ResMed smart card - any further info?

turbosnore · Post by **turbosnore** » Sun Jul 19, 2015 12:39 pm

My goal regarding the smart card is really two fold: I'd like to get a grip of my HW and hopefully help the SleepyHead project by offering the way to read the data, supplying the raw data dump and the report that ResScan got out of it.
But first I need to make contact with the card.

About buying the machines without prescriptions, I've been a "Pugsy" on a Finnish sleep apnea site (I wouldn't dare to compare myself to snoredog). There are people that need to get a machine without prescription. They may be professional drivers - if they are diagnosed, a doctor can, without further explanations, declare the person not well enough to continue that profession. For a professional driver a sleep study is a gamble. Another group are people whose sleep polyclinic has a rule to set APAPs to titring pressures (4 - 20). For many people that doesn't work, so sometimes they take the machine away, because "the CPAP treatment doesn't work for the patient" or because the patient has been caught of making his/her own adjustments.

The way the people that actively participate in their treatment are treated by the sleep polyclinics vary a lot.

My next attempt is trying to see what ResScan talks to the driver using an USB sniffer.

turbosnore · Post by **turbosnore** » Sun Jul 19, 2015 12:55 pm

Thanks, palerider. I pinged Jay.

Jay Aitchsee · Post by **Jay Aitchsee** » Mon Jul 20, 2015 3:47 am

But he wasn't much help

turbosnore · Post by **turbosnore** » Mon Jul 20, 2015 6:46 am

With the ACS' reader monitor program (on Windows) I got the ATR visible: 3B 00.
bút

Code: Select all

    C:\SW\smacadu>smacdig
    SMACDIG. Smart Card Digging Utilities. Version 0.50720 by Ilya O. Levin
    Raw and uncondition detection of DF/EF objects within smart cards

    Usage: smacdig reader [target [initial id]]

    Examples:
             smacdig axalto
             smacdig "AKS ifdh" 3f00/6666 1FFE

    Available readers:
    * ACS ACR38U 0

    C:\SW\smacadu>smacdig ARC38U
    SMACDIG. Smart Card Digging Utilities. Version 0.50720 by Ilya O. Levin
    Raw and uncondition detection of DF/EF objects within smart cards

    * connecting to "ARC38U" - failed (SCARD_GENERIC_ERROR)

    C:\SW\smacadu>smacdig ACS ARC38U 0
    SMACDIG. Smart Card Digging Utilities. Version 0.50720 by Ilya O. Levin
    Raw and uncondition detection of DF/EF objects within smart cards

    * connecting to "ARC38U" - failed (SCARD_GENERIC_ERROR)

and SmartUtil says "<no cards>"

On linux:

