diff --git a/armsrc/i2c.c b/armsrc/i2c.c index f79943d90..6a4289ccf 100644 --- a/armsrc/i2c.c +++ b/armsrc/i2c.c @@ -45,13 +45,9 @@ #define SC_PROTO_T0 (1 << 0) #define SC_PROTO_T1 (1 << 1) -// Protocols the last ATR offered, as a bit mask of (1 << T). Zero means we do -// not know - no ATR has been read since the module was last reset. +// protocols the last ATR offered, (1 << T). 0 = no ATR read since reset static uint8_t s_card_protocols = 0; - -// Whether the protocol choice has already been reported this session. These -// messages are worth seeing once; sc_raw_device_cmd() runs per APDU, and an -// EMV AID sweep is 150 of them. +// sc_raw_device_cmd() runs per APDU, so report the choice once per card static bool s_proto_announced = false; // try i2c bus recovery at 100kHz = 5us high, 5us low @@ -848,11 +844,8 @@ bool sc_rx_bytes(uint8_t *dest, uint16_t *destlen, uint32_t wait) { return true; } -/* - * ISO/IEC 7816-3 clause 8: the protocols on offer are the low nibbles of the - * TDi bytes. With no TD1 at all, only T=0 is offered. T=15 carries global - * interface bytes rather than a transmission protocol and is ignored here. - */ +// ISO 7816-3 clause 8: offered protocols are the low nibbles of the TDi bytes. +// No TD1 means T=0 only. T=15 is global interface bytes, not a protocol. static uint8_t atr_protocols(const uint8_t *atr, uint8_t len) { if (len < 2) { @@ -892,10 +885,7 @@ static uint8_t atr_protocols(const uint8_t *atr, uint8_t len) { uint8_t sc_raw_device_cmd(smartcard_command_t flags) { - // An explicit T=1 request is always honoured as asked - it is an override, - // and a card that supports T=1 without advertising it is a real thing. But - // say so when the ATR disagrees, because the alternative is silence from - // the card and no clue why. + // an explicit T=1 request is an override, honoured even if the ATR disagrees if ((flags & SC_RAW_T1) == SC_RAW_T1) { if ((s_card_protocols != 0) && ((s_card_protocols & SC_PROTO_T1) == 0)) { @@ -909,21 +899,10 @@ uint8_t sc_raw_device_cmd(smartcard_command_t flags) { if ((flags & SC_RAW_T0) == SC_RAW_T0) { - /* - * A T=0 request to a card whose ATR offers no T=0 cannot work - the - * card will not hear it at all, which shows up as silence rather than - * an error. Most modern EMV and JCOP cards are T=1 only, and callers - * like ExchangeAPDUSC() ask for T=0 unconditionally. - * - * Only this one case is redirected, and only once an ATR has actually - * been read. A card that does offer T=0 is left alone even if it also - * offers T=1, because there the caller's choice is a real one - use - * SC_RAW_T1 to say otherwise. - * - * Note this cannot make anything worse even against a SIM module too - * old to know SEND_T1: in the exact case it fires, the request as given - * was already guaranteed to fail. - */ + // A T=0 request to a card offering no T=0 cannot work - it simply will + // not hear it. Most modern EMV/JCOP cards are T=1 only and callers like + // ExchangeAPDUSC() ask for T=0 unconditionally. Redirect only that case; + // a card offering both keeps the caller's choice. if ((s_card_protocols != 0) && ((s_card_protocols & SC_PROTO_T0) == 0) && ((s_card_protocols & SC_PROTO_T1) == SC_PROTO_T1)) { diff --git a/armsrc/i2c.h b/armsrc/i2c.h index 41453dbb9..06f7d2eb7 100644 --- a/armsrc/i2c.h +++ b/armsrc/i2c.h @@ -50,94 +50,29 @@ // The SIM module v4 supports up to 384 bytes for the length. #define ISO7816_MAX_FRAME 270 -/* - * Bit banged bus timing. - * - * I2C_DELAY_1CLK is spent twice per bit and I2C_DELAY_2CLK once, so the bit - * period is 2 * 1CLK + 2CLK. At 2/4 us that is ~125 kHz nominal; expect nearer - * 90 kHz once SpinDelayUsPrecision()'s own overhead at these short durations is - * counted. - * - * TODO DXL 修改了速度到比较慢的情况，测完需要改回来，原先是2和4 - * - * ("the speed was changed to a slower setting; change it back after testing, - * originally 2 and 4") - * - * That TODO belongs to the HAL refactoring for the Proxmark5 (Artery - * AT32F435/437), where SpinDelayUsPrecision() is a different