且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何访问使用MIFARE应用程序目录结构的MIFARE Classic卡?

更新时间:2022-11-04 19:53:17

请参见

See NXP's application note on the MIFARE Application Directory. Typically, in order to read data from a MIFARE Classic card that makes use of the MAD, you would do something like the following:

  1. 使用密钥A A0 A1 A2 A3 A4 A5(公用MAD读取密钥)对扇区0(MAD扇区)进行身份验证.
  2. 读取块3.
  3. 基于通用字节(从块3读取的字节9),您可以确定
    • 如果卡使用MAD(位7 = 1),
    • 如果卡支持多种应用程序(位6 = 1),并且
    • MAD版本(位1-0).
  1. Authenticate to sector 0 (MAD sector) using key A A0 A1 A2 A3 A4 A5 (the public MAD read key).
  2. Read block 3.
  3. Based on the general purpose byte (byte 9 read from block 3), you can determine
    • if the card uses the MAD (bit 7 = 1),
    • if the card supports multiple applications (bit 6 = 1), and
    • the MAD version (bits 1-0).

读取块1和2,这些块具有以下格式(其中AIDx是分配给扇区号 x 的应用程序ID):

Read blocks 1 and 2, these blocks have the following format (where AIDx is the application ID assigned to sector number x):

        +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
   Byte |  0 |  1 |  2 |  3 |  4 |  5 |  6 |  7 |  8 |  9 | 10 | 11 | 12 | 13 | 14 | 15 |
        +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
Block 1 |CRC |INFO|  AID01  |  AID02  |  AID03  |  AID04  |  AID05  |  AID06  |  AID07  |
        +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
Block 2 |  AID08  |  AID09  |  AID10  |  AID11  |  AID12  |  AID13  |  AID14  |  AID15  |
        +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+

  • 验证CRC(块1,字节0).

  • Verify the CRC (block 1, byte 0).

    如果使用MAD版本2,则对扇区16进行身份验证并读取块0(64),1(65)和2(66),以获得扩展的AID列表.这些块的格式为:

    If MAD version 2 is used, authenticate to sector 16 and read blocks 0 (64), 1 (65), and 2 (66) in order to get the extended AID list. The format of these blocks is:

            +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
       Byte |  0 |  1 |  2 |  3 |  4 |  5 |  6 |  7 |  8 |  9 | 10 | 11 | 12 | 13 | 14 | 15 |
            +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
    Block 0 |CRC |INFO|  AID17  |  AID18  |  AID19  |  AID20  |  AID21  |  AID22  |  AID23  |
            +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
    Block 1 |  AID24  |  AID25  |  AID26  |  AID27  |  AID28  |  AID29  |  AID30  |  AID31  |
            +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
    Block 2 |  AID32  |  AID33  |  AID34  |  AID35  |  AID36  |  AID37  |  AID38  |  AID39  |
            +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
    

  • 对应用程序的扇区进行身份验证(通过AID列表发现)并读取/写入应用程序的数据.

  • Authenticate to the sectors of your application (as discovered through the AID list) and read/write the data of your application.