forked from Hay1tsme/segatools
Add HW,FW notes on NFC assembly
This commit is contained in:
Tau
parent
2c6d48ce27
commit
9159be00a2
244
doc/nfc.txt
Normal file
244
doc/nfc.txt
Normal file
@ -0,0 +1,244 @@
|
||||
N.B. Quoted strings are NOT NUL-terminated unless otherwise noted.
|
||||
Useful reading: https://www.nxp.com/docs/en/data-sheet/MF1S50YYX_V1.pdf
|
||||
|
||||
(AiMe branded cards are Mifare Classic cards. Other technologies exist though)
|
||||
|
||||
Summary
|
||||
-------
|
||||
|
||||
Hardware:
|
||||
Assembly connector:
|
||||
5V Host in
|
||||
Tx;Rx;GND Host RS232 in
|
||||
Tx;Rx;GND Daisy-chain out
|
||||
Main board (probably LED controller):
|
||||
Silk "837-15084"
|
||||
CN1: Host 5V power in, ?V NFC-sub power out
|
||||
CN2: Host RS232 Tx;Rx;GND in, NFC-sub Tx;Rx out
|
||||
CN3: LED-Sub power and data(?) out
|
||||
DIPSW1: Set to hex nibble 8.
|
||||
Contains ADM3222 RS232 transceiver IC
|
||||
Contains ATMega32 MCU
|
||||
NFC subboard:
|
||||
Sticker: Model "TN32MSEC003S"
|
||||
CN1: ?V power and Tx;Rx;GND in, Tx;Rx;GND ass'y CN daisy out.
|
||||
DIPSW1: Set to hex nibble 0.
|
||||
Contains ATmega168 MCU
|
||||
Contains ADM3202A RS232 transceiver IC
|
||||
Contains shielded RF circuit
|
||||
Entire non-ground-plane PCB area is visible through the chassis
|
||||
torx screws lol
|
||||
LED subboard:
|
||||
Silk: "837-15120"
|
||||
CN1: ?V power and Tx;Rx;GND in.
|
||||
Five RGB LEDs and a bunch of resistors
|
||||
No visible logic ICs..?
|
||||
No DIPSW.
|
||||
|
||||
JVS framing:
|
||||
E0 sync
|
||||
D0 escape (+1 to unescape)
|
||||
Checksum is sum of bytes after unescaping
|
||||
|
||||
Frame header:
|
||||
Frame length (including length byte itself)
|
||||
Address
|
||||
Sequence no, hopefully loops before hitting esc byte...
|
||||
Command byte
|
||||
|
||||
Bus addressing:
|
||||
Low nibble set using DIPSWs
|
||||
High nibble ???
|
||||
Daisy chaining mechanism unknown (RS232 wires probably multi-tap)
|
||||
|
||||
Startup
|
||||
-------
|
||||
|
||||
Addr 00 Command 62:
|
||||
Req:
|
||||
00 Payload length
|
||||
Resp:
|
||||
00 Status byte
|
||||
00 Payload length
|
||||
Description:
|
||||
Unknown. Reset?
|
||||
|
||||
Addr 00 Command 30:
|
||||
Req:
|
||||
00 Payload length
|
||||
Resp:
|
||||
00 Status byte
|
||||
17 Payload length
|
||||
.. "TN32MSEC003S F/W Ver1.2E"
|
||||
Description:
|
||||
Get firmware version
|
||||
|
||||
Addr 00 Command 32:
|
||||
Req:
|
||||
00 Payload length
|
||||
Resp:
|
||||
00 Status byte
|
||||
17 Payload length
|
||||
.. "TN32MSEC003S H/W Ver3.0J"
|
||||
Description:
|
||||
Get hardware version
|
||||
|
||||
Addr 08 Command f5:
|
||||
Req:
|
||||
00 Payload length
|
||||
Resp:
|
||||
00 Status byte
|
||||
00 Payload length
|
||||
Description:
|
||||
LED sub-board reset.
|
||||
Won't accept LED commands until you do this.
|
||||
|
||||
Addr 08 Command f0:
|
||||
Req:
|
||||
00 Payload length
|
||||
Resp:
|
||||
00 Status byte
|
||||
09 Payload length
|
||||
.. "15084" (part nr for LED board)
|
||||
FF ??
|
||||
11 ??
|
||||
00 ??
|
||||
12 ??
