User Tools

Site Tools


epa_basis_reader

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
epa_basis_reader [2010/12/06 23:11]
steve_m [The PSoC microcontroller (Cypress CY7C64316)]
epa_basis_reader [2012/12/02 22:52]
steve_m [The chips]
Line 1: Line 1:
-====== ReinerSCT RFID basis reader ​======+====== ​Taking apart the ReinerSCT ​nPA RFID Basisreader ​======
  
 The ReinerSCT basis reader is a pretty basic reader for mifare cards and the new german ident-card (ePA or nPA). The ReinerSCT basis reader is a pretty basic reader for mifare cards and the new german ident-card (ePA or nPA).
-It was sold with german computer-magazine ComputerBild 26/2010 for €3,70 instead of the initial ​€34,90. It comes with a OWOK rfid card.+It was sold with german computer-magazine ComputerBild 26/2010 for €3,70 instead of the retail ​€34,90. It comes with a OWOK rfid card.
 There is a [[http://​www.mikrocontroller.net/​topic/​199865|thread]] on german µC-related forums [[http://​www.mikrocontroller.net/​|Mikrocontroller.net]] discussing the hackability of this reader as well. There is a [[http://​www.mikrocontroller.net/​topic/​199865|thread]] on german µC-related forums [[http://​www.mikrocontroller.net/​|Mikrocontroller.net]] discussing the hackability of this reader as well.
 +
 +Someone did a [[http://​sebastianschaper.net/​index.php/​archives/​13/​|nice writeup]] on the details of the OWOK-card that comes with the reader (german), and here's [[http://​www.twam.info/​hardware/​reiner-sct-rfid-basis-leser-teardown|another teardown]].
  
 ===== The package ===== ===== The package =====
Line 21: Line 23:
 ===== The chips ===== ===== The chips =====
  
-^NXP PN512 (RFID transceiver,​ [[http://​www.nxp.com/​documents/​data_sheet/​111334.pdf|datasheet]])^Cypress [[http://​www.cypress.com/?​mpn=CY7C64316-16LKXC|CY7C64316]] ([[http://​www.cypress.com/?​docID=24330|datasheet]]),​ implements the USB CCID -> PN512 SPI interface+^NXP PN512 (RFID transceiver,​ [[http://​www.nxp.com/​documents/​data_sheet/​PN512.pdf|datasheet]])^ 
-|package: HVQFN32 (SOT617-1)|package:​ HVQFN16 (SOT758-1)| +|package: HVQFN32 (SOT617-1)| 
-|{{:​rfid_pn512.jpg|NXP PN512}} | {{:​rfid_4316.jpg|4316}}|+|{{:​rfid_pn512.jpg|NXP PN512}}|
  
-^MUAB LEVB (5V -> 3.3V voltage regulator)^ +^Cypress [[http://​www.cypress.com/?​mpn=CY7C64316-16LKXC|CY7C64316]] ([[http://​www.cypress.com/?​docID=35960|datasheet]]),​ implements the USB CCID -> PN512 SPI interface^ 
-|{{:​rfid_muab.jpg|MUAB}}|+|package: HVQFN16 (SOT758-1)| 
 +|{{:​rfid_4316.jpg|4316}}| 
 + 
 +^NSC [[http://​www.national.com/​mpf/​LP/​LP3982.html#​Overview|LP3982 (LP3982IMM-ADJ)]] ([[http://​www.national.com/​ds/​LP/​LP3982.pdf|datasheet]])  ​(5V -> 3.3V voltage regulator)^^ 
 +|package marking: MUA8 / LEVB|package:​ [[http://​www.national.com/​mpf/​LP/​LP3982.html#​Packaging|8-Pin MSOP/​MINI-SOIC]]| 
 +|{{:​rfid_muab.jpg|LP3982}}||
  
 ===== Connection between the chips ===== ===== Connection between the chips =====
  
-The reader uses the SPI mode of the NXP PN512, and some of the signals go to testpoints (note that they are swapped).+The reader uses the SPI mode of the NXP PN512, and some of the signals go to testpoints ​<del>(note that they are swapped)</​del>​. The testpoints are for ISSP programming of the PSoC (needs DATA, CLK, RESET (XRES), GND and VCC).
  
 ^signal^pin on the 4316^pin on the PN512^testpoint^ ^signal^pin on the 4316^pin on the PN512^testpoint^
Line 43: Line 50:
  
 For handling the USB connection and controlling the RFID transceiver,​ the reader uses a Cypress PSoC microcontroller. For handling the USB connection and controlling the RFID transceiver,​ the reader uses a Cypress PSoC microcontroller.
-There is a free (windows-only) [[http://​www.cypress.com/?​rID=41083|IDE with built-in C-Compiler]] available. For more information see the [[http://​www.cypress.com/?​docID=24330|Datasheet]] as well as the [[http://​www.cypress.com/?​rID=14665|Technical Reference ​manual]].+There is a free (windows-only) [[http://​www.cypress.com/?​rID=41083|IDE with built-in C-Compiler]] available. For more information see the [[http://​www.cypress.com/?​docID=24330|datasheet]] as well as the [[http://​www.cypress.com/?​rID=14665|Technical Reference ​Manual]].
  
