CyberMouse

Smart Card Reader/Writer

Reference Manual

Last modified : 28 may 1999

Copyright  1996-1999, see www.cybermouse.de for newest driver/manual

 Cybermouse Reference Manual

Contents
INTRODUCTION............................................................................................................................................................................................... 4

FEATURES ......................................................................................................................................................................................................... 4

SUPPORTED CARD TYPES ............................................................................................................................................................................ 5

A. MEMORY-BASED SMART CARDS (SYNCHRONOUS INTERFACE)................................................................................................................. 5
B. MICROCONTROLLER-BASED SMART CARDS (ASYNCHRONOUS INTERFACE) ............................................................................................. 5
SMART CARD INTERFACE............................................................................................................................................................................ 6
A. SMART CARD POWER SUPPLY VCC (C1)................................................................................................................................................ 6
B. PROGRAMMING VOLTAGE VPP (C6)....................................................................................................................................................... 6
C. CARD TYPE SELECTION........................................................................................................................................................................... 6
D. INTERFACE FOR MEMORY-BASED CARDS................................................................................................................................................ 6
E. INTERFACE FOR MICROCONTROLLER-BASED CARDS ............................................................................................................................... 6
F. CARD TEARING PROTECTION .................................................................................................................................................................. 7
G. SHORT CIRCUIT PROTECTION .................................................................................................................................................................. 7
POWER SUPPLY ............................................................................................................................................................................................... 7
A. STATUS LEDS ......................................................................................................................................................................................... 7
SERIAL INTERFACE ....................................................................................................................................................................................... 7
A. COMMUNICATION PARAMETERS ............................................................................................................................................................. 7
1. Hardware Baud Rate......................................................................................................................................................................... 7
2. Software Baud Rate Selection ........................................................................................................................................................... 7
B. INTERFACE WIRING ................................................................................................................................................................................. 7
USB INTERFACE .............................................................................................................................................................................................. 9
A. COMMUNICATION PARAMETERS ............................................................................................................................................................. 9
COMMUNICATION PROTOCOL ................................................................................................................................................................ 10
1. Command ........................................................................................................................................................................................ 10
a) Normal Command (Length < 255 bytes)................................................................................................................10
b) Extended Command (Length >= 255 bytes) ..........................................................................................................11
2. Response.......................................................................................................................................................................................... 11
a) No transmission error with normal response (Length < 255 bytes)........................................................................11
b) No transmission error with extended response (Length >= 255 bytes) ..................................................................11
c) Transmission error .................................................................................................................................................12
3. Reset Message ................................................................................................................................................................................. 12
4. Card Status Message....................................................................................................................................................................... 12
B. TRANSMISSION PROTOCOL .................................................................................................................................................................... 13
COMMANDS .................................................................................................................................................................................................... 14
A. CONTROL COMMANDS .......................................................................................................................................................................... 14
1. GET_ACR_STAT ............................................................................................................................................................................. 14
2. SET_PROTOCOL............................................................................................................................................................................ 14
3. SELECT_CARD_TYPE ................................................................................................................................................................... 15
4. RESET ............................................................................................................................................................................................. 15
5. SET_NOTIFICATION ..................................................................................................................................................................... 16
B. CARD COMMANDS ................................................................................................................................................................................ 17
1. '104' - type non-reloadable Token Counter Cards.......................................................................................................................... 17
a) RESET ...................................................................................................................................................................17
b) POWER_OFF ........................................................................................................................................................17
c) READ_DATA........................................................................................................................................................17
d) WRITE_DATA ......................................................................................................................................................18
e) ERASE_DATA (ST1335)......................................................................................................................................18
f) PRESENT_TRANSPORT_CODE ........................................................................................................................18
g) AUTHENTICATE_CARD (SLE4436)..................................................................................................................19
h) AUTHENTICATE_CARD (ST1335) ....................................................................................................................19
i) AUTHENTICATE_CARD (SLE5536)..................................................................................................................20
2. I2C-Bus cards (standard and extended addressing) ....................................................................................................................... 21
a) RESET ...................................................................................................................................................................21
b) POWER_OFF ........................................................................................................................................................21
c) SET_OPTIONS......................................................................................................................................................21
d) READ_DATA........................................................................................................................................................21
e) WRITE_DATA ......................................................................................................................................................22
f) READ_P&HE (AM64KP and compatible)............................................................................................................22
g) SET_PROTECTION (AM64KP and compatible) .................................................................................................22
h) SET_HE (AM64KP and compatible).....................................................................................................................23
3. '416'/'896' - type intelligent EEPROMs with Security and PIN ...................................................................................................... 24
a) RESET ...................................................................................................................................................................24
b) POWER_OFF ........................................................................................................................................................24

Copyright  1996-1999 1
 Cybermouse Reference Manual
c) READ_DATA........................................................................................................................................................24
d) WRITE_DATA ......................................................................................................................................................24
e) ERASE_DATA ......................................................................................................................................................25
f) PRESENT_CODE .................................................................................................................................................25
g) SET_FUSE.............................................................................................................................................................26
h) BLOW_FUSE ........................................................................................................................................................26
4. Siemens SLE 4432/4442 intelligent 256 Byte Memory Card .......................................................................................................... 27
a) RESET ...................................................................................................................................................................27
b) POWER_OFF ........................................................................................................................................................27
c) READ_DATA........................................................................................................................................................27
d) WRITE_DATA ......................................................................................................................................................28
e) WRITE_PROTECTION ........................................................................................................................................28
f) PRESENT_CODE (only SLE 4442).....................................................................................................................28
g) READ PRESENTATION ERROR COUNTER (only SLE 4442)........................................................................29
h) CHANGE_CODE (only SLE 4442)......................................................................................................................29
5. Siemens SLE 4418/4428 intelligent 1K Byte Memory Card............................................................................................................ 30
a) RESET ...................................................................................................................................................................30
b) POWER_OFF ........................................................................................................................................................30
c) READ_DATA........................................................................................................................................................30
d) WRITE_DATA ......................................................................................................................................................31
e) WRITE_PROTECTION ........................................................................................................................................31
f) PRESENT_CODE (only SLE 4428).....................................................................................................................31
g) READ PRESENTATION ERROR COUNTER (only SLE 4428)........................................................................32
6. '93CS06/46' type EEPROMs with MICROWIRE interface ............................................................................................................ 33
a) RESET ...................................................................................................................................................................33
b) POWER_OFF ........................................................................................................................................................33
c) READ_DATA........................................................................................................................................................33
d) WRITE_DATA ......................................................................................................................................................33
e) WRITE_ALL .........................................................................................................................................................34
f) READ_PROT ........................................................................................................................................................34
g) SET_PROTECTION..............................................................................................................................................34
h) CLEAR_PROTECTION........................................................................................................................................35
i) DISABLE_PROTECTION ....................................................................................................................................35
7. ST1333 - type EEPROM WITH T2G PROTOCOL.......................................................................................................................... 36
a) RESET ...................................................................................................................................................................36
b) POWER_OFF ........................................................................................................................................................36
c) READ_DATA........................................................................................................................................................36
d) WRITE_DATA ......................................................................................................................................................36
e) ERASE_DATA ......................................................................................................................................................37
f) PRESENT_TRANSPORT_CODE ........................................................................................................................37
g) AUTHENTICATE_CARD ....................................................................................................................................38
8. X76F041 Card (Xicor) .................................................................................................................................................................... 39
a) RESET ...................................................................................................................................................................39
b) POWER_OFF ........................................................................................................................................................39
c) READ_DATA........................................................................................................................................................39
d) READ_DATA_WITH_PASSWORD ....................................................................................................................39
e) CONFIG_READ ....................................................................................................................................................40
f) WRITE_DATA ......................................................................................................................................................40
g) WRITE_DATA_WITH_PASSWORD ..................................................................................................................41
h) CONFIG_WRITE ..................................................................................................................................................41
i) CARD_ADMIN .....................................................................................................................................................41
9. X76F128/640 Card (Xicor) ............................................................................................................................................................. 44
a) RESET ...................................................................................................................................................................44
b) POWER_OFF ........................................................................................................................................................44
c) READ_DATA_WITH_PASSWORD ....................................................................................................................44
d) WRITE_DATA_WITH_PASSWORD ..................................................................................................................45
e) RESET_PASSWORD............................................................................................................................................45
f) RESET_DEVICE...................................................................................................................................................45
g) CHANGE_PASSWORD .......................................................................................................................................45
10. X76F100 Card (Xicor) ............................................................................................................................................................... 47
a) RESET ...................................................................................................................................................................47
b) POWER_OFF ........................................................................................................................................................47
c) READ_DATA_WITH_PASSWORD ....................................................................................................................47
d) WRITE_SECTOR_DATA_WITH_PASSWORD .................................................................................................47
e) CHANGE_ PASSWORD ......................................................................................................................................48
11. MCU-based Card ....................................................................................................................................................................... 49
a) RESET (3V or 5V) ................................................................................................................................................49
b) POWER_OFF ........................................................................................................................................................49
c) EXCHANGE_APDU.............................................................................................................................................49
d) EXCHANGE_T1_FRAME....................................................................................................................................50
12. Security Application Module (SAM) .......................................................................................................................................... 51
a) ACTIVATE_SAM .................................................................................................................................................51

Copyright  1996-1999 2
 Cybermouse Reference Manual
b) DEACTIVATE_SAM............................................................................................................................................51
c) EXCHANGE_SAM_APDU ..................................................................................................................................51
APPENDIX A: SUPPORTED CARD TYPES ............................................................................................................................................... 53

APPENDIX B: RESPONSE STATUS CODES ............................................................................................................................................. 54

APPENDIX C: CYBERMOUSE FIRMWARE REVISION INDEX........................................................................................................... 55

APPENDIX D: TECHNICAL SPECIFICATIONS....................................................................................................................................... 56

Copyright  1996-1999 3
 Cybermouse Reference Manual

INTRODUCTION
The Smart Card Reader/Writer CyberMouse is an interface for the communication between a computer (for example, a PC) and a smart card.
Different types of smart cards have different commands and different communication protocols. This prevents in most cases the direct
communication between a smart card and a computer. The CyberMouse Reader/Writer establishes a uniform interface from the computer to the
smart card for a wide variety of cards. By taking care of the card specific particulars, it releases the computer software programmer of getting
involved with the technical details of the smart card operation, which are in many cases not relevant for the implementation of a smart card
system.
The CyberMouse Smart Card Reader/Writer is connected to the computer through a serial asynchronous interface (RS-232) or USB interface.
The reader accepts commands from the computer, carries out the specified function at the smart card and returns the requested data or status
information.

