RR1036MFDemo Software Operation Reference

RR1036MF Demo Software Operation reference

1.

Open Port
Click Connect

can see
and the lower-left corner of the interface will show

which means the COM1

port has been opened. Otherwise, we will see the following dialog box which means a connection
failure.

2.

Reader-related operation
2.1 LED Control

Set LEDs action mode such as on/off duration and flash times.
2.2 Buzzer Control

Set Beeps action mode such as on/off duration and beeping times.
2.3 Read/Write The Readers EEPROM:

Read out the content of the readers EEPROM.

Select the beginning of the address 30, read data length of 3 bytes, Click ReadE2PROM, see
001213.
The address should be less than 0x80. The content of the EEPROM with address over 0x80 is
used for KEY storage and could not be read out.

RR1036MFDemo Software Operation Reference

3. Basic Knowledge of Mifare I Card:

3.1 Card EEPROM Storage Structure
The following Content Based on MF1 S50. As to other Mifare I card such as MF1S70
or Mifare Ultralight, Please refer to the cards datasheet

1MF1 S50 is organized in 16 sectors with 4 blocks of 16 bytes each (one block consists
of 16 byte)Every block also can be accessed by its absolute block address.
Sector 0

Block 0

Data Block

Block 1

Data Block

Block 2

Data Block

Control Block

Block 0

Data Block

Block 1

Data Block

Block 2

Data Block

Control Block

Block 0

Data Block

60

Block 1

Data Block

61

Block 2

Data Block

62

Control Block

63

Block 3
Sector 1

Block 3

Key A Access Bits Key B

KeyA Access Bits Key B

Sector 15

Block 3

KeyA Access Bits Key B

Each Data Block and Control Block is 16 bytes.

Key in each sector is independent.

The structure of Control Block is
Byte No.
Content

2
3
KeyA

7
8
9
Access Bits

10

11

12 13
KeyB

14

15

2organized in 40 sectors , Including (0~31 sector) 32 sector with 4 blocks of 16 bytes

each (one block consists of 16 byte), (32~39 sector) 8 sector with 16 blocks of 16 bytes each (one
block consists of 16 byte). To block for access unit.

RR1036MFDemo Software Operation Reference

3.2 Display the block data:

This is the 16 bytes of data expressed as hexadecimal, Each double-digit Is a byte .That is
F0A23D080F5D
In other words,F0, F is high 0 is low,A2, A is high 2 is low, 3D ,3 is high D is low
Therefore,Data in card is arranged from low to high:
0000 1111 0010 1010 1101 0011 1000 0000 0000 1111.
F0
A2
3D
08
0F
3.3 When a data block is a value block, data structure:

Value: Signifies a signed 4-byte value. The lowest significant byte of a value is stored in the
lowest address byte. Negative values are stored in standard 2!as complement format. For reasons
of data integrity and security, a value is stored three times, twice non-inverted and once inverted.
Adr: Signifies a 1-byte address, which can be used to save the storage address of a
block,when implementing a powerful backup management. The address byte is stored four
times,twice inverted and non-inverted. During increment, decrement, restore and transfer
operations the address remains unchanged. It can only be altered via a write command.

The Figure: F0A23D08 0F5DC2F7 F0A23D08 0D F2 0D F2

is a value block.
Values block operation: Increment 10000000. In other words, Value F0A23D08 add
10000000equal to 00A33D08
The value data in card is arranged from low to high:
0000 0000 0011 1010 1101 0011 1000 0000 0000 1111.
00
A3
3D
08
0F

RR1036MFDemo Software Operation Reference

4. Card Operation Process:

RequestIdle/All

Anticoll(Single/Multi)Get UID

Select
Change Sector

AuthenticationDesignated Sector

No Change

Read Block

Write Block

Inc

Dec

Restore

Halt

Transfer

Note: 1. Any operation, as long as there is a failure, it must be start again from Request according
to the process.
2. The value operation in key block,such as MF1 S50 No. 3 block,it will cause that the
sector can not be used, completely locked.
3.Please remember the Key A,if you forget it,the sector can not be used.

4.1 Tag Normal Operation Interface operationSimple Operation

4.1.1

Click Get tag information Effective as three steps RequestAnticollSelect:

4.1.2
After Select success,Read/Write operation (Any operation error must be click
Get tag information again

Select sector, as long as the correct KeyA fill, can read and write each block of data. (The
software automatically authenticate Key ,then read and write the data of block)
Note: Do not rewrite the access control data in Key Block.
4

RR1036MFDemo Software Operation Reference

4.1.3
After Select successvalue operationAny operation error must be click Get
tag information again

Select sector, as long as the correct KeyA fill, can initialize, increase,decrease and read each
block of value data.The software automatically authenticate Key ,then read and write the value
data of block
Note: Do not rewrite the access control data in Key Block.

4.2 Interface operationSimple Operation

4.2.1
RequestAnticollSelect first and last achieve Reader send an order,received a
card Response, Read the serial number on a card, Selected a card with its UID and read the card to
return selected response codes (ATS= 08h).

