pytey's mishmash of technology and tinkering.
hackerati
October 31, 2008
RFID on the cheap - hacking tikitag

“tikitag is a service that enables anyone to link real world objects with the online world and make applications accessible with a single touch”. It is a venture by Alcatel-Lucent and it plans to RFID (and internet) enable household objects using tikitags, this is truely great stuff from Alcatel-Lucent.


The service is now in public beta and hardware is being sold via Amazon, for $49.95/£27.96/€34.95 and for that you’ll get the tikitag starter package.

At the centre of tikitag is a slick looking USB reader that has client software for Windows or OS X (Linux support is available but unsupported), tikitags are attached to household objects (such as toys or business cards) and scanned by the reader, when this happens the unique RFID data is sent over the web to the tikitag server and information is returned to the client about that item that will initiate a local action (such as opening a web-browser at a specific URL or starting a video).

Developers can easily create applications that interface with the tikitag “Action Corellation Server” using SOAP.

SOAP requests (while great for online applications) do not allow us to access the lower levels and internals of the tikitag hardware and therefore prohibit us from using it for other non-tikitag uses, so if you want to go lower level, a little investigation reveals that this package is really an OEM ACR122U Contactless Smart Card Reader from ACS.

The ACR122U (and therefore tikitag reader) is a decent RFID reader that has the following feature set -

  • ISO/IEC18092 (NFC) compliant
  • NFC Tags Access Speed = 424 kbps
  • Supports FeliCa Card
  • Supports NFC Tags (Topaz)
  • Support ISO 14443 Type A & B cards - MIFARE® cards (Classics, DESFire)
  • PC/SC and CCID Compliant
  • SAM for secure applications

Full technical specification of the ACR122 is available as a PDF download (the ACR122U is the ACR122 with the additional SAM module).

If you are interested in reprogramming the MCU on the tikitag device the microcontroller used inside is from STmicroelectronics and is an “8-bit, low-power, full-speed MCU with 16K flash, 768 bytes of RAM a smartcard interface and timer” full details about the microcontroller used is available here.

When you buy the tikitag starter package you’ll get the ACS ACR122U reader (in a pretty white and green tikitag case) and 10 sticky tikitags (that are in fact MiFare UltraLight RFID tags with an adhesive backing and the tikitag logo).

The MiFare UltraLight tags (as used for tikitags) from NXP have the following features -

  • 100% compatible with existing MIFARE infrastructure
  • Real anti-collision supported
  • Operating distance up to 10 cm
  • 106 kbits/s data transfer rate
  • Unique 7 byte serial number (ISO 14443A, cascade level 2)
  • High data integrity – 16 bit CRC, parity per byte, bit coding, bit count check
  • 512 bit EEPROM, organized in 16 pages of 4 bytes
  • 32 bit one-time programmable (OTP) area
  • 384 bit read / write area for user data
  • Field programmable ‘Read only’ locking function per page
  • DESFire SAM based security methods supported

The IC used in the MIFARE UltraLight (the NXP MF0ICU1) and has a pretty detailed public funtional spec available as a PDF download

The Tikitag reader has a unique ID that is used to identify the reader with each transaction with the “Tikitag online ACS” this is achieved by the use of a SAM (Secure Access Module) inside the reader, this is a small smartcard that holds additional and individual unique security information.

“The SAM or Secure Access Module is an additional feature in a Smart Card Reader that can enhance the level of security in your Smart Card based application. Normally card authentication is implemented in PC or application level.  However with the presence of a SAM, key diversification and mutual authentication can be implemented between card and reader which means that the PC will not perform the authentication but it will
be done via card to reader and reader to card authentication making your system more secure and less prone to hacking.”

The removable part of the SAM consists of a ID-000 smartcard (GSM SIM card sized) that is inserted into an on-board reader by the manufacturer.

There is a full technical reference of the SAM used in the Tikitag here.

You can interface with the SAM and SAM card using the tikitag reader (you will need to send specificly crafted SAM related commands.)  It is also possible to interface with the SAM by removing it from the slot and inserting it into a ISO7816 compliant reader these commands can be created with something like pyscard or other similar smartcard tools.

BE WARNED! DIRECT AND INCORRECT USE OF THE SAM CAN RESULT IN A BLOCKED CARD THAT MAY RENDER YOUR TIKITAG USELESS! DO NOT ATTEMPT THESE TECHNIQUES (OR REMOVE THE SMARTCARD FROM THE READER) UNLESS YOU KNOW EXACTLY WHAT YOU ARE DOING!

Using the Tikitag reader with OS X.

After the installation of the drivers from Tikitag the reader will operate with the OS X PCSC drivers that are shipped with OS X, to test lower-level access to the reader and tags, use the pcsctest application that is provided with OS X.

mbp15:~ pytey$ pcsctest

MUSCLE PC/SC Lite Test Program

Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: ACS ACR 38U-CCID 00 00
Enter the reader number : 01

Waiting for card insertion : Command successful.
Testing SCardConnect : Command successful.
Testing SCardStatus : Command successful.
Current Reader Name : ACS ACR 38U-CCID 00 00
Current Reader State : 34
Current Reader Protocol : 0
Current Reader ATR Size : 13
Current Reader ATR Value : 3B BE 96 00 00 41 03 00 00 00 00 00 00 00 00 00 02 90 00
Testing SCardDisconnect : Command successful.
Testing SCardReleaseContext : Command successful.