|
||||
Description:
|
||||
Get board "info"
|
||||
|
||||
Addr 00 Command 54:
|
||||
Req:
|
||||
06 Payload length
|
||||
57 'W'
|
||||
43 'C'
|
||||
43 'C'
|
||||
46 'F'
|
||||
76 'v'
|
||||
32 '2'
|
||||
Resp:
|
||||
00 Status byte?
|
||||
00 ??
|
||||
Description:
|
||||
Set Mifare KeyA.
|
||||
"WCCF" might refer this this SEGA arcade game:
|
||||
https://en.wikipedia.org/wiki/World_Club_Champion_Football
|
||||
It's quite old and has AiMe readers, maybe where they first appeared?
|
||||
|
||||
Addr 00 Command 50:
|
||||
Req:
|
||||
06 Payload length
|
||||
60 ??
|
||||
90 ??
|
||||
D0 ?? (This is escaped of course)
|
||||
06 ??
|
||||
32 ??
|
||||
F5 ??
|
||||
Resp:
|
||||
00 Status byte
|
||||
00 Payload length
|
||||
Description:
|
||||
Possibly Mifare KeyB.
|
||||
|
||||
Polling
|
||||
-------
|
||||
|
||||
Addr 00 Command 40:
|
||||
Req:
|
||||
01 Payload length
|
||||
03 ??
|
||||
Resp:
|
||||
00 Status byte
|
||||
00 Payload length
|
||||
Description:
|
||||
Poll some other NFC technology?
|
||||
|
||||
Addr 00 Command 42:
|
||||
Req:
|
||||
00 Payload length
|
||||
Resp if no MiFare card:
|
||||
00 Status byte
|
||||
01 Payload length
|
||||
00 (represents nothing i guess)
|
||||
Resp if MiFare card:
|
||||
00 Status byte?
|
||||
07 Payload length
|
||||
01 Chunk length?
|
||||
10 ?? Block size maybe?
|
||||
04 Chunk length?
|
||||
.. Mifare UID, four bytes.
|
||||
Description:
|
||||
Check for Mifare card presence?
|
||||
|
||||
Addr 00 Command 41:
|
||||
Req:
|
||||
00 Payload length
|
||||
Resp:
|
||||
00 Status byte
|
||||
00 Payload length
|
||||
Description:
|
||||
Unknown. Poll some other NFC technology?
|
||||
|
||||
Card read
|
||||
---------
|
||||
|
||||
Addr 00 Command 43:
|
||||
Req:
|
||||
04 Payload length
|
||||
.. Mifare UID, four bytes.
|
||||
Resp:
|
||||
00 Status byte
|
||||
00 Payload length
|
||||
Description:
|
||||
Select MiFare by UID?
|
||||
|
||||
Addr 00 Command 55:
|
||||
Req:
|
||||
05 Payload length
|
||||
.. Mifare UID, four bytes.
|
||||
03 ??
|
||||
Resp:
|
||||
00 Status byte
|
||||
00 Payload length
|
||||
Description:
|
||||
Unknown.
|
||||
Block 3 on a Mifare sector contains keys and an access control list.
|
||||
It is generally not accessed directly (unless being provisioned?)
|
||||
|
||||
Addr 00 Command 52:
|
||||
Req:
|
||||
05 Payload length
|
||||
.. Mifare UID, four bytes.
|
||||
.. Block number, 1 or 2.
|
||||
Resp for Block 1:
|
||||
00 Status byte
|
||||
10 Payload length (1 block)
|
||||
.. "SBSD"
|
||||
00 00 00 00
|
||||
00 00 00 00
|
||||
00 4E C6 22
|
||||
Resp for Block 2:
|
||||
00 Status byte
|
||||
10 Payload length (1 block)
|
||||
.. 00 00 00 00 00 00 xx xx
|
||||
xx xx xx xx xx xx xx xx
|
||||
Description:
|
||||
Probably reads blocks 1 and 2 from Mifare sector 0.
|
||||
Block 0 contains the "vendor information" and UID.
|
||||
Block 1 contents are unknown, probably AiMe DB info.
|
||||
Block 2 last 10 bytes hex are printed on the card ("local unique id").
|
||||
(Block 3 contains encryption keys so is not allowed to be read)
|
||||
|
||||
LED
|
||||
---
|
||||
|
||||
Addr 08 Command 81:
|
||||
Req:
|
||||
03 Payload length
|
||||
ff Red intensity
|
||||
ff Green intensity
|
||||
ff Blue intensity
|
||||
Resp:
|
||||
None! Command is not acknowledged
|
||||
Description:
|
||||
Set LED color
|
||||
Loading…
Reference in New Issue
Block a user