欢迎光临
我们一直在努力

研究院

手机nfc阅读证研究(3)代码编写

admin阅读(2172)

读取身份证UID的代码

/**************** from pn53x-internal.h **********/
// Register addresses
#define PN53X_REG_Control_switch_rng 0x6106
#define PN53X_REG_CIU_Mode 0x6301
#define PN53X_REG_CIU_TxMode 0x6302
#define PN53X_REG_CIU_RxMode 0x6303
#define PN53X_REG_CIU_TxControl 0x6304
#define PN53X_REG_CIU_TxAuto 0x6305
#define PN53X_REG_CIU_TxSel 0x6306
#define PN53X_REG_CIU_RxSel 0x6307
#define PN53X_REG_CIU_RxThreshold 0x6308
#define PN53X_REG_CIU_Demod 0x6309
#define PN53X_REG_CIU_FelNFC1 0x630A
#define PN53X_REG_CIU_FelNFC2 0x630B
#define PN53X_REG_CIU_MifNFC 0x630C
#define PN53X_REG_CIU_ManualRCV 0x630D
#define PN53X_REG_CIU_TypeB 0x630E
// #define PN53X_REG_- 0x630F
// #define PN53X_REG_- 0x6310
#define PN53X_REG_CIU_CRCResultMSB 0x6311
#define PN53X_REG_CIU_CRCResultLSB 0x6312
#define PN53X_REG_CIU_GsNOFF 0x6313
#define PN53X_REG_CIU_ModWidth 0x6314
#define PN53X_REG_CIU_TxBitPhase 0x6315
#define PN53X_REG_CIU_RFCfg 0x6316
#define PN53X_REG_CIU_GsNOn 0x6317
#define PN53X_REG_CIU_CWGsP 0x6318
#define PN53X_REG_CIU_ModGsP 0x6319
#define PN53X_REG_CIU_TMode 0x631A
#define PN53X_REG_CIU_TPrescaler 0x631B
#define PN53X_REG_CIU_TReloadVal_hi 0x631C
#define PN53X_REG_CIU_TReloadVal_lo 0x631D
#define PN53X_REG_CIU_TCounterVal_hi 0x631E
#define PN53X_REG_CIU_TCounterVal_lo 0x631F
// #define PN53X_REG_- 0x6320
#define PN53X_REG_CIU_TestSel1 0x6321
#define PN53X_REG_CIU_TestSel2 0x6322
#define PN53X_REG_CIU_TestPinEn 0x6323
#define PN53X_REG_CIU_TestPinValue 0x6324
#define PN53X_REG_CIU_TestBus 0x6325
#define PN53X_REG_CIU_AutoTest 0x6326
#define PN53X_REG_CIU_Version 0x6327
#define PN53X_REG_CIU_AnalogTest 0x6328
#define PN53X_REG_CIU_TestDAC1 0x6329
#define PN53X_REG_CIU_TestDAC2 0x632A
#define PN53X_REG_CIU_TestADC 0x632B
// #define PN53X_REG_- 0x632C
// #define PN53X_REG_- 0x632D
// #define PN53X_REG_- 0x632E
#define PN53X_REG_CIU_RFlevelDet 0x632F
#define PN53X_REG_CIU_SIC_CLK_en 0x6330
#define PN53X_REG_CIU_Command 0x6331
#define PN53X_REG_CIU_CommIEn 0x6332
#define PN53X_REG_CIU_DivIEn 0x6333
#define PN53X_REG_CIU_CommIrq 0x6334
#define PN53X_REG_CIU_DivIrq 0x6335
#define PN53X_REG_CIU_Error 0x6336
#define PN53X_REG_CIU_Status1 0x6337
#define PN53X_REG_CIU_Status2 0x6338
#define PN53X_REG_CIU_FIFOData 0x6339
#define PN53X_REG_CIU_FIFOLevel 0x633A
#define PN53X_REG_CIU_WaterLevel 0x633B
#define PN53X_REG_CIU_Control 0x633C
#define PN53X_REG_CIU_BitFraming 0x633D
#define PN53X_REG_CIU_Coll 0x633E
/**************** end pn53x-internal.h **********/