PC/SC Test Completed Successfully !

pcscd is the daemon that is used for PCSC comms on OS X, so restarting this daemon in the foreground with debug mode enabled displays lots of juicy information about tag transactions.

mbp15:~ pytey$ sudo killall pcscd; sudo pcscd -fda
src/PCSC/debuglog.c:240:DebugLogSetLevel() debug level=debug
src/PCSC/debuglog.c:269:DebugLogSetCategory() Debug options: APDU
src/PCSC/pcscdaemon.c:572:main() pcsc-lite 1.4.0 daemon ready.
src/PCSC/readerfactory.c:762:RFInitializeReader() Attempting startup of ACS ACR 38U-CCID 00 00 using /usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle
src/PCSC/readerfactory.c:488:RFBindFunctions() Binding driver functions
src/PCSC/readerfactory.c:624:RFBindFunctions() Loading IFD Handler 3.0
ifdhandler.c:1306:init_driver() LogLevel: 0x0007
ifdhandler.c:1316:init_driver() DriverOptions: 0x0000
ifdhandler.c:81:IFDHCreateChannelByName() lun: 0, device: ACS ACR 38U-CCID
ccid_usb.c:157:OpenUSBByName() Reader index: 0, Device: ACS ACR 38U-CCID
ccid_usb.c:235:OpenUSBByName() Manufacturer: Ludovic Rousseau (ludovic.rousseau@free.fr)
ccid_usb.c:245:OpenUSBByName() ProductString: Generic CCID driver v1.3.5
ccid_usb.c:251:OpenUSBByName() Copyright: This driver is protected by terms of the GNU Lesser General Public License version 2.1, or (at your option) any later version.
ccid_usb.c:310:OpenUSBByName() Checking device: 001/003-072f-90cc-00-00
ccid_usb.c:358:OpenUSBByName() Trying to open USB bus/device: 001/003-072f-90cc-00-00
ccid_usb.c:405:OpenUSBByName() Found Vendor/Product: 072F/90CC (ACS ACR 38U-CCID)
ccid_usb.c:407:OpenUSBByName() Using USB bus/device: 001/003-072f-90cc-00-00
ccid_usb.c:832:ControlUSB() request: 0x03
receive:
ccid_usb.c:776:get_data_rates() IFD does not support GET_DATA_RATES request: Unknown error: 0
ifdhandler.c:304:IFDHGetCapabilities() lun: 0, tag: 0xFAE
ifdhandler.c:350:IFDHGetCapabilities() Reader supports 1 slot(s)
ifdhandler.c:908:IFDHPowerICC() lun: 0, action: PowerUp
...
..

Windows

The Windows ACR122 PC/SC drivers are available here the ACS diagnostic tool is here and the ACR122 “scripting tool” is here.

Unix

Python PC/SC support is available using pyscard. Adam Laurie’s fantastic RFIDIOt tools are available here.

APIs and other information

The ACR122 API guide available here as a PDF download. NXP’s Pegoda information here.

Thanks to Zf[idling] and Bushing for detective work and other cool research.

October 7, 2008
Fabrication d’une lampe triode

Pour a large cognac, puff on a good cigar and put up your feet and relax while watching this amazing video made by Claude Paillard a radio amateur since 1959 who still manufactures his own vaccum tubes in his workshop in France.

October 2, 2008
Elvis Presley - alive in Schiphol

Article and explanation here.

September 24, 2008
The 25¢ I2C Adapter

Today I came across Phillip Burgess’ ingenious method of accessing an I2C bus using the existing Display Data Channel that is present on your graphic card’s VGA or DVI port, very cool. I knew that DVI port on my MacBook Pro would come in useful for something.

September 23, 2008
September 22, 2008
Timbuktu - Tack för kaffet

According to The Pirate Bay Timbuktu is one of Swedens most famous musicians. Looks like he has chosen to release his new single using their site, which is an interesting move that more and more artists are adopting. They are using the free distribution of tracks as a vehicle to help promote other revenue streams. His new single “Tack för kaffet” (Thanks for the coffee) can be downloaded from them here

September 20, 2008
THAT is a good look

Homemade laser tag makes laser tag that much dorkier. - [dvice] 

                        

Amiga and ST fanboys still able to battle in FPGA bitstream

For all you old timers reading this blog ACube Systems is the manufacturer of the amazing little opensource Minimig, which is a Amiga 500 clone developed by Dennis van Weeren over the last few years. It is based around a Xilinx Spartan-3 FPGA but it has a real 68K CPU (the Freescale MC68SEC000) and uses an SD card for storage.

                 

Now if that isn’t cool enough for you Hyperion Entertainment are helping keep the Amiga OS going as they’ve just signed a deal with ACube Systems to OEM their Amiga OS 4.1  The OS will run on their SAM440ep board, which a rather neat MiniITX motherboard with a PowerPC CPU, in fact it is a 440EP, a System On Chip (SoC) produced by AMCC under license from IBM.

