My Bus Pirate v3 just arrived today, together with a 13.56Mhz RFID module. I bought the stuff at the seeedstudio webshop.
I had to update the Bus Pirate to the v4.1 firmware and v4.1 bootloader (and resolder the LED’s). The Bus Pirate use a FTDI USB Serial chip, so make sure you installed this driver.
Now let the fun begin, wire up the Bus Pirate and the RFID module like that:
1 2 3 4 5 | RESET —> AUX RXD —> MOSI (TX) TXD —> MISO (RX) GND —> GND +5V (DC) —>+5V |
Now fire up a terminal (I use CoolTerm on a Mac, 115200/8N1), activate the UART Mode, enter ‘W’ to active the +5V power supply, enter ‘a’ to trigger the reset (AUX LOW)
The whole procedure as serial dump:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 | > m 1. HiZ 2. 1-WIRE 3. UART 4. I2C 5. SPI 6. JTAG 7. RAW2WIRE 8. RAW3WIRE 9. PC KEYBOARD 10. LCD (1) >3 Mode selected Set serial port speed: (bps) 1. 300 … 5. 9600 … 10. 31250 (MIDI) (1) >5 Data bits and parity: 1. 8, NONE *default … (1) > Stop bits: 1. 1 *default 2. 2 (1) > Receive polarity: 1. Idle 1 *default 2. Idle 0 (1) > Select output type: 1. Open drain (H=Hi-Z, L=GND) 2. Normal (H=3.3V, L=GND) (1) > READY UART>W POWER SUPPLIES ON UART>a AUX LOW |
Some geek pr0n:
Closeup of the RFID reader:
I also bought a 13.56Mhz Mifare-One RFID card — read the card serial was my first task. But first some basics…
On the seeedstudio rfid reader product page is a sdk available — but I found a much better protocol description (more detail, more examples…).
How to communicate with the RFID module:
[0xAA STATION-ID DATA-LENGTH CMD OPTIONAL-DATA XOR-CHECKSUM 0xBB]
Each command begins with 0xAA and ends with 0xBB. The XOR checksum is calculated by XOR’ing each byte of the msg, exclusive the 0xAA and 0xBB byte. For more detail check the SDK/pdf file.
Examples:
Execute MF_GET_SNR (0x25, try to read the cards serial nr.):
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | UART>[0xAA 0x00 0x03 0x25 0x26 0x00 0x00 0xBB UART LIVE DISPLAY, } TO STOP WRITE: 0xAA — start of text WRITE: 0x00 — point-to-point communication mode WRITE: 0x03 — data length WRITE: 0x25 — cmd: MF_GET_SNR WRITE: 0x26 — 0x26 Request Idle WRITE: 0x00 — do not need to execute the halt command WRITE: 0x00 — checksum WRITE: 0xBB — end of text UART> READ: –f 0x00 READ: 0xAA — start of text READ: 0x00 — point-to-point communication mode READ: 0x06 — data length READ: 0x00 — status 0x00 — ok READ: 0x00 — 0x00 Only one card is in the readable area READ: 0x3C — serial nr, byte 1 READ: 0xEF — serial nr, byte 2 READ: 0xC8 — serial nr, byte 3 READ: 0x3C — serial nr, byte 4 READ: 0x21 — checksum READ: 0xBB — end of text |
So the serial for my mifare card is 0x3C 0xEF 0xC8 0x3C.
MF_Read (0x20, read data from the card)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 | UART>[0xAA 0x00 0x0A 0x20 0x01 0x01 0x10 0xff 0xff 0xff 0xff 0xff 0xff 0x3A 0xBB UART LIVE DISPLAY, } TO STOP WRITE: 0xAA — start of text WRITE: 0x00 — point-to-point communication mode WRITE: 0x0A — data length WRITE: 0x20 — cmd: MF_READ WRITE: 0x01 — Mode Control, Request all, Use Key A WRITE: 0x01 — Read one block WRITE: 0x10 — Start address of block WRITE: 0xFF — Start of key (6 bytes) WRITE: 0xFF WRITE: 0xFF WRITE: 0xFF WRITE: 0xFF WRITE: 0xFF — End of key WRITE: 0x3A — checksum WRITE: 0xBB — end of text UART> READ: –f 0x00 READ: 0xAA — start of text READ: 0x00 — point-to-point communication mode READ: 0x15 — data length READ: 0x00 — status ok READ: 0x3C — serial nr, byte 1 READ: 0xEF — serial nr, byte 2 READ: 0xC8 — serial nr, byte 3 READ: 0x3C — serial nr, byte 4 READ: 0xFF — data from the card READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0xFF READ: 0x11 READ: 0x11 — data from the card READ: 0x32 — checksum READ: 0xBB — end of text |
Writing to the card is also tested and worked fine. You may put Bus Pirate into transparent mode (enter ‘(0)’ to get all available modes) and use this module with other RFID software. Perhaps RFIDIOt or libnfc — both packages needs a patch to support the RDM880 module…
Links:
http://code.google.com/p/the-bus-pirate/
http://dangerousprototypes.com/forum/
python rb880 library
One Trackback