MikeFaith/pm3py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Big transponder support update

Browse Source
This commit is contained in:
michael
2026-07-05 09:53:52 -07:00
parent 950628ef4e
commit dc626faa60
42 changed files with 5859 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

258
docs/TRANSPONDERS.md Normal file
View File

@@ -0,0 +1,258 @@
# pm3py Simulated Transponders — Reference & Comparison
Every transponder model that `pm3py` can simulate, organized by RF frequency and
protocol, with feature-comparison tables. Import any model from `pm3py.sim`:
```python
from pm3py.sim import NTAG216, ST25DV16K, OptigaAuthenticateNBT, SimSession
```
Memory figures are **user memory** (excludes UID/lock/config/OTP pages) per the
manufacturer datasheet. "Faithful" models reproduce the documented command set,
UID prefix, and access rules; a ✓ in a feature column means the model implements
that behaviour (not merely that the silicon has it).
Legend: **T2/T4/T5** = NFC Forum Tag type · **A/B/V** = ISO 14443-A / 14443-B /
15693 (NFC-V) · **DI** = dual interface (RF + wired I²C/SPI) · **EH** = energy
harvesting · **—** = not applicable / not present.
---
## 1. Master list — by frequency and protocol
| Model(s) | Vendor | Freq | Protocol | NFC type | Module |
|---|---|---|---|---|---|
| MIFARE Ultralight / C / EV1 (MF0UL11/21) | NXP | 13.56 MHz | ISO 14443-A | T2 | `iso14443a/nxp/ultralight` |
| NTAG210/212/213/215/216 | NXP | 13.56 MHz | ISO 14443-A | T2 | `iso14443a/nxp/ntag21x` |
| NTAG I²C plus (NT3H2111/2211) | NXP | 13.56 MHz | ISO 14443-A | T2 + I²C | `iso14443a/nxp/ntag_i2c` |
| MIFARE Classic 1K/4K | NXP | 13.56 MHz | ISO 14443-A | — (Crypto1) | `iso14443a/nxp/mifare_classic` |
| MIFARE DESFire EV1/2/3 | NXP | 13.56 MHz | ISO 14443-A | T4 | `iso14443a/nxp/desfire` |
| ST25TN512/01K | ST | 13.56 MHz | ISO 14443-A | T2 | `iso14443a/st/st25tn` |
| ST25TA512B/02KB/16K/64K | ST | 13.56 MHz | ISO 14443-A | T4 | `iso14443a/st/st25ta` |
| OPTIGA Authenticate NBT | Infineon | 13.56 MHz | ISO 14443-A | T4 + I²C | `iso14443a/infineon/optiga_nbt` |
| ST25TB512-AC/AT, 02K, 04K | ST | 13.56 MHz | ISO 14443-B (SRIX) | — | `iso14443b/st/st25tb` |
| RF430CL330H | TI | 13.56 MHz | ISO 14443-B | T4 + I²C | `iso14443b/ti/rf430cl330h` |
| ICODE SLIX / SLIX2 / 3 / DNA | NXP | 13.56 MHz | ISO 15693 | T5 | `iso15693/nxp/icode_*` |
| NTAG 5 Switch / Link / Boost | NXP | 13.56 MHz | ISO 15693 | T5 (+I²C on Link/Boost) | `iso15693/nxp/ntag5_*` |
| ST25TV512C/02KC | ST | 13.56 MHz | ISO 15693 | T5 | `iso15693/st/st25tv` |
| ST25DV04K/16K/64K | ST | 13.56 MHz | ISO 15693 | T5 + I²C | `iso15693/st/st25dv` |
| my-d vicinity SRF55V02P/10P | Infineon | 13.56 MHz | ISO 15693 | T5 | `iso15693/infineon/myd_vicinity` |
| Tag-it HF-I Plus | TI | 13.56 MHz | ISO 15693 | T5 | `iso15693/ti/tagit` |
| RF430FRL152/153/154H | TI | 13.56 MHz | ISO 15693 + sensor | T5 + I²C/SPI | `iso15693/ti/rf430frl` |
| EM4100 | EM | 125 kHz | LF ASK | — | `lf/em/em4100` |
| HID Prox | HID | 125 kHz | LF FSK (Wiegand) | — | `lf/hid/hid` |
| T5577 | Atmel | 125 kHz | LF (multi) | — | `lf/atmel/t5577` |
Generic bases you can subclass: `NfcType2Tag` / `NfcType4Tag` (14443-A),
`NfcType5Tag`/`Tag15693` (15693), `Tag14443B` (SRIX) / `Tag14443B_4` (standard
Type B), `TagLF`.