implementation - * whose overhead at a two microsecond request has not been measured. The - * 20/22 us it was raised to is kept for that platform rather than thrown away. - * - * Nothing depends on it yet: smartcard support is not built for PM5 - see the - * "暂时不要编译i2c" note beside its PLATFORM_DEFS in common_arm/Makefile.hal - - * so the AT32 branch below is an unvalidated starting point, not a measurement. - * When that bring-up happens, measure the AT32 delay and set it here; every - * timeout in this file is derived from these two numbers, so that is the only - * place it needs to change. - */ -/* - * 20/22 on both platforms for now. - * - * Dropping this to 2/4 was tried and the bus stopped working entirely - no ATR, - * no answer to anything - even with the delay primitive's overshoot bug fixed - * (see SpinDelayUsPrecision in common_arm/ticks/ticks_hw_at91.c). 8 us per bit - * is about 125 kHz, and something in the path will not carry it: rise time - * through the pull ups is the obvious candidate, but it was not measured. - * - * Worth revisiting with a scope on SCL and SDA rather than by trial. Every - * timeout below is derived from these two numbers, so changing them is a - * two line edit once someone knows what the bus can actually do. - */ -#define I2C_DELAY_1CLK_US 20 -#define I2C_DELAY_2CLK_US 22 +// Bit banged bus timing. 1CLK is spent twice per bit, 2CLK once, so the bit +// period is 2 * 1CLK + 2CLK, here 17 us or about 59 kHz. Every timeout below +// derives from these, so they are the only two numbers to change. +#define I2C_DELAY_1CLK_US 5 +#define I2C_DELAY_2CLK_US 7 -/* - * Every SCL wait loop spends one I2C_DELAY_1CLK per iteration, so the timeouts - * below are iteration counts rather than times - which is why changing the - * delay used to silently rescale every one of them, and why the constants had - * drifted to roughly 6.5x their documented length. - * - * They are written in milliseconds now and converted in one place, so the two - * cannot come apart again. The conversion uses the nominal delay rather than a - * measured one on purpose: with the real per-iteration cost being a little - * higher, a timeout always lasts at least as long as it asks for. - */ +// The SCL wait loops spend one 1CLK per iteration, so their timeouts are +// iteration counts. Written in ms and converted here so the two cannot drift. #define I2C_ITERS_PER_MS (1000U / I2C_DELAY_1CLK_US) #define I2C_ITERS_FOR_MS(ms) ((uint32_t)(ms) * (uint32_t)I2C_ITERS_PER_MS) -// How long the master tolerates the slave stretching SCL inside a transfer. -#define I2C_STRETCH_TIMEOUT_MS 100 - -/* - * How long to wait for the SIM module to finish an operation and release SCL. - * - * This has to cover the card's own thinking time. A T=1 card's block waiting - * time is 1.4 s at the default BWI = 4, and a HID iCLASS SE SAM asks for - * BWI = 5, i.e. 2.9 s - so 3 s is the smallest value that clears both. - */ -// Upper bound on a host supplied SC_WAIT, so the conversion cannot overflow. -#define I2C_WAIT_MAX_MS 60000 +#define I2C_STRETCH_TIMEOUT_MS 100 // slave stretching SCL inside a transfer +#define I2C_WAIT_MAX_MS 60000 // clamp on a host supplied SC_WAIT +// Must cover the card's block waiting time: 1.4 s at BWI=4, 2.9 s at BWI=5. #define SIM_WAIT_MS 3000 #define SIM_WAIT_DELAY I2C_ITERS_FOR_MS(SIM_WAIT_MS) -/* - * Compile time guards on the two numbers above. The build is -std=c99 so this - * is the negative array size trick rather than _Static_assert. - */ +// -std=c99, so no _Static_assert #define I2C_BUILD_ASSERT(cond, name) typedef char i2c_assert_##name[(cond) ? 