How to access a MIFARE Classic card that uses the MIFARE Application Directory structure?

Question

How can I make authenticate and read data from a MIFARE Classic card that is formatted with the MIFARE Application Directory structure? I'm using Android.

Answer 1

See NXP's application note on the MIFARE Application Directory . Typically, in order to read data from a MIFARE Classic card that makes use of the MAD, you would do something like the following:

1. Authenticate to sector 0 (MAD sector) using key A A0 A1 A2 A3 A4 A5 (the public MAD read key).
2. Read block 3.
3. Based on the general purpose byte (byte 9 read from block 3), you can determine
   • if the card uses the MAD (bit 7 = 1),
   • if the card supports multiple applications (bit 6 = 1), and
   • the MAD version (bits 1-0).

4. Read blocks 1 and 2, these blocks have the following format (where AIDx is the application ID assigned to sector number x ):

    +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+ Byte | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+ Block 1 |CRC |INFO| AID01 | AID02 | AID03 | AID04 | AID05 | AID06 | AID07 | +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+ Block 2 | AID08 | AID09 | AID10 | AID11 | AID12 | AID13 | AID14 | AID15 | +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+

5. Verify the CRC (block 1, byte 0).

6. Browse through the AID list (as generated from the data of blocks 1 and 2) to find your application AIDs (and consequently to find the sectors that contain your application data).

7. If MAD version 2 is used, authenticate to sector 16 and read blocks 0 (64), 1 (65), and 2 (66) in order to get the extended AID list. The format of these blocks is:

    +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+ Byte | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+ Block 0 |CRC |INFO| AID17 | AID18 | AID19 | AID20 | AID21 | AID22 | AID23 | +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+ Block 1 | AID24 | AID25 | AID26 | AID27 | AID28 | AID29 | AID30 | AID31 | +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+ Block 2 | AID32 | AID33 | AID34 | AID35 | AID36 | AID37 | AID38 | AID39 | +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+

8. Authenticate to the sectors of your application (as discovered through the AID list) and read/write the data of your application.