NOTE - Although the CyberMouse is a true card reader/writer as it can read and write smart cards, the terms card reader or reader will be
used indifferently to refer to the CyberMouse, for the sake of readability and because these designations are commonly in use for this kind of
devices.

FEATURES
• ISO7816-1/2/3 compatible smart card interface
• Supports most common memory-based smart cards (2-wire bus, 3-wire bus)
• Supports CPU-based cards with T=0 and/or T=1 protocol
• Three CLK frequencies for microcontroller-based cards: 3.68MHz, 1.84MHz and 0.92MHz
• Automatic CLK frequency selection and PTS (protocol type selection) procedure
• Smart card interface short circuit protected
• RS-232 interface to PC with simple command structure
• Selectable baud rate of serial interface to PC, max. 115.2 kBit/s
• Installation of up to three security application modules (SAM) inside the reader
• Convenient stand available as accessory

Copyright  1996-1999 4
 Cybermouse Reference Manual

SUPPORTED CARD TYPES

The CyberMouse can operate a wide range of card types or card IC types. The table presented in Appendix A explains which card type selection
value must be specified for the various card types supported by the reader.

A. Memory-based smart cards (synchronous interface)

• '104' type EEPROM non-reloadable token counter cards, including:
AM104, AM221
Atmel AT88SC06
Gemplus GPM103
SGS-Thomson ST 1305 (192 bits), ST 1335 (272 bits)
Siemens SLE 4406, SLE 4436 (221 bits), SLE5536
• Cards following the I2C bus protocol (free memory cards) with memory capacity up to 16 Kbit and minimum 4 bytes page write
capability, including:
AM1KF, AM2KF, AM4KF, AM8KF
Atmel AT24C01/02/04/08/16
Gemplus GFM2K, GFM4K
SGS-Thomson ST14C02C,14C04C

• Cards following the extended I2C bus (XIIC) addressing protocol with memory capacity up to 64 Kbytes and minimum 4 bytes page write
capability, including, in particular:
AM64KP
Microchip 24C65
• '416'/'896' type intelligent EEPROMs with security and PIN, including:
AM416
Atmel AT88SC101/2/3, AT88SC1601/1604
Gemplus GPM416, GPM896
Siemens SLE 4404
• Siemens SLE4432/4442 intelligent 256 bytes EEPROM with write protect function:
AM2KP, AM2KS
SLE 4432, SLE 4442
• Siemens SLE 4418/4428 intelligent 1K bytes EEPROM with write-protect function:
AM8KP, AM8KS
SLE 4418, SLE 4428
• EEPROMs with MICROWIRE interface, including:
AM256
NM93CS06/CS46
• Cards following the T2G protocol:
SGS-Thomson ST1333
• XICOR card type, including:
X76F041, X76F128/640, X76F100

B. Microcontroller-based smart cards (asynchronous interface)

The CyberMouse supports EEPROM microcontroller-based cards with internal programming voltage (VPP) generation and the following
programming parameters transmitted in the ATR:
PI1 = 0 or 5
I = 25 or 50
The following communication protocol modes are supported:

T F D N
0 / 1 372 1 0...255
0 / 1 558 1 0...255
0 / 1 558 0.5 0...255
0 / 1 558 0.25 0...255
0 / 1 744 1 0...255
0 / 1 744 2 0...255
0 / 1 744 0.5 0...255
0 / 1 744 0.25 0...255
0 / 1 744 0.125 0...255
0 / 1 1116 1 0...255
0 / 1 1116 2 0...255
0 / 1 1116 0.5 0...255
0 / 1 1116 0.25 0...255
0 / 1 1488 1 0...255
0 / 1 1488 2 0...255
0 / 1 1488 4 0...255
0 / 1 1488 0.5 0...255
0 / 1 1488 0.25 0...255

Copyright  1996-1999 5
 Cybermouse Reference Manual
0 / 1 1860 1 0...255
0 / 1 1860 2 0...255
0 / 1 1860 4 0...255
0 / 1 1860 0.5 0...255
0 / 1 1860 0.25 0...255
0 / 1 512 1 0...255
0 / 1 512 0.5 0...255
0 / 1 512 0.25 0...255
0 / 1 768 1 0...255
0 / 1 768 2 0...255
0 / 1 768 0.5 0...255
0 / 1 768 0.25 0...255
0 / 1 1024 1 0...255
0 / 1 1024 2 0...255
0 / 1 1024 0.5 0...255
0 / 1 1536 1 0...255
0 / 1 1536 2 0...255
0 / 1 1536 4 0...255
0 / 1 1536 0.5 0...255
0 / 1 2048 1 0...255
0 / 1 2048 2 0...255
0 / 1 2048 4 0...255

The CyberMouse performs the Protocol Type Selection (PTS) procedure as specified in ISO7816-3:1989/Amd.2: 1994.
When the card ATR indicates the specific operation mode (TA2 present; bit b5 of TA2 must be 0) and that particular mode is not supported by
the CyberMouse, the reader will reset the card to set it to negotiable mode. If the card cannot be set to negotiable mode, the reader will reject the
card.
When the card ATR indicates the negotiable mode (TA2 not present) and communication parameters other than the default parameters, the
CyberMouse will execute the PTS and try to use the communication parameters that allow operating the card at the highest CLK frequency
(3.6864MHz), or allow at the highest communication speed (shortest etu), in this priority. If the card does not accept the PTS, the reader will use
the default parameters (F=372, D=1).
For the meaning of the aforementioned parameters, please refer to ISO7816, part 3.

SMART CARD INTERFACE

The interface between the CyberMouse and the inserted smart card follows the specifications of ISO7816-3 with certain restrictions or
enhancements to increase the practical functionality of the CyberMouse.

A. Smart Card Power Supply VCC (C1)

The current consumption of the inserted card must not be higher than 30mA.

B. Programming Voltage VPP (C6)

According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the smart card. Since all common smart cards
in the market are EEPROM based and do not require the provision of an external programming voltage, the contact C6 (VPP) has been
implemented as a normal control signal in the CyberMouse and is used only with memory-based smart cards. The electrical specifications of
this contact are identical to those of the signal RST (at contact C2).

C. Card Type Selection

The controlling PC has to always select the card type through the proper command sent to the CyberMouse prior to activating the inserted card.
This includes both the memory cards and MCU-based cards.
For MCU-based cards the reader allows to select the preferred protocol, T=0 or T=1. However, this selection is only accepted and carried out by
the reader through the PTS when the card inserted in the reader supports both protocol types. Whenever an MCU-based card supports only one
protocol type, T=0 or T=1, the reader automatically uses that protocol type, regardless of the protocol type selected by the application.

D. Interface for Memory-based Cards

The electrical interface for memory-based smart cards uses all eight smart card contacts (C1 to C8), even though ISO 7816-3 defines only the
functions of six contacts (C1, C2, C3, C5, C6 and C7). This allows the CyberMouse to perform all functions offered by memory cards which
use the contacts C4 and/or C8 for control purposes.

E. Interface for Microcontroller-based Cards

For microcontroller-based smart cards only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND) and C7 (I/O) are used. A frequency of 3.68
MHz, 1.84 MHz or 0.92 MHz is applied to the CLK signal (C3), depending on the parameters indicated by the card in the ATR and the outcome
of the PTS.

Copyright  1996-1999 6
 Cybermouse Reference Manual

F. Card Tearing Protection

The CyberMouse provides a mechanism to protect the inserted card when it is suddenly withdrawn while it is powered up. The power supply to
the card and the signal lines between the CyberMouse and the card are immediately deactivated when the card is being removed. As a general
rule, however, to avoid any electrical damage, a card should only be removed from the reader while it is powered down.
NOTE - The CyberMouse does never by itself switch on the power supply to the inserted card. This must explicitly be done by the controlling
computer through the proper command sent to the reader.

G. Short Circuit Protection

The smart card interface signal lines of the CyberMouse are designed to endure a permanent short circuit between any two or more of the
contacts in the smart card connector without causing any damage to the reader. A short circuit between the smart card pins VCC (C1) and GND
(C5) is detected by the CyberMouse when the inserted card is powered up and effects the immediate deactivation of the smart card interface. A
corresponding status code is transmitted by the CyberMouse to the host computer.

POWER SUPPLY
The CyberMouse requires a voltage of 5V DC, 200mA, regulated, power supply. The CyberMouse gets the power supply from PC (through the
cable supplied along with each type of reader).

A. Status LEDs
Two LEDs on the front of the reader indicate the presence of the power supply to the reader and the activation status of the smart card interface:
Red LED Indicates 5V power supply to the reader is present.
After a reset of the reader (by removing/applying the power supply, or through the RS-232/USB interface), the red LED
flashes three times.
Green LED Indicates power supply to the smart card is switched on, i.e., the smart card is activated.

SERIAL INTERFACE
The CyberMouse is connected to a computer through a serial asynchronous interface following the RS-232 standard.

A. Communication Parameters

The following communication parameters are used by the CyberMouse and cannot be modified by the host computer:
Transmission protocol : serial asynchronous
Parity : none
Data Bits : 8
Stop Bits : 1
Handshake : through CTS

The CyberMouse provides two means to select the transmission speed (baud rate) used by the reader in the normal operation, by hardware
and/or by software.

1. Hardware Baud Rate

The default hardware baud rate setting is 9600 bps.

2. Software Baud Rate Selection

The SET_PROTOCOL command allows setting the transmission speed (baud rate) and a delay time inserted between the bytes transmitted by
the reader to the PC.
Please note that the setting made with this command is volatile and will be lost when the reader is being reset or powered up next time.

B. Interface Wiring
For the communication between the CyberMouse and a computer, five lines of the RS-232 interface are used: RxD, TxD, CTS, DTR and GND.

Copyright  1996-1999 7
 Cybermouse Reference Manual

RS-232 Interface Wiring

Pin PC Cyber- Function

mouse

2 RxD TxD Data transmitted from PC to CyberMouse.

3 TxD RxD Data transmitted from CyberMouse to PC.
4 DTR RESET RESET input signal. Allows performing a hardware reset of the
reader module through the RS-232 interface.
Applying a logic '1' signal (negative voltage according to the
RS-232 convention) to this pin causes a hardware reset of the
CyberMouse.
5 GND GND Reference voltage level for power supply and serial interface.
7 CTS BUSY CTS (Clear To Send) signal to the PC. Indicates to the PC
whether the CyberMouse is ready to receive the next command.
A logic '0' signal (positive voltage according to the RS-232
convention) is applied to this pin while the CyberMouse is
executing a command. Only when a '1' signal is present at this
pin can the PC send a command to the CyberMouse.

