N2 Elite - Revision history

PhilippeTeuwen: /* UID */

2018-02-08T10:22:39Z

UID

← Older revision		Revision as of 10:22, 8 February 2018
Line 458:		Line 458:

	* ISO14443A		* ISO14443A
	* 7-byte Mifare Ultralight		** 7-byte Mifare Ultralight
	* 4-byte Mifare Classic		** 4-byte Mifare Classic
	* 7-byte Mifare Classic		** 7-byte Mifare Classic
	* 7-byte Desfire EV1		** 7-byte Desfire EV1
	* etc		** etc
	* ISO1443B !!		* ISO1443B !!
	* 4-byte TypeB PUPI		** 4-byte TypeB PUPI
	* ISO15693 !!		* ISO15693 !!
	* 8-byte PicoPass 2K		** 8-byte PicoPass 2K

	In the 4-byte cases he simply completes the UID with zeroes and in the 8-byte case, he drops the last one.		In the 4-byte cases he simply completes the UID with zeroes and in the 8-byte case, he drops the last one.

2018-02-08T10:22:06Z

UID

← Older revision		Revision as of 10:22, 8 February 2018
Line 455:		Line 455:
	</pre>		</pre>

	Interestingly enough, Gueulle has shown that some ~~systems~~ can be fooled when security is based only on UID, even if they are not using NTAG! E.g.:		Interestingly enough, Gueulle has shown that some readers can be fooled when security is based only on UID (typically readers sending a 10-digit serial to the system), even if they are not using NTAG! E.g.:

⚫	* 7-byte Mifare ~~Ultralight~~
			* ISO14443A
⚫	* 7-byte Desfire EV1
	* 4-byte Mifare ~~Classic~~		* 7-byte Mifare Ultralight
	* 4-byte ~~TypeB~~ ~~PUPI~~		* 4-byte Mifare Classic
		⚫	* 7-byte Mifare Classic
⚫	In ~~those~~ 4-byte cases he simply completes the UID with zeroes.
		⚫	* 7-byte Desfire EV1
			* etc
			* ISO1443B !!
			* 4-byte TypeB PUPI
			* ISO15693 !!
			* 8-byte PicoPass 2K

		⚫	In the 4-byte cases he simply completes the UID with zeroes and in the 8-byte case, he drops the last one.

	===ShowID===		===ShowID===

2017-05-06T18:12:25Z

0xAE: N2_WRITE_FAST

← Older revision		Revision as of 18:12, 6 May 2017
Line 355:		Line 355:
	Note: this command was found by brute-force, it's not used by the Android app.		Note: this command was found by brute-force, it's not used by the Android app.

	===0xAE: ~~N2_WRITE_FAST~~===		===0xAE: N2_FAST_WRITE===

			Similar to N2_FAST_READ with one parameter to specify the bank number so this command can access directly the 200 banks.
	input: [0]PAGE [1]BANK [2]SIZE [3]DATA...

			Syntax:
	output: ACK
			<pre>ae <start page> <bank> <size> <data></pre>
			Banks don't need to be active to be accessed.
			<br>Theoretically a bank could be accessed in one single command but it depends on the reader.

	Note: this command is not used by the Android app.		Note: this command is not used by the Android app.

2017-05-06T18:08:30Z

0xAE: ?

@@ Line 355: / Line 355: @@
 Note: this command was found by brute-force, it's not used by the Android app.
-===0xAE: ?===
+===0xAE: N2_WRITE_FAST===
 ==N2 tricks==

2017-05-05T21:16:32Z

Hardware

2017-05-05T20:08:13Z

Swapping banks

← Older revision		Revision as of 20:08, 5 May 2017
Line 379:		Line 379:
	* Of course you need more than a single slot active		* Of course you need more than a single slot active
	* You need to press the button when the tag gets powered, then it can be released		* You need to press the button when the tag gets powered, then it can be released
	* It works only if in the previous session some commands were executed, e.g. a FAST_READ (3A)		* It works only if in the previous session some specific commands were executed, e.g. a FAST_READ (3A)
	* Contrary to what I read elsewhere, it works both in LOCKED and UNLOCKED modes		* Contrary to what I read elsewhere, it works both in LOCKED and UNLOCKED modes

2017-05-05T20:02:10Z

Swapping banks

@@ Line 374: / Line 374: @@
 ==N2 tricks==
 ===Swapping banks===
-In principle one needs to press the button to access the next bank.
+One needs to press the button to access the next bank. While this is probably not a problem with the targeted reader, it's harder to get it working systematically from our scripts.
 See also N2_SELECT_BANK above.
 ===ECC===

2017-05-05T17:27:57Z

Hardware

← Older revision		Revision as of 17:27, 5 May 2017
Line 44:		Line 44:

	Patrick Gueulle mentions the QFN24 chip has a mark "SX3" but mine is completely black. Under the microscope he found two references on the die: "G4830H001I" and "DI 503 03".		Patrick Gueulle mentions the QFN24 chip has a mark "SX3" but mine is completely black. Under the microscope he found two references on the die: "G4830H001I" and "DI 503 03".

			Pinout:
			<pre>
			1 nc
			2 nc
			3 nc
			4 GND
			5 -+---15
			+---(switch 1)
			+---(C1 100nF)--- GND
			6 nc

			7 (antenna 1)
			8 nc
			9 nc
			10 nc
			11 nc
			12 (antenna 2)

			13 nc
			14 nc
			15 -+--- 5
			+---(switch 1)
			+---(C1 100nF)--- GND
			16 -+---(switch 2)
			+---(R1 2k8)----- GND
			17 nc
			18 nc

			19 nc
			20 nc
			21 GND
			22 GND
			23 nc
			24 nc

			</pre>

	=Traces=		=Traces=

2017-05-05T16:39:04Z

0x55: N2_GET_INFO

← Older revision		Revision as of 16:39, 5 May 2017
Line 210:		Line 210:
	* byte 1: currently active slot		* byte 1: currently active slot
	* byte 2: number of active banks		* byte 2: number of active banks
	* byte 3: ?		* byte 3: button pressed?
	* byte 4: FW version?		* byte 4: FW version?
	It could be that older N2 return only 2 bytes.		It could be that older N2 return only 2 bytes.

2017-05-05T16:13:04Z

N2 & NTAG Resources

← Older revision		Revision as of 16:13, 5 May 2017
Line 17:		Line 17:
	* 44d1ea2fd342c7faa3af81f473eada12 Amiiqo_1.1.apk		* 44d1ea2fd342c7faa3af81f473eada12 Amiiqo_1.1.apk
	* f39a091be603058329b085f1b0382caa Amiiqo_1.2.apk		* f39a091be603058329b085f1b0382caa Amiiqo_1.2.apk
			* d8aa32a1f8b8e62cbd376fc69be47829 com.n2elite.amiiqo_2.0.0.apk
⚫	Versions 1.1 ~~and~~ 1.2 contain ~~both~~ the same fw image to update older N2 Elite tags, see below the section about firmware.
			* bf1f6bbdb4692cedf3921026c7e3aa99 com.n2elite.amiiqo_2.0.1.apk
			* 506167b77f8860a6a78242022728e82e com.n2elite.amiiqo_2.0.2.apk

		⚫	Versions 1.1 to 2.0.2 contain the same fw image to update older N2 Elite tags, see below the section about firmware.

	=Amiibo Resources=		=Amiibo Resources=
	Nothing really useful for us but for sake of completion:		Nothing really useful for us but for sake of completion: