Proxmark3 community

danymag

Contributor

Registered: 2010-01-01

Posts: 17

Attempt at reading Calypso card

Today I tried reading my transport pass which ccording to the information at http://www.calypsonet-asso.org/pop_map.htm is a Calypso card. Altough there are some discussions in the other threads that indicate that the Calypso cards are actually not ISO 14443 B compliant, the specification document at http://www.calypsotechnology.net/index. … &Itemid=40 states that

The Calypso card works in contactless operations, at 13.56 MHz according to the ISO 14443, type B, part 1, 2, 3 and 4.

Knowing that the PM3 implements ISO14443 B functions I wanted to have my go at it. At first I tried using hi14read to read the card but I don`t really know what to make of the response.

> tune
...
# HF antenna: 11.41 V @    13.56 MHz

> hi14read
#db# 00000003, 00000001, 0000000e

> hexsamples
50 92 45 e3 e4 00 00 00
00 00 71 f3 8d f1 44 44

When trying to snoop the communication of the card with the reader it failed miserably

> hi14snoop
#db# blew circular buffer!
#db# 000000ff, 00000000, 00000000

Did anybody have any success with these cards ?

Last edited by danymag (2010-01-06 03:41:05)

iZsh

Contributor

Registered: 2010-01-02

Posts: 95

Re: Attempt at reading Calypso card

Are you using a B' type (i.e. the french one for example) or their new B type?
Also, apart from some small radio differences between the B' and B, Calypso is using a proprietary protocol as well.

From what I've heard at the 26c3, someone did an implementation of a Calypso reader for the proxmark. Can't wait to see it committed though

danymag

Contributor

Registered: 2010-01-01

Posts: 17

Re: Attempt at reading Calypso card

I have no idea if it's B or B'. The card was introduced in 2008 so I hope it's pure B.

Do you remember who did the implementation of the Calypso reader?

Last edited by danymag (2010-01-05 14:26:02)

rleroy

Contributor

From: Between a REQB and a ATQB

Registered: 2009-03-04

Posts: 61

Re: Attempt at reading Calypso card

Knowing that the PM3 implements ISO14443 B functions I wanted to have my go at it. At first I tried using hi14read to read the card but I don`t really know what to make of the response.

> tune
...
# HF antenna: 11.41 V @    13.56 MHz

> hi14read
#db# 00000003, 00000001, 0000000e

> hexsamples
50 92 45 3e e4 00 00 00
00 00 71 f3 8d f1 44 44

danymag, is the number "2454053860" written somewhere on your card? If yes, you have part of your response

Last edited by rleroy (2010-01-05 19:45:40)

danymag

Contributor

Registered: 2010-01-01

Posts: 17

Re: Attempt at reading Calypso card

is the number "2454053860" written somewhere on your card? If yes, you have part of your response

You know what ... that is the serial number of the card actually, it's written on the back. Thanks for that. I guess I have to start looking at those proprietary Calypso functions now.

Any idea why hi14snoop might have failed? If I can get a trace of the reader-card communication that would help a lot.

Last edited by danymag (2010-01-06 03:45:19)