Read the PBoC e-cash instruction Stream

This instruction flow applies only to T=0 protocol cards, and the data is from my bank of China debit card.

61 Send Get RESPONSE command fetch data

6C plus byte count, command re-send

Depending on its type, the file may be queried via file name and SFI.

Any ADF (application definition file) or DDF (directory definition file) of advant can be queried by its DF (private file) name, and the DF name of the ADF corresponds to its aid, and each DF name is unique within a given card.

SFI (short file identifier) is used to select AEF (apply base file). For any AEF in a given application, you can query by SFI (5-bit code, value range 1~30).

S1: Read ATR

<=3b 6D 00 00 80 65 08 49 04 86 53 00 00 00 00 00 00

ATR Data analysis

Character	Value	Description
Ts	3 b	Forward Convention, the first to send is the least significant bit of the character
T0	6D	TB1 and TC1 exist, and D represents the number of historical bytes present
TB1	00	Do not use VPP
TC1	00	Indicates the amount of time required for additional protection
History byte	80 65 08 49 04 86 53 00 00 00 00 00 00

S2: Select payment System "1PAY. SYS. DDF01 ", read FCI (file control information)

=>00 A4 0E

<=A4 (INS)

=>31 2E (2E)----1PAY. SYS. DDF01 "

<=61 28

=>00 C0 00 00 28

<=6f//FCI templates

0E (2E), 2E, 3031, DF,

A5//FCI-specific data

5F 2D 9f11 7A-----------------------

<=90 00

Command parsing

Command
A4 xx Lc	Select, 04 indicates the number of bytes that exist in the LC command data field by file name selection
C0-XX-Le	GET RESPONSE, le represents the maximum length of the expected data for the response

Data parsing

SELECTDDF Response Message (FCI)

Sign	Value	Data
6F	FCI templates
84	DF Name
A5	FCI-specific data
		88 SFI of the target base file

S3: According to the FCI control information returned by the card 88, read the first record of the 01 file, find aid

=>00 B2 0C//Care:high_5bits_sfi + low_3bits_0x04 = 0x01<< 3 + 0x01= 0x0c

<=6C 27

=>00 B2 0C 27

<=70 25//Structure data Object identification

61 23//Application Template

4F A0 xx 0101//ADF name (AID)

0A 4F 43 20 44 4542 49 54//Application Label

9F 0A 4F 43 20 4445 42 49 54//Application Priority name

Command parsing

Command
B2 0C 00	Read record for reading the contents of a log file

Data parsing

ADF directory Entry address format

Sign	Length	Value
70	Var.	Structural Object Data Labeling
		61	Var.	Apply a template
				4F	5-16	ADF name (AID)
				50	1-16	Apply Tags
				9f12	1-16	Apply Priority name

S4: Select Apps with aid

=>00 A4 04 00 08

<=a4

=>a0 00 00 03 33 01 01 01

<=61 47

=>00 C0 00 00 47

<=6F 45

A0 xx 0101//ADF name (AID)

A5 39

0A 4F 43 20 44 4542 49 54//Application Label

87 01 01

9F 9F 7A (9F) 065F 2A 02

5F 2D 7A 68

9F 11 01 01

9F 0A 4F 43 20 4445 42 49 54//Application Priority name

BF 0C 9F 4D, 0B 0A

<=90 00

S5: Read Electronic cash balances

=>80 CA 9F 79 00

<=6c 09

=>80 CA 9F 79 09

<=9F 79 06 00 00 00 00 00 00

<=90 00

Command parsing

Command	Description
CA 9F 79 00	GET data,9f 79 Read electronic cash balance

Data parsing

9F 79 06 00 00 00 00 00 00, returns the balance data of 6 bytes, with the BCD encoding, and the last byte representing the two digits after the decimal point.

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

Read the PBoC e-cash instruction Stream