scaramanga::acgtools

project topics: smartcards

acgtools

A driver for the ACG HF MultiISO RFID reader — an OEM RFID reader circuit behind an FTDI USB serial converter, talking ASCII or (carefully) binary. Tools like RFIDIOt already support this device; this went after some of its extended features.

Features

  • Identifying the protocol in use for tag communications
  • Retrieving ATS and REQA for RFID tags
  • Continuous select and multi-select
  • Page read mode — data blocks are automatically read from any tag entering the field and stored for later retrieval
  • The binary protocol — never actually enabled it, too scared of bricking the device

Also includes EEPROM dump/flash tools and an interactive command-line tool for editing EEPROM images meaningfully.

Driver module

  • Uses hal/dbus to automatically detect and configure the USB serial port
  • Select, high-speed select, multi-select, continuous-select, continuous multi-select
  • Select returns protocol, ATS, cascade-level where supported
  • EEPROM read/write
  • Mifare login/readblock
  • Custom APDU transmission

Also: an EEPROM flash/dump/edit toolset, select/mifare transport-key example tools, and a machine-readable-travel-document tool that sets up secure communications with an ePassport and dumps its contents to disk.

Downloads

GNU GPL v3.

acgtools-0.2.tar.gz
acgtools-0.1.tar.gz

Follow development:

git clone git://github.com/giannitedesco/acgtools.git

An example ePassport transaction

The second line of the MRZ (passport number, country code, date of birth, expiry date) is required for basic access control.

$ ./passport
Future Technology Devices International, Ltd
USB Vendor Specific Interface
/dev/ttyUSB0 @ 460800 baud
Found ISO 1443-A tag with serial 0x083dbf51
  Cascade level 1
  RATS: 107833d4020064041101013180009000
  Baud rate 424k, frame size 256 bytes

Valid passport application
  Passport: XXXXXXXXX check digit C
  Country: GBR
  Date of birth: YYMMDD check digit C
  Gender: M
  Expiry date: YYMMDD check digit C
  Kmrz = XXXXXXXXXXXXXXXXXXXXXXXX
  Kseed = YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
  Kenc = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  Kmac = YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
  RND.ICC = 449ef0c05bd94dab
  RND.ifd = 70d095f708009d55
  K.ifd = e281ccfc39847b41af06df20a318f00d
  S = 70d095f708009d55449ef0c05bd94dabe281ccfc39847b41af06df20a318f00d
  Eifd = d4e9b8b64ba7512f586fb8f384c69c8207428ffd49a1ca93c618c00be4aeef83
  Mifd = 6a78a81605e8f38c
  MAC: 8f3c0a1a9487f090
  K.icc: a58b73e96ba3098b9da73ea0aa61a04a
  Session key seed: 470abf15522772ca32a1e18009795047
  Senc = 45f13186d5f410080e6eb6ec58dad937
  Smac = d64c315b91450b230e0808792a7cbcce
  Sseq = 5bd94dab08009d55

Basic Access Control Successful

Retrieved common data elements
  LDS Version: 1.7
  UNICODE Version: 4.0.0
  Taglist: 0x61, 0x75

Retrieved MRZ
  P<GBRTEDESCO<<GIANPAOLO<<<<<<<<<<<<<<<<<<<<<
  XXXXXXXXXCGBRYYMMDDCMYYMMDDC<<<<<<<<<<<<<<00

Retrieved Biometric Information
  Wrote image to face.0.jpeg

Changing EEPROM configuration

Enabling the "Programmable LED's" feature:

$ ./eepromdump
Future Technology Devices International, Ltd
USB Vendor Specific Interface
/dev/ttyUSB0 @ 460800 baud
Dumped EEPROM: acg-eeprom-0.bin

$ ./eepromtool acg-eeprom-0.bin
eeprom> p
  Device ID         : 0x44060120
  Admin data        : 0x47160120
  Station ID        : 0x01
  Baud Rate         : 460800
  Guard time (ms)   : 1.210
  Auto start        : False
  Binary protocol   : False
  Multitag          : False
  New serial mode   : False
  Programmed LEDs   : False
  Single shot mode  : False
  Ext. protocol     : True
  Ext. ID's         : True
  op: ISO 1443-A    : True
  op: ISO 1443-B    : True
  op: SR-176        : True
  op: ICODE         : True
  op: ISO 15693     : True
  op: ICODE-EPC     : True
  op: ICODE-UID     : True
  Single shot (ms)  : 1000
  Multitag reset    : True
  Startup message   : True
  Binary frames v2  : False
  Noisy environment : False
  ISO Anti-collision: False
  ISO Err handling  : True
  Reset time (ms)   : 10
  Recover time (ms) : 0
  AFI               : 0
  Timeout ISO 1443-A: 4.800
  Timeout ISO 1443-B: 24.000
  Timeout SR-176    : 4.800
  Timeout ISO 15693 : 9.600
  Auto timeout      : True
  Page Read Mode    : False
  Ext. REQA         : False
  Start Page        : 0x00
  Internal byte 1   : 0x05
  Internal byte 2   : 0xeb
  Start Page        : 0x00
  RFU data:
  0000 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0010 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0020 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0030 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0040 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0050 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  User data:
  0000 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0010 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0020 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0030 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0040 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0050 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0060 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

eeprom> dev_id 10
ERROR: setting dev_id: Device ID is read-only
dev_id = 0x44060120

eeprom> program_led
program_led = False

eeprom> program_led true
program_led = True

eeprom> w
Writing to: acg-eeprom-0.bin

$ ./eepromflash acg-eeprom-0.bin
Future Technology Devices International, Ltd
USB Vendor Specific Interface
/dev/ttyUSB0 @ 460800 baud
Flash device with EEPROM acg-eeprom-0.bin? [y/N]
y
Flashing EEPROM...
OK

License

GNU GPL v3.