NOTE - Communication problems between the CyberMouse and a PC can occur if a 25 pin to 9 pin RS-232 adapter or a cable is used in
which not all 9 signal lines are connected. Adapters supplied with computer mouse frequently have not all lines connected. For the correct
operation of the reader, use only a 9 pin to 25 pin adapter and a serial interface cable in which all 9 signal lines are connected!

NOTE - To prevent any radio interference between the CyberMouse and other electrical and electronic equipment, do not use an RS-232
cable longer than 3 meters!

Copyright  1996-1999 8
 Cybermouse Reference Manual

USB INTERFACE
The CyberMouse is connected to a computer through a USB following the USB standard.

A. Communication Parameters

The CyberMouse is connected to a computer through USB as specified in the USB Specification 1.0. The CyberMouse is working in low speed
mode, i.e. 1.5 Mbps.
USB Interface Wiring

Pin Signal Function

1 VBUS +5V power supply for the reader

2 D- Differential signal transmits data between CyberMouse and PC.
3 D+ Differential signal transmits data between CyberMouse and PC.
4 GND Reference voltage level for power supply

NOTE - In order for the CyberMouse functioning properly through USB interface, CyberMouse proprietary device drive has to be installed.
Please refer to the Device Driver Installation Guide for more detail. You can download the newest driver from www.cybermouse.de

Copyright  1996-1999 9
 Cybermouse Reference Manual

COMMUNICATION PROTOCOL
In the normal operation, the CyberMouse acts as a slave device with regard to the communication between a computer and the reader. The
communication is carried out in the form of successive command-response exchanges. The computer transmits a command to the reader and
receives a response from the reader after the command has been executed. A new command can be transmitted to the CyberMouse only after the
response to the previous command has been received.
There are two cases where the reader transmits data without having received a command from the computer, namely, the Reset Message of the
reader and the Card Status Message.

1. Command

a) Normal Command (Length < 255 bytes)

A command consists of four protocol bytes and a variable number of data bytes and has the following structure:
byte 1 2 3 4 ... N+3 N+4
(0<N<255)
Header Instruction Data length = N Data Checksum

Header Always 01H to indicate the start of a command.

Instruction The instruction code of the command to be carried out by the CyberMouse
Data Length Number of subsequent data bytes.(0 < N < 255)
Data Data contents of the command.
For a READ command, for example, the data bytes would specify the start address and the number of bytes to be read.
For a WRITE command, the data bytes would specify the start address and the data to be written to the card.
The data bytes can represent values to be written to a card and/or command parameters such as an address, a counter, etc.
Checksum The checksum is computed by XORing all command bytes including header, instruction, data length and all data bytes.
The following example shows the structure of a command with instruction code = 91H and three data bytes with the values 11H, 22H and 33H,
respectively:
byte 1 2 3 4 5 6 7
01 H 91 H 03 H 11 H 22 H 33 H 93 H

Copyright  1996-1999 10
 Cybermouse Reference Manual

b) Extended Command (Length >= 255 bytes)

A command consists of six protocol bytes and a variable number of data bytes and has the following structure:
byte 1 2 3 4 5 6 ... N+5 N+6
(N>0)
Header Instruction Data Length = N Data Checksum

FFH Data Length N

Header Always 01H to indicate the start of a command.

Instruction The instruction code of the command to be carried out by the CyberMouse.
Data Length Number of subsequent data bytes, and is encoded in 3 bytes. The first byte is FFH. The second byte and the third byte
represent data length N.
Data Data contents of the command.
For a READ command, for example, the data bytes would specify the start address and the number of bytes to be read.
For a WRITE command, the data bytes would specify the start address and the data to be written to the card.
The data bytes can represent values to be written to a card and/or command parameters such as an address, a counter, etc.
Checksum The checksum is computed by XORing all command bytes including header, instruction, data length and all data bytes.

2. Response
The response from the CyberMouse to any command depends on whether the command has been received by the reader without error (e.g.,
checksum error).

a) No transmission error with normal response (Length < 255 bytes)

The response by the CyberMouse to a correctly received command consists of three protocol bytes, two status bytes and a variable number of
data bytes and has the following structure:
byte 1 2 3 4 5 ... N+4 N+5
(0<N<255)
Header SW1 SW2 Data length = N Data Checksum

Header Always 01H to indicate the start of the response.

SW1 Indicates the command execution status:
90 H = command successfully executed
60 H = error in command data; command cannot be executed
67 H = error detected in command execution
FFH = status message initiated by the reader
SW2 Further qualification of the command execution status.
A table listing the possible values of the status bytes SW1 and SW2 and the corresponding meaning is given in
Appendix B.
Data Length Number of subsequent data bytes (0 < N < 255)
Data Data contents of the command.
For a READ_DATA command, for example, the data bytes would contain the contents of the memory addresses read from
the card. The data bytes can represent values read from the card and/or status information.
Checksum The checksum is computed by XORing all response bytes including header, status bytes, data length and all data bytes.
The following example shows the structure of the response to a command which has successfully been executed and which returns three data
bytes with the values 11H, 22H and 33H, respectively:
byte 1 2 3 4 5 6 7 8
01 H 90 H 00 H 03 H 11 H 22 H 33 H 92 H

b) No transmission error with extended response (Length >= 255 bytes)

The response by the CyberMouse to a correctly received command consists of three protocol bytes, two status bytes and a variable number of
data bytes and has the following structure:
byte 1 2 3 4 5 6 7 ... N+6 N+7
(N>0)
Header SW1 SW2 Data length = N Data Checksum

FFH Data Length N

Header Always 01H to indicate the start of the response.

SW1 Indicates the command execution status:

Copyright  1996-1999 11
 Cybermouse Reference Manual
90 H = command successfully executed
60 H = error in command data; command cannot be executed
67 H = error detected in command execution
FFH = status message initiated by the reader
SW2 Further qualification of the command execution status.
A table listing the possible values of the status bytes SW1 and SW2 and the corresponding meaning is given in
Appendix B.
Data Length Number of subsequent data bytes, and is encoded in 3 bytes. The first byte is FFH. The second byte and the third byte
represent data length N.
Data Data contents of the command.
For a READ_DATA command, for example, the data bytes would contain the contents of the memory addresses read from
the card. The data bytes can represent values read from the card and/or status information.
Checksum The checksum is computed by XORing all response bytes including header, status bytes, data length and all data bytes.

c) Transmission error
If the receiving party of a command (i.e., the CyberMouse) or a response (i.e., the computer) detects an error in the data length or the checksum
of a command, it disregards the received data and sends a "NOT ACKNOWLEDGE" message to the transmitting party upon completion of the
faulty transmission. The "NOT ACKNOWLEDGE" message consists of two bytes:
byte 1 2
05H 05 H

If the CyberMouse responds with a 'NOT ACKNOWLEDGE' message to a command from the computer, the computer would normally transmit
the command again.
If the computer detects a transmission error in a response from the CyberMouse, it can send the 'NOT ACKNOWLEDGE' to the reader upon
which the reader will transmit the most recent response again.

3. Reset Message
A reset of the reader occurs automatically whenever the reader is being powered up. A reset can also be actuated through the RS-232/USB
interface.
In either case the reader transmits one time a Reset Message, which has the same structure as the normal response to a command and the
following contents:

byte 1 2 3 4 5 6
Header SW1 SW2 Data length Data Checksum

01 H FF H 00 H 01 H BAUD=12 H

BAUD Indicates the hardware baud rate setting (default baud rate), which is set to 9600 bps (this is only valid in the RS232 reader).
The reader does not expect an acknowledge signal from the computer. After transmitting the Reset Message the reader is waiting for the first
command from the computer.

4. Card Status Message

When a card is being inserted into the reader or an inserted card is being removed from the reader while the reader is idle, i.e., not executing a
command, the reader transmits a Card Status Message to notify the host computer of the change in the card insertion status.
In a system where these unsolicited messages from the reader to the computer are not desired, they can be disabled with the
SET_NOTIFICATION command. Please note that the setting made with this command is volatile and will be lost with the next reader reset or
power up. By default, the Card Status Message will be transmitted by the reader after a reset.
The Card Status Messages have the following structure and contents:

Copyright  1996-1999 12
 Cybermouse Reference Manual
Card Status Message for Card Insertion

byte 1 2 3 4 5
Header SW1 SW2 Data length Checksum

01 H FF H 01 H 00 H FF H

Card Status Message for Card Removal

byte 1 2 3 4 5
Header SW1 SW2 Data length Checksum

01 H FF H 02 H 00 H FC H

A card status message is transmitted only once for every card insertion or removal event. The reader does not expect an acknowledge signal
from the computer. After transmitting a status message, the reader waits for the next command from the computer.
NOTE - If the card is being removed from the reader while a card command is being executed, the reader will transmit a normal response to
the computer with the response status bytes indicating the card removal during command execution (see Appendix B: Response Status Codes).

B. Transmission Protocol
The start of a command (to the reader) or a response (from the reader, including the Reset Message and Card Status Messages) is indicated by
the respective party through the transmission of the single byte Start-of-Text (STX) character with the value 02H.
The end of a command or response is indicated through the single byte End-of-Text (ETX) character with the value 03H.
Within the command and response transmission only ASCII characters representing the hexadecimal (hex) digits 0...F are used. Each byte of a
command or response is splitted into its upper and lower halfbyte (nibble). For each halfbyte is transmitted the ASCII character representing the
respective hex digit value. For example, to transmit the data byte 3AH, two bytes are actually sent on the interface, namely, 33H (ASCII code for
'3') followed by 41H (ASCII code for 'A'):

Data byte value 3AH

Transmitted values 33 H = '3' 41H = 'A'

The following example shows the transmission of a command with instruction code A2H and one data byte with the value 3DH. The command
has the following structure:
byte 1 2 3 4 5
Header Instruction Data length Data Checksum

01H A2H 01H 3DH 9FH

This command is transmitted on the serial interface in 12 bytes as follows:

byte 1 2 3 4 5 6 7 8 9 10 11 12
STX '0' '1' 'A' '2' '0' '1' '3' 'D' '9' 'F' ETX

02H 30H 31H 41H 32H 30H 31H 33H 44H 39H 46H 03H

For the representation of the hex halfbyte values as the corresponding ASCII characters in commands, the CyberMouse accepts both upper case
characters 'A' ... 'F' (41H ... 46H) and lower case characters 'a' ... 'f' (61H ... 66H):

byte 1 2 3 4 5 6 7 8 9 10 11 12
STX '0' '1' 'A' '2' '0' '1' '3' 'D' '9' 'F' ETX

02H 30H 31H 41H 32H 30H 31H 33H 44H 39H 46H 03H

... is equivalent to:

byte 1 2 3 4 5 6 7 8 9 10 11 12
STX '0' '1' 'a' '2' '0' '1' '3' 'd' '9' 'f' ETX

02H 30H 31H 61H 32H 30H 31H 33H 64H 39H 66H 03H

In its response messages, the CyberMouse uses upper case characters 'A' ... 'F'.

