Nokia 3220 w/ NFC P&T Shell, accessing internal Mifare Cards

[viktor.tamas]

Hi,
I want to use a Nokia 3220 phone as an RFID tag, by writing data into its cover and reading this data with another card reader.

I use Secure Chip SDK with this theory:

conn = SecureChipConnection.openConnection(null, this);
//setting internal mode to write data into the SC
conn.setSCCMode(SCCMode.SC_INTERNAL, true, null, 0);
//constructing APDU, but I don't know the appropriate "cla" and "ins"...
byte[] data = ...
conn.sendAPDU(data);
//sendAPDU now returns with error codes.
Thread.sleep(1000); //simplest mode for waiting for a while.
//setting SC only mode to be visible for card readers.
conn.setSCCMode(SCCMode.SC_ONLY, true, null, 0);

Writing to the virtual Mifare1k/ISO tag isn't succeeded, otherwise, card reader can't read data from the phone (in any SC mode).

Has anybody any experience or idea about this?

[marcvandam4]

Hi Victor,

I think you should take a look at 'HelloMidlet'
and 'HelloApplet' from Nokia SC SDK examples.

You can also run HelloMidlet in emulator.

Greetings,
Marc van Dam

[viktor.tamas]

I have seen HelloMidlet and HelloApplet but I don't understand the following:

Do I have to create an applet to be able to communicate with the internal secure card? Isn't there a default applet or other kind of internal logic which emulates a Mifare 1k or ISO14443-4 card?

[marcvandam4]

Hello,

I think you will have to make an applet for that. Ones you
uploaded the applet (with a external reader) into the cover.
You have to use "select" APDU to tell javacard you want to
talk to your application. There is a mifare in the Nokia, but this
is emulated, and does not have memory.

Greetings,
Marc

[viktor.tamas]

Hi Marc,
I've heard that I can upload applets from external card reader by using IBM's JCOP tools. Actually, I'm waiting for activation codes for this product.

Do you know any other software component which can be used for uploading applet into the phone?
BR,
Viktor

[marcvandam4]

Hi,

Yes, I know in my case this took only 4 days. (read: that's quick!)

There is a "work around" using JCOP, (put all jars in /jre/ext/) and run
script files. But I can advice you to wait!

For uploading applets you must login to the Covers 'cardmanager'. If you
use wrong security keys for +/- 3 times it will permanently lock.

Greetings,
Marc van Dam

[viktor.tamas]

Hi,
now, I am using JCOP tools. I followed instructions of the Secure Chip SDK of the HelloApplet Midlet but always get this error:

Status: Security condition not satisfied
jcshell: Error code: 6982 (Security condition not satisfied)
jcshell: Wrong response APDU: 6982
Unexpected error; aborting execution

I guess I miss some authentication stuff. I received keys for the NFC shell but I don't know where to write them in the JCOP tools.

Would you explain this?

...you must login to the Covers 'cardmanager'.

BR,
Viktor

[viktor.tamas]

Another thing about HelloApplet / HelloMidlet when I have running it in Cover Emulator / S40 DP 2.0 phone emulator: It always responds me "Hello Jane", no matter what I write as name.

I'm getting feel lama. :/

[marcvandam4]

Here starts the trouble...

jcshell: Error code: 6982 (Security condition not satisfied)

if you try this a few times, you can forget about the cover!

Send me an email, I will reply with a JCOP log file.

marcvandam2@hotmail.com


Greetings,
Marc

[viktor.tamas]

Meantime, I found out why was the response always "Hello Jane". I run Nokia Cover Emulator and it has an apdu_response.conf file in bin directory with static request/response patterns.

Eclipse JCOP plugin deploys javacard applet into its own JavaCard simulator which isn't in contact with Nokia Cover Emulator.

(Marc: e-mail has been sent.)

[marcvandam4]

exactly.

after you uploaded HelloApplet into the cover, using HelloMidlet,
it will respond with for example "Hello viktor.tamas".

see your email.

greetz,
Marc

[viktor.tamas]

Hi Marc,
thanks for the logs, they helped a lot!

I'm trying to discover now, how much memory is in the secure card but I can't find it in any docs after 2 hours seeking. Do anybody know it?

[viktor.tamas]

Got it: 72k.
(Thanks for the Nokia support.)

[viktor.tamas]

Now we are succeeding in making a JavaCard applet - MIDlet communication. But when the device is in RF field the JavaCard applet is inaccessible, e.g. JavaCard doesn't responds for SELECT APDUs.

Is it a part of some conception?
Or do I miss something?

Here is the part of my Midlet which calls the Applet time to time:

//run() method of a Thread
public void run() {
  try {
    while(true) {
      conn.setSCCMode(SCCMode.SC_INTERNAL, true, null, 0);
      //THIS IS BLOCKED WHEN DEVICE IN RF FIELD:
      byte[] data = conn.exchangeAPDU(SELECT);
        if(data.length == 2 && data[0] == (byte) 0x90 && data[1] == (byte) 0x00) {
          //select was successfull
          byte[] cmdApdu = getReadApdu(); //creates a command for Applet
	  data = conn.exchangeAPDU(cmdApdu); //receives data from Applet
	  screenText.setText(new String(data, 0, data.length-2);
          conn.setSCCMode(SCCMode.SC_ON, true, null, 0);
          Thread.sleep(5000);
        } else {
          print("Can't select."); //Writes it to the display
          Thread.sleep(5000);
        }
      }
    } catch(Exception e) {
      print("Error: " + e);    		
    }
  }
}

[marcvandam4]

Hey Victor,

I see you copied this from "helloMidlet"...
Great, must work..

Look if your "byte [] SELECT" is correct:

It has to be like:

SELECT APDU: (cla,sel,p1,p2)
(byte)0x00,(byte)0xA4,(byte)0x04,(byte)0x00,

LENGTH "NAME APPLICATION":
(byte)0x0E,

NAME APPLICATION:
(byte)0x48,(byte)0x65,(byte)0x6C,(byte)0x6C,(byte)0x6F,(byte)0x41,(byte)0x70,(byte)0x70,(byte)0x6C,(byte)0x65,(byte)0x74,(byte)0x2E,(byte)0x61,		(byte)0x70,(byte)0x70

(in this case: HelloApplet.app)

You must change the select array "name application" into your own
AID of the Applet. (this can be a name, but also just a byte array)

I hope it helps,

Greetings,
Marc van Dam