FeliCa
FeliCa¶
- Made by Sony
- Operates at 13.56 MHz
- Bitrate fc/64 212kbps
- Cards used for Hong Kong Transit System (Octopus)
- Uses 3DES
Suica¶
Japanese Transit Card
Card Info:
[usb] pm3 --> hf felica info
[=] --- Tag Information ---------------------------
[=] IDm............ 0101021498173609
[=] Code........... 0101
[=] NFCID2......... 021498173609
[=] Parameter
[=] PAD............ 053143454682B7FF
[=] IC code........ 0531 ( Suica card (FeliCa Standard RC-S ?) )
[=] MRT............ 43454682B7FF
[=] Service code... 03 0B
Common Commands:
[usb] pm3 --> hf felica rqresponse
[=] Using last known IDm... 0A040101021498173609
[+] (15) B2 4D 0B 05 01 01 02 14 98 17 36 09 00 6B 82
[+] Request Response
[+] IDm...... 01 01 02 14 98 17 36 09
[+] Mode... 00
[usb] pm3 --> hf felica rqsyscode
[=] Using last known IDm... 0A0C0101021498173609
[+] (21) B2 4D 11 0D 01 01 02 14 98 17 36 09 03 00 03 FE 00 86 A7 2C CD
[+] Request Response
[+] IDm... 01 01 02 14 98 17 36 09
[+] - Number of Systems: 03
[+] - System Codes: enumerated in ascending order starting from System 0.
[+] - 00 03
[+] - FE 00
[+] - 86 A7
[usb] pm3 --> hf felica rqspecver
[=] Using last known IDm... 0C3C01010214981736090000
[+] (22) B2 4D 12 3D 01 01 02 14 98 17 36 09 00 00 00 00 85 01 00 85 66 87
[+] Got Request Response
[+] IDm............ 01 01 02 14 98 17 36 09
[+] Status Flag1... 00
[+] Status Flag2... 00
[+] Format Version..... 00
[+] Basic Version...... 00 85
[+] Number of Option... 01
[+] Option Version List...
[+] - 00 85
FeliCa Light:
[usb] pm3 --> hf felica litedump
[+] FeliCa lite - dump started
[=] Press pm3 button or press <Enter> to abort dumping
[#] 28 60 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
[+] Recorded Activity (trace len = 532 bytes)
[=] 00 | 00 01 A6 28 60 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 01 01 A6 28 00 82 B7 FF AD B4 00 00 00 | ...(`.................(.........
[=] 01 | 00 00 00 00 00 00 02 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 03 01 A6 28 00 82 B7 | .........(..................(...
[=] 02 | FF AD B4 00 00 00 00 00 00 00 00 00 04 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 05 | ...............(................
[=] 03 | 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 06 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 | ..(..................(..........
[=] 04 | 00 00 00 00 00 07 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 08 01 A6 28 00 82 B7 FF | ........(..................(....
[=] 05 | AD B4 00 00 00 00 00 00 00 00 00 09 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 0A 01 | ..............(.................
[=] 06 | A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 0B 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 | .(..................(...........
[=] 07 | 00 00 00 00 0C 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 0D 01 A6 28 00 82 B7 FF AD | .......(..................(.....
[=] 08 | B4 00 00 00 00 00 00 00 00 00 0E 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 80 01 A6 | .............(..................
[=] 09 | 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 81 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 | (..................(............
[=] 10 | 00 00 00 82 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 83 01 A6 28 00 82 B7 FF AD B4 | ......(..................(......
[=] 11 | 00 00 00 00 00 00 00 00 00 84 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 85 01 A6 28 | ............(..................(
[=] 12 | 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 86 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 | ..................(.............
[=] 13 | 00 00 87 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 88 01 A6 28 00 82 B7 FF AD B4 00 | .....(..................(.......
[=] 14 | 00 00 00 00 00 00 00 00 90 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 91 01 A6 28 00 | ...........(..................(.
[=] 15 | 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 92 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 | .................(..............
[=] 16 | 00 A0 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 | ....(...............
[=] ------------------------------------------------------------------------------------
block number 00, status: 01 a6
S_PAD0: 28 60 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 01, status: 01 a6
S_PAD1: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 02, status: 01 a6
S_PAD2: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 03, status: 01 a6
S_PAD3: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 04, status: 01 a6
S_PAD4: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 05, status: 01 a6
S_PAD5: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 06, status: 01 a6
S_PAD6: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 07, status: 01 a6
S_PAD7: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 08, status: 01 a6
S_PAD8: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 09, status: 01 a6
S_PAD9: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 0a, status: 01 a6
S_PAD10: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 0b, status: 01 a6
S_PAD11: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 0c, status: 01 a6
S_PAD12: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 0d, status: 01 a6
S_PAD13: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 0e, status: 01 a6
REG: regA: -1216217048 regB: 11841023 regC: 0000000000000000
block number 80, status: 01 a6
Random Challenge, WO: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 81, status: 01 a6
MAC, only set on dual read: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 82, status: 01 a6
ID Block, IDd: 0x280082b7ffadb400 DFC: 0x0000 Arb: 000000000000
block number 83, status: 01 a6
DeviceId: IDm: 0x280082b7ffadb400 PMm: 0x0000000000000000
block number 84, status: 01 a6
SER_C: 0x2800
block number 85, status: 01 a6
SYS_Cl 0x2800
block number 86, status: 01 a6
CKV (key version): 0x2800
block number 87, status: 01 a6
CK (card key), WO: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 88, status: 01 a6
Memory Configuration (MC):
MAC needed to write state: off
Write with MAC for S_PAD : 0000000000000000
Write with AUTH for S_PAD : 0000000000000000
Read after AUTH for S_PAD : 1011010000000000
MAC needed to write CK and CKV: on
RF parameter: 07
Compatible with NDEF: yes
Memory config writable : no
RW access for S_PAD : 0010100000000000
block number 90, status: 01 a6
Write count, RO: 28 00 82
block number 91, status: 01 a6
MAC_A, RW (auth): 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00
block number 92, status: 01 a6
State:
Polling disabled: no
Authenticated: yes
[=] ----------------------------