在Mifare DESFire卡上读取和写入数据时出错

Question

I am trying to read and write data on Mifare DESFire cards using ISO 7816-4 APDU commands. I followed the steps:

1. Select application using {00,A4,04,00,07,D2,76,00,00,85,01,00} . I get the response as 9100 .
2. Then I select file using {00,A4,00,00,02,3F,00} and I get the response as 9100 .
3. Then I try to read the file using command {00,B0,00,00,03} and I get an error with code 6A86 .

Now I want to know the exact commands to read and write the data on the cards. I think I still don't get the meaning of P1 and P2 in read/write commands. I already tried many other combinations but I always get errors like 6A86 , 6982 , etc.

Answer 1

I assume you receive the status word 9000 on success. If you actually receive 9100 when using ISO/IEC 7816-4 basic inter-industry command APDUs something very strange must be going on. 91xx status words should only be returned when you use the ISO/IEC 7816-4 wrapped command set (ie when the class byte of the command APDU is set to 0x90).

Let's look at what you currently do:

1. You start my selecting the MIFARE DESFire ISO AID D2760000850100 :

   \n00 A4 0400 07 D2760000850100 \n

   This makes sure that the card is in ISO/IEC 7816-4 framing mode and automatically selects the MF (master file; ie the PICC level application).

2. You then, again(!), select the MF (PICC level application):

   \n00 A4 0000 02 3F00 \n

   So you are now at the same level as after step 4.

3. Finally, you try to read 3 bytes starting at offset 0 from the currently selected file using the READ BINARY APDU:

   \n00 B0 0000 03 \n

   Since the currently selected file is the MF you can't read binary data from it. The MF does not have a data part. Consequently, the card reports the error code 6A86 ("wrong parameter P1 and/or P2") as it tries to tell you that reading at offset 0 (P1|P2 = 0x0000) from the MF (currently selected file indicated by the upper bit of P1 being zero) makes no sense.

Therefore, before you can read binary data, you need to select an elementary file (EF), probably even located in a different application (dedicated file, DF), that contains an actual data part. This can be done bei either explicitly sending SELECT commands for EF (and, if necessary, the DF) or by implicitly selecting the EF using a short file identifier in P1 of the first read binary command. In the latter case, you would set the upper bit of P1 to one to indicate that the remaining part of P1 encodes a short file ID. In both cases you would need to know the file/application identifiers of the files and applications that you want to read from.