User Tools

Site Tools


epa_basis_reader

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Last revision Both sides next revision
epa_basis_reader [2010/12/06 23:11]
steve_m [The PSoC microcontroller (Cypress CY7C64316)]
epa_basis_reader [2012/12/02 22:51]
steve_m [The chips]
Line 1: Line 1:
-====== ReinerSCT RFID basis reader ​======+====== ​Taking apart the ReinerSCT ​nPA RFID Basisreader ​======
  
 The ReinerSCT basis reader is a pretty basic reader for mifare cards and the new german ident-card (ePA or nPA). The ReinerSCT basis reader is a pretty basic reader for mifare cards and the new german ident-card (ePA or nPA).
-It was sold with german computer-magazine ComputerBild 26/2010 for €3,70 instead of the initial ​€34,90. It comes with a OWOK rfid card.+It was sold with german computer-magazine ComputerBild 26/2010 for €3,70 instead of the retail ​€34,90. It comes with a OWOK rfid card.
 There is a [[http://​www.mikrocontroller.net/​topic/​199865|thread]] on german µC-related forums [[http://​www.mikrocontroller.net/​|Mikrocontroller.net]] discussing the hackability of this reader as well. There is a [[http://​www.mikrocontroller.net/​topic/​199865|thread]] on german µC-related forums [[http://​www.mikrocontroller.net/​|Mikrocontroller.net]] discussing the hackability of this reader as well.
 +
 +Someone did a [[http://​sebastianschaper.net/​index.php/​archives/​13/​|nice writeup]] on the details of the OWOK-card that comes with the reader (german), and here's [[http://​www.twam.info/​hardware/​reiner-sct-rfid-basis-leser-teardown|another teardown]].
  
 ===== The package ===== ===== The package =====
Line 21: Line 23:
 ===== The chips ===== ===== The chips =====
  
-^NXP PN512 (RFID transceiver,​ [[http://​www.nxp.com/​documents/​data_sheet/​111334.pdf|datasheet]])^Cypress [[http://​www.cypress.com/?​mpn=CY7C64316-16LKXC|CY7C64316]] ([[http://​www.cypress.com/?​docID=24330|datasheet]]),​ implements the USB CCID -> PN512 SPI interface+^NXP PN512 (RFID transceiver,​ [[http://​www.nxp.com/​documents/​data_sheet/​111334.pdf|datasheet]])^ 
-|package: HVQFN32 (SOT617-1)|package:​ HVQFN16 (SOT758-1)| +|package: HVQFN32 (SOT617-1)| 
-|{{:​rfid_pn512.jpg|NXP PN512}} | {{:​rfid_4316.jpg|4316}}|+|{{:​rfid_pn512.jpg|NXP PN512}}|
  
-^MUAB LEVB (5V -> 3.3V voltage regulator)^ +^Cypress [[http://​www.cypress.com/?​mpn=CY7C64316-16LKXC|CY7C64316]] ([[http://​www.cypress.com/?​docID=35960|datasheet]]),​ implements the USB CCID -> PN512 SPI interface^ 
-|{{:​rfid_muab.jpg|MUAB}}|+|package: HVQFN16 (SOT758-1)| 
 +|{{:​rfid_4316.jpg|4316}}| 
 + 
 +^NSC [[http://​www.national.com/​mpf/​LP/​LP3982.html#​Overview|LP3982 (LP3982IMM-ADJ)]] ([[http://​www.national.com/​ds/​LP/​LP3982.pdf|datasheet]])  ​(5V -> 3.3V voltage regulator)^^ 
 +|package marking: MUA8 / LEVB|package:​ [[http://​www.national.com/​mpf/​LP/​LP3982.html#​Packaging|8-Pin MSOP/​MINI-SOIC]]| 
 +|{{:​rfid_muab.jpg|LP3982}}||
  
 ===== Connection between the chips ===== ===== Connection between the chips =====
  
-The reader uses the SPI mode of the NXP PN512, and some of the signals go to testpoints (note that they are swapped).+The reader uses the SPI mode of the NXP PN512, and some of the signals go to testpoints ​<del>(note that they are swapped)</​del>​. The testpoints are for ISSP programming of the PSoC (needs DATA, CLK, RESET (XRES), GND and VCC).
  
 ^signal^pin on the 4316^pin on the PN512^testpoint^ ^signal^pin on the 4316^pin on the PN512^testpoint^
Line 43: Line 50:
  
 For handling the USB connection and controlling the RFID transceiver,​ the reader uses a Cypress PSoC microcontroller. For handling the USB connection and controlling the RFID transceiver,​ the reader uses a Cypress PSoC microcontroller.
-There is a free (windows-only) [[http://​www.cypress.com/?​rID=41083|IDE with built-in C-Compiler]] available. For more information see the [[http://​www.cypress.com/?​docID=24330|Datasheet]] as well as the [[http://​www.cypress.com/?​rID=14665|Technical Reference ​manual]].+There is a free (windows-only) [[http://​www.cypress.com/?​rID=41083|IDE with built-in C-Compiler]] available. For more information see the [[http://​www.cypress.com/?​docID=24330|datasheet]] as well as the [[http://​www.cypress.com/?​rID=14665|Technical Reference ​Manual]].
  
