User Tools

Site Tools


epa_basis_reader

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
epa_basis_reader [2010/12/19 14:33]
steve_m [The PSoC microcontroller (Cypress CY7C64316)]
epa_basis_reader [2012/12/02 22:52] (current)
steve_m [The chips]
Line 1: Line 1:
-====== ReinerSCT RFID basis reader ​======+====== ​Taking apart the ReinerSCT ​nPA RFID Basisreader ​======
  
 The ReinerSCT basis reader is a pretty basic reader for mifare cards and the new german ident-card (ePA or nPA). The ReinerSCT basis reader is a pretty basic reader for mifare cards and the new german ident-card (ePA or nPA).
-It was sold with german computer-magazine ComputerBild 26/2010 for €3,70 instead of the initial ​€34,90. It comes with a OWOK rfid card.+It was sold with german computer-magazine ComputerBild 26/2010 for €3,70 instead of the retail ​€34,90. It comes with a OWOK rfid card.
 There is a [[http://​www.mikrocontroller.net/​topic/​199865|thread]] on german µC-related forums [[http://​www.mikrocontroller.net/​|Mikrocontroller.net]] discussing the hackability of this reader as well. There is a [[http://​www.mikrocontroller.net/​topic/​199865|thread]] on german µC-related forums [[http://​www.mikrocontroller.net/​|Mikrocontroller.net]] discussing the hackability of this reader as well.
  
Line 23: Line 23:
 ===== The chips ===== ===== The chips =====
  
-^NXP PN512 (RFID transceiver,​ [[http://​www.nxp.com/​documents/​data_sheet/​111334.pdf|datasheet]])^Cypress [[http://​www.cypress.com/?​mpn=CY7C64316-16LKXC|CY7C64316]] ([[http://​www.cypress.com/?​docID=24330|datasheet]]),​ implements the USB CCID -> PN512 SPI interface^ +^NXP PN512 (RFID transceiver,​ [[http://​www.nxp.com/​documents/​data_sheet/​PN512.pdf|datasheet]])
-|package: HVQFN32 (SOT617-1)|package: HVQFN16 (SOT758-1)| +|package: HVQFN32 (SOT617-1)| 
-|{{:​rfid_pn512.jpg|NXP PN512}} ​| {{:​rfid_4316.jpg|4316}}|+|{{:​rfid_pn512.jpg|NXP PN512}}| 
 + 
 +^Cypress [[http://​www.cypress.com/?​mpn=CY7C64316-16LKXC|CY7C64316]] ([[http://​www.cypress.com/?​docID=35960|datasheet]]),​ implements the USB CCID -> PN512 SPI interface^ 
 +|package: HVQFN16 (SOT758-1)| 
 +|{{:​rfid_4316.jpg|4316}}|
  
 ^NSC [[http://​www.national.com/​mpf/​LP/​LP3982.html#​Overview|LP3982 (LP3982IMM-ADJ)]] ([[http://​www.national.com/​ds/​LP/​LP3982.pdf|datasheet]]) ​ (5V -> 3.3V voltage regulator)^^ ^NSC [[http://​www.national.com/​mpf/​LP/​LP3982.html#​Overview|LP3982 (LP3982IMM-ADJ)]] ([[http://​www.national.com/​ds/​LP/​LP3982.pdf|datasheet]]) ​ (5V -> 3.3V voltage regulator)^^
Line 52: Line 56:
   * 2KB RAM   * 2KB RAM
   * M8C architecture   * M8C architecture
-    * There is an open-source assembler for this architecture called [[http://​m8cutils.sourceforge.net/​index.html|m8cutils]]+    * There is an open-source assembler for this architecture called ​m8cas, which is part of [[http://​m8cutils.sourceforge.net/​index.html|m8cutils]] 
 +    * contains a disassembler as well, m8cdas 
 +    * There'​s another disassembler called m8cdis: [[http://​www.cypress.com/?​app=forum&​id=1573&​rID=43998|forum post]], [[https://​code.google.com/​p/​m8cdis/​|code]] 
 +    * [[http://​www.das-labor.org/​wiki/​GRAS/​en|GRAS]],​ the Generic Assembler, supports the m8c as well 
 +    * Yet another assembler, GPLv2 bootloader, USB code [[http://​iguanaworks.net/​projects/​IguanaIR/​browser/​trunk|here]]
   * internal oscillator with up to 24MHz   * internal oscillator with up to 24MHz
   * supports ISSP (in-system serial programming)   * supports ISSP (in-system serial programming)
Line 60: Line 68:
   * the Cypress [[http://​www.cypress.com/?​rID=3412|CY3210 MiniProg1]] supports the CY7C64316   * the Cypress [[http://​www.cypress.com/?​rID=3412|CY3210 MiniProg1]] supports the CY7C64316
   * I hacked m8cprog to support the chip, by sniffing what the MiniProg1 does, so it is now possible to flash custom code via ISSP without the need for a quite expensive MiniProg1   * I hacked m8cprog to support the chip, by sniffing what the MiniProg1 does, so it is now possible to flash custom code via ISSP without the need for a quite expensive MiniProg1
 +    * Get the code [[https://​github.com/​steve-m/​m8cutils/​tree/​cy7_prog|here]]
   * With a few tricks I was able to [[http://​www.youtube.com/​watch?​v=R6NdeUanK7s|dump]] the firmware   * With a few tricks I was able to [[http://​www.youtube.com/​watch?​v=R6NdeUanK7s|dump]] the firmware
  
Line 84: Line 93:
 /* NXP PN512 initialization /* NXP PN512 initialization
  * this was obtained by sniffing the communication between the PN512 and the  * this was obtained by sniffing the communication between the PN512 and the
- ​* ​USB-chip ​in the ReinerSCT Basisreader,​ and decoding it with the datasheet.+ ​* ​CY7C64316 ​in the ReinerSCT Basisreader,​ and decoding it with the datasheet.
  *  *
  * (C) 2010 by Steve Markgraf <​steve@steve-m.de>​  * (C) 2010 by Steve Markgraf <​steve@steve-m.de>​
epa_basis_reader.1292765586.txt.gz · Last modified: 2010/12/19 00:00 (external edit)