#include <inttypes.h>
#include <signal.h>
#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>

#include <nfc/nfc.h>
#include <nfc/nfc-types.h>

int pn53x_read_register(struct nfc_device *pnd, uint16_t ui16RegisterAddress, uint8_t *ui8Value);
int pn53x_write_register(struct nfc_device *pnd, const uint16_t ui16RegisterAddress, const uint8_t ui8SymbolMask, const uint8_t ui8Value);

static nfc_device *pnd = NULL;
static nfc_context *context;

int
main(int argc, const char *argv[])
{

    // Display libnfc version
    const char *acLibnfcVersion = nfc_version();

    printf("%s uses libnfc %s\n", argv[0], acLibnfcVersion);

    nfc_target nt;
    int res = 0;

    nfc_init(&context);
    if (context == NULL) {
        printf("Unable to init libnfc (malloc)");
        exit(EXIT_FAILURE);
    }

    pnd = nfc_open(context, NULL);

    if (pnd == NULL) {
        printf("%s", "Unable to open NFC device.");
        nfc_exit(context);
        exit(EXIT_FAILURE);
    }

    if (nfc_initiator_init(pnd) < 0) {
        nfc_perror(pnd, "nfc_initiator_init");
        nfc_close(pnd);
        nfc_exit(context);
        exit(EXIT_FAILURE);
    }

    printf("NFC reader: %s opened\n", nfc_device_get_name(pnd));
    printf("nfc_device_set_property_bool(NP_EASY_FRAMING)=%d\n",
           nfc_device_set_property_bool(pnd, NP_EASY_FRAMING, false));

    printf("pn53x_write_register(PN53X_REG_CIU_Mode)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_Mode, 0xff, 0xff));
    printf("pn53x_write_register(PN53X_REG_CIU_TxAuto)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_TxAuto, 0xff, 0x00));
    printf("pn53x_write_register(PN53X_REG_CIU_TxMode)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_TxMode, 0xff, 0x03));
    printf("pn53x_write_register(PN53X_REG_CIU_RxMode)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_RxMode, 0xff, 0x03));
    printf("pn53x_write_register(PN53X_REG_CIU_TypeB)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_TypeB, 0xff, 0x03));
    printf("pn53x_write_register(PN53X_REG_CIU_Demod)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_Demod, 0xff, 0x4d));
    printf("pn53x_write_register(PN53X_REG_CIU_GsNOn)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_GsNOn, 0xff, 0xff));
    printf("pn53x_write_register(PN53X_REG_CIU_CWGsP)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_CWGsP, 0xff, 0x3f));
    printf("pn53x_write_register(PN53X_REG_CIU_ModGsP)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_ModGsP, 0xff, 0x18));
    printf("pn53x_write_register(PN53X_REG_CIU_RxThreshold)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_RxThreshold, 0xff, 0x4d));
    printf("pn53x_write_register(PN53X_REG_CIU_ModWidth)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_ModWidth, 0xff, 0x68));
    printf("pn53x_write_register(PN53X_REG_CIU_ManualRCV)=%d\n",
           pn53x_write_register(pnd, PN53X_REG_CIU_ManualRCV, 0xff, 0x10));

