Link to this headingFeliCa

  • Made by Sony
  • Operates at 13.56 MHz
    • Bitrate fc/64 212kbps
  • Cards used for Hong Kong Transit System (Octopus)
  • Uses 3DES

Timing Document
Commands

Link to this headingSuica

Japanese Transit Card

Card Info:

[usb] pm3 --> hf felica info [=] --- Tag Information --------------------------- [=] IDm............ 0101021498173609 [=] Code........... 0101 [=] NFCID2......... 021498173609 [=] Parameter [=] PAD............ 053143454682B7FF [=] IC code........ 0531 ( Suica card (FeliCa Standard RC-S ?) ) [=] MRT............ 43454682B7FF [=] Service code... 03 0B

Common Commands:

[usb] pm3 --> hf felica rqresponse [=] Using last known IDm... 0A040101021498173609 [+] (15) B2 4D 0B 05 01 01 02 14 98 17 36 09 00 6B 82 [+] Request Response [+] IDm...... 01 01 02 14 98 17 36 09 [+] Mode... 00 [usb] pm3 --> hf felica rqsyscode [=] Using last known IDm... 0A0C0101021498173609 [+] (21) B2 4D 11 0D 01 01 02 14 98 17 36 09 03 00 03 FE 00 86 A7 2C CD [+] Request Response [+] IDm... 01 01 02 14 98 17 36 09 [+] - Number of Systems: 03 [+] - System Codes: enumerated in ascending order starting from System 0. [+] - 00 03 [+] - FE 00 [+] - 86 A7 [usb] pm3 --> hf felica rqspecver [=] Using last known IDm... 0C3C01010214981736090000 [+] (22) B2 4D 12 3D 01 01 02 14 98 17 36 09 00 00 00 00 85 01 00 85 66 87 [+] Got Request Response [+] IDm............ 01 01 02 14 98 17 36 09 [+] Status Flag1... 00 [+] Status Flag2... 00 [+] Format Version..... 00 [+] Basic Version...... 00 85 [+] Number of Option... 01 [+] Option Version List... [+] - 00 85

FeliCa Light:

[usb] pm3 --> hf felica litedump [+] FeliCa lite - dump started [=] Press pm3 button or press <Enter> to abort dumping [#] 28 60 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [#] 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 [+] Recorded Activity (trace len = 532 bytes) [=] 00 | 00 01 A6 28 60 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 01 01 A6 28 00 82 B7 FF AD B4 00 00 00 | ...(`.................(......... [=] 01 | 00 00 00 00 00 00 02 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 03 01 A6 28 00 82 B7 | .........(..................(... [=] 02 | FF AD B4 00 00 00 00 00 00 00 00 00 04 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 05 | ...............(................ [=] 03 | 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 06 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 | ..(..................(.......... [=] 04 | 00 00 00 00 00 07 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 08 01 A6 28 00 82 B7 FF | ........(..................(.... [=] 05 | AD B4 00 00 00 00 00 00 00 00 00 09 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 0A 01 | ..............(................. [=] 06 | A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 0B 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 | .(..................(........... [=] 07 | 00 00 00 00 0C 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 0D 01 A6 28 00 82 B7 FF AD | .......(..................(..... [=] 08 | B4 00 00 00 00 00 00 00 00 00 0E 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 80 01 A6 | .............(.................. [=] 09 | 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 81 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 | (..................(............ [=] 10 | 00 00 00 82 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 83 01 A6 28 00 82 B7 FF AD B4 | ......(..................(...... [=] 11 | 00 00 00 00 00 00 00 00 00 84 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 85 01 A6 28 | ............(..................( [=] 12 | 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 86 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 | ..................(............. [=] 13 | 00 00 87 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 88 01 A6 28 00 82 B7 FF AD B4 00 | .....(..................(....... [=] 14 | 00 00 00 00 00 00 00 00 90 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 91 01 A6 28 00 | ...........(..................(. [=] 15 | 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 92 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 | .................(.............. [=] 16 | 00 A0 01 A6 28 00 82 B7 FF AD B4 00 00 00 00 00 00 00 00 00 | ....(............... [=] ------------------------------------------------------------------------------------ block number 00, status: 01 a6 S_PAD0: 28 60 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 01, status: 01 a6 S_PAD1: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 02, status: 01 a6 S_PAD2: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 03, status: 01 a6 S_PAD3: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 04, status: 01 a6 S_PAD4: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 05, status: 01 a6 S_PAD5: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 06, status: 01 a6 S_PAD6: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 07, status: 01 a6 S_PAD7: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 08, status: 01 a6 S_PAD8: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 09, status: 01 a6 S_PAD9: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 0a, status: 01 a6 S_PAD10: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 0b, status: 01 a6 S_PAD11: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 0c, status: 01 a6 S_PAD12: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 0d, status: 01 a6 S_PAD13: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 0e, status: 01 a6 REG: regA: -1216217048 regB: 11841023 regC: 0000000000000000 block number 80, status: 01 a6 Random Challenge, WO: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 81, status: 01 a6 MAC, only set on dual read: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 82, status: 01 a6 ID Block, IDd: 0x280082b7ffadb400 DFC: 0x0000 Arb: 000000000000 block number 83, status: 01 a6 DeviceId: IDm: 0x280082b7ffadb400 PMm: 0x0000000000000000 block number 84, status: 01 a6 SER_C: 0x2800 block number 85, status: 01 a6 SYS_Cl 0x2800 block number 86, status: 01 a6 CKV (key version): 0x2800 block number 87, status: 01 a6 CK (card key), WO: 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 88, status: 01 a6 Memory Configuration (MC): MAC needed to write state: off Write with MAC for S_PAD : 0000000000000000 Write with AUTH for S_PAD : 0000000000000000 Read after AUTH for S_PAD : 1011010000000000 MAC needed to write CK and CKV: on RF parameter: 07 Compatible with NDEF: yes Memory config writable : no RW access for S_PAD : 0010100000000000 block number 90, status: 01 a6 Write count, RO: 28 00 82 block number 91, status: 01 a6 MAC_A, RW (auth): 28 00 82 b7 ff ad b4 00 00 00 00 00 00 00 00 00 block number 92, status: 01 a6 State: Polling disabled: no Authenticated: yes [=] ----------------------------