“超时，目标尚未回答”，来自ACR122U阅读器的Jewel/Topaz512 NFC标记

Question

我正在构建一个Windows/Java程序(使用javax.smartcardio)，使用ACR122U设备(内置PN532 NFC控制器芯片)与Jewel/Topaz512标记(来自Innovision/Broadcom)进行通信。

我实现了Topaz512协议(来自这张数据表)，但是只有一半的命令在运行。

• 一些有用的命令：RID, RALL, READ, WRITE-NE, RSEG
• 一些不起作用的命令：WRITE-E, READ8, WRITE-E8, WRITE-NE8

使用写不擦除命令的示例。

例如，当我发送写不擦除命令时，我得到了以下内容：

命令：FF:00:00:00:0C:D4:40:01:1A:7F:42:38:01:9A:00:17:E8

其中：

• D4:40:01是InDataExchange命令，
• 1A:7F:42是写非擦除命令(值: 0x42，块0x0F，字节7)，
• 38:01:9A:00是4字节的UID标记，
• 17:E8是儿童权利委员会。

答复：D5:41:00:42:90:00

这里的反应是正确的：0x42。状态字节(0x00)通知一切顺利。

使用写与擦除命令进行示例。

下面是我发送写与擦除命令时得到的信息：

命令：FF:00:00:00:0C:D4:40:01:53:7F:42:38:01:9A:00:28:6E

其中：

• D4:40:01是InDataExchange命令，
• 53:7F:42是写与擦除命令(值: 0x42，块0x0F，字节7)，
• 38:01:9A:00是4字节的UID标记，
• 28:6E是儿童权利委员会。

答复：D5:41:01:90:00

在这里，状态字节(0x01)通知PN532检测到的超时。(来自PN532文档 (p67)：“超时，目标没有回答- 0x01")

另外，当我删除PN532超时(使用FF:00:00:00:06:D4:32:02:00:00:00)时，不工作的命令不会响应D5:41:01:90:00，但是等待时间更长，则不会得到响应。

编辑2020-04-20

我只是尝试使用gscriptor (来自pcsc-工具套件)执行这些命令，并且得到了相同的行为。以下是我的研究结果：

剧本：

FF 00 00 00 06 D4 32 05 02 02 02

# SAMConfiguration
FF 00 00 00 04 D4 14 01 00

# SetParameters
FF 00 00 00 03 D4 12 04

# InListPassiveTarget: Jewel mode
FF 00 00 00 04 D4 4A 01 04

# InDataExchange: RID
FF 00 00 00 04 D4 40 01 78

# InDataExchange: RALL
FF 00 00 00 04 D4 40 01 00

# InDataExchange: RSEG 0-3
FF 00 00 00 05 D4 40 01 10 00
FF 00 00 00 05 D4 40 01 10 20
FF 00 00 00 05 D4 40 01 10 40
FF 00 00 00 05 D4 40 01 10 60

##########

# GetFirmwareVersion
FF 00 00 00 02 D4 02

# GetGeneralStatus
FF 00 00 00 02 D4 04

##########

# RFConfiguration: No timeout
FF 00 00 00 06 D4 32 02 00 00 00

# InDataExchange: READ-1
FF 00 00 00 05 D4 40 01 01 7F

# InDataExchange: READ-8
FF 00 00 00 05 D4 40 01 02 00

# InDataExchange: WRITE-E-1
FF 00 00 00 06 D4 40 01 53 7F 42

# InDataExchange: WRITE-E-8
FF 00 00 00 0C D4 40 01 55 02 01 02 03 04 05 06 07 08

# InDataExchange: WRITE-NE-1
FF 00 00 00 06 D4 40 01 1A 7F 42

# InDataExchange: WRITE-NE-8
FF 00 00 00 0C D4 40 01 1B 02 01 02 03 04 05 06 07 08

结果：

Sending: FF 00 00 00 06 D4 32 05 02 02 02
Received: D5 33 90 00
Normal processing.

