{"id":296,"date":"2021-02-09T23:48:42","date_gmt":"2021-02-09T14:48:42","guid":{"rendered":"https:\/\/www.drassal.net\/wp\/?p=296"},"modified":"2021-02-09T23:56:12","modified_gmt":"2021-02-09T14:56:12","slug":"reading-felica-rfid-with-a-rc-s620s-and-arduino","status":"publish","type":"post","link":"https:\/\/www.drassal.net\/wp\/reading-felica-rfid-with-a-rc-s620s-and-arduino\/","title":{"rendered":"Reading FeliCa RFID with a RC-S620S and Arduino"},"content":{"rendered":"

\"FeliCa<\/a><\/p>\n

After some more playing around with RFID tags and trying to read some FeliCa tags with the Proxmark3 it was obvious I needed a reader designed for FeliCa. \u00a0FeliCa was designed by SONY and has a very long history of usage starting in the 1990’s and beginning wide use in 2001 with the SUICA prepaid rail card. \u00a0It is similar to a\u00a0ISO\/IEC 14443, and is closer to a\u00a0ISO\/IEC 18092 (Near Field Communication, NFC TYPE-F) in its communications but its specification actually follows specification\u00a0JIS: X6319-4.<\/p>\n

The card offers very high level encryption and security, I have not seen a single instance of it being hacked even after all these years (yet).<\/p>\n

To read the card and get the card id, called the IDm, I found a RC-S620S FeliCa reader at the local shop and searched around to see if anyone had attempted to connect it up to an Arduino platform. \u00a0Not suppressing I found\u00a0some information on this site below with some sample Arduino code.<\/p>\n

https:\/\/deviceplus.jp\/hobby\/entry_f02\/<\/a><\/p>\n

With this information I used the Arduino platform to successfully retrieve the IDm from various FeliCa cards in my possession. \u00a0After this, I found out that it is not that difficult to retrieve the current balance of the electronic money on the card as well after running across the following below site. \u00a0FeliCa is very commonly used in Japan and this can retrieve the unique 8 byte card id (IDm)\u00a0and balance information for Suica, Icoca, PiTaPa, nanao, edy, and others.<\/p>\n

https:\/\/www.orsx.net\/archives\/3835<\/a><\/p>\n

I then proceeded to create a reader with an OLED display to display the IDm of the card along with the remaining electronic money balance. \u00a0This uses an Arduino Feather M0 basic along with a 128×64 OLED display to show the results. \u00a0Surprisingly, SONY released an Arduino library for the RC-S620S, which is still up on their website for download, but needs a few fixes since it is from so many years back (2000).<\/p>\n