---
## 2. HF · ISO 14443-A · NFC Forum Type 2 (Ultralight / NTAG)
| Model | User mem | Pages | GET_VERSION | FAST_READ | PWD_AUTH | Counter | Signature | Extra |
|---|---|---|---|---|---|---|---|---|
| MIFARE Ultralight (MF0ICU1) | 48 B | 16 | — | — | — | — | — | OTP, COMPAT_WRITE |
| MIFARE Ultralight C (MF0ICU2) | 144 B | 48 | — | — | — | 16-bit | — | **3DES AUTHENTICATE** |
| Ultralight EV1 MF0UL11 | 48 B | 20 | ✓ | ✓ | 32-bit | 3 × 24-bit | ✓ | INCR_CNT, tearing |
| Ultralight EV1 MF0UL21 | 128 B | 41 | ✓ | ✓ | 32-bit | 3 × 24-bit | ✓ | INCR_CNT, tearing |
| NTAG210 | 48 B | 20 | ✓ | ✓ | 32-bit | — | ✓ | — |
| NTAG212 | 128 B | 41 | ✓ | ✓ | 32-bit | — | ✓ | — |
| NTAG213 | 144 B | 45 | ✓ | ✓ | 32-bit | 1 × 24-bit NFC | ✓ | mirror |
| NTAG215 | 504 B | 135 | ✓ | ✓ | 32-bit | 1 × 24-bit NFC | ✓ | mirror |
| NTAG216 | 888 B | 231 | ✓ | ✓ | 32-bit | 1 × 24-bit NFC | ✓ | mirror |
| NTAG I²C plus 1K (NT3H2111) | 888 B | — | ✓ | ✓ | 32-bit | — | ✓ | **SECTOR_SELECT**, 64 B SRAM, DI |
| NTAG I²C plus 2K (NT3H2211) | 1912 B | — | ✓ | ✓ | 32-bit | — | ✓ | 2 sectors, FAST_WRITE, DI |
| ST25TN512 | 64 B | 64 | — | — | — | — | TruST25 | Kill password |
| ST25TN01K | 160 B | 64 | — | — | — | — | TruST25 | Kill password |
All: ATQA `0x0044`, SAK `0x00`, 7-byte UID. NXP UID prefix `04…`; ST prefix `02…`.
NFC counter on NTAG213/215/216 auto-increments once per power cycle when enabled
(`ACCESS.NFC_CNT_EN`). Ultralight EV1 counters are read/increment (one-way) with
`CHECK_TEARING_EVENT`.
---
## 3. HF · ISO 14443-A · NFC Forum Type 4 (ISO-DEP / APDU)
| Model | NDEF | Extra files | Password | Crypto auth | Counter | Extra |
|---|---|---|---|---|---|---|
| ST25TA512B | 64 B | System | 128-bit R/W | — | — | — |
| ST25TA02KB | 256 B | System | 128-bit R/W | — | 20-bit event | TruST25, GPO (-D/-P) |
| ST25TA16K | 2 KB | System | 128-bit R/W | — | — | — |
| ST25TA64K | 8 KB | System | 128-bit R/W | — | — | *constants extrapolated* |
| OPTIGA Authenticate NBT | 4 KB | 4×1 KB proprietary + FAP | 32-bit (per-file, FAP) | **ECDSA P-256** + AES-CMAC COTT | — | DI (I²C), life-cycle |
All ISO-DEP with per-model ATS. ST25TA UID prefix `02…`; OPTIGA prefix `05…`,
ATS historical bytes = `"NBT2000"`. OPTIGA read/write access is gated by the
File Access Policy (per file, per interface); AUTHENTICATE TAG (INS `0x88`)
signs a challenge with the device's NIST P-256 key.
