acgtools

About acgtools

acgtools is a driver for ACG HF MultiISO RFID reader. This device consists of an OEM RFID reader circuit connected to an FTDI USB serial converter. The communications protocol is ASCII or, optionally, binary. Although projects like RFIDIOt support this device, I wanted to play with some of the extended features such as:

Identifying protocol used for tag communications
Retreiving ATS and REQA for RFID tags
Continuous select and multi-select
Page read mode where data blocks are automatically read from any tag entering the field and stored for later retrieval.
The binary protocol, although I have been too scared to enable this one for fear of even temporarily bricking the device ;)

To this end EEPROM dump/flash tools are included as well as a nice interactive command-line tool for editing the EEPROM images in a meaningful way.

Features

Driver module supporting the following features:
- Uses hal/dbus to automatically detect and configure USB serial port
- Select, high speed select, multi-select, continuous-select, continuous multi-select
- Select returns protcol, ATS, cascade-level where supported
- EEPROM read/write
- Mifare login/readblock
- Custom APDU transmission
EEPROM flash/dump/edit toolset
select/mifare-transport-keys example tools
Machine-readable-travel-document tool which sets up secure communications with an ePassport and dumps the contents of the passport to disk.

The Software

acgtools is released under the terms of the GNU GPL v3.
Version 0.2 acgtools-0.2.tar.gz.
Version 0.1 acgtools-0.1.tar.gz.

You can follow development using git by issuing the following command:

git clone git://github.com/giannitedesco/acgtools.git

An example ePassport transaction

Here is an example of the passport tool. The second line of the MRZ is required in order to carry out basic access control. This consists of the passport number, country code, date of birth and passport expiry date.

$ ./passport 
Future Technology Devices International, Ltd
USB Vendor Specific Interface
/dev/ttyUSB0 @ 460800 baud
Found ISO 1443-A tag with serial 0x083dbf51
  Cascade level 1
  RATS: 107833d4020064041101013180009000
  Baud rate 424k, frame size 256 bytes

Valid passport application
  Passport: XXXXXXXXX check digit C
  Country: GBR
  Date of birth: YYMMDD check digit C
  Gender: M
  Expiry date: YYMMDD check digit C
  Kmrz = XXXXXXXXXXXXXXXXXXXXXXXX
  Kseed = YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
  Kenc = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  Kmac = YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
  RND.ICC = 449ef0c05bd94dab
  RND.ifd = 70d095f708009d55
  K.ifd = e281ccfc39847b41af06df20a318f00d
  S = 70d095f708009d55449ef0c05bd94dabe281ccfc39847b41af06df20a318f00d
  Eifd = d4e9b8b64ba7512f586fb8f384c69c8207428ffd49a1ca93c618c00be4aeef83
  Mifd = 6a78a81605e8f38c
  MAC: 8f3c0a1a9487f090
  K.icc: a58b73e96ba3098b9da73ea0aa61a04a
  Session key seed: 470abf15522772ca32a1e18009795047
  Senc = 45f13186d5f410080e6eb6ec58dad937
  Smac = d64c315b91450b230e0808792a7cbcce
  Sseq = 5bd94dab08009d55

Basic Access Control Successful

Retrieved common data elements
  LDS Version: 1.7
  UNICODE Version: 4.0.0
  Taglist: 0x61, 0x75

Retrieved MRZ
  P<GBRTEDESCO<<GIANPAOLO<<<<<<<<<<<<<<<<<<<<<
  XXXXXXXXXCGBRYYMMDDCMYYMMDDC<<<<<<<<<<<<<<00

Retrieved Biometric Information
  Wrote image to face.0.jpeg

An example of changing EEPROM configuration

Here is an example of enabling the "Programmable LED's" feature.

$ ./eepromdump 
Future Technology Devices International, Ltd
USB Vendor Specific Interface
/dev/ttyUSB0 @ 460800 baud
Dumped EEPROM: acg-eeprom-0.bin

$ ./eepromtool acg-eeprom-0.bin 
eeprom> p
  Device ID         : 0x44060120
  Admin data        : 0x47160120
  Station ID        : 0x01
  Baud Rate         : 460800
  Guard time (ms)   : 1.210
  Auto start        : False
  Binary protocol   : False
  Multitag          : False
  New serial mode   : False
  Programmed LEDs   : False
  Single shot mode  : False
  Ext. protocol     : True
  Ext. ID's         : True
  op: ISO 1443-A    : True
  op: ISO 1443-B    : True
  op: SR-176        : True
  op: ICODE         : True
  op: ISO 15693     : True
  op: ICODE-EPC     : True
  op: ICODE-UID     : True
  Single shot (ms)  : 1000
  Multitag reset    : True
  Startup message   : True
  Binary frames v2  : False
  Noisy environment : False
  ISO Anti-collision: False
  ISO Err handling  : True
  Reset time (ms)   : 10
  Recover time (ms) : 0
  AFI               : 0
  Timeout ISO 1443-A: 4.800
  Timeout ISO 1443-B: 24.000
  Timeout SR-176    : 4.800
  Timeout ISO 15693 : 9.600
  Auto timeout      : True
  Page Read Mode    : False
  Ext. REQA         : False
  Start Page        : 0x00
  Internal byte 1   : 0x05
  Internal byte 2   : 0xeb
  Start Page        : 0x00
  RFU data:
  0000 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0010 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0020 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0030 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0040 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0050 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  User data:
  0000 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0010 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0020 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0030 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0040 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0050 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0060 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

eeprom> dev_id 10
ERROR: setting dev_id: Device ID is read-only
dev_id = 0x44060120

eeprom> program_led
program_led = False

eeprom> program_led true
program_led = True

eeprom> w
Writing to: acg-eeprom-0.bin

$ ./eepromflash acg-eeprom-0.bin 
Future Technology Devices International, Ltd
USB Vendor Specific Interface
/dev/ttyUSB0 @ 460800 baud
Flash device with EEPROM acg-eeprom-0.bin? [y/N]
y
Flashing EEPROM...
OK