I recently picked up a USB RFID reader/writer pod to play with, partly to learn enough to be dangerous about the tech, and partly hoping to tamper with the RFIDs in the current university ID cards. I’m pretty sure I failed on the latter point, but am succeeding at the former in the process.
Notes from the first round of fiddling with it follow.
It’s branded “Mifare Card Encoder M302,” I paid about $23 at NewConcept on Aliexpress for a bundle with the device, a standard A to mini B USB cable, five fobs, and five cards, all of which should be writable cards of the Mifare Classic flavor. Product link New Contactless USB Interface 13.56MHZ RFID 14443A Card Encoder IC Card Reader for Mifare Writer with 5pcs Cards 5pcs Key Fob – I bought several things from the seller and one of the other ones came as single items when the description was lots of 3, so this is neither an endorsement nor a warning, I’ve seen apparently the same kit for similar prices many, many places online. It included the standard unlabeled 25Minute MiniCD that comes with all cheap Chinese electronics, which in addition to various drivers and instructions, and some RAR files I’m not terribly excited to find out what are lurking in, included an extremely useful PDF describing the device protocol in reasonable detail.
Linux sees the devices as a
1a86:7523 QinHeng Electronics HL-340 USB-Serial adapter in lsusb, which is simply a USB/Serial adapter. Support for the device seems to be extremely limited, however Michael Ablassmeier has shared a little 33-line python script on github which literally converts part of the text of the provided PDF into an absolutely minimal dumper for reading the serial numbers off of MIFARE tags. I haven’t tried the Windows drivers or found other more featureful software that works with it under Linux, but this was just a first pass to verify that it works.
Being me, as soon as I verified that it basically worked, I pulled it apart to see what I actually got.
Photo quality improved by the rather awesome collapsible soft box I got in the same Aliexpress binge.
The main RFID chip is a NXP MFRC500 (PDF Warning!), the “Original” Mifare Classic/1K/4k part, with support for all of ISO/IEC 14443 A.
It is USB interfaced via a CH340T (PDF Warning!) USB/Serial adapter, which works under Linux with the ch341 module in mainline, and whose datasheet is, despite being an exercise in Chinglish, readily available, comprehensible and complete.
The board is glued together with a STC 89C52RC microcontroller, which is a typical cheap 8051 part with 8k of flash and 512 byes of RAM onboard.
The three chips each have their own crystal can, at the expected 12.0000Mhz for the USB/Serial, 11.0592 for the micro, and 13.5600 for the RFID.
It has R/G indicator LEDs and a buzzer, both of which are easily controlled by serial. The antenna is a five loop PCB antenna on the underside of the board.
There are also quite a number of unpopulated pads, including two rows marked 5V/TXL/RXL/G that I suspect are a programming interfaces for the USB/Serial bridge and microcontroller respectively, though the one near the bridge may simply be a second port on the bridge. There are also a couple of extra pads for (probably redundant) indicator LEDs, what I suspect are pads for an external antenna connector, and footprints for two extra SOIC packages, one 8 pin labeled U4 and one 21 pin with a weird bidirectional silkscreen labeled U7 at one end and U8 at the other, and surrounded by footprints for decoupling caps – my first guess is optional external RAM/ROM.
I haven’t yet succeeded in talking to either the HID iClass Px G8H card or XceedID Proximity 7610 fob I have from the university, most likely because I didn’t read carefully and they are ISO/IEC15693 type RFID devices not supported by the reader/writer I bought. The pin-compatible NXP CLRC63201T part offers 14443 A, B and ISO/IEC 15693 support, but that’s not what’s in here, nor what the vendor claimed. While trying to figure out my mistake, I eventually came across and learned a great deal from this handy multi-vendor RFID Selection Guide from EVB which explains the various RFID flavors in circulation and, like so much good documentation, is hosted by Adafruit.
It should still make a fun toy.