*MIFARE DESFire (EV1/2/3) is also Type 4 but uses the proprietary DESFire
command set + DES/3DES/AES auth — see `iso14443a/nxp/desfire`.*
---
## 4. HF · ISO 14443-B
| Model | Anticollision | Blocks × size | User | Counters | OTP area | Extra |
|---|---|---|---|---|---|---|
| ST25TB512-AC | SRIX slot-marker | 16 × 4 B | 36 B | 2 × count-down | blocks 0-4 | resettable OTP |
| ST25TB512-AT | SRIX slot-marker | 16 × 4 B | 36 B | 2 × count-down | — | plain EEPROM 0-4 |
| ST25TB02K | SRIX slot-marker | 64 × 4 B | 228 B | 2 × count-down | blocks 0-4 | reload counter |
| ST25TB04K | SRIX slot-marker | 128 × 4 B | 484 B | 2 × count-down | blocks 0-4 | reload counter |
| RF430CL330H | **standard REQB/ATTRIB** | 3 KB SRAM | 3 KB NDEF | — | — | NFC **Type 4**, DI (I²C/SPI) |
ST25TB use the simplified SRIX/SRI anticollision (Initiate/Pcall16/Slot_marker
/Select-by-Chip_ID), 64-bit UID prefix `D0 02 …`, decrement-only counters at
blocks 5/6. RF430CL330H uses full ISO 14443-3 Type B (REQB→ATQB→ATTRIB) and then
Type 4 NDEF APDUs; its NDEF SRAM is volatile (host-filled over I²C/SPI).
---
## 5. HF · ISO 15693 (NFC-V / NFC Forum Type 5)
| Model | User mem | Blocks | UID prefix | Password | Privacy | Signature | Extra |
|---|---|---|---|---|---|---|---|
| ICODE SLIX | 112 B | 28 × 4 B | `E0 04 01` | EAS/AFI | — | ✓ | EAS |
| ICODE SLIX2 | 320 B | 80 × 4 B | `E0 04 02` | 4 × 32-bit | privacy | ✓ | DESTROY, protect-page |
| ICODE 3 | 304 B | 76 × 4 B | `E0 04 01` | 4 × 32-bit | privacy | ✓ | — |
| ICODE DNA | 256 B | 64 × 4 B | `E0 04 01` | 4 × 32-bit | privacy | ✓ | **AES-128** mutual auth |
| NTAG 5 Switch (NTP5210) | 512 B | 128 × 4 B | `E0 04 01` | password | privacy | ✓ | PWM/GPIO, EH, ED — **no I²C**, no AES |
| NTAG 5 Link (NTP53x2) | 2 KB | 512 × 4 B | `E0 04 01` | password | privacy | ✓ | **DI (I²C)**, 256 B SRAM, EH, ED, AES (NTP5332) |
| NTAG 5 Boost (NTA5332) | 2 KB | 512 × 4 B | `E0 04 01` | password | privacy | ✓ | **DI (I²C)**, SRAM, EH, AES always, **ALM**³ |
| ST25TV512C | 64 B | 16 × 4 B | `E0 02 08` | 64/32-bit areas | Kill/Silent/Discreet | TruST25 | tamper (-T) |
| ST25TV02KC | 320 B | 80 × 4 B | `E0 02 08` | 64/32-bit areas | Kill/Silent/Discreet | TruST25 | tamper (-T) |
| ST25DV04K | 512 B | 128 × 4 B | `E0 02 24` | 3 × 64-bit | — | — | **EH**, mailbox/FTM, DI |
| ST25DV16K | 2 KB | 512 × 4 B | `E0 02 26` | 3 × 64-bit | — | — | **EH**, 4 areas, GPO, DI |
| ST25DV64K | 8 KB | 2048 × 4 B | `E0 02 26` | 3 × 64-bit | — | — | **EH**, mailbox, DI |
| my-d vicinity SRF55V02P | 224 B | 56 × 4 B | `E0 05 40` | — | — | — | value counters, page mode¹ |
| my-d vicinity SRF55V10P | 992 B | 248 × 4 B | `E0 05 00` | — | — | — | value counters, page mode¹ |
| Tag-it HF-I Plus | 256 B | 64 × 4 B | `E0 07 …` | — | — | — | Write_2/Lock_2 (0xA2/0xA3) |
| RF430FRL152/3/4H | 256 B² | 64 × 4 B² | `E0 07 A2` | — | — | — | **ADC + temp sensor**, DI |
¹ my-d vicinity has **no GET SYSTEM INFO** (0x2B) — identify via the Chip-ID UID
byte. ² RF430FRL block map + sensor commands are defined by ROM firmware
(SLAU603, not modelled); the model provides identity + standard 15693 I/O.
