pm3py/docs/SLIX2_COMMAND_AUDIT.md

ICODE SLIX2 Command Audit

Date: 2026-03-17 Source: SL2S2602 datasheet Rev 4.2, AN11809 Rev 1.2, SL2S2002 datasheet Rev 3.4

Status

Commands marked OK are implemented in firmware native handler or response table. Commands marked MISSING need implementation in the Python transponder model + table compiler.

Standard ISO 15693 (firmware native handler)

Cmd	Name	Status
0x01	INVENTORY	OK
0x02	STAY QUIET	OK
0x20	READ SINGLE BLOCK	OK (with lock_mode access control)
0x21	WRITE SINGLE BLOCK	OK (with lock_mode access control)
0x22	LOCK BLOCK	OK (firmware native)
0x23	READ MULTIPLE BLOCKS	OK
0x25	SELECT	OK
0x26	RESET TO READY	OK
0x27	WRITE AFI	OK (firmware native)
0x28	LOCK AFI	OK (firmware native)
0x29	WRITE DSFID	OK (firmware native)
0x2A	LOCK DSFID	OK (firmware native)
0x2B	GET SYSTEM INFO	OK
0x2C	GET MULTIPLE BLOCK SECURITY	OK

NXP Custom Commands (table entries)

Code	Name	Status	Priority	Notes
0xA0	INVENTORY READ	MISSING	Nice to have	Like inventory but returns data blocks
0xA1	FAST INVENTORY READ	MISSING	Nice to have	Same as A0 at double data rate
0xA2	SET EAS	MISSING	Nice to have	Enables EAS mode (password protected)
0xA3	RESET EAS	MISSING	Nice to have	Disables EAS mode
0xA4	LOCK EAS	MISSING	Nice to have	Permanently locks EAS state
0xA5	EAS ALARM	MISSING	Nice to have	Returns 256-bit EAS sequence
0xA6	PASSWORD PROTECT EAS/AFI	MISSING	Nice to have	Enables password protection for EAS/AFI
0xA7	WRITE EAS ID	MISSING	Nice to have	Writes 16-bit EAS identifier
0xAB	GET NXP SYSTEM INFO	MISSING	Must have	Returns PP, PP conditions, lock bits, feature flags
0xB2	GET RANDOM NUMBER	OK	-	Firmware native handler
0xB3	SET PASSWORD	OK	-	Firmware native + table entries
0xB4	WRITE PASSWORD	MISSING	Should have	Changes password value (requires prior SET PASSWORD)
0xB5	LOCK PASSWORD	MISSING	Should have	Permanently locks a password
0xB6	PROTECT PAGE	MISSING	Must have	Sets protection pointer + access conditions
0xB7	LOCK PAGE PROTECTION	MISSING	Should have	Permanently locks protection config
0xB9	DESTROY	MISSING	Should have	Irreversibly kills tag (XOR password)
0xBA	ENABLE PRIVACY	MISSING	Must have	Enters privacy mode (separate from SET PASSWORD)
0xBB	64-BIT PASSWORD PROTECTION	MISSING	Should have	Requires both R+W passwords
0xBC	STAY QUIET PERSISTENT	MISSING	Nice to have	Persistent quiet survives power cycles
0xBD	READ SIGNATURE	MISSING	Must have	Returns 32-byte ECC originality signature

Model Issues

1. Password ID 0x10 (EAS/AFI) missing — datasheet lists 5 IDs: 0x01=Read, 0x02=Write, 0x04=Privacy, 0x08=Destroy, 0x10=EAS/AFI. Model only has 4.

2. Privacy mode behavior — datasheet says tag responds to GET RANDOM NUMBER AND SET PASSWORD in privacy mode. Model only allows SET PASSWORD.

3. ENABLE PRIVACY (0xBA) is separate from SET PASSWORD — uses XOR'd password, specifically enters privacy mode. Model conflates with SET PASSWORD pwd_id=privacy.

4. 16-bit counter (block 79) has special increment-only semantics via WRITE with specific data format. Not modeled.

5. Protection pointer access conditions — datasheet defines Page L / Page H with separate read/write protection bits (Extended Protection Status byte). Model uses simpler protection_pointer integer.

Implementation Priority

Next session — must haves:

1. GET NXP SYSTEM INFO (0xAB) — static response from tag config
2. READ SIGNATURE (0xBD) — static 32-byte signature
3. ENABLE PRIVACY (0xBA) — XOR password, enter privacy mode
4. EAS/AFI password (pwd_id 0x10) — add to model
5. PROTECT PAGE (0xB6) — set protection pointer via RF

After that — should haves: 6. WRITE PASSWORD (0xB4) 7. LOCK PASSWORD (0xB5) 8. DESTROY (0xB9) 9. LOCK PAGE PROTECTION (0xB7) 10. 64-BIT PASSWORD PROTECTION (0xBB)

Later — nice to haves: 11-16. EAS subsystem, INVENTORY READ, STAY QUIET PERSISTENT, counter handling