MikeFaith/pm3py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(rawcli): NTAG 5 datasheet catalog (config + SRAM + pick-random-UID)

Browse Source 
_NTAG5 = the SLIX2 command set minus STAY_QUIET_PERSISTENT (which NTAG5 rejects per the
NTP5210/NTA5332 tables) plus the NTAG5-specific NXP customs: READ_CONFIG (0xC0),
WRITE_CONFIG (0xC1, session registers 0xA0 STATUS_REG / 0xA1 CONFIG_REG), PICK_RANDOM_UID
(0xC2), and READ_SRAM (0xD2) / WRITE_SRAM (0xD3) for the Link/Boost variants. Sourced
from transponders/hf/iso15693/nxp/ntag5_*, routed by catalog_for, verified live.

Not yet wired: auto-identify of NTAG5. NTAG5 and ICODE DNA share UID E0 04 01 18, so
they can't be told apart by UID — routing needs a functional probe (READ_CONFIG of a
session register), which needs a brief NTAG5 tap to nail without risking DNA
misclassification. AES/ISO-29167-10 commands (0x35/0x39/0x3A) noted as a follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
michael
2026-07-16 13:14:33 -07:00
parent d0339bceb5
commit 9e18a10274
3 changed files with 53 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/rawcli-todo.md
View File

@@ -48,12 +48,16 @@ rendered dropdown on a real terminal is the only thing left unautomated.
inventory, protocol-ext (0x08), and the mode-dependent bits 5-6 (Select/Address vs AFI byte +
Nb_slots 1/16), plus option. `iso15_flags_decode` decodes every bit for the byte-0 hint.
2. **Per-chip identify** — `identify.name_iso15` distinguishes SLIX vs SLIX2 (READ_SIGNATURE 0xBD
probe). **NTAG5 and ICODE DNA still fall through to "ICODE SLIX"** (they share `E0 04`); NTAG5
needs a finer probe (IC-reference / GET_SYSTEM_INFO) before its catalog can be routed.
3. **Catalogs** — `_SLIX` (plain) and `_SLIX2` (`_SLIX` + READ_SIGNATURE 0xBD /
PASSWORD_PROTECTION_64BIT 0xBB / STAY_QUIET_PERSISTENT 0xBC, 80 blocks) done, dispatched by
`catalog_for`, verified live. **NTAG5 catalog** (READ/WRITE_CONFIG, the NTAG5 config registers,
password/AES) still to build — source from `transponders/hf/iso15693/nxp/ntag5_*`.
probe). **NTAG5 and ICODE DNA both carry UID `E0 04 01 18`** (identical type indicator — model
comment confirms), so they can't be told apart by UID. Routing NTAG5 needs a **functional
probe** (e.g. READ_CONFIG 0xC0 of session register 0xA0/0xA1 — NTAG5 has them, DNA doesn't).
⚠ HARDWARE-DEPENDENT: needs a brief NTAG5 tap to capture the discriminating response (and ideally
a DNA capture to confirm it differs) before wiring — otherwise it risks misclassifying DNA.
3. **Catalogs** — `_SLIX`, `_SLIX2`, and **`_NTAG5`** ✅ all done, dispatched by `catalog_for`,
verified live. `_NTAG5` = SLIX2 minus STAY_QUIET_PERSISTENT (NTAG5 rejects it) + READ_CONFIG
(0xC0) / WRITE_CONFIG (0xC1) / PICK_RANDOM_UID (0xC2) / READ_SRAM (0xD2) / WRITE_SRAM (0xD3).
**Follow-up:** the AES / ISO 29167-10 commands AUTHENTICATE (0x35) / CHALLENGE (0x39) / READBUFFER
(0x3A) for Link/Boost (AES-capable) variants — a crypto sub-protocol with its own param format.
4. Autocomplete UX ✅ (hex + binary, command names + opcode-by-value; the byte-line completion bug
is fixed).