1 : -1] -// A delay that does not divide 1000 makes I2C_ITERS_PER_MS silently lose -// precision, and every timeout with it. I2C_BUILD_ASSERT((1000U % I2C_DELAY_1CLK_US) == 0, clk_divides_ms); - -// A T=1 card may sit quiet for its whole block waiting time before answering: -// 1.4 s at the default BWI = 4, and 2.9 s at the BWI = 5 a HID iCLASS SE SAM -// asks for. Shorten this and T=1 starts timing out on slow cards with nothing -// to show for it but an empty response. I2C_BUILD_ASSERT(SIM_WAIT_MS >= 3000, sim_wait_covers_bwt); - -// The largest host supplied wait must still fit the iteration counter. I2C_BUILD_ASSERT((uint64_t)I2C_WAIT_MAX_MS * I2C_ITERS_PER_MS <= 0xFFFFFFFFULL, wait_fits_u32); diff --git a/client/resources/sim016.bin b/client/resources/sim016.bin new file mode 100644 index 000000000..dedbbc2d3 Binary files /dev/null and b/client/resources/sim016.bin differ diff --git a/client/resources/sim016.sha512.txt b/client/resources/sim016.sha512.txt new file mode 100644 index 000000000..de29cc9f8 --- /dev/null +++ b/client/resources/sim016.sha512.txt @@ -0,0 +1 @@ +9a3d623aa3c749ffb5125b6a4912f74e46902a9135441c427e1635be24d43c048e40e1f60a052175f383a1316c63dbddb999cac170a4224fe9a0d7df896391d4 *sim018.bin diff --git a/client/src/cmdhflist.c b/client/src/cmdhflist.c index 6711c2a5a..90e7648b6 100644 --- a/client/src/cmdhflist.c +++ b/client/src/cmdhflist.c @@ -818,17 +818,10 @@ void annotateTopaz(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize) { // iso 7816-3 // -// `contact` tells the two framings that reach this decoder apart: -// -// - contactless (ISO 14443-4 / T=CL): every frame is a block, its type is in -// the first byte, and the length comes from the transport layer. -// - contact (the SIM module): a T=0 frame is a bare APDU with no block layer -// at all, and a T=1 frame is NAD PCB LEN INF[LEN] EDC, so its length is -// fixed by LEN. -// -// Without that distinction a GSM APDU beginning with CLA 'A0' satisfies the -// T=CL R-block test - 0xA0 & 0xD0 == 0x80 - and "A0 A4 00 00 02 3F 00" gets -// annotated as "R-block ACK". +// contact tells the two framings apart: a contactless frame is always a block +// typed by its first byte, while a contact T=0 frame is a bare APDU and a T=1 +// frame is NAD PCB LEN INF EDC. Without it a GSM APDU starting with CLA 'A0' +// matches the T=CL R-block test. void annotateIso7816(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, bool is_response, bool contact) { if (cmdsize < 2) { @@ -839,21 +832,29 @@ void annotateIso7816(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, bool return; } - // A contact frame is either a bare T=0 APDU or a T=1 block, and the two - // framings put things in different places: T=1 is NAD PCB LEN INF[LEN] EDC, - // so the block type is in cmd[1], not cmd[0] the way T=CL has it. - // - // Only the one byte LRC is considered when matching the length. A five - // byte APDU whose P1 is zero - "A0 C0 00 00 22" - is indistinguishable from - // a LEN=0 block with a two byte CRC, and CRC EDC is vanishingly rare. - // Requiring NAD 0x00 rules out the rest; every card and this SIM module use - // it exclusively. + // T=1 puts the block type in cmd[1], not cmd[0] as T=CL does. Match only + // the one byte LRC length - a five byte APDU with P1 zero is otherwise + // indistinguishable from a LEN=0 block with a CRC. NAD must be 0x00. if (contact) { if ((cmdsize >= 4) && (cmd[0] == 0x00) && ((int)cmdsize == (int)cmd[2] + 4)) { uint8_t pcb = cmd[1]; + // Length alone is not enough - "00 B2 01 0C 00" is a READ RECORD + // that matches it. Require PCB and LEN to agree: an R-block carries + // no INF, an S-block at most one byte. + bool pcb_agrees = true; + if ((pcb & 0xC0) == 0x80) { + pcb_agrees = (cmd[2] == 0); /* R */ + } else if ((pcb & 0xC0) == 0xC0) { + pcb_agrees = (cmd[2] <= 1); /* S */ + } + + if (pcb_agrees == false) { + goto not_a_block; + } + if ((pcb & 0x80) == 0x00) { snprintf(exp, size, "I-block N(S)=%u%s", (pcb >> 6) & 1, (pcb & 0x20) ? " chained" : ""); @@ -875,14 +876,13 @@ void annotateIso7816(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, bool } return; } - // not a block, so it is a bare APDU - decoded below with pos = 1 +not_a_block: + ; // a bare APDU then - decoded below with pos = 1 } bool blocks = (contact == false); - // S-block. The test used to be a plain truthiness check on cmd[0] & 0xC0, - // so any first byte from 0x40 up