http:\/\/blog.felicalauncher.com\/sdk_for_air\/?page_id=2699
\n<\/a>
\nDownload the above library and place it in the Arduino “libraries” folder. \u00a0In the file “RCS620S.cpp” the following changes need to be made.<\/p>\n\n\n\n\n\n\n\n\n
Line<\/th>\nSearch for<\/th>\nReplace with<\/th>\n<\/tr>\n
10<\/td>\n#include \u201cWprogram.h\u201d<\/td>\n#include \u201cArduino.h\u201d<\/td>\n<\/tr>\n
312<\/td>\nSerial.write(data, len);<\/td>\nSerial1.write(data, len);<\/td>\n<\/tr>\n
327<\/td>\nif (Serial.available() > 0) {<\/td>\nif (Serial1.available() > 0) {<\/td>\n<\/tr>\n
328<\/td>\ndata[nread] = Serial.read();<\/td>\ndata[nread] = Serial1.read();<\/td>\n<\/tr>\n
338<\/td>\nSerial.flush();<\/td>\nSerial1.flush();<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The following hardware items were used in this project:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Adafruit Feather M0 Basic Proto – ATSAMD21 Cortex M0<\/td>\n<\/tr>\n
+<\/td>\nhttps:\/\/www.adafruit.com\/product\/2772<\/a><\/td>\n<\/tr>\n
Adafruit FeatherWing OLED – 128×64 OLED Add-on For Feather<\/td>\n<\/tr>\n
+<\/td>\nhttps:\/\/www.adafruit.com\/product\/4650<\/a><\/td>\n<\/tr>\n
FeatherWing Tripler Mini Kit – Prototyping Add-on For Feathers<\/td>\n<\/tr>\n
+<\/td>\nhttps:\/\/www.adafruit.com\/product\/3417<\/a><\/td>\n<\/tr>\n
NFC FeliCa Reader\/Writer Module RC-S620\/S<\/td>\n<\/tr>\n
+<\/td>\nhttps:\/\/international.switch-science.com\/catalog\/353\/<\/a><\/td>\n<\/tr>\n
FeliCa RC-S620\/S and FeliCa Link RC-S730 pitch converter board set (with flat cable)<\/td>\n<\/tr>\n
+<\/td>\nhttps:\/\/international.switch-science.com\/catalog\/1029\/<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Here is the pinout of the RC-S602S. \u00a0It can work on either 3.3V or 5.0V. \u00a0Connect to the “uart1” of the Arduino device being used. \u00a0In the case of the Adafruit Feather m0 Basic this is D0 (UART1 RX) and D1 (UART1 TD). \u00a0There are two grounds, connect them both to ground. \u00a0The RC-S620S can be powered by 5.0v or 3.3v. \u00a0An Arduino Uno would work, but it has only one hardware UART, the softserial won’t be able to keep up with the 115200 BAUD of the RC-S620S. \u00a0I believe the limit for the softserial is around 9600 or 19200.<\/p>\n

Connect the flat cable as shown here in the picture.<\/p>\n

\"RC-S620S<\/a><\/p>\n

\"RC-S620S\"<\/a><\/p>\n

\"RC-S620S<\/a><\/p>\n\n\n\n\n\n\n\n\n\n
pin<\/th>\ncolor<\/th>\ndescription<\/th>\n<\/tr>\n
1<\/td>\nred<\/td>\nVCC (5v or 3.3v)<\/td>\n<\/tr>\n
2<\/td>\ngreen<\/td>\nRXD<\/td>\n<\/tr>\n
3<\/td>\nwhite<\/td>\nTXD<\/td>\n<\/tr>\n
4<\/td>\nblack<\/td>\nGND<\/td>\n<\/tr>\n
5<\/td>\nn\/c<\/td>\ndo not connect, reserved<\/td>\n<\/tr>\n
6<\/td>\nblack<\/td>\nGND<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

A version with the OLED display functions is in the below ZIP file, it is rather big to copy paste here. \u00a0Credit for the parts that I copy pasted is these two sources below.<\/p>\n

https:\/\/deviceplus.jp\/hobby\/entry_f02\/<\/a>
\nhttps:\/\/www.orsx.net\/archives\/3835<\/a><\/p>\n

https:\/\/www.drassal.net\/filestore\/m0_felica_oled_20210209.zip<\/a><\/p>\n

The following code is a very simple serial only version that can be pasted. \u00a0A zip fie is also available to download.<\/p>\n

