Hi everyone,
I'm having trouble to remove a password applied to a NTAG213. I set a password to a tag and I can't authenticate to write in tag again. Also, I can't remove the tag password either. Can someone help me?
Here are my code:
...
// already connect to tag
//Changing password in NTAG213 - sector 2B
uCla = 0xFF;
uIns = 0xD6; //write command used by my reader
uP1 = 0x00;
uP2 = 0x2B; //memory block to write
Data[0] = 0x40; //PWD data -- @ A B C
Data[1] = 0x41;
Data[2] = 0x42;
Data[3] = 0x43;
uLe = 0x04; //Return lenght expected
uLc = 0x04; //Data size
response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Everything looks fine
//Activate (AUTH0)
uCla = 0xFF;
uIns = 0xD6; // write command used by my reader
uP1 = 0x00;
uP2 = 0x29; //memory block to write
Data[0] = 0x04; //Data filled with NTAG213 specs - Strong encript + protect block 04h and foward
Data[1] = 0x00;
Data[2] = 0x00;
Data[3] = 0x04;
uLe = 0x04;
uLc = 0x04;
response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Everything looks fine
-- From now on, the tag is protected. With the NXP Writer APP I can unlock it with no problems. I didn't changed the PACK number, because this seems to lock the authentication.
Next step, I'll try to authenticate (AUTH_PWD) and write the sector 09h of the tag.
// already connect to tag
//Authenticate the tag
uCla = 0xFF;
uIns = 0x00;
uP1 = 0x00;
uP2 = 0x00;
uLc = 0x05;
uLe = 0xFF;
Data[0] = 0x1B; //PWD_AUTH command in NTAG213 specs
Data[1] = 0x40; //PWD data - @ A B C
Data[2] = 0x41;
Data[3] = 0x42;
Data[4] = 0x43;
response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Received response 00 00 90 00 - PACK (00 00) and ACK (90 00)
-- As said in NTAG21x docs, after an authentication I can send a write command to the tag and it will accept it. So I tried to write a memory sector:
//write NXP tag
uCla = 0xFF;
uIns = 0xD6; // write command used by my reader
uP1 = 0x00;
uP2 = 0x09; //memory block to write
Data[0] = 0x70; //random hex numbers
Data[1] = 0x71;
Data[2] = 0x72;
Data[3] = 0x73;
uLe = 0x04; //Return lenght expected
uLc = 0x04; //Data size
response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Return 99 00 - unknown error
-- I tried a lot of other commands, but with no luck. It seems I need to use PACK somewhere, but I don't know where.
I tried the NTAG213 spec commands of Write, It returns 90 00 but no data is written.
Thank for the help!!!
Fernando Coelho