Copyright  1996-1999 13
 Cybermouse Reference Manual

COMMANDS
The commands executed by the CyberMouse can generally be divided into two categories, namely, Control Commands and Card Commands.
Control Commands control the internal operation of the CyberMouse. They do not directly affect the card inserted in the reader and are
therefore independent of the selected card type.
Card Commands are directed toward the card inserted in the CyberMouse. The structure of these commands and the data transmitted in the
commands and responses depend on the selected card type.

A. Control Commands

1. GET_ACR_STAT
This command returns relevant information about the particular CyberMouse model and the current operating status, such as, the firmware
revision number, the maximum data length of a command and response, the supported card types, and whether a card is inserted and powered
up.

Command format

Instruction Data length

Code

01 H 00 H

Response data format

REV MAX_C MAX_R C_TYPE C_SEL C_STAT

REV 10 bytes CyberMouse firmware type and revision code. The following data are transmitted:
AC-SETxxxx

'xxxx' represents the firmware revision code, for example, '0109'.

MAX_C The maximum number of command data bytes.
MAX_R The maximum number of data bytes that can be requested to be transmitted in a response.
C_TYPE The card types supported by the CyberMouse. This data field is a bitmap with each bit representing a particular card type. A
bit set to '1' means the corresponding card type is supported by the reader and can be selected with the SELECT_CARD_TYPE
command. The bit assignment is as follows:

byte 1 2

card type 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

See Appendix A for the correspondence between these bits and the respective card types.
C_SEL The currently selected card type as specified in a previous SELECT_CARD_TYPE command. A value of 00H means that no
card type has been selected.
C_STAT Indicates whether a card is physically inserted in the reader and whether the card is powered up:
00H : no card inserted
01H : card inserted, not powered up
03H : card powered up

2. SET_PROTOCOL
This command is used to control the line speed of the communication channel between CyberMouse reader and host device. The line speed of
the communication is controlled by two factors, namely, the Delay Factor and the Baud Rate.

Command format

Instruction Data length Data

Code
DELAY N

03 H 01 H

to change only the Delay Factor (for RS232 reader only), or

Copyright  1996-1999 14
 Cybermouse Reference Manual
Instruction Data length Data
Code
DELAY N BAUD RATE

03 H 02 H

to change the Delay Factor and the Baud Rate (for RS232 reader only).

DELAY Determines the time delay inserted by the CyberMouse between two consecutive bytes sent in order to adapt to slower host
system speeds. The time delay is given by N * 0.1msec, with N ranging from 0 ... 255 (00 - FFH). The default value is N = 0
(delay changes only valid on RS232 reader).
BAUD RATE Selects the baud rate (bps) of the serial interface between reader and host system. The default hardware baud rate is 9600 bps.
(baud rate changes only valid on RS232 reader).

BAUD RATE Serial baud rate (bps)

12H 9600
11H 19200
10H 38400
03H 14400
02H 28800
01H 57600
00H 115200

Response data format

No response data

The new protocol becomes effective by the completion of the SET_PROTOCOL command, immediately after the CyberMouse has sent out
the response string to the SET_PROTOCOL command.

3. SELECT_CARD_TYPE
This command sets the required card type. The firmware in the CyberMouse adjusts the communication protocol between reader and the
inserted card according to the selected card type.

Command format

Instruction Data length Data

Code
TYPE

02 H 01 H

TYPE See Appendix A for the value to be specified in this command for a particular card to be used.

Response data format

No response data

4. RESET
This section describes the RESET command only for the case when no card type is selected or when the card type 00H is selected. For all other
cases, please refer to the specific section described for each individual card type.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

ATR

ATR The answer-to-reset string returned by the card.

Copyright  1996-1999 15
 Cybermouse Reference Manual

The return status code for this command is 90 00H when the inserted card is a T=0 card, 90 01H when the inserted card is a T=1 card, and 90 10
H when the inserted card is a memory card; otherwise the status code is 60 20H.

5. SET_NOTIFICATION
This command disables / enables the Card Status Messages transmitted by the reader to notify the host computer of the insertion or removal of a
card.

Command format

Instruction Data length Data

Code
NOTIFY

06 H 01 H

NOTIFY Specifies whether the Card Status Message shall be transmitted to notify the host computer of card insertion / removal
01H : transmit Card Status Message
02H : do not transmit Card Status Message

Response data format

No response data

Copyright  1996-1999 16
 Cybermouse Reference Manual

B. Card Commands
The available commands and the parameters specified in the card commands as well as the data transmitted in the response from the
CyberMouse depend on the selected card type.

1. '104' - type non-reloadable Token Counter Cards

a) RESET
This command powers up the card inserted in the card reader and performs a card reset.
If the card is powered up when the command is being issued, only a reset of the card is carried out; the power supply to the card is not switched
off.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

ATR

ATR Four bytes Answer-To-Reset read from the card.

The ATR bytes are read from the card with LSB first, i.e., the first bit read from the card is the LSB of the first ATR byte.

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) READ_DATA
To read the specified number of bytes from the specified address of the inserted card. The bytes are read from the card with LSB first, i.e., the
bit at card address 0 is regarded as the LSB of byte 0.

Command format

Instruction Data length Data

Code
ADDR LEN

90 H 03 H 00 H

ADDR Byte address of first byte to be read from the card

LEN Number N of data bytes to be read from the card
(0 < N ≤ MAX_R)

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

Copyright  1996-1999 17
 Cybermouse Reference Manual
d) WRITE_DATA
To write one byte to the specified address of the inserted card. The byte is written to the card with LSB first, i.e., the bit at card address 0 is
regarded as the LSB of byte 0.
Two different WRITE modes are available for this card type, which are distinguished by a flag in the command data field:
a) Write
The byte value specified in the command is written to the specified address. This command can be used for writing personalization
data and counter values to the card.
b) Write with carry
The byte value specified in the command is written to the specified address and the command is sent to the card to erase the next
lower counter stage. This write mode can therefore only be used for updating the counter value in the card.
With either write mode, the byte at the specified card address is not erased prior to the write operation and, hence, memory bits can only be
programmed from '1' to '0'.
The backup mode available in the SLE4436 card can be enabled or disabled in the write operation.

Command format

Instruction Data length Data

Code
ADDR MODE BYTE

91 H 04 H 00 H

ADDR Byte address of byte to be written

MODE Specifies the write mode and backup option (SLE4436)
00H : write
01H : write with carry
02H : write with backup enabled
03H : write with carry and with backup enabled
BYTE Byte value to be written to the card

Response data format

No response data

e) ERASE_DATA (ST1335)
To erase the specified number of bytes starting at the specified address, i.e., set all bits to '1'.

Command format

Instruction Data length Data

Code
ADDR LEN

95 H 03 H

ADDR Byte address in the card of the first byte to be erased

LEN Number of bytes to be erased in the card

Response data format

No response data

f) PRESENT_TRANSPORT_CODE
To submit the transport code to the card in order to enable the card personalization mode. The following actions are executed by the
CyberMouse:
- search a '1' bit in the presentation counter and write the bit to '0'
- present the specified code to the card
The CyberMouse does not try to erase the presentation counter after the code submission! This must be done by the application software through
a separate 'Write with carry' command.

Copyright  1996-1999 18
 Cybermouse Reference Manual
Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 BYTE 2 ... ... BYTE N

92 H

LEN Number of transport code bytes, N, + 1

ADDR Byte address of the presentation counter in the card
BYTE x Transport code

Response data format

No response data

g) AUTHENTICATE_CARD (SLE4436)
To read a card authentication certificate from a SLE4436 card. The following actions are executed by the CyberMouse:
- select Key 1 or Key 2 in the card as specified in the command
- present the challenge data specified in the command to the card
- generate the specified number of CLK pulses for each bit of authentication data computed by the card
- read 16 bits of authentication data from the card
- reset the card to normal operation mode
The CyberMouse returns the 16 bits of authentication data calculated by the card in the response.

Command format

Instruction Data length Data

Code
KEY CLK_CNT BYTE 1 ... ... BYTE 6

96 H 08 H

KEY Key to be used for the computation of the authentication certificate:

00H : key 1
01H : key 2
CLK_CNT Number of CLK pulses to be supplied to the card for the computation of each bit of the authentication certificate.
BYTE 1...6 Card challenge data

Response data format

CERT

CERT 16 bits of authentication data computed by the card. The LSB of BYTE 1 is the first authentication bit read from the card.

h) AUTHENTICATE_CARD (ST1335)
To read a card authentication certificate from a ST1335 card. The following actions are executed by the CyberMouse:
- present the challenge data specified in the command to the card
- generate the required number of READ and PROG pulses for the computation of signature by the card
- read 4 bits of authentication data from the card
- reset the card to normal operation mode
The CyberMouse returns the 4 bits of authentication data calculated by the card in the response.

Command format

Instruction Data length Data

Code
BYTE 1 BYTE 2 BYTE 3 BYTE 4...

96 H 04 H

BYTE 1...4 Card challenge data

Copyright  1996-1999 19
 Cybermouse Reference Manual
Response data format

CERT

CERT Single byte response which holds 4 bits of authentication data computed by the card. The LSB of CERT is the first
authentication bit read from the card.

i) AUTHENTICATE_CARD (SLE5536)
To read a card authentication certificate from a SLE5536 card. The following actions are executed by the CyberMouse:
- select Key 1 or Key 2 in the card as specified in the command
- present the challenge data specified in the command to the card
- generate the specified number of CLK pulses for each bit of authentication data computed by the card
- read 16 bits of authentication data from the card
- reset the card to normal operation mode
The CyberMouse returns the 16 bits of authentication data calculated by the card in the response.