landed here - an R-block 0xA2 in a 3 byte - // frame was reported as an S-block. + // S-block if (blocks && ((cmd[0] & 0xC0) == 0xC0) && ((cmdsize == 3) || (cmdsize == 4))) { switch ((cmd[0] & 0x3F)) { diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c index e088b348d..410b25362 100644 --- a/client/src/cmdsmartcard.c +++ b/client/src/cmdsmartcard.c @@ -327,18 +327,9 @@ static int smart_wait(uint8_t *out, int maxoutlen, bool verbose) { return -1; } -// Which class byte a GET RESPONSE following a 61xx / 9Fxx should carry. -// -// There is no rule that can be derived from the command's own class, because -// two cards that both use CLA 'A0' disagree: -// -// - a GSM 11.11 / TS 51.011 SIM answers 6D00 to '00 C0 ...' and needs 'A0 C0' -// - a HID iCLASS SE SAM answers 6D00 to 'A0 C0 ...' and needs '00 C0' -// -// and EMV (Book 1, 9.3.1) fixes GET RESPONSE at '00' even after a proprietary -// '80' command. So '00' is tried first - the historical behaviour, right for -// EMV and for the SAM - and a card that rejects the class gets one retry with -// the class of the command that produced the status word. +// Class byte for a GET RESPONSE after 61xx / 9Fxx. No single rule works: a GSM +// SIM needs 'A0 C0' and rejects '00 C0', a HID iCLASS SE SAM is the other way +// round, and EMV fixes it at '00'. Try '00' first, then the command's own. #define GETRESP_TRY_FIRST 0 #define GETRESP_TRY_RETRY 1 @@ -400,8 +391,7 @@ static int smart_responseEx(uint8_t *out, int maxoutlen, bool verbose, uint8_t c if (verbose) PrintAndLogEx(INFO, "Requesting " _YELLOW_("0x%02X") " bytes response", len); - // '00' first, then one retry with the command's own class if the card - // rejects it - see get_response_cla() for why neither works everywhere. + // '00' first, then the command's own class if the card rejects it for (int attempt = GETRESP_TRY_FIRST; attempt <= GETRESP_TRY_RETRY; attempt++) { uint8_t cmd_getresp[] = { @@ -442,20 +432,9 @@ static int smart_responseEx(uint8_t *out, int maxoutlen, bool verbose, uint8_t c goto out; } - /* - * Two shapes are valid here, depending on how the GET RESPONSE went out: - * - * len + 2 the data and its status word. This is what SEND_T0 - * gives, because the module runs the procedure byte - * exchange itself and strips the echoed INS. - * len + 2 + 1 the same with that procedure byte still in front, - * which is what the raw pass through leaves behind. - * - * Only the second needs unwrapping - but the first used to fall through - * both branches without ever adding to totallen, so the caller got zero - * bytes and reported "result length = 0" while the card had answered - * perfectly. It went unnoticed while GET RESPONSE was always sent raw. - */ + // Two valid shapes: len+2 is data plus SW, which SEND_T0 gives since + // the module strips the procedure byte; len+2+1 still has it in front, + // as the raw pass through leaves it. if (datalen == len + 2) { totallen += datalen; } else { @@ -823,15 +802,14 @@ static int CmdSmartInfo(const char *Cmd) { SendCommandNG(CMD_SMART_ATR, NULL, 0); PacketResponseNG resp; if (WaitForResponseTimeout(CMD_SMART_ATR, &resp, 2500) == false) { - if (verbose) { - PrintAndLogEx(WARNING, "smart card timeout"); - } + PrintAndLogEx(WARNING, "smart card timeout"); return PM3_ETIMEOUT; } if (resp.status != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "no ATR - check the card is present and seated"); if (verbose) { - PrintAndLogEx(WARNING, "smart card select failed"); + PrintAndLogEx(INFO, "module returned status %d", resp.status); } return PM3_ESOFT; } @@ -1653,14 +1631,8 @@ int CmdSmartcard(const char *Cmd) { return CmdsParse(CommandTable, Cmd); } -/* - * Which protocol the contact exchanges below ask for. - * - * T=0 by default, which is what this has always sent. The ARM side already - * redirects a T=0 request to T=1 when the card's ATR offers no T=0 at all - a - * request that could not have worked as asked. This is for the other case: a - * card that offers both, where T=0 would work but you want