Welcome To Security.Fx-Vista.Com

Computer Security Information

Home

Mousetrap SmartCard Reader!

<< Back

mousetrap-cardreader
 



 (c) phunatic phreak homebrew projects...
   Build your own cheap cardreader. 
    I used this to get the data out of the prepaid type-1 cards that were release in 
    Nov '96 by swisscom. I couldn't wait to see the data... and i didn't have a card 
    reader, so i built it on my own, veeeery cheap... 
    I used my old amiga, as the parallel port access is easy to program. 
    Think its not a problem to do that on a pc as well. Nice is, that you don't really 
    have to bother with the clockrate to read out the type 1 card. 
    The technical info on whats going on and how the pins are connected will follow, 
    in the meantime, figure it out yourself, you will learn more this way ; ). 
    Mousetrap cardreader items: 
    - mousetrap (my luchs does a great job...) 
    - some wire 
    - 8 pin jumper connector or similar thing 
    - leukoplast 
    - 25 pin parallel port connector 
    - computer equipment 
    - soldering equipment 
    - a little bit of knowledge 
 
closeup 

Remove all unecessary killer tools like cheese holder and stuff. All we need is 
a good pressure for the contacts. Bend the pins somewhat to have a good contact on the card. 
The 'leukoplast' will act as insulator and that the connector-pin block won't slip away. 
Adjust it and start the read process. 
  
Data read from sample card 
0000000 2ad8 caff d44a 066a 0000 3f7f ff0f ffff
0000010 ffff ffff ffff ffff ffff ffff ffff ffff
0000020 ffff ffff ffff ffff 0000 0000 88f4 a94a
0000030 ffff ffff ffff feff ffff ffff ffff ffff
0000040 2ad8 caff d44a 066a 0000 3f7f ff0f ffff
0000050 ffff ffff ffff ffff ffff ffff ffff ffff
0000060 ffff ffff ffff ffff 0000 0000 88f4 a94a
0000070 ffff ffff ffff feff ffff ffff ffff ffff
0000080 2ad8 caff d44a 066a 0000 3f7f ff0f ffff
0000090 ffff ffff ffff ffff ffff ffff ffff ffff
00000a0 ffff ffff ffff ffff 0000 0000 88f4 a94a
00000b0 ffff ffff ffff feff ffff ffff ffff ffff
00000c0 2ad8 caff d44a 066a 0000 3f7f ff0f ffff
00000d0 ffff ffff ffff ffff ffff ffff ffff ffff
00000e0 ffff ffff ffff ffff 0000 0000 88f4 a94a
00000f0 ffff ffff ffff feff ffff ffff ffff ffff
0000100 0000 0000 0000 0000 0000 0000 0000 0000
*
0000400
Source code for 68k assembler on amiga 
* card type 2 reader(/writer?)
* (c) phunatic phreak of amitech nov ´96
* 68k asm code, use seka on amiga...
port=$bfe101   ;parallel port datenregister
ddrb=$bfe301   ;datenrichtungsregister fuer port
clk=$1
data=$2
reset=$4
mainread:
        bsr.L   setint
        bsr.L   readinit
        bsr.L   readcard
        bsr.L   resetint
        rts
mainwrite:
        bsr.L   setint
        bsr.s   writecard
        bsr.L   resetint
        rts
writecard:
        bsr.L   initread       ;startsignal for read
        bsr.L   writeinit      ;data is output now
        lea.l   mem,a0         ;set memstart
        move.w  #$003f,d1      ;repeat 64 times
writeloop:
        bchg    #1,$bfe001     ;toggle led
        moveq   #0,d0          ;clear data-byte
        move.w  #$0007,d2      ;repeat for byte
        move.b  (a0)+,d0       ;naechstes Byte schreiben
bitwloop:
        move.b  #reset,port    ;reset impuls  WRITE START
        bsr.L   waitint        ;   -->
        move.b  #0,port        ;write signalisieren
        bsr.L   waitint
        move.w  #$0f00,$dff180 ; red screen
        move.b  d0,d3          ;data in d0
        and.b   #$80,d3        ;get databit
        lsl.b   #7,d3          ;an pos 2 setzen (data)
        move.b  d3,port        ;data setzen
        nop                    ;warten
        nop
        or.b    #clk,d3        ;daten mit clock
        move.b  d3,port        ;ausgeben (schreiben)
        bsr.L   waitint        ;wait
        bsr.L   waitint
        move.w  #$000f,$dff180 ;blue screen
        move.b  #0,port        ;set clock low
        bsr.L   waitint        ;wait   WRITE BEENDET          
        move.b  #clk,port      ;auf naechste adresse setzen   
        bsr.L   waitint
        move.b  #0,port
        lsl.b   #1,d0          ;naechstes Bit positionieren
        
