emsec / ChameleonMini

The ChameleonMini is a versatile contactless smartcard emulator compliant to NFC. The ChameleonMini was developed by https://kasper-oswald.de. The device is available at https://shop.kasper.it. For further information see the Getting Started Page https://rawgit.com/emsec/ChameleonMini/master/Doc/Doxygen/html/_page__getting_started.html or the Wiki tab above.
Other
1.72k stars 391 forks source link

Problems with external USB readers running ``CONFIG=MF_DESFIRE`` #321

Open maxieds opened 2 years ago

maxieds commented 2 years ago

Hello. I am continuing this from the discussion started in #313.

I am having issues getting an external USB ACR-122 reader to recognize the Chameleon running CONFIG=MF_DESFIRE built with either make desfire or make desfire-dev (used in screenshots below). I am building the source from this new branch of my fork -- binaries here: desfire-latest.zip. The Chameleon and the reader get through anticollision with RATS and then diverge in response to the 0xC0 command sent by the Chameleon back to the ACR reader:

The problem seems to be in the response which is handled here. Can anyone point out what needs to happen to get this working?

Update: I forgot to mention that I have PCSC running on Linux with pcscd -v -d -a. I am scanning the Chameleon with the reader while running this on the Linux box the reader is connected to: pcsc_spy -v.

maxieds commented 2 years ago

The latest pull request #322 merged yesterday still has the same problems with the Omnikey and ACR-122 readers. For reference, binary builds of the DESFire-dev firmware I used to log the transactions on my phone are here: desfire-latest.zip. Working on getting screenshots to document the problem with the latest debugging messages over to my desktop soon.

maxieds commented 2 years ago

Great news! I have had success getting the Chameleon DESFire tag recognized with the recent changes in this development branch of my fork (pull request to be filed very soon):

$ sudo pcsc_scan -v
Using reader plug'n play mechanism
Scanning present readers...
Waiting for the first reader...found one
Scanning present readers...
0: ACS ACR122U PICC Interface 00 00

Mon Jul 25 19:26:28 2022
 Reader 0: ACS ACR122U PICC Interface 00 00
  Event number: 3
  Card state: Card removed, 

Mon Jul 25 19:26:37 2022
 Reader 0: ACS ACR122U PICC Interface 00 00
  Event number: 4
  Card state: Card inserted, 
  ATR: 3B 81 80 01 80 80

ATR: 3B 81 80 01 80 80
+ TS = 3B --> Direct Convention
+ T0 = 81, Y(1): 1000, K: 1 (historical bytes)
  TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0 
-----
  TD(2) = 01 --> Y(i+1) = 0000, Protocol T = 1 
-----
+ Historical bytes: 80
  Category indicator byte: 80 (compact TLV data object)
+ TCK = 80 (correct checksum)

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B 81 80 01 80 80
    RFID - ISO 14443 Type A - NXP DESFire or DESFire EV1 or EV2
    "Reiner LoginCard" (or "OWOK", how they name it) - they have been distributed by a german computer magazine ("Computer BILD")
    https://cardlogin.reiner-sct.com/
    Belgium A-kaart (Antwerp citycard)
    Oyster card - Transport for London (second-gen "D")
    https://en.wikipedia.org/wiki/Oyster_card
    Kaba Legic Advant 4k
    Sydney Opal card public transport ticket (Transport)
    https://www.opal.com.au
    TH Köln (University of Applied Sciences Cologne) - Student Identity Card
    https://www.th-koeln.de/en/academics/multica_5893.php
    German red cross blood donation service
    http://www.blutspende-nordost.de/
    Greater Toronto/Hamilton/Ottawa PRESTO contactless fare card
    http://en.wikipedia.org/wiki/Presto_card
    Electic vehicle charging card of the EMSP EnBW Energie Baden-Württemberg AG, Tarif ADAC e-Charge, Germany

Mon Jul 25 19:26:37 2022
 Reader 0: ACS ACR122U PICC Interface 00 00
  Event number: 5
  Card state: Card removed, 

The HID Omnikey 5022CL reader still does not recognize the tag. The LibFreeFare mifare-desfire-info utility does not yet work either.

Updated firmware binaries: desfire-latest.zip

maxieds commented 2 years ago

There are a few changes to the source code in PR #323 since the last post. I am attaching the most recent build of the DESFire and DESFire development firmware binaries. This code should stay fixed for a while. No idea when the GitHub project auto builds will be available.

desfire-latest-build-2022-07-27.zip