"Time Out, the target has not answered" 来自 ACR122U reader 带有 Jewel/Topaz512 NFC 标签
"Time Out, the target has not answered" from ACR122U reader with Jewel/Topaz512 NFC tags
我正在构建一个 Windows/Java 程序（使用 javax.smartcardio）以使用 ACR122U 设备（带有 PN532 NFC 控制器）与 Jewel/Topaz512 标签（来自 Innovision/Broadcom）通信里面有芯片）。
我实现了 Topaz512 协议（来自 this data sheet）但是 我的命令只有一半有效。
- 一些有效的命令：
RID, RALL, READ, WRITE-NE, RSEG
- 一些不起作用的命令：
WRITE-E, READ8, WRITE-E8, WRITE-NE8
使用 WRITE-NO-ERASE 命令的示例
例如，这是我发送 WRITE-NO-ERASE 命令时得到的结果：
命令：FF:00:00:00:0C:D4:40:01:1A:7F:42:38:01:9A:00:17:E8
其中：
D4:40:01是InDataExchange命令，1A:7F:42 是 WRITE-NO-ERASE 命令（值：0x42，块 0x0F，字节 7），38:01:9A:00为4字节标签UID，17:E8 是 CRC。
响应：D5:41:00:42:90:00
这里的回答是正确的：0x42。状态字节 (0x00) 表明一切顺利。
使用 WRITE-WITH-ERASE 命令的示例
这是我发送 WRITE-WITH-ERASE 命令时得到的结果：
命令：FF:00:00:00:0C:D4:40:01:53:7F:42:38:01:9A:00:28:6E
其中：
D4:40:01是InDataExchange命令，53:7F:42是WRITE-WITH-ERASE命令（值：0x42，块0x0F，字节7），38:01:9A:00为4字节标签UID，28:6E 是 CRC。
响应：D5:41:01:90:00
此处，状态字节 (0x01) 通知 PN532 检测到超时。 （来自 the PN532 documentation（第 67 页）："Time Out, the target has not answered - 0x01"）
此外，当我删除 PN532 超时（使用 FF:00:00:00:06:D4:32:02:00:00:00）时，非工作命令不响应 D5:41:01:90:00，但等待更长时间，然后我没有响应。
编辑 2020-04-20
我只是尝试使用 gscriptor（来自 pcsc-tools 套件）执行命令，我得到了相同的行为。
这是我的结果：
脚本：
FF 00 00 00 06 D4 32 05 02 02 02
# SAMConfiguration
FF 00 00 00 04 D4 14 01 00
# SetParameters
FF 00 00 00 03 D4 12 04
# InListPassiveTarget: Jewel mode
FF 00 00 00 04 D4 4A 01 04
# InDataExchange: RID
FF 00 00 00 04 D4 40 01 78
# InDataExchange: RALL
FF 00 00 00 04 D4 40 01 00
# InDataExchange: RSEG 0-3
FF 00 00 00 05 D4 40 01 10 00
FF 00 00 00 05 D4 40 01 10 20
FF 00 00 00 05 D4 40 01 10 40
FF 00 00 00 05 D4 40 01 10 60
##########
# GetFirmwareVersion
FF 00 00 00 02 D4 02
# GetGeneralStatus
FF 00 00 00 02 D4 04
##########
# RFConfiguration: No timeout
FF 00 00 00 06 D4 32 02 00 00 00
# InDataExchange: READ-1
FF 00 00 00 05 D4 40 01 01 7F
# InDataExchange: READ-8
FF 00 00 00 05 D4 40 01 02 00
# InDataExchange: WRITE-E-1
FF 00 00 00 06 D4 40 01 53 7F 42
# InDataExchange: WRITE-E-8
FF 00 00 00 0C D4 40 01 55 02 01 02 03 04 05 06 07 08
# InDataExchange: WRITE-NE-1
FF 00 00 00 06 D4 40 01 1A 7F 42
# InDataExchange: WRITE-NE-8
FF 00 00 00 0C D4 40 01 1B 02 01 02 03 04 05 06 07 08
结果：
Sending: FF 00 00 00 06 D4 32 05 02 02 02
Received: D5 33 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 14 01 00
Received: D5 15 90 00
Normal processing.
Sending: FF 00 00 00 03 D4 12 04
Received: D5 13 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 4A 01 04
Received: D5 4B 01 01 0C 00 38 01 9A 00 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 40 01 78
Received: D5 41 00 12 4C 38 01 9A 00 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 40 01 00
Received: D5 41 00 12 4C 38 01 9A 00 00 10 25 00 00 10 3F
00 01 03 F2 30 33 02 03 F0 02 03 03 E3 D1 01 DF
54 02 65 6E 30 31 32 33 34 35 36 37 38 39 30 30
31 32 33 34 35 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 AA
AA 12 4C 06 00 01 E0 00 00 00 00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 00
Received: D5 41 00 38 01 9A 00 00 10 25 00 00 10 3F 00 01
03 F2 30 33 02 03 F0 02 03 03 E3 D1 01 DF 54 02
65 6E 30 31 32 33 34 35 36 37 38 39 30 30 31 32
33 34 35 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 55 55 AA AA 12
4C 06 00 01 E0 00 00 00 00 00 00 00 00 00 00 00
00 00 47 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 20
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 40
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 60
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 02 D4 02
Received: D5 03 32 01 06 07 90 00
Normal processing.