³ **ALM** = Active Load Modulation, unique to the NTAG 5 Boost (NTA5332) among
the NTAG 5 family — a physical RF feature (no command-layer effect; at the APDU
layer Boost is a Link NTP5332 with AES permanently enabled).
---
## 6. LF · 125 kHz
| Model | Data | Encoding | Writable | Notes |
|---|---|---|---|---|
| EM4100 | 40-bit ID | ASK / Manchester | read-only | classic access-control tag |
| HID Prox | 26/35/… bit Wiegand | FSK | read-only | facility + card number |
| T5577 | 4×32-bit blocks + config | ASK/FSK/PSK (multi) | ✓ | emulates EM4100/HID/etc. via config |
---
## 7. Specialized feature comparison
### 7.1 Energy harvesting (EH output for external circuits)
| Model | Protocol | EH mechanism |
|---|---|---|
| ST25DV04K/16K/64K | 15693 | V_EH analog output pin; `EH_CTRL_Dyn` register (EH_EN/EH_ON) |
| NTAG I²C plus | 14443-A | field-powered I²C host supply (V_OUT) |
| **NTAG 5 — all variants (Switch/Link/Boost)** | 15693 | energy-harvesting output + event-detection (ED) pin, shared via the NTAG 5 platform |
| RF430FRL15xH | 15693 | passive (field-powered) or battery-assisted operation |
### 7.2 Dual interface — RF + wired host (I²C / SPI bridge)
| Model | RF | Wired | Shared-memory / bridge feature |
|---|---|---|---|
| NTAG I²C plus (NT3H2111/2211) | 14443-A T2 | I²C | 64-byte SRAM, pass-through, SECTOR_SELECT |
| ST25DV04K/16K/64K | 15693 T5 | I²C | 256-byte mailbox (Fast Transfer Mode) |
| OPTIGA Authenticate NBT | 14443-A T4 | I²C (GP T=1′) | NFC↔I²C pass-through, IRQ |
| RF430CL330H | 14443-B T4 | I²C / SPI | 3 KB NDEF SRAM, host writes NDEF |
| NTAG 5 Link (NTP53x2) | 15693 T5 | I²C | 256 B SRAM, arbiter, pass-through/mirror/PHDC |
| NTAG 5 Boost (NTA5332) | 15693 T5 | I²C | = Link NTP5332 + AES always on + ALM |
| RF430FRL15xH | 15693 | I²C / SPI | MSP430 host access to FRAM |
*(NTAG 5 **Switch** (NTP5210) is single-interface — RF + PWM/GPIO only, no I²C.)*
### 7.3 Cryptographic authentication
| Model | Protocol | Scheme |
|---|---|---|
| MIFARE Classic 1K/4K | 14443-A | Crypto1 (48-bit, per-sector keys A/B) |
| MIFARE Ultralight C | 14443-A | 2-key **3DES** challenge-response (AUTHENTICATE 0x1A) |
| MIFARE DESFire | 14443-A T4 | DES / 3DES / **AES-128** |
| ICODE DNA | 15693 | **AES-128** tag + mutual auth |
| NTAG 5 Link (NTP5332) / Boost (NTA5332) | 15693 | **AES-128** TAM/MAM (Switch has none; Link NTP5312 is password-only) |
| OPTIGA Authenticate NBT | 14443-A T4 | **ECDSA P-256** (offline) + AES-128-CMAC COTT (online) |
### 7.4 Password protection (symmetric secret / verify)
| Model | Protocol | Password |