After Click ,in order to see:

At first,Click Request (Allor Request (Idle):
All card

Idle card

Then Click Anticoll (Single) or Anticoll (Multi)

single card

Multi card

Then Click Select

4.2.2

Click Get tag information Effective as three steps RequestAnticollSelect:

4.2.3
After Select successchoose sector and authentication:
Have 2 choices:
1Direct input Key authentication:

RR1036MFDemo Software Operation Reference

Figure choose 3 sector , authenticate KeyA,the content of Key is FFFFFFFFFFFFif in sector

3incard 3 Key can see:

Key
2Indirect Key authentication
<1>At first, Deposit Key into the Key register area of the reader (Power off no lost)
(In the Key register of the reader the same sector can store different Key A and Key B at the
same time ):

Figure choose FFFFFFFFFFFF deposit in the Key A in sector 3 in the Key register area in the
reader.
<2>Then through the Reader Key areas compared with the card Key to authenticate,have 2
method:
Method one:

Figure choose Key A in sector 3 in card compared with Key A in sector 2 in reader,the same
can be seen:
Method two:

Figure choose Key A in sector 3 in card compared with Key A in sector 3 in reader,the same
can be seen:
the effect equivalent to do the following operation in method one:

RR1036MFDemo Software Operation Reference

4.2.4

After authenticate a sector success,Read/Write the contents of the sector:

Figure because authentication is 3 sector,we must choose 3 sector. Choose the block
number 0 ,Click Read.Data show in the edit box at the Data Block right side.

In a similar way,when writing content,write data of 16 bytes in the corresponding edit

box( Hexadecimal).Click Write Figure:

Note:
<1>the sectors last block in all sectors is Key block,as figure in the article is MF1 S50
card,NO.3 block is Key block,After read Key block,data show in the edit box at the Data Block
right side.howerver,the content of Key A is protected,the data that reader read it from card is
000000000000.Therefore,we can see the content of Key A in the edit box is 000000000000
<2>Write Key block must be careful.Dont change the storage control Condition data in
it ,about 4 bytes. If data change wrong, it will cause that the sector can not be used, completely
locked.
<3> the flowing value operation in key block (MF1 S50 No.3 block) will cause that the
sector can not be used,completely locked.

RR1036MFDemo Software Operation Reference

5After authenticate a sector successdo Purse Operation:

Figure we must fill the data in the edit box at the Value(Hex) right side,can initialize block 0
in sector 3 in the figure.

Select sector, as long as the correct KeyA fill, can initialize, increase,decrease and read each
block of value data.The software automatically authenticate Key ,then read and write the value
data of block
Note: Do not rewrite the access control data in Key Block.
If the content of a block in a sector is data , not value.cannt do Purse Operation,about
Increment,Decrement,ReadValue operation.In this case,we must Click initvalue.
Figure,Before Click InitValue,we can Read the content of block 0 in sector 3:

After Click InitValue3,we can Read the content of block 0 in sector 3 ,Figure:

Figure,fill 1 in eidt box at the Value(hex) right side. Click Increment

The result is that the block data increase 10000000

Then Click Read,we can see the content of block 0 in sector 3:

RR1036MFDemo Software Operation Reference

Click ReadValue,we can see the value in eidt box at the Value(hex) right side:

6After authenticate a sector success,do Value Operation:

Figure,after Click Value,reader make the value of block 0 in sector 3 decrease (Sub)01000000

Figure,after Click Value,reader make the value of block 0 in sector 3 increase (Add)01000000

Figure,after Click Value,reader make the value of block 0 in sector 3 increase

(Add)01000000.At the same time,reader store the value in block 1 sector 3 (The original content
are covered).In this case,block 0 and block 1in sector 3 have the same data.

Figure,after Click Value, reader store the value from block 0 sector 3 in block 1 sector 3 (The
original content are covered).In this case,block 0 and block 1in sector 3 have the same data.
Click Read,we can see:

RR1036MFDemo Software Operation Reference

6After authenticate a sector success, Modify Key

Figure,Click Modify Key,the Key A in cards sector 3 was changed to 111111111111.

Figure,Click Modify Key, the Key B in cards sector 3 was changed to 111111111111.At the
same time, the Key A in cards sector 3 was changed to 000000000000(As long as Key B change
success,,the Key B was changed to 000000000000).
7After authenticate a sector success, Check Write
Before check write,if the Key A in the cards sector 3 is 000000000000,we must store the
Key A 000000000000 in the readers key register area.

Figure,then choose sector 3 block 0,fill the data for calibration in edit box. Click CheckWrite:

If the data in card is the same as the data in edit box,we can see the lower-left corner of the
interface show
8After authenticate a sector success,Restore/Transfer data in card (only valid for
value).

10

RR1036MFDemo Software Operation Reference

Click Restore, the data in block 0 sector 3 is stored in the cards register area(power off
lost).

Change block number,Click Transfer,the data in cards register area is stored in block 1 sector
3(The original content are covered).
Note: 1.Restore and Transfer is
1.Restore Transfer is a continuous operation, Data replication limited to the same sector
2.change sector must be authenticateagain.
UltraLight Operation

Read data,Click Get tag information and then choose page number, Click Read Figure:
Write data,we must choose page number first,and then write the data in the corresponding
edit box,Click Write.

11