-Specs:+**Specs:**
   * 32KB flash   * 32KB flash
   * 2KB RAM   * 2KB RAM
   * M8C architecture   * M8C architecture
 +    * There is an open-source assembler for this architecture called m8cas, which is part of [[http://​m8cutils.sourceforge.net/​index.html|m8cutils]]
 +    * contains a disassembler as well, m8cdas
 +    * There'​s another disassembler called m8cdis: [[http://​www.cypress.com/?​app=forum&​id=1573&​rID=43998|forum post]], [[https://​code.google.com/​p/​m8cdis/​|code]]
 +    * [[http://​www.das-labor.org/​wiki/​GRAS/​en|GRAS]],​ the Generic Assembler, supports the m8c as well
 +    * Yet another assembler, GPLv2 bootloader, USB code [[http://​iguanaworks.net/​projects/​IguanaIR/​browser/​trunk|here]]
   * internal oscillator with up to 24MHz   * internal oscillator with up to 24MHz
   * supports ISSP (in-system serial programming)   * supports ISSP (in-system serial programming)
-    ​it doesn'​t seem that there are any open-source programmers like for the AVR out there + 
-    * the Cypress [[http://​www.cypress.com/?​rID=3412|CY3210 MiniProg1]] ​seems to support the CY7C64316+**Notes:** 
 +  * [[http://​m8cutils.sourceforge.net/​index.html#​progssrc|m8cprogs]],​ as part of m8cutils, contains schematics ​for various programmers,​ <​del>​but it is unclear yet if it works with the enCoRe V series of PSoCs (to which the CY7C64316 belongs to)</​del>​ 
 +  * the Cypress [[http://​www.cypress.com/?​rID=3412|CY3210 MiniProg1]] ​supports the CY7C64316 
 +  * I hacked m8cprog ​to support the chip, by sniffing what the MiniProg1 does, so it is now possible to flash custom code via ISSP without the need for a quite expensive MiniProg1 
 +    * Get the code [[https://​github.com/​steve-m/​m8cutils/​tree/​cy7_prog|here]] 
 +  * With a few tricks I was able to [[http://​www.youtube.com/​watch?​v=R6NdeUanK7s|dump]] the firmware
  
 ^the chip^package pinout^pin^port^I/​O^signal^ ​ ^the chip^package pinout^pin^port^I/​O^signal^ ​
Line 76: Line 93:
 /* NXP PN512 initialization /* NXP PN512 initialization
  * this was obtained by sniffing the communication between the PN512 and the  * this was obtained by sniffing the communication between the PN512 and the
- ​* ​USB-chip ​in the ReinerSCT Basisreader,​ and decoding it with the datasheet.+ ​* ​CY7C64316 ​in the ReinerSCT Basisreader,​ and decoding it with the datasheet.
  *  *
  * (C) 2010 by Steve Markgraf <​steve@steve-m.de>​  * (C) 2010 by Steve Markgraf <​steve@steve-m.de>​
Line 370: Line 387:
 Device Status: ​    ​0x0000 Device Status: ​    ​0x0000
   (Bus Powered)</​code>​   (Bus Powered)</​code>​
 +  ​
 +===== Other readers =====
 +
 +There are other devices (Basislesegeräte) which have been [[http://​www.ccepa.de/​basiskartenleser|certified by the BSI]]:
 +
 +^device^SCM SCL011^SCM SDI011 (not yet certified)^SCM SDI010^
 +|link|[[http://​www.scmmicro.com/​de/​products-services/​chipkartenleser-terminals/​kontaktlos-dual-interface/​scl011.html|SCL011]]|[[http://​www.scmmicro.com/​products-services/​smart-card-readers-terminals/​contactless-dual-interface-readers/​sdi010.html|SDI011]]| |
 +|type|RFID|RFID/​SC dual|RFID/​SC dual|
 +|used microcontroller|SCM STC3|SCM STC II-B|SCM STC II-B|
 +|used RFID transceiver|NXP PM512HN|?​|?​|
 +|firmware update available|[[http://​support.scmmicro.com/​dfu_fw.php?​lang=0&​readerno=85|yes]]|no|[[http://​support.scmmicro.com/​dfu_fw.php?​lang=0&​readerno=83|yes]]|
 +|FCC-ID|[[https://​fjallfoss.fcc.gov/​oetcf/​eas/​reports/​ViewExhibitReport.cfm?​mode=Exhibits&​RequestTimeout=500&​calledFromFrame=N&​application_id=913923&​fcc_id=%27MBPSCL011-4400%27|MBPSCL011-4400]]|[[https://​fjallfoss.fcc.gov/​oetcf/​eas/​reports/​ViewExhibitReport.cfm?​mode=Exhibits&​RequestTimeout=500&​calledFromFrame=N&​application_id=731440&​fcc_id=%27MBPSDI011-1000%27|MBPSDI011-1000]]|[[https://​fjallfoss.fcc.gov/​oetcf/​eas/​reports/​ViewExhibitReport.cfm?​mode=Exhibits&​RequestTimeout=500&​calledFromFrame=N&​application_id=662322&​fcc_id=%27MBPSDI010MOD02%27|MBPSDI010MOD02]]|
 +|pcb pictures| ​ yes, see link above ('​Internal photos'​) ​ |||
 +
 +
 +~~DISCUSSION~~
epa_basis_reader.txt · Last modified: 2012/12/02 22:52 by steve_m