Sending: FF 00 00 00 04 D4 14 01 00
Received: D5 15 90 00
Normal processing.

Sending: FF 00 00 00 03 D4 12 04
Received: D5 13 90 00
Normal processing.

Sending: FF 00 00 00 04 D4 4A 01 04
Received: D5 4B 01 01 0C 00 38 01 9A 00 90 00
Normal processing.

Sending: FF 00 00 00 04 D4 40 01 78
Received: D5 41 00 12 4C 38 01 9A 00 90 00
Normal processing.

Sending: FF 00 00 00 04 D4 40 01 00
Received: D5 41 00 12 4C 38 01 9A 00 00 10 25 00 00 10 3F
00 01 03 F2 30 33 02 03 F0 02 03 03 E3 D1 01 DF
54 02 65 6E 30 31 32 33 34 35 36 37 38 39 30 30
31 32 33 34 35 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 AA
AA 12 4C 06 00 01 E0 00 00 00 00 00 00 90 00
Normal processing.

Sending: FF 00 00 00 05 D4 40 01 10 00
Received: D5 41 00 38 01 9A 00 00 10 25 00 00 10 3F 00 01
03 F2 30 33 02 03 F0 02 03 03 E3 D1 01 DF 54 02
65 6E 30 31 32 33 34 35 36 37 38 39 30 30 31 32
33 34 35 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 55 55 AA AA 12
4C 06 00 01 E0 00 00 00 00 00 00 00 00 00 00 00
00 00 47 90 00
Normal processing.

Sending: FF 00 00 00 05 D4 40 01 10 20
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.

Sending: FF 00 00 00 05 D4 40 01 10 40
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.

Sending: FF 00 00 00 05 D4 40 01 10 60
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.

Sending: FF 00 00 00 02 D4 02
Received: D5 03 32 01 06 07 90 00
Normal processing.

Sending: FF 00 00 00 02 D4 04
Received: D5 05 01 00 01 01 00 00 02 80 90 00
Normal processing.

Sending: FF 00 00 00 06 D4 32 02 00 00 00
Received: D5 33 90 00
Normal processing.

Sending: FF 00 00 00 05 D4 40 01 01 7F
Received: D5 41 00 47 90 00
Normal processing.

Sending: FF 00 00 00 05 D4 40 01 02 00
Received:
wrong SW size for:

Sending: FF 00 00 00 06 D4 40 01 53 7F 42
Received:
wrong SW size for:

Sending: FF 00 00 00 0C D4 40 01 55 02 01 02 03 04 05 06
07 08
Received:
wrong SW size for:

Sending: FF 00 00 00 06 D4 40 01 1A 7F 42
Received: D5 41 00 47 90 00
Normal processing.

Sending: FF 00 00 00 0C D4 40 01 1B 02 01 02 03 04 05 06
07 08
Received:
wrong SW size for:

Script was executed without error...

Answer 1

不久前，我详细研究了这一点，并得出结论，NXP的PN532 NFC控制器芯片的固件存在问题，无法成功地接收到NFC 1标签(Topaz/Jewel品牌)的一些命令。正如所指出的，ACR122U是基于这个芯片的。

当我尝试使用WRITE-E8 (0x54)命令一次编写8个字节块时，收到的响应是0x01，这是等待标记响应的超时。

我尝试过的不起作用的东西：

包括InDataExchange中的UID回波，我甚至还使用了UID回波的特性，结果仍然相同。

使用inCommunicateThru命令而不是InDataExchange，并在应用程序级别计算CRC1和CRC2值(结果相同)

我得出的最后结论是：

PN532不能在Type 1标记上写入pages、0x10和更大的页面，这使得无法在诸如Topaz 512这样的流行模型上写入全部内存。

Recommendation:

这个问题是相关的2012年，当时的黄玉512是一个伟大的低成本，但高内存NFC标签。现在有了NAG215和NTAG216模型，我建议使用那些具有高内存和与NFC读取器兼容的模型。