ib technology
Internal EEPROM memory map
Byte 0: Tag Polling Rate (x 2.5ms)
Byte 1: RF ON/OFF lock (0x55 = ON, anything else = OFF, normally set to 0x55)
Byte 2: Reserved (Checksum)
Byte 3: Reserved
Byte 4: PASSWORD_RWD "M" (Sent to HT2)
Byte 5: PASSWORD_RWD "I"
Byte 6: PASSWORD_RWD "K"
Byte 7: PASSWORD_RWD "R"
Byte 8: Reserved
Byte 9: PASSWORD_TAG 0xAA (Reply from HT2)
Byte 10: PASSWORD_TAG "H"
Byte 11: PASSWORD_TAG "T”
Start of authorised tag codes. List is terminated with FF FF FF FF sequence.
List is regarded as empty (all identity codes valid) if first code sequence in list is (FF FF FF FF).
List can hold up to 60 identity codes (serial numbers).
Byte 12: 0xFF
Byte 13: 0xFF
Byte 14: 0xFF
Byte 15: 0xFF
Empty list
Byte 16: (MSB) Tag identity code
Byte 17:
Byte 18:
Byte 19: (LSB)
Byte 20: (MSB) Tag identity code
Byte 21:
Byte 22:
Byte 23: (LSB)
-
-
-
-
Byte 255:
Last Internal EEPROM location
Method of Operation
The Micro RWD reader only allows full Read/Write access to the Hitag 2 transponders
if TWO levels of security have both succeeded. During the initial communication with
the H2 tag the serial number (identity code) is acquired (4-bytes from H2 page 0). The
Micro RWD internal EEPROM is then checked to see if this serial number is stored in
the authorisation list located from byte 12 onwards. If the tag serial number is matched
or the list is empty then the tag has passed the first security check (If the Micro RWD
has 0xFF FF FF FF stored at EEPROM locations 12 to 15 then the list is treated as
empty and all Hitag 2 tags are accepted through the first security level).
The serial number can be accessed at this stage using the CARD UID command.
7
RFSOLUTIONS [ RFSOLUTIONS.LTD ]