Command format

Instruction Data length Data

Code
KEY CLK_CNT BYTE 1 ... ... BYTE 6

96 H 08 H

KEY Key to be used for the computation of the authentication certificate:

00H : key 1 with no cipher block chaining
01H : key 2 with no cipher block chaining
80H : key 1 with cipher block chaining
81H : key 2 with cipher block chaining
CLK_CNT Number of CLK pulses to be supplied to the card for the computation of each bit of the authentication certificate.
BYTE 1...6 Card challenge data

Response data format

CERT

CERT 16 bits of authentication data computed by the card. The LSB of BYTE 1 is the first authentication bit read from the card.

Copyright  1996-1999 20
 Cybermouse Reference Manual

2. I²C-Bus cards (standard and extended addressing)

a) RESET
This command powers up the card inserted in the card reader. No action is taken if the card is powered up when the command is being issued.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

No response data

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) SET_OPTIONS
To set the memory page size for the Page Write mode and for the XIIC-bus cards, the chip select address bits transmitted in the XIIC-bus
control byte.
If this command is not sent to the CyberMouse, the default value for the memory page size is four (4) bytes and the default value for the XIIC-
bus chip select address bits is 000B.

Command format

Instruction Data length Data

Code
OPTION

84 H 01 H

OPTION Chip select address and memory page size

xxxxxPPPB : Page size : 000 = 4 bytes
001 = 8 bytes
010 = 16 bytes
011 = 32 bytes
100 = 64 bytes
101 = 64 bytes
110 = 64 bytes
111 = 64 bytes
xA2A1A0xxxxB : Chip select address bits (only XIIC-bus cards)

Response data format

No response data

d) READ_DATA
To read the specified number of bytes from the specified address of the inserted card.

Copyright  1996-1999 21
 Cybermouse Reference Manual
Command format

Instruction Data length Data

Code
ADDR LEN

90 H 03 H

ADDR Byte address of first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card
(0 < N ≤ MAX_R)

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

e) WRITE_DATA
To write the specified data bytes to the specified address of the inserted card.

Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 ... ... BYTE N

91 H

LEN Number of data bytes to be written to the card, N, + 2

ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.

Response data format

No response data

f) READ_P&HE (AM64KP and compatible)

To read the block write-protection status (registers PROT_START and PROT_CNT) and the block number of the High Endurance memory
block (register HE_BLOCK) from the AM64KP card.

Command format

Instruction Data length

Code

97 H 00 H

Response data format

START BLK_CNT HE_BLK

START Value of register PROT_START, i.e., the number of the first write-protected block
BLK_CNT Value of register PROT_CNT, i.e., the number of write-protected blocks starting from block # START
HE_BLK Value of register HE_BLOCK, i.e., the number of the High Endurance memory block

g) SET_PROTECTION (AM64KP and compatible)

To set the block write-protection in the card (registers PROT_START and PROT_CNT).

Copyright  1996-1999 22
 Cybermouse Reference Manual
Command format

Instruction Data length Data

Code
START BLK_CNT

94H 02H

START New value of register PROT_START, i.e., the number of the first block to be write-protected (0 ≤ START ≤ 15)
BLK_CNT New value of register PROT_CNT, i.e., the number of blocks to be write-protected starting from block # START (0 <
BLK_CNT ≤ 15)

Response data format

No response data

h) SET_HE (AM64KP and compatible)

To relocate the High Endurance memory block to the specified block address.

Command format

Instruction Data length Data

Code
HE_BLK

94H 01H

HE_BLK New value of register HE_BLOCK, i.e., the block number of the High Endurance memory block (0 ≤ HE_BLK ≤ 15)

Response data format

No response data

Copyright  1996-1999 23
 Cybermouse Reference Manual

3. '416'/'896' - type intelligent EEPROMs with Security and PIN

a) RESET
This command powers up the card inserted in the card reader and performs a card reset.
If the card is powered up when the command is being issued, only a reset of the card is carried out, the power supply to the card is not switched
off.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

ATR

ATR Four bytes Answer-To-Reset read from the card.

The ATR bytes are read from the card with LSB first, i.e., the first bit read from the card is the LSB of the first ATR byte.

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) READ_DATA
To read the specified number of bytes from the specified address of the inserted card. The bytes are read from the card with LSB first, i.e., the
bit at card address 0 is regarded as the LSB of byte 0.

Command format

Instruction Data length Data

Code
ADDR LEN

90 H 03 H

ADDR Byte address of first byte to be read from the card

LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

d) WRITE_DATA
To write the specified data bytes to the specified address of the inserted card. The bytes are written to the card with LSB first, i.e., the bit at
card address 0 is regarded as the LSB of byte 0.
The data contents at the specified addresses are not erased prior to the write operation and, hence, memory bits can only be programmed from '1'
to '0'.

Copyright  1996-1999 24
 Cybermouse Reference Manual
Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 ... ... BYTE N

91 H

LEN Number of data bytes to be written to the card, N, + 2

ADDR Byte address in the card of the first byte to be written
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.

Response data format

No response data

e) ERASE_DATA
To erase the specified number of bytes starting at the specified address, i.e., set all bits to '1'.
NOTE - The memory of the 416/896 type cards is organized in words (16 bits) and only complete words can be erased. Therefore, if an odd
number N (N=2*X + 1; 0 ≤ X ) of bytes is specified in the ERASE_DATA command, N+1 bytes will actually be erased.

Command format

Instruction Data length Data

Code
ADDR LEN

95 H 03 H

ADDR Byte address in the card of the first byte to be erased

LEN Number of bytes to be erased in the card

Response data format

No response data

f) PRESENT_CODE
To submit a secret code to the card to enable the read or write operations according to the card lifecycle stage and the setting of option bits in
the card.
Through parameters specified in the command data, this command allows to present all the different codes provided by different card types,
such as the transport code, the erase code, etc.
The following actions are executed by the CyberMouse:
- present the specified code to the card
- if applicable, search a '1' bit in the error/erase counter at the specified address and write the bit to '0'
- if applicable, try to erase the erase counter / error counter / reloadable memory area immediately following the secret code in the card
memory

Command format

Instruction Data length Data

Code
LEN ADDR CNT BYTE 1 ... BYTE N

92 H

LEN Number of code bytes, N, + 3

ADDR Byte address of the presented code in the card
CNT Number of bits of the presentation/erase counter
00 = No counter bits but ERASE must be executed after code presentation
FFH = No counter bits, no ERASE after code presentation
BYTE x Secret code
Examples: SLE4404 (416 bits) - Presentation of Secret Code (PIN)
N = 02
LEN = 05

Copyright  1996-1999 25
 Cybermouse Reference Manual
ADDR = 08
CNT = 04

GPM896 (896 bits) - Presentation of Erase Code 1

N = 06
LEN = 09
ADDR = 36H
CNT = 00
AT88SC1604 - Presentation of Security Code 3
N = 02
LEN = 05
ADDR = 5CBH
CNT = FFH

Response data format

BYTE 1 ... BYTE N

BYTE x Contents of the presentation/erase counter (if applicable)

N = Max (1, CNT/ 8)
NOTE - No response data are transmitted if the command parameter CNT is 00 or FFH.

g) SET_FUSE
To set the FUSE pin of the inserted card to the required electrical state. The FUSE pin controls the way a card interprets the status of the internal
FUSE bit.
The selection becomes active only after a card reset. The default state of the FUSE pin after selecting this card type is 'not connected' (= high
impedance), which is by most cards interpreted as 'Fuse blown'.

Command format

Instruction Data length Data

Code
FUSE

84 H 01 H

FUSE State of the FUSE pin

00H : not connected (high impedance)
01H : High (5V)
FFH : Low (0V)

Response data format

No response data

h) BLOW_FUSE
To execute the process for blowing a fuse at the specified memory address to irreversibly change the card life cycle state.
NOTE - This command is only used with the ATMEL cards of type AT88SCxxxx. The AM416 / GPM896 / SLE4404 cards use normal
WRITE operations to the proper addresses to blow the fuses.

Command format

Instruction Data length Data

Code
ADDR

94 H 02 H

ADDR Byte address of the fuse. The first bit (bit 0) at this byte address will be written to 0 using the special control signal timing
required by the AT88SCxxxx cards.

Response data format

No response data

Copyright  1996-1999 26
 Cybermouse Reference Manual

4. Siemens SLE 4432/4442 intelligent 256 Byte Memory Card

a) RESET
This command powers up the card inserted in the card reader and performs a card reset.
If the card is powered up when the command is being issued, only a reset of the card is carried out, the power supply to the card is not switched
off.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

ATR

ATR Four bytes Answer-To-Reset read from the card.

The ATR bytes are read from the card with LSB first, i.e., the first bit read from the card is the LSB of the first ATR byte.

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) READ_DATA
To read the specified number of bytes from the specified address of the inserted card.

Command format

Instruction Data length Data

Code
ADDR LEN

90 H 03 H

ADDR Byte address of first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)

Response data format

BYTE 1 BYTE 2 BYTE 3 ... BYTE N PROT 1 ... PROT L

BYTE x Data bytes read from the card memory

PROT y Bytes containing the protection bits of the data bytes read
(0...4 bytes)
The protection bits are only returned in the response data if the start address ADDR specified in the command is < 20H, i.e., it is lying within the
first 32 bytes of card memory which can be write protected.
Accordingly, the number of PROT bytes returned depends on how many of the data bytes read lie within the protectable area. If all data bytes
read are outside the protectable area, only the data bytes read from the card are returned in the response, no PROT bytes are returned.
The arrangement of the protection bits in the PROT bytes is as follows:

Copyright  1996-1999 27
 Cybermouse Reference Manual

PROT 1 PROT 2 ....

P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 .. .. .. .. .. .. P18 P17

Px is the protection bit of BYTE x in the response data

'0' : byte is write protected
'1' : byte can be written

d) WRITE_DATA
To write the specified data bytes to the specified address of the inserted card.

Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 ... ... BYTE N

91 H

LEN Number of data bytes to be written to the card, N, + 2

ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.

Response data format

No response data

e) WRITE_PROTECTION
To write the protection bits for the specified addresses in the card.
Each of the bytes specified in the command is internally in the card compared with the byte stored at the specified address and if the data match,
the corresponding protection bit is irreversibly programmed to '0'.

Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 ... ... BYTE N

94 H

LEN Number of data bytes to be write protected, N, + 2

ADDR Byte address in the card of the first byte to be write protected. The high byte of the address is specified as the first byte of
ADDR.
BYTE x Byte values to be compared with the data in the card starting at address ADDR. BYTE 1 is compared with the data at address
ADDR; BYTE N is compared with the data at address ADDR+N-1.

Response data format

No response data

f) PRESENT_CODE (only SLE 4442)

To submit the secret code to the card to enable the write operation with the SLE 4442 card.
The following actions are executed by the CyberMouse:
- search a '1' bit in the presentation error counter and write the bit to '0'
- present the specified code to the card
- try to erase the presentation error counter

Copyright  1996-1999 28
 Cybermouse Reference Manual
Command format

Instruction Data length Data

Code
CODE

92 H 03 H

CODE Three bytes secret code (PIN)

Response data format

ERRCNT CODE

ERRCNT The value of the presentation error counter after the code presentation.
CODE The three bytes secret code read from the card.
If the correct code has been presented to the card, the value of ERRCNT is 07H and the value of CODE is identical to the
code data specified in the command.

g) READ PRESENTATION ERROR COUNTER (only SLE 4442)

To read the presentation error counter

Instruction Data length

Code

92 H 0H

Response data format

ERRCNT DUMMY

ERRCNT The value of the presentation error counter.

DUMMY Three bytes dummy data read from the card.

h) CHANGE_CODE (only SLE 4442)

To write the specified data as new secret code in the card.
The current secret code must have been presented to the card with the PRESENT_CODE command prior to the execution of this command!

Command format

Instruction Data length Data

Code
CODE

93 H 03 H

CODE The three bytes new secret code (PIN)

Response data format

No response data

Copyright  1996-1999 29
 Cybermouse Reference Manual

5. Siemens SLE 4418/4428 intelligent 1K Byte Memory Card

a) RESET
This command powers up the card inserted in the card reader and performs a card reset.
If the card is powered up when the command is being issued, only a reset of the card is carried out, the power supply to the card is not switched
off.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

ATR

ATR Four bytes Answer-To-Reset read from the card.

The ATR bytes are read from the card with LSB first, i.e., the first bit read from the card is the LSB of the first ATR byte.

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) READ_DATA
To read the specified number of bytes from the specified address of the inserted card.

Command format

Instruction Data length Data

Code
ADDR LEN

90 H 03 H

ADDR Byte address of first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)

Response data format

BYTE 1 BYTE 2 BYTE 3 ... BYTE N PROT 1 ... PROT L

BYTE x Data bytes read from the card memory

PROT y Bytes containing the protection bits of the data bytes read (1...4 bytes)

The number L of protection bytes returned in the response is determined by the number N of data bytes read from the card as follows:

L = 1 + INT(N/8)
The arrangement of the protection bits in the PROT bytes is as follows:

Copyright  1996-1999 30
 Cybermouse Reference Manual
PROT 1 PROT 2 ....

P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 .. .. .. .. .. .. P18 P17

Px is the protection bit of BYTE x in the response data

'0' : byte is write protected
'1' : byte can be written

d) WRITE_DATA
To write the specified data bytes to the specified address of the inserted card.

Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 ... ... BYTE N

91 H

LEN Number of data bytes to be written to the card, N, + 2

ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.

Response data format

No response data

e) WRITE_PROTECTION
To write the protection bits for the specified addresses in the card.
Each of the bytes specified in the command is internally in the card compared with the byte stored at the specified address and if the data match,
the corresponding protection bit is irreversibly programmed to '0'.

Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 ... ... BYTE N

94 H

LEN Number of data bytes to be write protected, N, + 2

ADDR Byte address in the card of the first byte to be write protected. The high byte of the address is specified as the first byte of
ADDR.
BYTE x Byte values to be compared with the data in the card starting at address ADDR. BYTE 1 is compared with the data at address
ADDR; BYTE N is compared with the data at address ADDR+N-1.

Response data format

No response data

f) PRESENT_CODE (only SLE 4428)

To submit the secret code to the card to enable the write operation with the SLE 4442 card. The following actions are executed by the
CyberMouse:
- search a '1' bit in the presentation error counter and write the bit to '0'
- present the specified code to the card
- try to erase the presentation error counter

Command format

Instruction Data length Data

Code
CODE

92 H 02 H

CODE Two bytes secret code (PIN)

Copyright  1996-1999 31
 Cybermouse Reference Manual
Response data format

ERRCNT CODE

ERRCNT The value of the presentation error counter after the code presentation.
CODE The two bytes secret code read from the card.
If the correct code has been presented to the card, the value of ERRCNT is FFH and the value of CODE is identical to the
code data specified in the command.

g) READ PRESENTATION ERROR COUNTER (only SLE 4428)

To read the presentation error counter for the secret code.

Command format

Instruction Data length

Code

92 H 0H

Response data format

ERRCNT DUMMY

ERRCNT The value of the presentation error counter.

DUMMY Three bytes dummy data read from the card.

Copyright  1996-1999 32
 Cybermouse Reference Manual

6. '93CS06/46' type EEPROMs with MICROWIRE interface

NOTE - The memory of the 93CS06/46 type EEPROM is electrically organized in words (16 bits) and only complete words can be read,
written and erased.

a) RESET
This command powers up the card inserted in the card reader. If the card is powered up when the command is being issued, the power supply to
the card will not temporarily be switched off.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

No response data

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) READ_DATA
To read the specified number of words from the specified address of the inserted card.

Command format

Instruction Data length Data

Code
ADDR LEN

90 H 03 H

ADDR Word address of first word to be read from the card

LEN Number N of data words to be read from the card (0 < N ≤ MAX_R/2)

Response data format

WORD 1 WORD 2. ... WORD N

BYTE x Data words read from the card memory. Each data word is transmitted in two bytes, with the high byte of the word transmitted
first.

d) WRITE_DATA
To write the specified data words to the specified address of the inserted card.

Copyright  1996-1999 33
 Cybermouse Reference Manual
Command format

Instruction Data length Data

Code
LEN ADDR WORD 1 ... ... WORD N

91 H

LEN Number of data words to be written to the card, N, multiplied by 2, + 2

ADDR Word address of the first word to be written to the card
WORD x Word values to be written to the card starting at word address ADDR. WORD 1 is written to address ADDR; WORD N is
written to address ADDR+N-1. Each word is transmitted in two bytes with the high byte of the word transmitted first.

Response data format

No response data

e) WRITE_ALL
To fill the complete card memory with the specified value.

Command format

Instruction Data length Data

Code
DATA

95 H 02 H

DATA The word value to be written to all card addresses. The value is transmitted in two bytes with the high byte of the word
transmitted first.

Response data format

No response data

f) READ_PROT
To read the contents of the write-protection register from the card (i.e., the start address of the write-protected memory area).

Command format

Instruction Data length

Code

97 H 00 H

Response data format

PROT

PROT Value of write protection register, i.e., the address of the first write-protected word.

g) SET_PROTECTION
To set the start address of the write-protected memory area in the card.

Command format

Instruction Data length Data

Code
PROT

94H 01H

PROT New value of the write protection register, i.e., the address of the first word to be write-protected

Response data format

No response data

Copyright  1996-1999 34
 Cybermouse Reference Manual
h) CLEAR_PROTECTION
To clear the write-protection register in the card, i.e., to set all memory addresses to 'not write-protected'.

Command format

Instruction Data length

Code

94H 00H

Response data format

No response data

i) DISABLE_PROTECTION
Irreversibly to disable access to the write-protection register in the card. The contents of the write-protection register is not changed and the
currently write-protected memory area cannot be modified any more.

Command format

Instruction Data length Data

Code

94H 02H FFH FFH

Response data format

No response data

Copyright  1996-1999 35
 Cybermouse Reference Manual

7. ST1333 - type EEPROM WITH T2G PROTOCOL

NOTE - a programmed bit is '1' while an erased bit is '0' for this type of card.

a) RESET
This command powers up the card inserted in the card reader and performs a card reset.
If the card is powered up when the command is being issued, only a reset of the card is carried out; the power supply to the card is not switched
off.

Command format

Instruction Data length

Code

80 H 00 H

Response data format

ATR

ATR Four bytes Answer-To-Reset read from the card.

The ATR bytes are read from the card with LSB first, i.e., the first bit read from the card is the LSB of the first ATR byte.

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) READ_DATA
To read the specified number of bytes from the specified address of the inserted card. The bytes are read from the card with LSB first, i.e., the
bit at card address 0 is regarded as the LSB of byte 0.

Command format

Instruction Data length Data

Code
ADDR LEN

90 H 03 H 00 H

ADDR Byte address of first byte to be read from the card

LEN Number N of data bytes to be read from the card
(0 < N ≤ MAX_R)

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

d) WRITE_DATA
To write one byte to the specified address of the inserted card. The byte is written to the card with LSB first, i.e., the bit at card address 0 is
regarded as the LSB of byte 0.

Copyright  1996-1999 36
 Cybermouse Reference Manual
Two different WRITE modes are available for this card type, which are distinguished by a flag in the command data field:
a) Write
The byte value specified in the command is written to the specified address. This command can be used for writing personalization
data and counter values to the card.
b) Write with carry
The byte value specified in the command is written to the specified address and the command is sent to the card to erase the next
lower counter stage. This write mode can therefore only be used for updating the counter value in the card.
With either write mode, the byte at the specified card address is not erased prior to the write operation and, hence, memory bits can only be
programmed from '0' to '1'.
The backup mode available in the ST1333 card can be enabled or disabled in the write operation.

Command format

Instruction Data length Data

Code
ADDR MODE BYTE

91 H 04 H 00 H

ADDR Byte address of byte to be written

MODE Specifies the write mode and backup option (ST1333)
00H : write
01H : write with carry
02H : write with backup enabled
03H : write with carry and with backup enabled
BYTE Byte value to be written to the card

Response data format

No response data

e) ERASE_DATA
To erase the specified number of bytes starting at the specified address, i.e., set all bits to '0'.

Command format

Instruction Data length Data

Code
ADDR LEN

95 H 03 H

ADDR Byte address in the card of the first byte to be erased

LEN Number of bytes to be erased in the card

Response data format

No response data

f) PRESENT_TRANSPORT_CODE
To submit the transport code to the card in order to enable the card personalization mode. The following actions are executed by the
CyberMouse:
- search a '0' bit in the presentation counter and write the bit to '1'
- present the specified code to the card
The CyberMouse does not try to erase the presentation counter after the code submission! This must be done by the application software through
a separate 'Write with carry' command.

