Dumping An Unknown SmartCard

Hacking multi-tool. Get one for $30, including worldwide shipping.

Dumping An Unknown SmartCard

Postby backXslash » Wed Dec 05, 2012 12:52 am

Hey guys, long time lurker, first time poster.

I've got an unknown SmartCard on my hands. I'm using a Bus Pirate v3b with firmware v5.10 (r559) and bootloader v4.4. The contact layout is identical to the pictures in the datasheet for the Atmel AT88SC102. And with that I have exhausted all the knowledge I have of the card.

When hooked up to the Bus Pirate in the same way as the SLE4442, it doesn't seem to reply at all, and returns only 0xFF to any query. I've appended the doc sheets from Atmel to the end of the post.

The card is a laundry card, and stores credits for the washer and dryer machines in my apartment complex. The "fill station" appears to be just a writer that checks the value on the card, then adds however many credits you feed it to that value, then writes it back to the card. The machines themselves appear to simply check the value of the card, then deduct a set amount from it, and write it back to the card. None of the machines are internet connected.

Pictures of the card and reader I'm using are available here:

IMG_20121205_003742.jpg

IMG_20121205_003712.jpg

IMG_20121205_003614.jpg


Can anyone offer insight as to how I go about A) finding out more about the card, and B) dumping and/ or manipulating the data on the card?
Attachments
Laundry Card Full Spec Sheet.pdf
(779.09 KiB) Downloaded 225 times
AT88SC102.pdf
(525.95 KiB) Downloaded 283 times
Last edited by backXslash on Wed Dec 05, 2012 11:51 am, edited 1 time in total.
backXslash
Newbie
Newbie
 
Posts: 6
Joined: Wed Dec 05, 2012 12:22 am

Re: Dumping An Unknown SmartCard

Postby ian » Wed Dec 05, 2012 1:21 am

Welcome to the forum. The spam filter will pass after 24 hours.

Your best bet is to sent the standard ATR (?) query that should return data about the card. There's more about manipulating that manually in my old Hack a Day article at one of the SLE4442 links in the manual. If it doesn't respond, it could be non-standard and I have no idea where to go from there.

Either way, you will likely be able to probe the contents if it is standard, but most systems will use a key so you won't be able to write or change the data without the key.
User avatar
ian
Crew
Crew
 
Posts: 10578
Joined: Mon Jul 06, 2009 6:14 am

Re: Dumping An Unknown SmartCard

Postby backXslash » Wed Dec 05, 2012 11:53 am

I added the photos and manuals to the first post.

Let me get everything set up the way I had it last night, and maybe someone can point out a flaw in what I've got going on.
backXslash
Newbie
Newbie
 
Posts: 6
Joined: Wed Dec 05, 2012 12:22 am

Re: Dumping An Unknown SmartCard

Postby backXslash » Wed Dec 05, 2012 12:16 pm

Set up is as follows:

Bus Pirate v3b
Firmware v5.10 (r559) Bootloader v4.4
DEVID:0x0447 REVID:0x3043 (24FJ64GA002 B5)
http://dangerousprototypes.com
CFG1:0xFFDF CFG2:0xFF7F
*----------*
Pinstates:
1.(BR) 2.(RD) 3.(OR) 4.(YW) 5.(GN) 6.(BL) 7.(PU) 8.(GR) 9.(WT) 0.(Blk)
GND 3.3V 5.0V ADC VPU AUX SCL SDA - -
P P P I I I O I I I
GND 3.13V 5.01V 0.00V 5.03V L H H H H
Power supplies ON, Pull-up resistors ON, Open drain outputs (H=Hi-Z, L=GND)
LSB set: LEAST sig bit first, Number of bits read/write: 8
a/A/@ controls CS pin
R2W (spd hiz)=( 1 1 )
*----------*

When I issue the command (1) [The ATR macro], it returns the following:

ISO 7816-3 ATR (RESET on CS)
RESET HIGH, CLOCK TICK, RESET LOW
ISO 7816-3 reply (uses current LSB setting): 0xFF 0xFF 0xFF 0xFF
Protocol: RFU
Read type: variable length
Data units: RFU
Data unit length (bits): 128

But it does so regardless of whether or not the card is in the reader.
backXslash
Newbie
Newbie
 
Posts: 6
Joined: Wed Dec 05, 2012 12:22 am

Re: Dumping An Unknown SmartCard

Postby backXslash » Wed Dec 05, 2012 1:53 pm

IMG_20121205_122247.jpg


There's the actual hook up. The green probe is the purple wire on the bus pirate, clock, the white one is cs, the red one is the orange 5v+, black is ground, yellow is the gray MOSI wire.
backXslash
Newbie
Newbie
 
Posts: 6
Joined: Wed Dec 05, 2012 12:22 am

Dumping An Unknown SmartCard

Postby cybergibbons » Thu Dec 06, 2012 6:02 am

I personally don't care, but I think some people won't like the fact that this looks like you are trying to avoid paying for credits.

I would normally deal with this by using a sniffer board and my Salaea Logic. Once the protocol is worked out, the bus pirate can be used.
cybergibbons
Newbie
Newbie
 
Posts: 6
Joined: Wed Nov 11, 2009 4:47 pm

Re: Dumping An Unknown SmartCard

Postby ian » Fri Dec 07, 2012 3:10 am

You might try switching the least significant bit setting with L/l before doing the ATR. You have the pullup pin (Vpu) connected to the +5 right?
User avatar
ian
Crew
Crew
 
Posts: 10578
Joined: Mon Jul 06, 2009 6:14 am

Re: Dumping An Unknown SmartCard

Postby matseng » Fri Dec 07, 2012 3:57 am

Might be a stupid question, but have you tried another card? Like you ATM card or whatever?

(Unless you're in US where "the eighties called and wanted their magstripes back" ^_^)
User avatar
matseng
Hero Member
Hero Member
 
Posts: 876
Joined: Sat Oct 15, 2011 12:29 pm
Location: Kuala Lumpur, Malaysia

Re: Dumping An Unknown SmartCard

Postby backXslash » Fri Dec 07, 2012 8:26 pm

ian wrote:You might try switching the least significant bit setting with L/l before doing the ATR. You have the pullup pin (Vpu) connected to the +5 right?


I'm gunna try that now. And yes, I do have the VPU pin attached to the 5v line off a stripped USB plug
backXslash
Newbie
Newbie
 
Posts: 6
Joined: Wed Dec 05, 2012 12:22 am

Re: Dumping An Unknown SmartCard

Postby backXslash » Fri Dec 07, 2012 8:29 pm

No go on the LSB MSB settings. Anything else? I mean it's acting like the card isn't even there.
backXslash
Newbie
Newbie
 
Posts: 6
Joined: Wed Dec 05, 2012 12:22 am

Re: Dumping An Unknown SmartCard

Postby ian » Mon Dec 10, 2012 2:52 am

My guess is it is not a standard card that responds to the ISO ATR command. There are so many cards, many use something totally custom instead of the ATR standard.
User avatar
ian
Crew
Crew
 
Posts: 10578
Joined: Mon Jul 06, 2009 6:14 am


Return to Bus Pirate Support