Sending: FF 00 00 00 02 D4 04
Received: D5 05 01 00 01 01 00 00 02 80 90 00
Normal processing.
Sending: FF 00 00 00 06 D4 32 02 00 00 00
Received: D5 33 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 01 7F
Received: D5 41 00 47 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 02 00
Received:
wrong SW size for:
Sending: FF 00 00 00 06 D4 40 01 53 7F 42
Received:
wrong SW size for:
Sending: FF 00 00 00 0C D4 40 01 55 02 01 02 03 04 05 06
07 08
Received:
wrong SW size for:
Sending: FF 00 00 00 06 D4 40 01 1A 7F 42
Received: D5 41 00 47 90 00
Normal processing.
Sending: FF 00 00 00 0C D4 40 01 1B 02 01 02 03 04 05 06
07 08
Received:
wrong SW size for:
Script was executed without error...
前段时间我对此进行了详细研究，并得出结论，NXP 的 PN532 NFC 控制器芯片的固件存在问题，导致它无法成功接收带有 NFC Forum Type 1 标签的某些命令（Topaz/Jewel品牌）。如前所述，ACR122U 基于该芯片。
当我尝试使用 WRITE-E8 (0x54) 命令一次写入 8 字节块时，收到的响应是 0x01，等待标签响应的超时。
我试过的东西不起作用：
包括 InDataExchange 中的 UID 回显，我什至尝试了 UID 回显的字节顺序，结果仍然相同。
使用 inCommunicateThru 命令而不是 InDataExchange 并在应用程序级别计算 CRC1 和 CRC2 值（相同结果）
我最后得出的结论是：
PN532 无法在 Type 1 标签上写入页面 0x10 和更大页面，这使得无法写入 Topaz 512 等流行型号上的全部内存。
建议：
这个问题与 2012 年相关，当时 Topaz 512 是一款成本低但内存高的 NFC 标签。既然有NAG215和NTAG216型号，我推荐使用那些内存大且与NFC阅读器普遍兼容的型号。
我正在构建一个 Windows/Java 程序（使用 javax.smartcardio）以使用 ACR122U 设备（带有 PN532 NFC 控制器）与 Jewel/Topaz512 标签（来自 Innovision/Broadcom）通信里面有芯片）。
我实现了 Topaz512 协议（来自 this data sheet）但是 我的命令只有一半有效。
- 一些有效的命令：
RID, RALL, READ, WRITE-NE, RSEG - 一些不起作用的命令：
WRITE-E, READ8, WRITE-E8, WRITE-NE8
使用 WRITE-NO-ERASE 命令的示例
例如，这是我发送 WRITE-NO-ERASE 命令时得到的结果：
命令：FF:00:00:00:0C:D4:40:01:1A:7F:42:38:01:9A:00:17:E8
其中：
D4:40:01是InDataExchange命令，1A:7F:42是 WRITE-NO-ERASE 命令（值：0x42，块 0x0F，字节 7），38:01:9A:00为4字节标签UID，17:E8是 CRC。
响应：D5:41:00:42:90:00
这里的回答是正确的：0x42。状态字节 (0x00) 表明一切顺利。
使用 WRITE-WITH-ERASE 命令的示例
这是我发送 WRITE-WITH-ERASE 命令时得到的结果：
命令：FF:00:00:00:0C:D4:40:01:53:7F:42:38:01:9A:00:28:6E
其中：
D4:40:01是InDataExchange命令，53:7F:42是WRITE-WITH-ERASE命令（值：0x42，块0x0F，字节7），38:01:9A:00为4字节标签UID，28:6E是 CRC。
响应：D5:41:01:90:00
此处，状态字节 (0x01) 通知 PN532 检测到超时。 （来自 the PN532 documentation（第 67 页）："Time Out, the target has not answered - 0x01"）
此外，当我删除 PN532 超时（使用 FF:00:00:00:06:D4:32:02:00:00:00）时，非工作命令不响应 D5:41:01:90:00，但等待更长时间，然后我没有响应。
编辑 2020-04-20
我只是尝试使用 gscriptor（来自 pcsc-tools 套件）执行命令，我得到了相同的行为。 这是我的结果：
脚本：
FF 00 00 00 06 D4 32 05 02 02 02
# SAMConfiguration
FF 00 00 00 04 D4 14 01 00
# SetParameters
FF 00 00 00 03 D4 12 04
# InListPassiveTarget: Jewel mode
FF 00 00 00 04 D4 4A 01 04
# InDataExchange: RID
FF 00 00 00 04 D4 40 01 78
# InDataExchange: RALL
FF 00 00 00 04 D4 40 01 00
# InDataExchange: RSEG 0-3
FF 00 00 00 05 D4 40 01 10 00
FF 00 00 00 05 D4 40 01 10 20
FF 00 00 00 05 D4 40 01 10 40
FF 00 00 00 05 D4 40 01 10 60
##########
# GetFirmwareVersion
FF 00 00 00 02 D4 02
# GetGeneralStatus
FF 00 00 00 02 D4 04
##########
# RFConfiguration: No timeout
FF 00 00 00 06 D4 32 02 00 00 00
# InDataExchange: READ-1
FF 00 00 00 05 D4 40 01 01 7F