Command format

Instruction Data length Data

Code
LEN ADDR BYTE 1 BYTE 2 ... ... BYTE N

92 H

LEN Number of transport code bytes, N, + 1

ADDR Byte address of the presentation counter in the card

Copyright  1996-1999 37
 Cybermouse Reference Manual
BYTE x Transport code

Response data format

No response data

g) AUTHENTICATE_CARD
To read a card authentication certificate from a ST1333 card. The following actions are executed by the CyberMouse:
- present the challenge data specified in the command to the card
- generate the required number of READ and PROG pulses for the computation of signature by the card
- read 4 bits of authentication data from the card
- reset the card to normal operation mode
The CyberMouse returns the 4 bits of authentication data calculated by the card in the response.

Command format

Instruction Data length Data

Code
BYTE 1 BYTE 2 BYTE 3 BYTE 4

96 H 04 H

BYTE 1...4 Card challenge data

Response data format

CERT

B8 B7 B6 B5 B4 B3 B2 B1

CERT B1 - B4 are 4 bits of authentication data computed by the card.

Copyright  1996-1999 38
 Cybermouse Reference Manual

8. X76F041 Card (Xicor)

a) RESET
This command powers up the card inserted in the card reader.
No action is taken if the card is powered up when the command is being issued.

Command format

Instruction Data
Code length

80 H 00 H

Response data format

ATR

19 H 55 H AA H 55 H

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data
Code length

81 H 00 H

Response data format

No response data

c) READ_DATA
To read the specified number of bytes from the specified address of the inserted card. Please note that the reader always use the sequential read
command to read out the data.
The X76F041 card allows reading data only within a block. However, the AC-SET EVB handles the reading across block boundaries
transparently to the application. Thus, data can be read from any address irrespective of the bock structure of the card., provided that the
adjacent blocks are both not READ protected.

Command format

Instruction Data Data

Code length

ADDR LEN

90 H 03 H

ADDR Byte address of first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

d) READ_DATA_WITH_PASSWORD
To read the specified number of bytes from the specified address of the inserted card after submission of the specified READ password.

Copyright  1996-1999 39
 Cybermouse Reference Manual
The X76F041 card allows reading data only within a block. However, the AC-SET EVB handles the reading across block boundaries
transparently to the application. Thus, data can be read from any address irrespective of the bock structure of the card., provided that the
adjacent blocks are both READ protected.

Command format

Instruction Data Data

Code length

PASSWORD (8 bytes) ADDR LEN

90 H 0B H PW7 …. PW0

ADDR Byte address of the first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)
PASSWORD The READ password

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

e) CONFIG_READ
This command is the same as READ_DATA_WITH_PASSWORD except that the CONFIGURATION password is used in this command and the
read operation is not restricted to a certain memory area.

Command format

Instruction Data Data

Code length

PASSWORD (8 bytes) ADDR LEN

92 H 0B H PW7 …. PW0

ADDR Byte address of first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)
PASSWORD The CONFIGURATION password

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

f) WRITE_DATA
To write the specified number of data bytes starting from a specified address.
The X76F041 card allows writing data only to one complete sector (8 bytes) at a time. However, the AC-SET EVB handles the writing across
sector boundaries transparently to the application. Thus, any number of data bytes can be written to any address irrespective of the sector
structure of the card provided that the number of bytes to be written is a multiple of 8 and that adjacent memory blocks are both not WRITE
protected.

Command format

Instruction Data length Data

Code

LEN ADDR BYTE 1 ... ... BYTE N

91 H

LEN Number of data bytes to be written to the card, N, + 2

ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.

Copyright  1996-1999 40
 Cybermouse Reference Manual
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.

Response data format

No response data

g) WRITE_DATA_WITH_PASSWORD
To write the specified number of data bytes starting from a specified address, after submitting the specified WRITE password to the card.
The X76F041 card allows writing data only to one complete sector (8 bytes) at a time. However, the AC-SET EVB handles the writing across
sector boundaries transparently to the application. Thus, any number of data bytes can be written to any address irrespective of the sector
structure of the card provided that the number of bytes to be written is a multiple of 8 and that adjacent memory blocks are both WRITE
protected.

Command format

Instruction Data Data

Code length

LEN PASSWORD (8 bytes) ADDR BYTE 1 ... BYTE N

94 H PW7 …. PW0

LEN Number of data bytes to be written to the card, N, + 10

ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.
PASSWORD WRITE password

Response data format

No response data

h) CONFIG_WRITE
This command is exactly the same as WRITE_DATA_WITH_PASSWORD except that the CONFIGURATION password is used in this
command and the write operation is not restricted.

Command format

Instruction Data Data

Code length

LEN PASSWORD (8 bytes) ADDR BYTE 1 ... BYTE N

93 H PW7 …. PW0

LEN Number of data bytes to be written to the card, N, + 10

ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.
PASSWORD CONFIGURATION password

Response data format

No response data

i) CARD_ADMIN
This command is used to perform various card administration functions.

Copyright  1996-1999 41
 Cybermouse Reference Manual
Command format

Instruction Data Data

Code length

LEN PASSWORD (8 bytes) CMD RSLEN PARAM x

95 H PW7 …. PW0 1 .. N

LEN Number of data bytes of the command

CMD Command code for the administration function ( refer to Table 7-1)
PASSWORD Password to be submitted with the command
RSLEN Expected length of response data (refer to Table 7-1)
PARAM x Input parameter for the command (refer to Table 7-1)
Not all commands require input parameters!

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

Copyright  1996-1999 42
 Cybermouse Reference Manual

Table 7-1: Command codes and parameters

CMD PARAM Length of PASSWORD Response
PARAM length
(bytes) (RsLen)

Program the WRITE password

0x00 [New READ password, 16 [Old READ 0
2 times] password]

Program the READ password

0x10 [New WRITE password, 16 [Old WRITE 0
2 times] password]

Program the CONFIGURATION password

0x20 [New CONFIGURATION 16 [Old 0
password, 2 times] CONFIGURATION
password]

Reset the WRITE password

0x30 Nil 0 [CONFIGURATION 0
password]

Reset the READ password

0x40 Nil 0 [CONFIGURATION 0
password]

Program the configuration registers

0x50 [New configuration 5 [CONFIGURATION 0
register values] password]

Read the configuration registers

0x60 Nil 0 [CONFIGURATION 5
password]

Mass program
0x70 Nil 0 [CONFIGURATION 0
password]

Mass erase
0x80 Nil 0 [CONFIGURATION 0
password]

Copyright  1996-1999 43
 Cybermouse Reference Manual

9. X76F128/640 Card (Xicor)

a) RESET
This command powers up the card inserted in the card reader.
No action is taken if the card is powered up when the command is being issued.

Command format

Instruction Data
Code length

80 H 00 H

Response data format for X76F128 Card

ATR

19 H 28 H AA H 55 H

Response data format for X76F640 Card

ATR

19 H 64 H AA H 55 H

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data
Code length

81 H 00 H

Response data format

No response data

c) READ_DATA_WITH_PASSWORD
To read the specified number of bytes from the specified address of Array 0 or Array 1 of the inserted card, after submission of the specified
READ password for Array 0 or Array 1, respectively.
The X76F128/640 card allows reading data only within an array.

Command format

Instruction Data Data

Code length

ARRAY PASSWORD (8 bytes) ADDR LEN

90 H 0C H PW7 …. PW0

ARRAY Array number. 0 for Array 0, 1 for Array 1

ADDR Byte address of the first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)
PASSWORD The READ password for the array specified in ARRAY.

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

Copyright  1996-1999 44
 Cybermouse Reference Manual

BYTE x Data bytes read from the card memory

d) WRITE_DATA_WITH_PASSWORD
To write the specified number of data bytes starting from a specified address of Array 0 or Array 1, after submitting the specified WRITE
password of the corresponding array to the card.

Command format

Instructio Data Data

n Code length

LEN ARRAY PASSWORD (8 bytes) ADDR BYTE 1 ... BYTE N

91 H PW7 …. PW0

ARRAY Array number. 0 for Array 0, 1 for Array 1

LEN Number of data bytes to be written to the card, N, + 11
ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.
PASSWORD WRITE password for the array specified.

Response data format

No response data

e) RESET_PASSWORD
This command is will clear both arrays and set all passwords to all zero, after submitting the correct password for reset.

Command format

Instruction Data Data

Code length

LEN PASSWORD (8 bytes)

96 H 08 PW7 …. PW0

PASSWORD RESET password

f) RESET_DEVICE
This command will clear the X76F128/640 retry counter and reactivate the device, after submitting the correct password for reset. When this
command is used prior to the retry counter overflow, the retry counter is reset and no arrays or passwords are affected. If the retry counter has
overflowed, all memory areas are cleared and all commands are blocked and the retry counter is disabled. Issuing a valid RESET_DEVICE
command (with reset password) to the device resets and re-enables the retry counter and re-enables the other commands. Again, the passwords
are not affected.

Command format

Instruction Data Data

Code length

LEN PASSWORD (8 bytes)

97 H 08 PW7 …. PW0

PASSWORD RESET password

Response data format

No response data

g) CHANGE_PASSWORD
This command is used to change the X76F128/640 various passwords after submitting the original corresponding password.

Copyright  1996-1999 45
 Cybermouse Reference Manual

Command format

Instructio Data Data

n Code length

LEN TYPE PASSWORD (8 bytes) NEWPASS(8 bytes) NEWPASS (8 bytes)

95 H 19H PW7 …. PW0 NW7 . NW0 NW7 .. NW0

LEN Number of data bytes of the command

TYPE Password type :
0 : Read Array 0 Password
1 : Read Array 1 Password
2 : Write Array 0 Password
3 : Write Array 1 Password
4 : Reset Password
PASSWORD Original password to be submitted with the command
NEWPASS New Password (type twice)

Response data format

No response data

Copyright  1996-1999 46
 Cybermouse Reference Manual

10. X76F100 Card (Xicor)

a) RESET
This command powers up the card inserted in the card reader.
No action is taken if the card is powered up when the command is being issued.

Command format

Instruction Data
Code length

80 H 00 H

Default Response data format

ATR

19 H 00H AA H 55 H

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data
Code length

81 H 00 H

Response data format

No response data

c) READ_DATA_WITH_PASSWORD
To read the specified number of bytes from the specified address of the inserted card after submission of the specified READ password.

