Search code examples
smartcardmifareapdupcsccontactless-smartcard

SmartMX Hybrid Card - How to access MIFARE Classic


I have a bunch of hybrid smart cards with SmartMX chip (smartmx-m3b.03.d3-NX212A to be exact), which contain a MIFARE Classic 4k. I have been trying to access the MIFARE portion of the cards, and while doing so on Android is rather trivial task of accessing the android.nfc.tech.MifareClassic tag, I have no idea of how to do so in Windows. Should I be looking for PCSC Reader specific commands to access MIFARE Classic on this card? Or should I look for a SmartMX chip specific APDU to wrap commands for MIFARE classic?


Solution

  • This heavily depends on the smartcard reader that you are using. First of all, as mictter pointed out, your reader has to support MIFARE Classic technology (which basically means that you are stuck with contactless readers based on some NXP chipset, or readers that (despite NXP's licensing policy on MF Classic reader technology) implement MIFARE Classic reader functionality).

    Next, you will likely run into a problem with automatic protocol activation of the reader. Most PS/SC readers I used so far (e.g. HID Omnikey 5321) will automatically perform protocol activation up to the highes available protocol layer. For a SmartMX chip that exposes both MIFARE Classic and ISO-DEP (ISO/IEC 14443-4, with ISO/IEC 7816-4 APDUs on top) protocols over its contactless interface, this means that the reader will automatically perform the ISO-DEP link activation. This effectively disables access through the MIFARE Classic protocol (as the MF Classic protocol operates on top of a lower layer -> ISO/IEC 14443-3).

    Therefore, you basically have two options:

    • Use an applet that speaks APDUs on the one side and accesses the MIFARE Classic memory area1 on the other side. NXP provides a ready-made applet for this that may or may not be enabled for the contactless interface. Also NXP provides an API that you could use within your own applet2 to access the MIFARE Classic memory area1. So you could write your own custom applet

    • Force the smartcard reader to activate only to ISO/IEC 14443-3 protocol layer in order to access the card as MIFARE Classic card. Depending on your reader this could be something between trivial and impossible to do. Some readers, like the afore mentioned HID Omnikey reader, support changing the level of automatic protocol activation through a registry setting (or through the HID Workbench tool). Some readers (e.g. the ACR122U in its older variant) permit you to perform a manual enumeration and activation of contactless cards, where you can freely choose the activated protocol layer. The PC/SC specification, in its current version (which means that those features might not be supported by some/many readers), defines a SWITCH_PROTOCOL command that can be used to force manual activation of a contactless card up to a user-defined protocol level (see the PC/SC 2 specification, Part 3, Supplemental Document 2 - Contactless ICCs on how this command works).


    1) Read either as "MIFARE Classic memory area" or as "virtual MIFARE Classic card". I did not find much information on that chip type. Depending on how new this chip and its software is, instead of MIFARE Classic memory area, the chip might (I doubt that though) be capable of managing true virtual MIFARE Classic cards according to the new version of the MIFARE4Mobile specification.

    2) I assume that the SmartMX you are using runs JCOP OS and that you can install arbitrary Java Card applets.