# InDataExchange: READ-8
FF 00 00 00 05 D4 40 01 02 00
# InDataExchange: WRITE-E-1
FF 00 00 00 06 D4 40 01 53 7F 42
# InDataExchange: WRITE-E-8
FF 00 00 00 0C D4 40 01 55 02 01 02 03 04 05 06 07 08
# InDataExchange: WRITE-NE-1
FF 00 00 00 06 D4 40 01 1A 7F 42
# InDataExchange: WRITE-NE-8
FF 00 00 00 0C D4 40 01 1B 02 01 02 03 04 05 06 07 08
结果：
Sending: FF 00 00 00 06 D4 32 05 02 02 02
Received: D5 33 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 14 01 00
Received: D5 15 90 00
Normal processing.
Sending: FF 00 00 00 03 D4 12 04
Received: D5 13 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 4A 01 04
Received: D5 4B 01 01 0C 00 38 01 9A 00 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 40 01 78
Received: D5 41 00 12 4C 38 01 9A 00 90 00
Normal processing.
Sending: FF 00 00 00 04 D4 40 01 00
Received: D5 41 00 12 4C 38 01 9A 00 00 10 25 00 00 10 3F
00 01 03 F2 30 33 02 03 F0 02 03 03 E3 D1 01 DF
54 02 65 6E 30 31 32 33 34 35 36 37 38 39 30 30
31 32 33 34 35 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 AA
AA 12 4C 06 00 01 E0 00 00 00 00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 00
Received: D5 41 00 38 01 9A 00 00 10 25 00 00 10 3F 00 01
03 F2 30 33 02 03 F0 02 03 03 E3 D1 01 DF 54 02
65 6E 30 31 32 33 34 35 36 37 38 39 30 30 31 32
33 34 35 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 55 55 AA AA 12
4C 06 00 01 E0 00 00 00 00 00 00 00 00 00 00 00
00 00 47 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 20
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 40
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 10 60
Received: D5 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 90 00
Normal processing.
Sending: FF 00 00 00 02 D4 02
Received: D5 03 32 01 06 07 90 00
Normal processing.
Sending: FF 00 00 00 02 D4 04
Received: D5 05 01 00 01 01 00 00 02 80 90 00
Normal processing.
Sending: FF 00 00 00 06 D4 32 02 00 00 00
Received: D5 33 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 01 7F
Received: D5 41 00 47 90 00
Normal processing.
Sending: FF 00 00 00 05 D4 40 01 02 00
Received:
wrong SW size for:
Sending: FF 00 00 00 06 D4 40 01 53 7F 42
Received:
wrong SW size for:
Sending: FF 00 00 00 0C D4 40 01 55 02 01 02 03 04 05 06
07 08
Received:
wrong SW size for:
Sending: FF 00 00 00 06 D4 40 01 1A 7F 42
Received: D5 41 00 47 90 00
Normal processing.
Sending: FF 00 00 00 0C D4 40 01 1B 02 01 02 03 04 05 06
07 08
Received:
wrong SW size for:
Script was executed without error...
前段时间我对此进行了详细研究，并得出结论，NXP 的 PN532 NFC 控制器芯片的固件存在问题，导致它无法成功接收带有 NFC Forum Type 1 标签的某些命令（Topaz/Jewel品牌）。如前所述，ACR122U 基于该芯片。
当我尝试使用 WRITE-E8 (0x54) 命令一次写入 8 字节块时，收到的响应是 0x01，等待标签响应的超时。
我试过的东西不起作用：
包括 InDataExchange 中的 UID 回显，我什至尝试了 UID 回显的字节顺序，结果仍然相同。
使用 inCommunicateThru 命令而不是 InDataExchange 并在应用程序级别计算 CRC1 和 CRC2 值（相同结果）
我最后得出的结论是：
PN532 无法在 Type 1 标签上写入页面 0x10 和更大页面，这使得无法写入 Topaz 512 等流行型号上的全部内存。
建议：
这个问题与 2012 年相关，当时 Topaz 512 是一款成本低但内存高的 NFC 标签。既然有NAG215和NTAG216型号，我推荐使用那些内存大且与NFC阅读器普遍兼容的型号。