Command format

Instruction Data Data

Code length

PASSWORD (8 bytes) ADDR LEN

90 H 0B H PW7 …. PW0 00

ADDR Byte address of the first byte to be read from the card. The high byte of the address is specified as the first byte of ADDR.
LEN Number N of data bytes to be read from the card (0 < N ≤ MAX_R)
PASSWORD The READ password

Response data format

BYTE 1 BYTE 2 BYTE 3 ... ... BYTE N

BYTE x Data bytes read from the card memory

d) WRITE_SECTOR_DATA_WITH_PASSWORD
To write the specified number of data bytes(in multiples of 8) starting from a specified address, after submitting the specified WRITE
password to the card. The starting address must be on a sector start (i.e. multiples of 8).

Copyright  1996-1999 47
 Cybermouse Reference Manual
Command format

Instruction Data Data

Code length

LEN PASSWORD (8 bytes) ADDR BYTE ... BYTE

1 N

91 H PW7 …. PW0 00

LEN Number of data bytes to be written to the card, N, + 10

ADDR Byte address in the card of the first byte to be written. The high byte of the address is specified as the first byte of ADDR.
BYTE x Byte values to be written to the card starting at address ADDR. BYTE 1 is written to address ADDR; BYTE N is written to
address ADDR+N-1.
PASSWORD WRITE password

Response data format

No response data

e) CHANGE_ PASSWORD
This command will change the password for READ or the password for WRITE, after submitting the WRITE password.

Command format

Instruction Data Data

Code length

LEN TYPE PASSWORD(8 bytes) NEWPASS (8 bytes)

95 H 11H PW7 …. PW0 PW7 .... PW0

TYPE Password type: 0 = READ password

1 = WRITE password
PASSWORD WRITE password
NEWPASS new READ or WRITE password

Response data format

No response data

Copyright  1996-1999 48
 Cybermouse Reference Manual

11. MCU-based Card

a) RESET (3V or 5V)

This command powers up the card inserted in the card reader and performs a card reset. If the card is powered up when the command is being
issued, only a reset of the card is carried out. The power supply to the card is not switched off.
To reset the card using 5V, normal reset command can be used

Command format (Reset using 5V)

Instruction Data length

Code

80 H 00 H

To reset the card using 3V, extended reset command can be used

Command format (Reset using 3V)

Instruction Data length Data

Code

80 H 01 H 01 H

Response data format

ATR

ATR Answer-To-Reset as transmitted by the card according to ISO7816-3.

NOTE - The ATR is only returned in the CyberMouse response if the communication protocol of the card is compatible with the reader, i.e.,
if the card can be processed by the CyberMouse. Otherwise, the CyberMouse returns an error status and deactivates the smart card interface.

b) POWER_OFF
This command powers off the card inserted in the card reader.

Command format

Instruction Data length

Code

81 H 00 H

Response data format

No response data

c) EXCHANGE_APDU
To exchange an APDU (Application Protocol Data Unit) command/response pair between the MCU card inserted in the CyberMouse and the
host computer.

Command format

Instruction Data length Data

Code
LEN CLA INS P1 P2 Lc BYTE 1 ...2 ... BYTE N Le

A0 H

LEN Length of APDU command data, N, + 6 (0 < N ≤ MAX_R)

CLA APDU instruction class byte
INS APDU instruction
P1 APDU parameter byte 1
P2 APDU parameter byte 2
Lc APDU command data length
BYTE x APDU command data
Le Expected APDU response data length

Copyright  1996-1999 49
 Cybermouse Reference Manual

NOTE - With the T=0 communication protocol it is not possible to transmit data to the card and from the card in a single command-response
pair. Hence, only either Lc or Le can be greater than 0 in an EXCHANGE_APDU command when a T=0 card is in the reader. If both parameters
have a value greater than 0, the CyberMouse does not execute the command and returns an error status.

Response data format

BYTE 1 ... ... BYTE N SW1 SW2

BYTE x Response data from card (if any)

SW1, SW2 Status code returned by the card.

d) EXCHANGE_T1_FRAME
To exchange an APDU (Application Protocol Data Unit) command/response pair between the MCU card inserted in the CyberMouse and the
host computer using T1 protocol.

Command format

Instruction Data length Data

Code
LEN T1 BLOCK FRAME

A1 H

LEN Length of APDU command data, N

DATA T1 Block frame to be sent to the card

Response data format

BYTE 1 ... ... BYTE N

BYTE x Response T1 Block from card (if any)

Copyright  1996-1999 50
 Cybermouse Reference Manual

12. Security Application Module (SAM)

a) ACTIVATE_SAM
To power up and reset the specified SAM and transmit the SAM's ATR in the response.

Command format

Instruction Data length Data

Code
SM#

88 H 01 H

SM# SAM to be activated - SAM0, SAM1 or SAM2.

Must be 0; values other than 0 are only allowed with the CyberMouse-M20-3 board.

Response data format

ATR

ATR Answer-To-Reset as transmitted by the card according to ISO7816-3.

NOTE - The ATR is only returned in the CyberMouse response if the communication protocol of the SAM is compatible with the reader, i.e.,
if the SAM can be processed by the CyberMouse. Otherwise, the CyberMouse returns an error status and deactivates the SAM.

b) DEACTIVATE_SAM
This command powers off the SAM inserted in the CyberMouse-M20-1 board.

Command format

Instruction Data length

Code

89 H 00 H

Response data format

No response data

c) EXCHANGE_SAM_APDU
To exchange an APDU (Application Protocol Data Unit) command/response pair between the SAM in the CyberMouse-M20-1 board and the
host computer.

Command format

Instruction Data length Data

Code
LEN CLA INS P1 P2 Lc BYTE 1 ...2 ... BYTE N Le

B0 H

LEN Length of APDU command data, N, + 6 (0 < N ≤ MAX_R)

CLA APDU instruction class byte
INS APDU instruction
P1 APDU parameter byte 1
P2 APDU parameter byte 2
Lc APDU command data length
BYTE x APDU command data
Le Expected APDU response data length

NOTE - With the T=0 communication protocol it is not possible to transmit data to the SAM and from the SAM in a single command-
response pair. Hence, only either Lc or Le can be greater than 0 in an EXCHANGE_SAM_APDU command when a T=0 SAM is in the reader. If
both parameters have a value greater than 0, the CyberMouse does not execute the command and returns an error status.

Copyright  1996-1999 51
 Cybermouse Reference Manual
Response data format

BYTE 1 ... ... BYTE N SW1 SW2

BYTE x Response data from SAM (if any)

SW1, SW2 Status code returned by the SAM.

Copyright  1996-1999 52
 Cybermouse Reference Manual

APPENDIX A: SUPPORTED CARD TYPES

The following table summarizes which values must be specified in the SET_CARD_TYPE command for a particular card type to be used, and
how the bits in the response to the GET_ACR_STAT command correspond with the respective card types.

Cyber-mouse Siemens Atmel SGS-Thomson Gemplus Others

card type code

01 AM104 SLE4406 AT88SC06 ST1305 GPM103

AM221 SLE4436 ST1335
SLE5536

AM1KF AT24C01 ST14C02C GFM1K

AM2KF AT24C02 ST14C04C GFM2K
AM4KF AT24C04 GFM4K
02 AM8KF AT24C08
AT24C16

03 AM416 SLE4404 AT88SC101 GPM416

AT88SC102 GPM896
AT88SC1601
AT88SC1604

05 AM8KP SLE4418
AM8KS SLE4428

06 AM2KP SLE4432
AM2KS SLE4442

07 AM64KP 24C65

08 AM256 93CS06/46

0AH X76F041

0BH ST1333

0CH MCU-based cards with T=0 communication protocol

0DH MCU-based cards with T=1 communication protocol

0EH X76F128/640

10H X76F100

Copyright  1996-1999 53
 Cybermouse Reference Manual

APPENDIX B: RESPONSE STATUS CODES

The following table summarizes the possible status code bytes SW1, SW2 returned by the CyberMouse:

SW1 SW2 Status

90 00 OK – command successfully executed

90 01 OK – using T=1 protocol (only in response to the RESET command)

90 10 OK – synchronous protocol is used (only in response to the RESET command). The exact card type should be
selected by using the SELECT_CARD_TYPE command.

60 01 No card type selected

60 02 No card in reader

60 03 Wrong card type specified

60 04 Card not powered up;

This status code is also returned in a response if the card was temporarily removed during a card access.

60 05 Invalid Instruction Code

60 20 Card failure

60 22 Short circuit at card connector

62 01 Secret code verify failed

67 01 Command incompatible with card type

67 02 Card address error

67 03 Data length error

67 04 Invalid length of response (with READ command)

67 05 Secret code locked

67 12 APDU command aborted (only MCU-based card using T=1 protocol); the command abortion may be caused by a
card internal failure.

Copyright  1996-1999 54
 Cybermouse Reference Manual

APPENDIX C: CYBERMOUSE FIRMWARE REVISION INDEX

Revision Modifications
1.09 first distributed release

Copyright  1996-1999 55
 Cybermouse Reference Manual

APPENDIX D: TECHNICAL SPECIFICATIONS

Device

CyberMouse Smart Card Reader/Writer

Power supply

Supply voltage ..................................... Regulated 5V DC

Supply current...................................... < 100mA (without smart card)
The presence of the power supply voltage is indicated through a red LED on the reader

Serial Communication Interface

Type ..................................................... RS-232C, five lines: RxD, TxD, CTS, DTR, GND
Connector............................................. supplied together with the reader

Universal Serial Bus Interface

Type ..................................................... USB, four lines: +5V, GND, D+ and D-

Connector............................................. supplied together with the reader

Smart Card Interface

Standard ............................................... ISO 7816 1/2/3, T=0 and T=1

Supply current...................................... max. 30mA
Short circuit protection ....................... +5V / GND on all pins
The presence of the smart card power supply voltage is indicated through a green LED on the reader
CLK frequency..................................... 3.68 MHz / 1.84 MHz / 0.92 MHz
Card connector..................................... sliding contacts (8 contacts)
Card insertion cycles............................ min. 100,000

Case

Dimensions .......................................... 77mm (L) x 68mm (B) x 20mm (H)

Color .................................................... bone gray
Weight.................................................. 0.16 kg

Operating Conditions

Temperature ......................................... 0 - 50° C

Copyright  1996-1999 56
 Cybermouse Reference Manual
NOTES

Copyright  1996-1999 57
 Cybermouse Reference Manual
NOTES

Copyright  1996-1999 58