https:\/\/www.drassal.net\/filestore\/m0_felica_uart_20210209.zip<\/a><\/p>\n

\r\n#include <RCS620S.h>\r\n\r\n#define COMMAND_TIMEOUT               400\r\n#define POLLING_INTERVAL              500\r\n#define RCS620S_MAX_CARD_RESPONSE_LEN 30\r\n\r\n\/\/ FeliCa Service\/System Code\r\n#define CYBERNE_SYSTEM_CODE           0x0003\r\n#define COMMON_SYSTEM_CODE            0xFE00\r\n#define PASSNET_SERVICE_CODE          0x090F\r\n#define EDY_SERVICE_CODE              0x170F\r\n#define NANACO_SERVICE_CODE           0x564F\r\n#define WAON_SERVICE_CODE             0x680B\r\n\r\nRCS620S rcs620s;\r\n\r\n\/\/ UNO\r\n#define SERIAL_DEBUG Serial\r\n\/\/ Due\r\n\/\/ #define SERIAL_DEBUG SerialUSB\r\n\r\nvoid setup() {\r\n  int ret;\r\n  while (!Serial && millis() < 10000);\r\n  Serial.begin(115200);\r\n  Serial.println("Serial init done!");\r\n\r\n  \/\/ RC-S620S\u306e\u521d\u671f\u5316\r\n  Serial1.begin(115200);\r\n  Serial.println("Serial1 init done!");\r\n  ret = rcs620s.initDevice();\r\n  while (!ret) {}\r\n  rcs620s.timeout = COMMAND_TIMEOUT;\r\n  Serial.println("RC-S620S init ok");\r\n}\r\n\r\nvoid polling(void) {\r\n  int ret;\r\n  char temp[3];\r\n  char cardid[17];\r\n\r\n  \/\/ FeliCa\u306e\u30bf\u30c3\u30c1\u72b6\u614b\u3092\u5f97\u308b\r\n  ret = rcs620s.polling();\r\n\r\n  \/\/ FeliCa\u304c\u30bf\u30c3\u30c1\u3055\u308c\u305f\u5834\u5408\r\n  if(ret) {\r\n    \/\/ IDm\u3092\u53d6\u5f97\u3059\u308b\r\n    for(int i = 0; i < 8; i++){\r\n      sprintf(temp, "%02X", rcs620s.idm[i]);\r\n      cardid[i * 2] = temp[0];\r\n      cardid[(i * 2) + 1] = temp[1];\r\n    }\r\n    cardid[16] = 0;\r\n\r\n    printId(cardid);\r\n  }\r\n  \r\n  rcs620s.rfOff();\r\n}\r\n\r\nvoid polling_balance(void) {\r\n  char temp[3];\r\n  char cardid[17];\r\n  uint32_t balance;\r\n  uint8_t buf[RCS620S_MAX_CARD_RESPONSE_LEN];\r\n   \r\n  rcs620s.timeout = COMMAND_TIMEOUT;\r\n   \r\n  \/\/ \u30b5\u30a4\u30d0\u30cd\u9818\u57df\r\n  if(rcs620s.polling(CYBERNE_SYSTEM_CODE)){\r\n    \/\/ Suica PASMO\r\n    if(requestService(PASSNET_SERVICE_CODE)){\r\n      if(readEncryption(PASSNET_SERVICE_CODE, 0, buf)){\r\n        \/\/ Little Endian\u3067\u5165\u3063\u3066\u3044\u308bPASSNET\u306e\u6b8b\u9ad8\u3092\u53d6\u308a\u51fa\u3059\r\n        balance = buf[23];                  \/\/ 11 byte\u76ee\r\n        balance = (balance << 8) + buf[22]; \/\/ 10 byte\u76ee\r\n\r\n        \/\/ IDm\u3092\u53d6\u5f97\u3059\u308b\r\n        for(int i = 0; i < 8; i++){\r\n          sprintf(temp, "%02X", rcs620s.idm[i]);\r\n          cardid[i * 2] = temp[0];\r\n          cardid[(i * 2) + 1] = temp[1];\r\n        }\r\n        cardid[16] = 0;\r\n\r\n        \/\/ \u6b8b\u9ad8\u8868\u793a\r\n        printBalance(cardid, "PASSNET", &balance);\r\n      }\r\n    }\r\n  }\r\n   \r\n  \/\/ \u5171\u901a\u9818\u57df\r\n  else if(rcs620s.polling(COMMON_SYSTEM_CODE)){\r\n    \/\/ Edy\r\n    if(requestService(EDY_SERVICE_CODE)){\r\n      if(readEncryption(EDY_SERVICE_CODE, 0, buf)){\r\n        \/\/ Big