|---|---|---|
| NTAG21x, Ultralight EV1 | 14443-A | 32-bit PWD_AUTH (+16-bit PACK), AUTH0 page gate |
| ST25TA family | 14443-A T4 | 128-bit read + write passwords (VERIFY) |
| OPTIGA NBT | 14443-A T4 | 32-bit per-file passwords via File Access Policy |
| ICODE SLIX2 / 3 / DNA | 15693 | 4 × 32-bit (read/write/privacy/destroy) |
| ST25TV | 15693 | 64-bit (single-area) or 2 × 32-bit (dual-area) + config pwd |
| ST25DV | 15693 | 3 × 64-bit RF passwords + area protection |
| ST25TN | 14443-A | 32-bit Kill password only |
### 7.5 Counters
| Model | Counter(s) | Type |
|---|---|---|
| NTAG213/215/216 | 1 × 24-bit | NFC read counter (auto-increment) |
| Ultralight EV1 | 3 × 24-bit | one-way, increment + tearing check |
| Ultralight C | 1 × 16-bit | one-way |
| ST25TA02KB | 20-bit | event counter (anti-tearing) |
| my-d vicinity | per-page | value counters (decrement-only, 0…65535) |
| ST25TB (all) | 2 × 32-bit | count-down (decrement-only) |
### 7.6 Tamper detection, privacy & kill
| Model | Feature |
|---|---|
| ST25TV02KC-T | tamper loop (TD0/TD1), seal/unseal/reseal event memorization |
| ST25TV | Kill (permanent), Silent + Discreet (reversible), NUID masking |
| ST25TN | Kill (permanent RF mute) |
| ICODE SLIX2 / 3 / DNA | privacy mode, DESTROY (permanent) |
| ST25DV | RF-disable / RF-sleep dynamic registers |
### 7.7 Originality / authenticity signatures
| Signature scheme | Models |
|---|---|
| NXP originality (32-byte ECC, READ_SIG) | NTAG21x, Ultralight EV1, NTAG I²C, ICODE SLIX/SLIX2/3/DNA, NTAG5 |
| ST TruST25 digital signature | ST25TN, ST25TA (02KB), ST25TV |
| Certificate-based (X.509 + ECDSA) | OPTIGA Authenticate NBT |
### 7.8 Sensors
| Model | Sensor |
|---|---|
| RF430FRL152/153/154H | 14-bit sigma-delta ADC + internal temperature sensor (over 15693, via ROM firmware) |
---
## 8. Implant presets
Pre-configured instances for the common dual/single-frequency implants
(`from pm3py.sim import xEM, xNT, xM1, FlexDF, NExT`):
| Preset | Backing model | Notes |
|---|---|---|
| `xEM` | T5577 (EM4100 mode) | LF |
| `xNT` | NTAG216 | HF, NDEF |
| `xM1` | MIFARE Classic 1K | HF |
| `FlexDF` | DESFire EV2 | HF |
| `NExT` | T5577 + NTAG216 | dual-frequency (LF + HF) |
| `MagicMifareClassicTag` | gen1a / gen2 Classic | writable block 0 |
---
*Generated from the `pm3py.sim` model set. Memory/feature values follow the
manufacturer datasheets; where a datasheet was not supplied (ST25TA64K,
RF430FRL firmware command set) the model is marked accordingly in its module
docstring.*