From b70568d34ae5c0ca893e5b83a9d722e2c8495651 Mon Sep 17 00:00:00 2001
From: CinderSocket <cindersocket@protonmail.ch>
Date: Sun, 1 Mar 2026 22:05:30 -0800
Subject: [PATCH] Update seader.asn1

Add reverse engineered U90 packet details
---
 seader.asn1 | 115 ++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 107 insertions(+), 8 deletions(-)

diff --git a/seader.asn1 b/seader.asn1
index 6e59547..d56000c 100644
--- a/seader.asn1
+++ b/seader.asn1
@@ -1,7 +1,7 @@
 Seader DEFINITIONS IMPLICIT TAGS ::=
 BEGIN
 
-Protocol ::= OCTET STRING
+Protocol ::= OCTET STRING  -- UHF module constrains this to SIZE (1..2)
 RfStatus ::= OCTET STRING
 SamResponse ::= OCTET STRING
 -- omnikey_5326_dfr_softwaredeveloperguide 4.2
@@ -25,7 +25,9 @@ SamCommand ::= CHOICE {
   requestPacs [1] RequestPacs,
   version [2] NULL,
   cardDetected [13] CardDetected,
+  processSNMPMessage [20] OCTET STRING,
   serialNumber [22] NoArguments,
+  getItemKCV [43] OCTET STRING,
   requestPacs2 [30] RequestPacs,
   processConfigCard [26] NoArguments
 }
@@ -34,13 +36,6 @@ CardDetected ::= SEQUENCE {
   detectedCardDetails [0] CardDetails
 }
 
-CardDetails ::= SEQUENCE {
-  protocol [0] Protocol,
-  csn [1] OCTET STRING,
-  atqa [2] OCTET STRING OPTIONAL,
-  sak [3] OCTET STRING OPTIONAL
-}
-
 Pacs2 ::= SEQUENCE {
   bits [0] OCTET STRING OPTIONAL,
   oid [1] OCTET STRING OPTIONAL,
@@ -130,4 +125,108 @@ SIO ::= SEQUENCE {
   unknown9 [9] NULL
 }
 
+-- UHF Module reverse engineering from U90
+
+-- Boxed INTEGER constrained to uint32 range; used as RF run-timer ms value
+RunTimerValue ::= INTEGER (0..4294967295)
+
+CardDetails ::= SEQUENCE {
+  protocol       [0] Protocol,
+  csn            [1] OCTET STRING,
+  atsOrAtqbOrAtr [2] OCTET STRING              OPTIONAL,  -- aka atqa/atqb/atr
+  sak            [3] OCTET STRING (SIZE (0..1)) OPTIONAL,
+  cid            [4] OCTET STRING (SIZE (0..1)) OPTIONAL,
+  fwi            [5] OCTET STRING (SIZE (0..1)) OPTIONAL,
+  runTimer       [6] RunTimerValue              OPTIONAL,
+  doTcl          [7] BOOLEAN                   OPTIONAL,
+  fsd            [8] INTEGER                   OPTIONAL
+}
+
+I2CClockSpeed ::= ENUMERATED {
+    i2c100KHz  (100),   -- 0x0064
+    i2c400KHz  (400),   -- 0x0190
+    i2c1000KHz (1000)   -- 0x03E8
+}
+
+UHFModuleTransactionStatus ::= ENUMERATED {
+    unknown              (0),
+    success              (1),
+    failure              (2),
+    antipassBackRejected (3)
+}
+
+-- Commands (host -> UHF module); each alternative identified by context tag [0]..[7]
+
+UHFModuleCommandGetVersion ::= NULL        -- request firmware/hardware version string
+
+UHFModuleCommandGetStatus ::= NULL         -- request current field/inventory status
+
+UHFModuleCommandTransceive ::= SEQUENCE {  -- send raw RF command bits to a tag
+    command  [0] BIT STRING
+}
+
+UHFModuleCommandDeactivateMedia ::= SEQUENCE {  -- mark a specific tag as used/deactivated
+    mediaEPC          [0] OCTET STRING,
+    transactionStatus [1] UHFModuleTransactionStatus
+}
+
+UHFModuleCommandGetProperties ::= NULL     -- query module capability properties
+
+UHFModuleCommandSetConfiguration ::= SEQUENCE {  -- write module configuration (not used?)
+    unknown  [0] OCTET STRING  OPTIONAL
+}
+
+UHFModuleCommandSetAccessPassword ::= OCTET STRING  -- EPC Gen2 access password
+
+UHFModuleCommandGetPrivateData ::= NULL    -- read TID and user-data memory banks
+
+UHFModuleCommand ::= CHOICE {
+    uhfModuleCommandGetVersion        [0] UHFModuleCommandGetVersion,
+    uhfModuleCommandGetStatus         [1] UHFModuleCommandGetStatus,
+    uhfModuleCommandTransceive        [2] UHFModuleCommandTransceive,
+    uhfModuleCommandDeactivateMedia   [3] UHFModuleCommandDeactivateMedia,
+    uhfModuleCommandGetProperties     [4] UHFModuleCommandGetProperties,
+    uhfModuleCommandSetConfiguration  [5] UHFModuleCommandSetConfiguration,
+    uhfModuleCommandSetAccessPassword [6] UHFModuleCommandSetAccessPassword,
+    uhfModuleCommandGetPrivateData    [7] UHFModuleCommandGetPrivateData
+}
+
+-- Responses (UHF module -> host); tag assignments mirror UHFModuleCommand
+
+UHFModuleResponseVersion ::= OCTET STRING  -- version payload (firmware/hardware string)
+
+UHFModuleResponseStatus ::= SEQUENCE {     -- current status; mediaInfo present when tag in field
+    mediaInfo  [0] CardDetails  OPTIONAL
+}
+
+UHFModuleResponseTransceive ::= SEQUENCE { -- raw RF response bits; absent on error
+    response  [0] BIT STRING  OPTIONAL
+}
+
+UHFModuleResponseDeactivateMedia ::= NULL  -- deactivate acknowledged
+
+UHFModuleResponseGetProperties ::= SEQUENCE {
+    i2cMaxClockSpeedInKHz  [0] I2CClockSpeed  OPTIONAL
+}
+
+UHFModuleResponseSetConfiguration ::= NULL -- configuration write acknowledged
+
+UHFModuleResponseSetAccessPassword ::= NULL -- access password write acknowledged
+
+UHFModuleResponseGetPrivateData ::= SEQUENCE { -- TID + user memory read response
+    tid       [0] OCTET STRING,
+    userData  [1] OCTET STRING
+}
+
+UHFModuleResponse ::= CHOICE {
+    uhfModuleResponseVersion           [0] UHFModuleResponseVersion,
+    uhfModuleResponseStatus            [1] UHFModuleResponseStatus,
+    uhfModuleResponseTransceive        [2] UHFModuleResponseTransceive,
+    uhfModuleResponseDeactivateMedia   [3] UHFModuleResponseDeactivateMedia,
+    uhfModuleResponseGetProperties     [4] UHFModuleResponseGetProperties,
+    uhfModuleResponseSetConfiguration  [5] UHFModuleResponseSetConfiguration,
+    uhfModuleResponseSetAccessPassword [6] UHFModuleResponseSetAccessPassword,
+    uhfModuleResponseGetPrivateData    [7] UHFModuleResponseGetPrivateData
+}
+
 END