        dbra    d2,bitwloop    ;repeat for byte
        dbra    d1,writeloop   ;repeat for 64 bytes
        move.b  #0,port        ;reset port state
        rts                    ;!!! done ???
initread:
        move.b  #reset,port
        bsr.L   waitint
        bsr.L   waitint
        bsr.L   waitint
        move.b  #clk!reset,port
        bsr.s   waitint
        bsr.s   waitint
        move.b  #reset,port
        bsr.s   waitint
        move.b  #0,port
        bsr.s   waitint
        rts
readcard:
        bsr.s   initread       ;startsignal for read
        lea.l   mem,a0         ;set memstart
        move.w  #$003f,d1      ;repeat 64 times
readloop:
        bchg    #1,$bfe001     ;toggle led
        moveq   #0,d0          ;clear data-byte
        move.w  #$0007,d2      ;repeat for byte
bitloop:
        move.w  #$0f00,$dff180 ; red screen
        move.b  #clk,port      ;set clock high
        move.b  port,d3
        and.b   #data,d3       ;bit 1 of port
        lsr.b   #1,d3          ;shift to bit position 0
        lsl.b   d2,d3          ;shift to recent bit position
        or.b    d3,d0          ;set new bit
        bsr.s   waitint        ;wait
        move.w  #$000f,$dff180 ;blue screen
        move.b  #0,port        ;set clock low
        bsr.s   waitint        ;wait                  
        dbra    d2,bitloop     ;repeat for byte
        move.b  d0,(a0)+       ;store byte
        dbra    d1,readloop    ;repeat for 256 bytes
        move.b  #0,port        ;reset port state
        rts                    ;!!! done !!!
waitint:
        tst.b   intflag        ; check for 0
        beq.s   waitint        ; wait until z=0
        clr.b   intflag        ; clear intflag
        rts
resettimer:
        ;cia b event counter (zeilenfreq 15625/s)
        and.b   #$7e,$bfdf00   ;alarm mode off,stop timer
        move.b  #$00,$bfda00   ;timer auf 0 setzen
        move.b  #$00,$bfd900
        move.b  #$00,$bfd800
        or.b    #$81,$bfdf00   ;alarm mode cia b ein,start
        rts
setalarm:
        ;cia b event counter (zeilenfreq 15625/s)
        or.b    #$80,$bfdf00   ;alarm mode setzen,stop
        move.b  #$00,$bfda00   ;timer start bei lsb write...
        move.b  #$00,$bfd900   ;setzen des alarmwerts
        move.b  #$0F,$bfd800   ;2604.16 baud...
        move.b  #$84,$bfdd00   ;alarm mask setzen cia b interr.
        move.b  #$81,$bfdf00   ;alarmmode,starten,cont
        rts                            ; fuer interrupt
setint:
        move.w  $dff01c,intstat ; status save int-enable
        move.w  #$7fff,$dff09a ;interrupts abstellen  (alle!)
        move.l  $78,intvek     ;int vektor saven
        bsr.s   resettimer
        bsr.s   setalarm
        move.l  #interrupt,$78 ;neuer vektor setzen ciab int p6
        
        move.w  #$e000,$dff09a         ;cia b interrupt erlauben
        rts
resetint:
        move.w  #$4000,$dff09a ;interrupts abstellen
        move.l  intvek,$78     ;alte vektoradresse setzen
        move.w  intstat,d0     ;alter enable status setzen
        or.w    #$c000,d0
        move.w  d0,$dff09a
        rts
interrupt:
        move.l  d0,-(sp)
        move.w  #$2000,$dff09c ;clear request cia b
        move.b  $bfdd00,d0
        and.b   #$04,d0        ;cia b alarm ??
        seq     intflag        ;set intflag =-1 bei gesetztem flag
        bsr.L   resettimer
        move.l  (sp)+,d0
        rte
; bits 2:reset 1:data 0:clock
readinit:
        move.b  #%00000101,ddrb
        move.b  #0,port        ;output auf 0 setzen 
        rts
writeinit:
        move.b  #%00000111,ddrb
        rts
; bytezugriffe (koennen odd accessed werden)
clockstat:
        blk.b   1
intflag:
        dc.b    0
even
mem:    blk.b   64,0
memend:
reserve:
        blk.b   256,0
;wordzugriffe (gerade adressen)
even:
dataptr:
        blk.l   1
intvek:
        blk.l   0
intstat:
        blk.w   0
Credits
-- UnKnown --

<< Back

 

Copyright ©2008 www.Security.Fx-Vista.Com | All rights reserved