Endian\u3067\u5165\u3063\u3066\u3044\u308bEdy\u306e\u6b8b\u9ad8\u3092\u53d6\u308a\u51fa\u3059\r\n        balance = buf[26];                  \/\/ 14 byte\u76ee\r\n        balance = (balance << 8) + buf[27]; \/\/ 15 byte\u76ee\r\n\r\n        \/\/ IDm\u3092\u53d6\u5f97\u3059\u308b\r\n        for(int i = 0; i < 8; i++){\r\n          sprintf(temp, "%02X", rcs620s.idm[i]);\r\n          cardid[i * 2] = temp[0];\r\n          cardid[(i * 2) + 1] = temp[1];\r\n        }\r\n        cardid[16] = 0;\r\n\r\n        \/\/ \u6b8b\u9ad8\u8868\u793a\r\n        printBalance(cardid, "Edy", &balance);\r\n      }\r\n    }\r\n     \r\n    \/\/ nanaco\r\n    else if(requestService(NANACO_SERVICE_CODE)){\r\n      if(readEncryption(NANACO_SERVICE_CODE, 0, buf)){\r\n        \/\/ Big Endian\u3067\u5165\u3063\u3066\u3044\u308bNanaco\u306e\u6b8b\u9ad8\u3092\u53d6\u308a\u51fa\u3059\r\n        balance = buf[17];                  \/\/ 5 byte\u76ee\r\n        balance = (balance << 8) + buf[18]; \/\/ 6 byte\u76ee\r\n        balance = (balance << 8) + buf[19]; \/\/ 7 byte\u76ee\r\n        balance = (balance << 8) + buf[20]; \/\/ 8 byte\u76ee\r\n\r\n        \/\/ IDm\u3092\u53d6\u5f97\u3059\u308b\r\n        for(int i = 0; i < 8; i++){\r\n          sprintf(temp, "%02X", rcs620s.idm[i]);\r\n          cardid[i * 2] = temp[0];\r\n          cardid[(i * 2) + 1] = temp[1];\r\n        }\r\n        cardid[16] = 0;\r\n        \r\n        \/\/ \u6b8b\u9ad8\u8868\u793a\r\n        printBalance(cardid, "nanaco", &balance);\r\n      }\r\n    }\r\n     \r\n    \/\/ waon\r\n    else if(requestService(WAON_SERVICE_CODE)){\r\n      if(readEncryption(WAON_SERVICE_CODE, 1, buf)){\r\n        \/\/ Big Endian\u3067\u5165\u3063\u3066\u3044\u308bWaon\u306e\u6b8b\u9ad8\u3092\u53d6\u308a\u51fa\u3059\r\n        balance = buf[17];                  \/\/ 21 byte\u76ee\r\n        balance = (balance << 8) + buf[18]; \/\/ 22 byte\u76ee\r\n        balance = (balance << 8) + buf[19]; \/\/ 23 byte\u76ee balance = balance & 0x7FFFE0; \/\/ \u6b8b\u9ad818bit\u5206\u306e\u307f\u8ad6\u7406\u7a4d\u3067\u53d6\u308a\u51fa\u3059 balance = balance >> 5;             \/\/ 5bit\u5206\u30d3\u30c3\u30c8\u30b7\u30d5\u30c8\r\n\r\n        \/\/ IDm\u3092\u53d6\u5f97\u3059\u308b\r\n        for(int i = 0; i < 8; i++){ sprintf(temp, "%02X", rcs620s.idm[i]); cardid[i * 2] = temp[0]; cardid[(i * 2) + 1] = temp[1]; } cardid[16] = 0; \/\/ \u6b8b\u9ad8\u8868\u793a printBalance(cardid, "waon", &balance); } } } rcs620s.rfOff(); } \/\/ request service int requestService(uint16_t serviceCode){ int ret; uint8_t buf[RCS620S_MAX_CARD_RESPONSE_LEN]; uint8_t responseLen = 0; buf[0] = 0x02; memcpy(buf + 1, rcs620s.idm, 8); buf[9] = 0x01; buf[10] = (uint8_t)((serviceCode >> 0) & 0xff);\r\n  buf[11] = (uint8_t)((serviceCode >> 8) & 0xff);\r\n \r\n  ret = rcs620s.cardCommand(buf, 12, buf, &responseLen);\r\n   \r\n  if(!ret || (responseLen != 12) || (buf[0] != 0x03) ||\r\n      (memcmp(buf + 1, rcs620s.idm, 8) != 0) || ((buf[10] == 0xff) && (buf[11] == 