Code: Select all

root@jaa-debian:/# pcscd --foreground --debug
00000000 debuglog.c:292:DebugLogSetLevel() debug level=debug
00000129 configfile.l:355:DBGetReaderList() Parsing conf file: /etc/reader.conf.d
00000021 pcscdaemon.c:569:main() pcsc-lite 1.8.13 daemon ready.
00000663 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x1D6B, PID: 0x0002, path: /dev/bus/usb/001/001
00000104 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x1D6B, PID: 0x0003, path: /dev/bus/usb/002/001
00000095 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x1D6B, PID: 0x0002, path: /dev/bus/usb/003/001
00000072 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x1D6B, PID: 0x0002, path: /dev/bus/usb/003/001
00000105 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x8087, PID: 0x0024, path: /dev/bus/usb/003/002
00000085 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x05E3, PID: 0x0605, path: /dev/bus/usb/003/003
00000082 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x072F, PID: 0x9000, path: /dev/bus/usb/003/069
00000014 hotplug_libudev.c:435:HPAddDevice() Adding USB device: ACS ACR38U
00000039 readerfactory.c:1012:RFInitializeReader() Attempting startup of ACS ACR38U 00 00 using /usr/lib/pcsc/drivers/ACR38UDriver.bundle/Contents/Linux/ACR38UDriver.so
00000214 dyn_unix.c:106:DYN_GetAddress() IFDHCreateChannelByName: /usr/lib/pcsc/drivers/ACR38UDriver.bundle/Contents/Linux/ACR38UDriver.so: undefined symbol: IFDHCreateChannelByName
00000020 readerfactory.c:865:RFBindFunctions() Loading IFD Handler 2.0
00125180 readerfactory.c:350:RFAddReader() Using the pcscd polling thread
00000664 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x05E3, PID: 0x0605, path: /dev/bus/usb/003/003
00000063 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x04A9, PID: 0x172B, path: /dev/bus/usb/003/009
00000066 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x04A9, PID: 0x172B, path: /dev/bus/usb/003/009
00000052 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x05E3, PID: 0x0605, path: /dev/bus/usb/003/003
00000049 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x8087, PID: 0x0024, path: /dev/bus/usb/003/002
00000051 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x046D, PID: 0xC03E, path: /dev/bus/usb/003/004
00000052 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x8087, PID: 0x0024, path: /dev/bus/usb/003/002
00000087 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x1D6B, PID: 0x0002, path: /dev/bus/usb/004/001
00000053 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x1D6B, PID: 0x0002, path: /dev/bus/usb/004/001
00000048 hotplug_libudev.c:296:get_driver() Looking for a driver for VID: 0x8087, PID: 0x0024, path: /dev/bus/usb/004/002
10079546 eventhandler.c:410:EHStatusHandlerThread() powerState: POWER_STATE_UNPOWERED
00000031 eventhandler.c:419:EHStatusHandlerThread() Card inserted into ACS ACR38U 00 00
00000012 eventhandler.c:435:EHStatusHandlerThread() Error powering up card.

But I guess I don't pester the forum with this problem any more. I go rant somewhere else...
I'll keep on pestering the people here with other problems though...

Jay Aitchsee · Post by **Jay Aitchsee** » Mon Jul 20, 2015 9:05 am

I don't think you're pestering anybody. Just nobody has come along, yet, that understands what you're doing. Somebody should show up eventually

turbosnore · Post by **turbosnore** » Mon Jul 20, 2015 10:45 am

Thanks for the encouragement.

Maybe I still pester a bit more. I manadef to see in USB sniffer that ResScan resets the care every now and then, then
selects the card as a bigger memory card. I also see both reads and writes.

If only I figured out how to make the driver to turn on the power for the card...

Jay Aitchsee · Post by **Jay Aitchsee** » Mon Jul 20, 2015 11:32 am

I don't understand "power to the card" , but, If ResScan reads and displays the card data properly then the card must be powered correctly. Right? At least in Windows.
In Linux, maybe it's the wrong driver, maybe the driver is for a CCID compliant reader rather than a non CCID reader. Without more research, I don't know which Linux driver (If any) is appropriate. It looks like there have been 10 versions. Did you try v 1.0.0. released in 2011?

PoolQ · Post by **PoolQ** » Mon Jul 20, 2015 1:36 pm

Here is a list of known commercial smart card ATR's http://ludovic.rousseau.free.fr/softwar ... d_list.txt notice how long ATR's are?
I don't think you are getting an ATR from that card.
I think it is a memory card and not a classic smart card
A memory card will not have an ATR. ATR's do not have any handshake to be sure what you are getting. The reader activates what it thinks is the reset pin and then starts "reading" anything that is on the data pin, assumes that it is serial data at 9600 baud and says "hey this is what I think I got" it may be an ATR or it may be total garbage. two bytes is not an ATR.

If you don't know what you have, you have to parse the ATR and see if it makes sense, then using the info in the ATR try and talk to the card and see if that makes sense. If it is a smart card and has encryption, well then all bets are off because most modern encrypted smart cards will detect that you don't know how to talk to it and will start responding with total garbage so you can't even know that it is on to you trying to hack it. Once in this mode it will never return to normal, a fuse has been blown and the card is useless.