I was an Atari ST man myself, but it is nice to see FPGA reimplementations of these old machines. For the ST there is Suka which is a VHDL implementation of the Atari ST with a similar board that is currently in prototype *drools*. 

Part of the Weekend Never Dies

Yesterday I watched “Radio Soulwax - Part of the Weekend Never Dies”  a fantastic documentary and tour log of David and Stephen Dewaele and their musical entourage.

  • Soulwax is a rock band from Benelux, headed up by two brothers AKA “The Dewaele brothers”, David and Stephen with Steve Slingeneyer on drums and the bass player Stefaan Van Leuven.
  • 2ManyDJs is the moniker for the DJ troupe that are again, David and Stephen Dewaele.
  • “Nite versions” are the name of the remixes that the whole band “Soulwax” make of their own “Any minute now”, in the style of Duran Duran’s Extended Night Versions
  • “Radio Soulwax” is the name of a Dewaele promoted night where other acts are invited to perform live, they also play themselves (Soulwax/Nite Versions/2ManyDJs).

It is a great candid view of the brothers Dewaele with great input from LCD Soundsystem’s James Murphy and James Righton from the Klaxons.

I’ve seen 2ManyDJs live a good few times and I’ve loved them since running around the record stores in 2000/2001 trying to buy bootlegs of the “As heard on Radio Soulwax” series (nowadays all of their discography is available on the internet).

Anyhow, the documentary DVD is fantastic well worth watching with headphones or on a very loud home cinema system.

September 19, 2008
Micro-payments as mobile remittances

The Newstatesman has an interesting article  on the popularity of “mobile remittances”. These payments take place on mobile phones and are used as an alternative to internet banking and other payment processors.

Tivoli Audio Internet Player

Tivoli audio are the guys who are known for manufacturing  functional, stylish, high end  wooden cased radios. They have released a series of internet enabled devices called “NetWorks”. These devices, instead of using traditional radio connect to the internet to acquire content over the net.  I’ve been a fan of standalone internet radios for quite a while, ever since using my 3Com Audrey as one. In recent years I moved to the Reciva based radios that use an ARM CPU and the “Familiar Linux” distribution, I have a softspot for this company as I did some of the earliest hacks on this suite of devices to customize the functionality. 

The “Tivoli NetWorks” start at a whopping $599.00 but a Reciva based radio can cost as little as $50 and has almost the same feature set, but it certainly won’t have the same design and style that the trendy Tivoli Audio has. An interesting note is that the firmware for the current Reciva based radios contains configuration files and behavior modifications that emulate the Tivoli Audio radio identically, even down to the Tivoli banner and channel selection screen. Clearly Reciva were in advanced talks to use their technology inside the Tivoli, but this didn’t materialize.

Here is a video demonstrating the Tivoli devices, it is a little corny, but shows some of the UI and features.

September 18, 2008
Saleae’s USB Logic Analyzer

Logic analyzers are usually large, expensive, dedicated pieces of equipment that are out of reach to most hobbyists, bedroom engineers and other hardware hackers.

Joseph Garrison of Saleae has designed and manufactured a gorgeous USB logic analyzer built around a Cypress CY7C68013A  microcontroller. He has high-quality test probes and a stunning laser etched, anodized aluminum case,  all put together nicely and aptly named it ‘Logic’.

                         

This isn’t a dedicated bench device that would be mucho dollars but is a USB device that uses a PC to provide the interface that is usually provided by beige buttons and a CRT display. Using the horsepower of the PC allows the device to be cheap low cost, is good up to 24MHz and a bargain at a mere $149.  

Saleae have managed to make the UI to their application look as simple and beautiful too.

I haven’t bought one of these simply because it doesn’t support OS X yet, but on Joe’s very cool development blog it suggests that OS X support is on the way, maybe I’ll order one to test with Bootcamp.

Sony PS3 EyePet

This is a small teaser video for an application that Sony are developing for the PS3. It uses the Playstation Eye camera module to create a “virtual pet” that interacts with the user by using motion tracking, video overlays and other “augmented reality” techniques. It is due for release some time in 2009. 


EyePet Hd from Nkio on Vimeo.

Neuros OSD 2.0 HD Developer Kits

Neuros Technology yesterday released their Neuros OSD2.0 Developer Kit. The developer kit is the updated, not yet for end user version of their OSD open media player. The kit costs $249.99 and uses the Texas Instruments TI’s DaVinci DM 6446 chipset to deliver “high def video recording from virtually any source and playback in a variety of formats”. TI themselves are doing some very interesting open projects recently, one of them of course being the $149.00 embedded BeagleBoard based on the OMAP3530 Application Processor.

Embedded RSS Ticker

                            

James Blackwell built an RSS news ticker for last year’s WIZnet iEthernet Design Contest. He used a PIC18F2525, a PIC18F2221, and a WIZnet WIZ810MJ Ethernet module to build this cool looking ticker. 

This month’s Circuit Cellar magazine has an article about it, the article can also be read online.