CODEWITHSUNDEEP
nfcrfidmifareapducontactless-smartcard
Vanja Keglevic
Vanja Keglevic

Reputation: 83

Mifare 1k value block operations

I have a problem with a Mifare Standard 1k card. I made a value block (00000001FFFFFFFE0000000100FF00FF - valid?) on the data block with address 62. The value of the value block is supposed to be 1, and address of the value block is 0.

I've changed the access bits for the data block 2 to be:

The other 2 data blocks have factory access bits. Access bits for the sector trailer are also changed and are:

So, access bits for the corresponding sector (16th sector) are 3B478C69 (valid?).

The problem is that I can't do any of the value block specific functions on that block (increment, decrement, etc), I always get 6A81 as response -> "Card is blocked or command not supported". The APDU I'm using is FFF5C13E0400000001.

Upvotes: 1

Views: 8050

Answers (1)

Michael Roland
Michael Roland

Reputation: 40821

OMNIKEY readers have extensions to the PC/SC API for contactless memory cards. The commands defined by these extensions for increment and decrement of MIFARE Classic value blocks are:

Increment:

+------+------+------+------+------+-------------+
| CLA  | INS  | P1   | P2   | Lc   | DATA        |
+------+------+------+------+------+-------------+
| 0xFF | 0xD4 | BLOCK#      | 0x04 | XX 00 00 00 |
+------+------+------+------+------+-------------+

or (depending on the firmware version???) the same command with a 1-byte data field:

+------+------+------+------+------+----+
| 0xFF | 0xD4 | BLOCK#      | 0x01 | XX |
+------+------+------+------+------+----+

Decrement:

+------+------+------+------+------+-------------+
| CLA  | INS  | P1   | P2   | Lc   | DATA        |
+------+------+------+------+------+-------------+
| 0xFF | 0xD8 | BLOCK#      | 0x04 | XX 00 00 00 |
+------+------+------+------+------+-------------+

or (depending on the firmware version???) the same command with a 1-byte data field:

+------+------+------+------+------+----+
| 0xFF | 0xD8 | BLOCK#      | 0x01 | XX |
+------+------+------+------+------+----+

BLOCK#: P1 is the MSB of the block number (always zero) and P2 is the LSB of the block number.

XX: The increment/decrement value.

The commands are documented in OMNIKEY Contactless Smart Card Readers Developer Guide.

It seems as if both commands implicitly issue a transfer command to commit the operation. A restore command is not documented for the PC/SC extensions, however, the restore command is available through the OMNIKEY synchronous API.

Upvotes: 5

Related Questions