The good news is that the resmed card really has no need to be anything other than a memory card, just an early version of an SD card they use now. poke around http://www.atmel.com and find their memory card products and see if you can find a driver there or someplace else for their cards, you might get lucky and read the data.

turbosnore · Post by **turbosnore** » Mon Jul 20, 2015 3:03 pm

Well, if I start ACS reader monitor and push the card in I get

https://www.dropbox.com/s/0ygcg01p69a3z ... 2.JPG?dl=0

but if I remove the card, start ResScan and then insert the card, I get

https://www.dropbox.com/s/ry4aiy42f9al4 ... r.JPG?dl=0

I keep getting the latter if I re-insert again and again even after shutting down ResScan.
Only after detaching and re-attaching the reader gets me back to the first situation.

So I guess ResScan says something to the reader...

(How do you put pictures into postings? img-tags around a link to picture didn't show it - at least in preview.)

The USB snoop gets this kind of stuff when ResScan notices the card:

I guess this is reset or something

Code: Select all

Pipe Handle: 0x86f62234 (Endpoint Address: 0x2)
Send 0x5 bytes to the device
 01 80 00 01 00                                    .€...

and this is ATR (or pseudo-ATR or whatever)

Code: Select all

Pipe Handle: 0x86f62254 (Endpoint Address: 0x82)
Get 0x6 bytes from the device
 01 00 00 02 3B 00                                 ....;.

...

This is card type select

Code: Select all

000018: Bulk or Interrupt Transfer (DOWN), 20.07.2015 23:50:19.241 +0.0 (1. Device: ACR38 Smart Card Reader)
Pipe Handle: 0x86f62234 (Endpoint Address: 0x2)
Send 0xa bytes to the device
 01 A0 00 06 FF A4 00 00 01 02                     . ..ÿ¤....

Pipe Handle: 0x86f62254 (Endpoint Address: 0x82)
Get 0x6 bytes from the device
 01 00 00 02 90 00                                 .....

...

This is read

Code: Select all

000078: Bulk or Interrupt Transfer (DOWN), 20.07.2015 23:50:20.608 +0.0 (1. Device: ACR38 Smart Card Reader)
Pipe Handle: 0x86f62234 (Endpoint Address: 0x2)
Send 0x9 bytes to the device
 01 A0 00 05 FF B0 00 00 FA                        . ..ÿ°..ú

000081: Bulk or Interrupt Transfer (UP), 20.07.2015 23:50:20.633 +0.024. (1. Device: ACR38 Smart Card Reader) Status: 0x00000000
Pipe Handle: 0x86f62254 (Endpoint Address: 0x82)
Get 0x40 bytes from the device
 01 00 00 FC 80 62 40 00 ED 00 3B 52 7A 48 F0 A1   ...ü€b@.í.;RzHð¡
 C2 47 D9 80 00 41 30 01 26 36 9D 08 00 41 60 37   ÂGÙ€.A0.&6..A`7
 3E 28 84 8C 00 41 A0 5F B2 13 2D A8 00 FF 01 02   >(„Œ.A _².-¨.ÿ..
 00 02 02 00 FF AD 4C FF FF FF FF FF FF FF FF FF   ....ÿLÿÿÿÿÿÿÿÿÿ

...

This is write

Code: Select all

Pipe Handle: 0x86f62234 (Endpoint Address: 0x2)
Send 0xc bytes to the device
 01 A0 00 08 FF D0 00 00 03 00 78 31               . ..ÿÐ....x1
000065: Bulk or Interrupt Transfer (UP), 20.07.2015 23:50:20.599 +0.002. (1. Device: ACR38 Smart Card Reader) Status: 0x00000000
Pipe Handle: 0x86f62254 (Endpoint Address: 0x82)
Get 0x6 bytes from the device
 01 00 00 02 90 00                                 .....

But I think ResScan says something to power up the card and it doesn't show in these logs.

palerider · Post by **palerider** » Mon Jul 20, 2015 3:14 pm

turbosnore wrote:(How do you put pictures into postings? img-tags around a link to picture didn't show it - at least in preview.)

https://sleep.tnet.com/reference/tips/imgur

Jay Aitchsee · Post by **Jay Aitchsee** » Mon Jul 20, 2015 4:11 pm

http://www.scdeveloper.com/datasheet/AC ... .0.0.0.zip
Did you run this diagnostic tool? (windows app, there might be a later one if you register at the ACS site)

If you do run it, it will provide some data about the reader and possibly the card, I don't remember, but with the diagnostic you can access the reader/card without ResScan and maybe you can sniff out a little more than with the Monitor App.