T=1 anyway. - */ +// Protocol the contact exchanges ask for. T=0 by default; the ARM redirects a +// card offering no T=0 by itself, so this is for one that offers both. static smartcard_command_t s_sc_protocol = SC_RAW_T0; void SetSmartcardProtocolT1(bool use_t1) { diff --git a/client/src/emv/cmdemv.c b/client/src/emv/cmdemv.c index 8452a5914..da9966dda 100644 --- a/client/src/emv/cmdemv.c +++ b/client/src/emv/cmdemv.c @@ -575,16 +575,8 @@ static int emv_parse_card_details(uint8_t *response, size_t reslen, bool verbose return PM3_SUCCESS; } -/* - * Resolve --t0 / --t1 for the contact interface. - * - * The ARM already switches a card whose ATR offers no T=0 over to T=1 by - * itself, since a T=0 request to it could never have worked. This is for the - * other case: a card offering both, where T=0 is a legitimate choice and the - * caller wants T=1 anyway. - * - * Reports the problem and returns non-success if the flags make no sense. - */ +// Resolve --t0 / --t1 for the contact interface. The ARM switches a card +// offering no T=0 over by itself; this is for one that offers both. static int emv_set_protocol(bool use_t0, bool use_t1, Iso7816CommandChannel channel) { if (use_t0 && use_t1) { @@ -660,8 +652,6 @@ static int CmdEMVSelect(const char *Cmd) { if (sw == 0) { PrintAndLogEx(FAILED, "No answer from card ( %d )", res); if (channel == CC_CONTACT) { - // Point the other way when T=1 was forced - suggesting the flag - // that is already in use is worse than saying nothing. if (GetSmartcardProtocolT1()) { PrintAndLogEx(HINT, "Hint: card was driven as T=1, drop `" _YELLOW_("--t1") "` to use T=0"); } else { @@ -2961,19 +2951,9 @@ static int CmdEMVReader(const char *Cmd) { const char *al = "Applets"; struct tlvdb *tlvSelect = tlvdb_fixed(1, strlen(al), (const unsigned char *)al); - /* - * Search the directory this channel expects first, then the other one. - * - * A contact card may carry either: 1PAY was the norm and 2PAY is what - * modern cards use, and plenty carry only one of them. This used to - * select 2PAY, throw the answer away, and then search whichever psenum - * says - 1PAY on contact - so a card with only a PPSE fell through to - * the AID list sweep with its directory already read and discarded. - * The sweep then cannot find anything the built-in list does not carry, - * which is most non-Visa/Mastercard applets. - * - * The first call activates the field; the fallback reuses it. - */ + // Search the expected directory then the other - a contact card may + // carry 1PAY or 2PAY and plenty carry only one. First call activates + // the field, the fallback reuses it. res = EMVSearchPSE(channel, true, true, psenum, false, tlvSelect, true); if (res) { res = EMVSearchPSE(channel, false, true, (psenum == 1) ? 2 : 1, false, tlvSelect, false); diff --git a/client/src/emv/emvcore.c b/client/src/emv/emvcore.c index 07487dfa4..51f1e9f8a 100644 --- a/client/src/emv/emvcore.c +++ b/client/src/emv/emvcore.c @@ -475,6 +475,17 @@ int EMVSearchPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFi } } else if (quiet == false) { PrintAndLogEx(ERR, "%s ERROR: Can't select PPSE AID. Error: %d", PSE_or_PPSE, res); + + // an empty slot and a card that is simply not an EMV card both land + // here, so ask the module which one it is + if ((res < 0) && (channel == CC_CONTACT)) { + smart_card_atr_t atr; + if (smart_select(false, &atr)) { + PrintAndLogEx(HINT, "Hint: card answered its ATR but not the APDU - is this an EMV card? try `" _YELLOW_("smart info") "`"); + } else { + PrintAndLogEx(HINT, "Hint: no answer at all - is a card in the slot? try `" _YELLOW_("smart info") "`"); + } + } } if (!LeaveFieldON) @@ -503,12 +514,9 @@ int EMVSearch(Iso7816CommandChannel channel, bool ActivateField, bool LeaveField // retry if error and not returned sw error if (res && res != 5) { - // A negative result is a PM3_E* transport failure rather than - // anything the card said - PM3_EIO when the field has gone - // inactive, for instance. Retrying the same AID cannot fix