Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2010-01-04 06:18:44

danymag
Contributor
Registered: 2010-01-01
Posts: 17

Attempt at reading Calypso card

Today I tried reading my transport pass which ccording to the information at http://www.calypsonet-asso.org/pop_map.htm is a Calypso card. Altough there are some discussions in the other threads that indicate that the Calypso cards are actually not ISO 14443 B compliant, the specification document at http://www.calypsotechnology.net/index. … &Itemid=40 states that

The Calypso card works in contactless operations, at 13.56 MHz according to the ISO 14443, type B, part 1, 2, 3 and 4.

Knowing that the PM3 implements ISO14443 B functions I wanted to have my go at it. At first I tried using hi14read to read the card but I don`t really know what to make of the response.

> tune
...
# HF antenna: 11.41 V @    13.56 MHz

> hi14read
#db# 00000003, 00000001, 0000000e

> hexsamples
50 92 45 e3 e4 00 00 00
00 00 71 f3 8d f1 44 44

When trying to snoop the communication of the card with the reader it failed miserably

> hi14snoop
#db# blew circular buffer!
#db# 000000ff, 00000000, 00000000

Did anybody have any success with these cards ?

Last edited by danymag (2010-01-06 03:41:05)

Offline

#2 2010-01-05 13:47:35

iZsh
Contributor
Registered: 2010-01-02
Posts: 95

Re: Attempt at reading Calypso card

Are you using a B' type (i.e. the french one for example) or their new B type?
Also, apart from some small radio differences between the B' and B, Calypso is using a proprietary protocol as well.

From what I've heard at the 26c3, someone did an implementation of a Calypso reader for the proxmark. Can't wait to see it committed though smile

Offline

#3 2010-01-05 14:25:42

danymag
Contributor
Registered: 2010-01-01
Posts: 17

Re: Attempt at reading Calypso card

I have no idea if it's B or B'. The card was introduced in 2008 so I hope it's pure B.

Do you remember who did the implementation of the Calypso reader?

Last edited by danymag (2010-01-05 14:26:02)

Offline

#4 2010-01-05 19:41:19

rleroy
Contributor
From: Between a REQB and a ATQB
Registered: 2009-03-04
Posts: 61

Re: Attempt at reading Calypso card

danymag wrote:

Knowing that the PM3 implements ISO14443 B functions I wanted to have my go at it. At first I tried using hi14read to read the card but I don`t really know what to make of the response.

> tune
...
# HF antenna: 11.41 V @    13.56 MHz

> hi14read
#db# 00000003, 00000001, 0000000e

> hexsamples
50 92 45 3e e4 00 00 00
00 00 71 f3 8d f1 44 44

danymag, is the number "2454053860" written somewhere on your card? If yes, you have part of your response smile

Last edited by rleroy (2010-01-05 19:45:40)

Offline

#5 2010-01-06 03:40:31

danymag
Contributor
Registered: 2010-01-01
Posts: 17

Re: Attempt at reading Calypso card

rleroy wrote:

is the number "2454053860" written somewhere on your card? If yes, you have part of your response smile

You know what ... that is the serial number of the card actually, it's written on the back. Thanks for that. I guess I have to start looking at those proprietary Calypso functions now.

Any idea why hi14snoop might have failed? If I can get a trace of the reader-card communication that would help a lot.

Last edited by danymag (2010-01-06 03:45:19)

Offline

Board footer

Powered by FluxBB