Differences

This shows you the differences between two versions of the page.

--- cvend [2026-03-03 21:02 UTC (4 weeks ago)] – more reader->host msg types doof
+++ cvend [2026-03-17 20:08 UTC (2 weeks ago)] (current) – [Card reader flow] penguinowl
@@ Line 1: / Line 1: @@
 ====== cVEND NFC Reader ======
 cVEND is the NFC reader on the bottom half of the PM3
@@ Line 7: / Line 6: @@
 The associated serial device appears to be at ''%%/dev/ttymxc3%%'' in Linux.
 ===== cVEND protocol notes =====
@@ Line 67: / Line 65: @@
 | 0xba | -> | | //unknown, registered in ProxCardDesfire::ProxCardDesfire(RFIDReader&)// |
 | 0xbb | <- | DESFireCardRemoved | sent by reader when DESFire card removed from field |
-| 0xbc | -> | | //unknown, registered in ProxCardDesfire::ProxCardDesfire(RFIDReader&)// |
+| 0xbc | -> | DESFireCommand | sends desfire command, documented in {{ 0:m075031_desfire.pdf}} |
+| 0xbd | <- | DESFireCommandReply | response to command, documented above |
 | 0xbe | <- | UnhandledCard | sent by reader when a card is presented that is not supported by any enabled ProxCardFunction, containing UID, historical bytes, and other data |
 | 0xce | -> | | //unknown, registered in IppHandling::IppHandling()// |
@@ Line 83: / Line 82: @@
 -> - Host to Reader\\
 <- - Reader to Host
+==== Sample reader flow ====
+  - Host enables desired card type with ''ProxCardFunction''.
+  - Reader acknowledges with ''ProxCardFunctionReply''.
+  - Reader waits for card, seems like it eventually goes to sleep without any stimuli. Might have to keep it awake by sending packets occasionally (e.g. ''Status'').
+  - When card is scanned, reader sends the corresponding read packet if the card type is enabled (e.g. ''DESFireRead'' for DESFire). If type is not enabled, sends ''UnhandledCard''.
+  - Card data can then be queried by sending the equivalent command packets. DESFire commands are documented in {{ 0:m075031_desfire.pdf }}. Example for reading a page off a DESFire ( all of the following packets are of type ''DESFireCommand'' and ''DESFireCommandReply''):
+  - Host sets DESFire application (e.g. packet type ''DESFireCommand'' with body ''0x5AF210E0'' for application ID ''0xE010F2''). **NOTE:** The application ID will vary between issuer/agency. For example, the stock software uses application ID ''F9C32B'' while Portland's TriMet uses the one in the example. You can check this for your card with an NFC reader or app.
+  - Reader responds with a status code in accordance with the documentation. This comes in the form of a ''DESFireCommandReply'' packet.
+  - Host sends read command. To read the full contents of file 0x00, the body is ''0xBD00000000000000''.
+  - Reader responds with the status code and file data.
 ==== Reader -> Host ====