that, - // and neither can the ~150 AIDs still to come: without this it - // retries each of them three times and prints a failure for every - // attempt. + // A negative result is a PM3_E* transport failure, not something + // the card said. Retrying cannot fix it, nor can the ~150 AIDs + // still to come. if (res < 0) { if (LeaveFieldON == false) { DropFieldEx(channel); diff --git a/client/src/iso7816/iso7816core.c b/client/src/iso7816/iso7816core.c index c15f3c858..a506f2576 100644 --- a/client/src/iso7816/iso7816core.c +++ b/client/src/iso7816/iso7816core.c @@ -80,9 +80,11 @@ int Iso7816Connect(Iso7816CommandChannel channel) { return res; } -int Iso7816ExchangeEx(Iso7816CommandChannel channel, bool activate_field, bool leave_field_on, - sAPDU_t apdu, bool include_le, uint16_t le, uint8_t *result, - size_t max_result_len, size_t *result_len, uint16_t *sw) { +// allow_le_retry gates the 6Cxx reissue below; the retry itself passes false +static int iso7816_exchange_core(Iso7816CommandChannel channel, bool activate_field, bool leave_field_on, + sAPDU_t apdu, bool include_le, uint16_t le, uint8_t *result, + size_t max_result_len, size_t *result_len, uint16_t *sw, + bool allow_le_retry) { *result_len = 0; if (sw) { @@ -178,6 +180,29 @@ int Iso7816ExchangeEx(Iso7816CommandChannel channel, bool activate_field, bool l *sw = isw; } + // 6Cxx is "wrong length, ask again for xx". Handled here rather than per + // command since any case 2/4 APDU can get it - READ RECORD and GET DATA + // both do. Once only; the card has named the length. + if (allow_le_retry && ((isw >> 8) == 0x6C)) { + + if (APDULogging) { + PrintAndLogEx(INFO, ">>> wrong length, reissuing with Le=%02X...", isw & 0xFF); + } + + return iso7816_exchange_core(channel + , false + , leave_field_on + , apdu + , true + , (uint16_t)(isw & 0xFF) + , result + , max_result_len + , result_len + , sw + , false + ); + } + if (isw != ISO7816_OK) { if (APDULogging) { if (*sw >> 8 == 0x61) { @@ -191,6 +216,14 @@ int Iso7816ExchangeEx(Iso7816CommandChannel channel, bool activate_field, bool l return PM3_SUCCESS; } +int Iso7816ExchangeEx(Iso7816CommandChannel channel, bool activate_field, bool leave_field_on, + sAPDU_t apdu, bool include_le, uint16_t le, uint8_t *result, + size_t max_result_len, size_t *result_len, uint16_t *sw) { + + return iso7816_exchange_core(channel, activate_field, leave_field_on, apdu, include_le, le, + result, max_result_len, result_len, sw, true); +} + int Iso7816Exchange(Iso7816CommandChannel channel, bool leave_field_on, sAPDU_t apdu, uint8_t *result, size_t max_result_len, size_t *result_len, uint16_t *sw) { return Iso7816ExchangeEx(channel , false @@ -220,22 +253,10 @@ int Iso7816Select(Iso7816CommandChannel channel, bool activate_field, bool leave , sw ); - /* - * A contact card running T=1 needs the Le that a T=0 card must not be - * given. T=0 answers a case 4 command with 61xx and hands the data over - * through GET RESPONSE, so the Le is left off; T=1 carries the whole APDU - * in one block and has no such step, so the command has to ask for its - * length up front. Send one without and a strict card answers 6700. - * - * Rather than work out which protocol the link ended up on - the ARM may - * have switched to T=1 on its own, off the ATR, without the client being - * told - let the card say so and reissue. EMVReadRecord() and - * EMVGenerateChallenge() already do the mirror image of this. - * - * Only on 6700/6F00, and only on contact: a T=0 card has no reason to - * answer a SELECT that way, and if one did the retry costs a single extra - * APDU that it will reject just as it rejected the first. - */ + // T=1 carries the whole APDU in one block, so a case 4 command must include + // Le - unlike T=0, which answers 61xx and hands the data over via GET + // RESPONSE. A strict card answers 6700 without it. Reissue rather than work + // out which protocol the link ended up on. if ((channel == CC_CONTACT) && (sw != NULL) && ((*sw == 0x6700) || (*sw == 0x6F00))) { if (APDULogging) {