0xff))) {\r\n    return 0;\r\n  }\r\n \r\n  return 1;\r\n}\r\n \r\nint readEncryption(uint16_t serviceCode, uint8_t blockNumber, uint8_t *buf){\r\n  int ret;\r\n  uint8_t responseLen = 0;\r\n   \r\n  buf[0] = 0x06;\r\n  memcpy(buf + 1, rcs620s.idm, 8);\r\n  buf[9] = 0x01; \/\/ \u30b5\u30fc\u30d3\u30b9\u6570\r\n  buf[10] = (uint8_t)((serviceCode >> 0) & 0xff);\r\n  buf[11] = (uint8_t)((serviceCode >> 8) & 0xff);\r\n  buf[12] = 0x01; \/\/ \u30d6\u30ed\u30c3\u30af\u6570\r\n  buf[13] = 0x80;\r\n  buf[14] = blockNumber;\r\n \r\n  ret = rcs620s.cardCommand(buf, 15, buf, &responseLen);\r\n \r\n  if (!ret || (responseLen != 28) || (buf[0] != 0x07) ||\r\n      (memcmp(buf + 1, rcs620s.idm, 8) != 0)) {\r\n    return 0;\r\n  }\r\n \r\n  return 1;\r\n}\r\n\r\nvoid printId(char *card_id){\r\n  Serial.print("IDm      : ");\r\n  Serial.println(card_id);\r\n  return;\r\n}\r\n\r\nvoid printBalance(char *card_id, char *service_name, uint32_t *balance){\r\n  char result[8];\r\n  Serial.print("IDm      : ");\r\n  Serial.println(card_id);\r\n\r\n  Serial.print(" SERVICE : ");\r\n  sprintf(result, "%u", *balance);\r\n  Serial.println(service_name);\r\n  \r\n  Serial.print(" BALANCE : ");\r\n  Serial.println(result);\r\n  \r\n  return;\r\n}\r\n\r\nvoid loop() {\r\n  \/\/ put your main code here, to run repeatedly:\r\n  \/\/polling();\r\n  polling_balance();\r\n  delay(POLLING_INTERVAL);\r\n}\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
After some more playing around with RFID tags and trying to read some FeliCa tags with the Proxmark3 it was obvious I needed a reader designed for FeliCa. \u00a0FeliCa was designed by SONY and has a very long history of usage starting in the 1990’s and beginning wide use in 2001 with the SUICA prepaid rail card. \u00a0It is similar to a\u00a0ISO\/IEC 14443, and is closer to a\u00a0ISO\/IEC 18092 (Near Field Communication, NFC TYPE-F) in its communications but its specification actually follows specification\u00a0JIS: X6319-4. The card offers very high level encryption and security, I have not seen a single instance of it being hacked even after all these years (yet). […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-296","post","type-post","status-publish","format-standard","hentry","category-rfid"],"_links":{"self":[{"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/posts\/296","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/comments?post=296"}],"version-history":[{"count":4,"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/posts\/296\/revisions"}],"predecessor-version":[{"id":305,"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/posts\/296\/revisions\/305"}],"wp:attachment":[{"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/media?parent=296"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/categories?post=296"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.drassal.net\/wp\/wp-json\/wp\/v2\/tags?post=296"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}