    uint8_t val;
    pn53x_read_register(pnd, PN53X_REG_CIU_Mode, &val); printf("PN53X_REG_CIU_Mode %d %d\n", val, 0xff);
    pn53x_read_register(pnd, PN53X_REG_CIU_TxAuto, &val); printf("PN53X_REG_CIU_TxAuto %d %d\n", val, 0x00);
    pn53x_read_register(pnd, PN53X_REG_CIU_TxMode, &val); printf("PN53X_REG_CIU_TxMode %d %d\n", val, 0x03);
    pn53x_read_register(pnd, PN53X_REG_CIU_RxMode, &val); printf("PN53X_REG_CIU_RxMode %d %d\n", val, 0x03);
    pn53x_read_register(pnd, PN53X_REG_CIU_TypeB, &val); printf("PN53X_REG_CIU_TypeB %d %d\n", val, 0x03);
    pn53x_read_register(pnd, PN53X_REG_CIU_Demod, &val); printf("PN53X_REG_CIU_Demod %d %d\n", val, 0x4d);
    pn53x_read_register(pnd, PN53X_REG_CIU_GsNOn, &val); printf("PN53X_REG_CIU_GsNOn %d %d\n", val, 0xff);
    pn53x_read_register(pnd, PN53X_REG_CIU_CWGsP, &val); printf("PN53X_REG_CIU_CWGsP %d %d\n", val, 0x3f);
    pn53x_read_register(pnd, PN53X_REG_CIU_ModGsP, &val); printf("PN53X_REG_CIU_ModGsP %d %d\n", val, 0x18);
    pn53x_read_register(pnd, PN53X_REG_CIU_RxThreshold, &val); printf("PN53X_REG_CIU_RxThreshold %d %d\n", val, 0x4d);
    pn53x_read_register(pnd, PN53X_REG_CIU_ModWidth, &val); printf("PN53X_REG_CIU_ModWidth %d %d\n", val, 0x68);
    pn53x_read_register(pnd, PN53X_REG_CIU_ManualRCV, &val); printf("PN53X_REG_CIU_ManualRCV %d %d\n", val, 0x10);

    uint8_t cmd_atqb[] = {0x05, 0, 0, 0x71, 0xff};
    uint8_t recv[384];

    int sz = nfc_initiator_transceive_bytes(pnd, cmd_atqb, sizeof(cmd_atqb), recv, sizeof(recv), -1);
    if(sz<0){
        printf("ATQB got %s (%d)\n", nfc_strerror(pnd) ,sz);
    }else{
        printf("ATQB got %d bytes\n", sz);
    }

    uint8_t cmd_attrib[] = {0x1d  , 0x00  , 0x00  , 0x00  , 0x00  , 0x00  , 0x08  , 0x01  , 0x08, 0xf3, 0x10};
    sz = nfc_initiator_transceive_bytes(pnd, cmd_attrib, sizeof(cmd_attrib), recv, sizeof(recv), -1);
    if(sz<0){
        printf("ATTRIB got %s (%d)\n", nfc_strerror(pnd) ,sz);
    }else{
        printf("ATTRIB got %d bytes\n", sz);
    }

    uint8_t cmd_uid[] = {0x00 , 0x36 , 0x00 , 0x00 , 0x08  , 0x57 , 0x44};
    sz = nfc_initiator_transceive_bytes(pnd, cmd_uid, sizeof(cmd_uid), recv, sizeof(recv), -1);
    if(sz<0){
        printf("UID got %s (%d)\n", nfc_strerror(pnd) ,sz);
    }else{    
        printf("UID got %d bytes\n", sz);
    }

    for (int i = 0; i < sz; ++i) {
        printf("%02x,", recv[i]);
    }
    printf("\n");

    nfc_close(pnd);
    nfc_exit(context);
    exit(EXIT_SUCCESS);
}

手机nfc阅证的研究(2)可行性分析

admin阅读(1769)

读卡流程

指令 描述 返回值
50 00 00 寻卡 返回卡的类型
1d 00 00 00 00 00 08 01 08 选卡 返回 08
00 36 00 00 08 读UID 8字节UID+状态码

可行性分析

手机支持 Type B 卡读取

硬件远程tcp透传nfc信号

延迟 90 ms 以内

手机nfc阅证的研究 (1)资料收集

admin阅读(1827)

相关资料收集

二代居民身份证wiki

身份证读UID

libnfc macos 编译

命令 CLA INS P1 P2 Lc Data Le Response
选择文件 00 A4 00 00 02 EF-ID 状态码
读二进制文件 80 B0 偏移量高位 偏移量低位 读取长度 内容+状态码
内部(卡片)认证 00 88 00 42 0A 10字节认证数据 8字节认证响应+状态码
外部(读卡器)认证 00 82 00 42 0A 10字节认证数据 状态码
获取随机数 00 84 00 00 08 8字节随机数+状态码
读芯片序列号 00 36 00 00 08 8字节序列号+状态码

登录

找回密码

注册