-Specs:+**Specs:**
   * 32KB flash   * 32KB flash
   * 2KB RAM   * 2KB RAM
   * M8C architecture   * M8C architecture
 +    * There is an open-source assembler for this architecture called m8cas, which is part of [[http://​m8cutils.sourceforge.net/​index.html|m8cutils]]
 +    * contains a disassembler as well, m8cdas
 +    * There'​s another disassembler called m8cdis: [[http://​www.cypress.com/?​app=forum&​id=1573&​rID=43998|forum post]], [[https://​code.google.com/​p/​m8cdis/​|code]]
 +    * [[http://​www.das-labor.org/​wiki/​GRAS/​en|GRAS]],​ the Generic Assembler, supports the m8c as well
 +    * Yet another assembler, GPLv2 bootloader, USB code [[http://​iguanaworks.net/​projects/​IguanaIR/​browser/​trunk|here]]
   * internal oscillator with up to 24MHz   * internal oscillator with up to 24MHz
   * supports ISSP (in-system serial programming)   * supports ISSP (in-system serial programming)
-    ​it doesn'​t seem that there are any open-source programmers like for the AVR out there + 
-    * the Cypress [[http://​www.cypress.com/?​rID=3412|CY3210 MiniProg1]] ​seems to support the CY7C64316+**Notes:** 
 +  * [[http://​m8cutils.sourceforge.net/​index.html#​progssrc|m8cprogs]],​ as part of m8cutils, contains schematics ​for various programmers,​ <​del>​but it is unclear yet if it works with the enCoRe V series of PSoCs (to which the CY7C64316 belongs to)</​del>​ 
 +  * the Cypress [[http://​www.cypress.com/?​rID=3412|CY3210 MiniProg1]] ​supports the CY7C64316 
 +  * I hacked m8cprog ​to support the chip, by sniffing what the MiniProg1 does, so it is now possible to flash custom code via ISSP without the need for a quite expensive MiniProg1 
 +    * Get the code [[https://​github.com/​steve-m/​m8cutils/​tree/​cy7_prog|here]] 
 +  * With a few tricks I was able to [[http://​www.youtube.com/​watch?​v=R6NdeUanK7s|dump]] the firmware
  
 ^the chip^package pinout^pin^port^I/​O^signal^ ​ ^the chip^package pinout^pin^port^I/​O^signal^ ​
Line 76: Line 93:
 /* NXP PN512 initialization /* NXP PN512 initialization
  * this was obtained by sniffing the communication between the PN512 and the  * this was obtained by sniffing the communication between the PN512 and the
- ​* ​USB-chip ​in the ReinerSCT Basisreader,​ and decoding it with the datasheet.+ ​* ​CY7C64316 ​in the ReinerSCT Basisreader,​ and decoding it with the datasheet.
  *  *
  * (C) 2010 by Steve Markgraf <​steve@steve-m.de>​  * (C) 2010 by Steve Markgraf <​steve@steve-m.de>​
Line 370: Line 387:
 Device Status: ​    ​0x0000 Device Status: ​    ​0x0000
   (Bus Powered)</​code>​   (Bus Powered)</​code>​
 +  ​
 +===== Other readers =====
 +
 +There are other devices (Basislesegeräte) which have been [[http://​www.ccepa.de/​basiskartenleser|certified by the BSI]]:
 +
 +^device^SCM SCL011^SCM SDI011 (not yet certified)^SCM SDI010^
 +|link|[[http://​www.scmmicro.com/​de/​products-services/​chipkartenleser-terminals/​kontaktlos-dual-interface/​scl011.html|SCL011]]|[[http://​www.scmmicro.com/​products-services/​smart-card-readers-terminals/​contactless-dual-interface-readers/​sdi010.html|SDI011]]| |
 +|type|RFID|RFID/​SC dual|RFID/​SC dual|
 +|used microcontroller|SCM STC3|SCM STC II-B|SCM STC II-B|
 +|used RFID transceiver|NXP PM512HN|?​|?​|
 +|firmware update available|[[http://​support.scmmicro.com/​dfu_fw.php?​lang=0&​readerno=85|yes]]|no|[[http://​support.scmmicro.com/​dfu_fw.php?​lang=0&​readerno=83|yes]]|
 +|FCC-ID|[[https://​fjallfoss.fcc.gov/​oetcf/​eas/​reports/​ViewExhibitReport.cfm?​mode=Exhibits&​RequestTimeout=500&​calledFromFrame=N&​application_id=913923&​fcc_id=%27MBPSCL011-4400%27|MBPSCL011-4400]]|[[https://​fjallfoss.fcc.gov/​oetcf/​eas/​reports/​ViewExhibitReport.cfm?​mode=Exhibits&​RequestTimeout=500&​calledFromFrame=N&​application_id=731440&​fcc_id=%27MBPSDI011-1000%27|MBPSDI011-1000]]|[[https://​fjallfoss.fcc.gov/​oetcf/​eas/​reports/​ViewExhibitReport.cfm?​mode=Exhibits&​RequestTimeout=500&​calledFromFrame=N&​application_id=662322&​fcc_id=%27MBPSDI010MOD02%27|MBPSDI010MOD02]]|
 +|pcb pictures| ​ yes, see link above ('​Internal photos'​) ​ |||
 +
 +
 +~~DISCUSSION~~
epa_basis_reader.txt · Last modified: 2012/12/02 22:52 by steve_m