9

I'm trying to read the data off a contactless Visa Paywave card.

For the Paywave, I have to submit a SELECT using PPSE (2PAY.SYS.DDF01) instead of PSE (1PAY.SYS.DDF01).

The EMV book 1, section 11.3.4, table 43 only describes how to interpret the response for a successful SELECT command using PSE. Does anyone know or can refer me to a source that shows how to process the data returned from a successful SELECT command using PPSE?

Here's my request APDU:

00A404000e325041592e5359532e444446303100

Here's the response:

6F2F840E325041592E5359532E4444463031A51DBF0C1A61184F07A0000000031010500A564953412044454249548701019000

I understand tag 84, tag 85, tag BF0C from the response. According to the examples for reading PSE, I should be able to just send GET PROCESSION OPTIONS (to get the AIP and AFL) with PDOL = null after this successful response as follows: 80A80000830000.

But request 80A80000830000 returns error code 6985 - Command not allowed; conditions of use not satisfied.

I also tried reading all the files after successfully selecting the PPSE by traversing through every single SFI (0-30) and every single record (0-16) of each SFI. Yes, I also did the 3 bit shift and bitwise-OR the SFI with 0x4. But I got no data.

I'm stuck, any help that would point me into getting some info from my Paywave card would be appreciated!

Tom Blodget
  • 20,260
  • 3
  • 39
  • 72
9999bao
  • 191
  • 1
  • 2
  • 5
  • 2
    What version of that EMV book are you referring to? (I suppose it's 4.3...) Did you also notice that there are [EMV contactless specs](http://www.emvco.com/specifications.aspx?id=21) available from EMVCo? – martijno Feb 25 '13 at 13:13
  • Yes, EMV 4.3. I didn't even notice the contactless specs book from EMVCo. Gosh, how blind one can be when all one thinks about is coding coding coding. :-) Thanks for pointing that book out, I will read it and let you know what I did wrong. – 9999bao Feb 25 '13 at 16:41

5 Answers5

8

Have you tried this tool from EMVLAB http://www.emvlab.org/emvtags/

Using that tool,

http://www.emvlab.org/tlvutils/?data=6F2F840E325041592E5359532E4444463031A51DBF0C1A61184F07A0000000031010500A564953412044454249548701019000

enter image description here

nish1013
  • 3,658
  • 8
  • 33
  • 46
3

2PAY.SYS.DDF01 is for contactless (e.g. NFC ) cards, while 1PAY.SYS.DDF01 is for contact cards.

1.

After successfully (SW1 SW2 = 90 00) reading a PSE, you should only search for the SFI (tag 88) which is a mandatory field in the FCI template returned.

2.

With the SFI as your start index, your would have to read the records starting from the start index until you get a 6A83 (RECORD_NOT_FOUND). E.g. if your SFI is 1, you would do a readRecord with record_number=1. That would probably be successful. Then you increment record_number to 2 and do readRecord again. The increment to 3 .... Repeat it until you get 6A83 as your status.

3.
The records read would be ADFs (at least 1). Then your would have to compare the read ADF Names with what your terminal support and also based on the ASI (Application Selection Indicator). At the end you would have a list of possible ADFs (Candidate list)

All the above steps (1-3) are documented in chapter 12.3.2 Book1 v4.3 of the EMV spec.

You would have to make a final selection (Chapter 12.4 Book1)

Read the spec book 1 chapter 12.3 - 12.4 for all the detailed steps.

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Derick Beng
  • 41
  • 5
2

You seem to have the flow mixed up a bit, you want to:

  • Send 1PAY or 2PAY, it doesn't actually matter for all of the cards I've tested. This will return a list of the AIDs available on the card. Alternately you can just select an AID straight away if you know it's there but good practice would be to check first.

  • Get the list of AIDs returned in response to 1PAY/2PAY, in PayWave's case this will probably be A0000000031010 if you sent 2PAY but you may get more if you send 1PAY.

  • Select one of the AIDs sent back (or one you already know is on there).

  • Then loop through the SFIs and records sending the Read Records command to get the data.

You don't have to send Get Processing Options before sending the Read Records command even though that's now a normal transaction flow goes.

Nik
  • 2,718
  • 23
  • 34
Peanut
  • 2,221
  • 1
  • 26
  • 37
  • 1PAY is different than 2PAY. I have a PCSC and a NFC reader, if i try to select 2PAY using my PCSC I get a File not found error returned, and if i try to select 1PAY with NFC I get File not found. The OP said he read through all the records, but wants to do it correctly by getting the processing options to know which SFI's to use. – Robert Snyder Nov 07 '13 at 21:22
  • 1
    I know they're different, was just pointing out for all of the Visa cards I tested you could send either, and sometimes they actually give different information back. OP said he read through all records and didn't get any information back, that's because he hasn't selected an the Visa AID, he said he thought he could just send GPO straight after 2PAY which is incorrect, which my answer tries to clear up. – Peanut Nov 07 '13 at 21:28
  • I'm glad I found this thread in General because I can't get my GPO to work at all, and finally found out why... Now for some serious reading. – Robert Snyder Nov 07 '13 at 21:36
0

I think the information you're looking for is available from this VISA website. But only if you're a registered and/or licensed partner of VISA.

EDIT: Looking at the resulting TLV struct under BF0C:

tag=0xBF0C, length=0x1A
    tag=0x61, length=0x18
        tag=0x4F, length=0x07, value=0xA0000000031010 // looks like an AID to me
        tag=0x50, length=0x0A, value="VISA DEBIT"
        tag=0x87, length=0x01, value=0x01

I would guess that you need to first select A0000000031010 before getting the processing options.

martijno
  • 1,723
  • 1
  • 23
  • 53
  • You might be right. I registered with visa yesterday, still waiting on the application approval process. Thanks! – 9999bao Feb 25 '13 at 16:42
0

I was selecting application 2PAY.SYS.DDF01. when I should have been selecting AID = 0xA0000000031010. It looks like there's no records under application 2PAY.SYS.DDF01.

But there was 1 record under application 0xA0000000031010. After I got this application, I performed a READ RECORD, and the first record gave me the PAN and all the credit card info I wanted.

Thanks everyone for chiming in.

9999bao
  • 191
  • 1
  • 2
  • 5
  • 2
    See my answer for an explanation of this, 2PAY will return a list of AIDs, it's not actually an AID itself, and you're then meant to select one of the returned ones and read records from that. You can however just select an AID straight away which you know is on there which is what you've found :) – Peanut Aug 05 '13 at 18:25