 48 66 3F 4A

This should work

Regards

PB