Some Linux experiments with the ACR38 smartcards reader

Trying to read smartcards using only libusb. For fun and learning.

Nom :

20 mars 2007

In the ACR38 manual...

*** draft ***

The ACR38 USB Smart Card Reader/Writer Reference Manual (.pdf) is 43 pages long...

There are four USB End Points :
* control
* 0x02 bulk out for commands from computer (64 bytes)
* 0x82 bulk in for response from reader (64 bytes)
* 0x81 interrupt in for card status messages (8 bytes)


Commands are in the form of <01><cmd><len-hi><len-low><data><data>...
Responses are in the form of <01><status><len-hi><len-low><data><data>...
Card status are in the form of <01><status : C0/C1><00><00>

There are two types of commands : control commands to the ACR38 and card commands to the inserted card.

A/ Control commands

A-1 : GET_ACR_STATUS

cmd : <01><01><00><00>
rsp : <01><status><00><10> (len=0x10)
<10 bytes undocumented internals>
<ff><ff> (max cmd/rsp len)
<ctype><ctype> (bitmaps card types)
<c_cel> (selected card type)
<c_stat 00/01/03> (empty/loaded/powered)

A-2 : SELECT_CARD_TYPE

cmd : <01><02><00><00><c_type>
rsp : <01><status><00><00>

A-3 : SET_OPTION

cmd : <01><07><00><01><option>
rsp : <01><status><00><00>

A-4 : SET_CARD_PPS

cmd : <01><04><00><04><..><..><..><..> (??)
rsp : <01><status><00><00>

A-5 : SET_READER_PPS

cmd : <01><0b><00><04><..><..><..><..> (??)
rsp : <01><status><00><00>


B/ Card commands (for MCU based cards)


B-1 : RESET_WITH_5_VOLTS_DEFAULT

cmd : <01><80><00><00>
rsp : <01><status><len-hi><len-lo><...card's Answer-To-Reset (ATR) data...>

B-2 : RESET_WITH_SPECIFIC_VOLTAGE

cmd : <01><80><00><01><00/01/02/03> (voltages)
rsp : <01><status><len-hi><len-lo><...card's Answer-To-Reset (ATR) data...>

B-3 : POWER_OFF

cmd : <01><81><00><00>
rsp : <01><status><00><00>

B-4 : EXCHANGE_TPDU_T0

cmd : <01><a0><len-hi><len-lo><...APDU data...>
rsp : <01><status><len-hi><len-lo><...APDU response...><crc><crc>

B-5 : EXCHANGE_TPDU_T1

cmd : <01><a1><len-hi><len-lo><...APDU data...>
rsp : <01><status><len-hi><len-lo><...APDU response...>

APDU format is described elsewhere...

So, that can't be that complicated (but doesn't seem to work that way)... Anyway, to be sure, it is now time to look at the sources to know what commands and parameters are actualy used...


Error Codes
00 - no error
F4 - SLOTERROT_PROCEDURE_BYTE_CONFLICT
F6 - SLOTERROR_BAD_LENGTH
F7 - SLOTERROR_BAD_FIDI
F8 - SLOTERROR_BAD_ATR_TS
F9 - SLOTERROR_ICC_NOT_POWERED_UP
FA - SLOTERROR_ICC_NOT_INSERTED
FB - SLOTERROR_HW_ERROR
FC - SLOTERROR_XFE_OVERRUN
FD - SLOTERROR_XFE_PARITY_ERROR
FE - SLOTERROR_ICC_MUTE
FF - SLOTERROR_CMD_ABORTED



There are also other manuals available from ACS...