From OpenPCD

Jump to: navigation, search

R10CGNN and 6100CGN iCLASS reader programming plug

Connecting a PICkit2 Programmer to a CGN 20 pin programming connector using a adapter PCB

20 pin adapter PCB for connecting a PICkit2 programmer to a iCLASS R10/R6100 reader CGN

Introduction

During our security research on HID iCLASS access control system security we evaluated several hardware revisions of HID iCLASS RFID readers. All the readers we evaluated (AKN, BKN, CGN revisions) have their in-system programming interfaces accessible on the back. This allows certain attacks on the systems like the installation of backdoors and reading out the system encryption keys in some selected cases.

This particular reader revision (CGN) doesn't seem to be vulnerable to key extraction over the 20 pin interface as a modern PIC CPU (PIC18F67J11) is used where the problems we found are fixed.

Please refer to HID iClass demystified for further information and read our whitepaper.

Programming Connector Pinout

R10CGNN and 6100CGN iCLASS readers have a more sophisticated programming connector than AKN and BKN readers (6 pin layout as seen in our whitepaper). It's a fine pitch 2x10 pin connector with 0.5mm spacing:

Signal	Pin	Pin	Signal
YEL-Beeper	19	20	VCC+5V
VIO-Tamper	17	18	BRN-Red LED
ORN-Green LED	15	16
	13	14	/MCLR
	11	12
BLK-GND	09	10	BLK-GND
	07	08	GRN-DATA0
PGC	05	06
PGD	03	04
red+12V	01	02

You need to select the PIC18F_J (PIC18F67J11) architecture in your PICkit2 programming software to be able to access the programming interface.

The counterpart to this connector is available at Digi-Key and has the part number H11714CT-ND. It's a Hirose DF12A(3.0)-20DS-0.5V(81) plug.