Or, get it here after registering http://www.acs.com.hk/index.php?pid=drivers&id=ACR38 (ACS Quickview)
http://www.acs.com.hk/en/registration/utility-tools/

Advanced Mode: (QuickView help)
This feature displays the ATR Value and the Active Protocol of the Card inserted. To do this, check the Advanced mode and select the reader name. It also enables the user to view Diagnostics Log.

SAMPLE QuickView Diagnostics Log:
Checking for Proprietary readers

Loading ACR30 library...
No ACR30 library found, loading acsr2032 library...
No ACSR2032 library found

Loading ACR38 library...
No ACR38 library found

Loading ACR80 library...
No ACR80 library found

Checking for PC/SC readers

Loading PC/SC library...
PC/SC library is loaded
Checking PC/SC functions...
PC/SC functions loaded
Calling SCardEstablishContext...
Success!
Calling SCardListReaders...
Success!
Calling SCardConnect...ACS ACR38U 0
Success!
Calling SCardControl...
Success!

ACS ACR38U 0
Firmware Version: ACR38-1100

Calling SCardDisconnect...
Success!
Calling SCardConnect...ACS ACR38U 1
The specified reader name is not recognized.

turbosnore · Post by **turbosnore** » Mon Jul 20, 2015 11:15 pm

palerider wrote:
turbosnore wrote:(How do you put pictures into postings? img-tags around a link to picture didn't show it - at least in preview.)
https://sleep.tnet.com/reference/tips/imgur

Thanks.

turbosnore · Post by **turbosnore** » Mon Jul 20, 2015 11:24 pm

This is news to me:
http://www.scdeveloper.com/datasheet/AC ... .0.0.0.zip

Calling SCardConnect...ACS ACR38U 0
Success!

This is where it fails - unless I run ResScan first.

Jay Aitchsee · Post by **Jay Aitchsee** » Tue Jul 21, 2015 5:18 am

I've run the diagnostic successfully several times without ResScan.
Are you using the proprietary ResMed reader or another?
Most of my work was done with a non-proprietary reader. (I suppose it's possible, but I don't think so, that the proprietary readers have different firmware which requires a handshake from ResScan to initialize) I have used a proprietary reader but I don't remember if I used the diagnostic on it. I don't have one now to test.
See this thread for situation similar to yours: viewtopic.php?f=1&t=43836&st=0&sk=t&sd=a

turbosnore · Post by **turbosnore** » Tue Jul 21, 2015 10:36 am

Well, now the QuickWiev says:

Code: Select all

CS QuickView Log : 21.7.2015:19:08:01
Starting diagnostics routine...
Reading System Information
Operating System : Windows Vista 32-bit
OS Build: 6002
CSD Version: Service Pack 2
Processor: Intel - Xeon or Core 2 Duo/Extreme
Processor speed: 1277,66685 MHz
Submodel: Primary
Model ID: Family 6  Model 15  Stepping 13  Level 10
No of Processors: 2
Physical Memory Total: 2 147 483 647 Bytes
Physical Memory Free: 1 412 923 392 Bytes
Virtual Memory Free: 2 084 962 304 Bytes

Checking for Proprietary readers

Loading ACR30 library...
No ACR30 library found, loading acsr2032 library...
No ACSR2032 library found

Loading ACR38 library...
No ACR38 library found

Loading ACR80 library...
No ACR80 library found

Loading ACR122 library...
No ACR122 library found

Checking for PC/SC readers

Loading PC/SC library...
PC/SC library is loaded
Checking PC/SC functions...
PC/SC functions loaded
Calling SCardEstablishContext...
Success!
Calling SCardListReaders...
Success!
Calling SCardConnect...ACS ACR38U 0
Success!
Calling SCardControl...
Success!

ACS ACR38U 0
Firmware Version: ACR38-1100

Calling SCardDisconnect...
Success!

but ACS reader monitor still says "Card Status Unresponsive" and ATR is empty.

ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?

Re: ResMed smart card - any further info?