More than 1 year has passed since last update.

RC-S380 で FeliCa を読む

Posted at 2022-03-09

(Felica/Mifare/NFC チャレンジシリーズ) その他の記事はこちら「Felica/Mifare/NFC でいろいろ実験」
https://qiita.com/nanbuwks/items/1f416d6e45a87250ee0a

「nfcpy と PaSoRi RC-S380/P をセットアップ」
https://qiita.com/nanbuwks/items/348aa1849a12079d75cd

で設定した環境を使って、FeliCa を読んでみます。

waon.py を使ってみる

「Nfcpy on MacでFeliCaを読む（2021年2月）」
https://qiita.com/zaburo/items/db10ceadd49568d6f6f1

の waon.py を使ってみました。


$ sudo python3 waon.py

手持ちの Pasmo をかざしてみました


$ sudo python3 waon.py
Type3Tag ID=01120412A81A1508 PMM=053143454682B7FF SYS=0003
  This is not an NFC Forum Tag.

今度はnanaco


$ sudo python3 waon.py
Type3Tag 'FeliCa Standard (RC-S960)' ID=0114B4276B115A23 PMM=0F0D23042F7783FF SYS=8B61
  System 8B61 (unknown)
  Area 0000--FFFE
    Area 1000--13FF
      Random Service 64: write with key & read w/o key (0x1008 0x100B)
       0000: 31 01 6e 61 6e 62 75 77 6b 73 20 20 20 20 20 20 |1.nanbuwks      |
       0001: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |                |
       0003: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 32 32 |              22|
       0004: 6b 4c 66 52 37 75 32 46 5a 50 77 53 63 20 15 05 |kLfR7u2FZPwSc ..|
       0005: 12 20 15 05 12 01 01 00 00 00 00 00 00 00 00 00 |. ..............|
      Random Service 65: write with key & read with key (0x1048 0x104A)
      Random Service 66: write with key & read with key (0x1088 0x108A)
      Random Service 67: write with key & read with key (0x10C8 0x10CA)
      Random Service 68: write with key & read with key (0x1108 0x110A)
      Random Service 69: write with key & read with key (0x1148 0x114A)
      Random Service 70: write with key & read with key (0x1188 0x118A)
      Random Service 71: write with key & read with key (0x11C8 0x11CA)
      Random Service 72: write with key & read with key (0x1208 0x120A)
      Random Service 73: write with key & read with key (0x1248 0x124A)
      Random Service 74: write with key & read with key (0x1288 0x128A)
      Random Service 75: write with key & read with key (0x12C8 0x12CA)
      Random Service 76: write with key & read with key (0x1308 0x130A)
      Random Service 77: write with key & read with key (0x1348 0x134A)
      Random Service 78: write with key & read with key (0x1388 0x138A)
      Random Service 79: write with key & read with key (0x13C8 0x13CA)
      Area 2000--21FF
      Random Service 128: write with key & read with key (0x2008 0x200A)
      Random Service 129: write with key & read with key (0x2048 0x204A)
      Random Service 130: write with key & read with key (0x2088 0x208A)
      Random Service 131: write with key & read with key (0x20C8 0x20CA)
      Random Service 132: write with key & read with key (0x2108 0x210A)
      Random Service 133: write with key & read with key (0x2148 0x214A)
      Random Service 1008: write with key & read w/o key (0xFC08 0xFC0B)
       0000: 81 a1 d6 d8 08 25 0c 86 46 45 2a cb c7 ef 08 ce |.....%..FE*.....|
       0001: 34 73 11 1a f4 77 96 59 7e 05 b5 95 07 92 db 63 |4s...w.Y~......c|
       0002: 61 c5 3e 5d 3d 7a 8c 2d 84 d4 8f d0 e3 1a df 6f |a.>]=z.-.......o|
       0003: cf 64 e4 29 9a 3c 81 38 73 ee 18 35 d7 d8 1c 0e |.d.).<.8s..5....|
      Random Service 1009: write w/o key (0xFC49)
       0000: 55 a1 a7 3d f0 08 51 f7 a1 3e 01 0e 0f 86 35 27 |U..=..Q..>....5'|
       0001: 11 65 80 f5 c2 4d 3c 91 18 8e 79 3b aa 4e 77 00 |.e...M<...y;.Nw.|
       0002: ea ed 82 17 c8 39 52 11 e2 99 14 a7 16 e6 97 7a |.....9R........z|
  System FE00 (Common Area)
  Area 0000--FFFE
    Area 3940--39FF
      Area 3941--39FF
        Random Service 229: write with key & read w/o key (0x3948 0x394B)
         0000: f3 28 19 02 08 00 00 f3 01 00 00 00 00 00 00 00 |.(..............|
        Random Service 230: write with key & read w/o key (0x3988 0x398B)
         0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
         *     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
         000F: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
        Random Service 231: write w/o key (0x39C9)
         0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
         *     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
         0005: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
        Area 5580--56BF
        Area 5581--56BF
          Random Service 342: write with key & read w/o key (0x5588 0x558B)
           0000: 76 00 09 03 43 64 67 74 01 1d 32 01 00 00 00 00 |v...Cdgt..2.....|
           0001: 01 1d 32 01 01 00 00 00 00 00 00 00 00 00 00 00 |..2.............|
          Purse Service 342: direct with key & decrement with key & read w/o key (0x5590 0x5594 0x5597)
           0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
          Random Service 343: write with key & read w/o key (0x55C8 0x55CB)
           0000: 1d 32 00 00 1d 32 00 00 00 00 00 00 00 00 00 00 |.2...2..........|
          Random Service 344: write with key & read w/o key (0x5608 0x560B)
           0000: 01 00 1d 32 00 00 00 00 00 00 00 00 00 00 00 00 |...2............|
           0001: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
          Random Service 345: write with key & read w/o key (0x5648 0x564B)
           0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
           *     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
           0009: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
          Cyclic Service 345: write with key & read w/o key (0x564C 0x564F)
           0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
           *     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
           0004: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
          Random Service 346: write with key & read w/o key (0x5688 0x568B)
           0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
           *     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
           0003: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

「PN532を使ってArduinoでFeliCa学生証を読む方法」
https://qiita.com/gpioblink/items/91597a5275862f7ffb3c

では、会津大学の学生証の学籍番号が以下のように収録されているということでした。

サービスコードが0x1A8B。4ブロックあるのでブロックリストは0x8000から0x8003まで取得すればいいことがわかります。

別の大学の学生証も、同じ場所にありました。

$ sudo python3 waon.py | head -18
Type3Tag 'FeliCa Standard (RC-SA00/1)' ID=0123456789ABCDEF PMM=0123456789ABCDEF SYS=809E
  System 809E (unknown)
  Area 0000--FFFE
    Area 1000--1FFF
      Random Service 64: write with key (0x1008)
      Random Service 65: write with key (0x1048)
      Area 2000--2FFF
      Random Service 128: write with key & read with key (0x2008 0x200A)
      Area 3000--3FFF
      Random Service 192: write with key & read with key (0x3008 0x300A)
      Area 4000--4FFF
      Random Service 256: write with key & read with key (0x4008 0x400A)
  System FE00 (Common Area)
  Area 0000--FFFE
    Area 1A80--1AFF
      Area 1A81--1AFF
        Random Service 106: write with key & read w/o key (0x1A88 0x1A8B)
         0000: 30 31 31 32 33 34 34 35 36 37 38 39 00 00 31 31 |01123456789..11|

カードのIDMやPMMは適当に変更しています。
学籍番号123456789が該当です。

You get articles that match your needs
You can efficiently read back useful information
You can use dark theme

What you can do with signing up