New version of FUU supports unattended H663 firmware upgrade

FUU “Firmware Upgrade Utility” is SpringCard’s all-in-one software to flash the firmware of most of the product families.

The H663 family (including the H663 OEM module itself, and also the Prox’N’Roll HSP, CrazyWriter HSP, TwistyWriter HSP and CSB HSP) is architectured over an Atmel (now Microchip) MCU, which could be flashed through USB. FUU Supports this family for long, and comes with Atmel DFU (Device Firmware Upgrade) driver for Windows.

Read More

SpringCard PC/SC SDK VERSION 2016.03

The version 2016.03 of our PC/SC SDK is now available for download: pcsc-sdk_2016-03.zip.

You can use it with our products in the SpringCard CSB6 Family (CSB6, Prox’N’Roll PC/SC, EasyFinger and CrazyWriter), with our products in the H663 family (Prox’N’Roll HSP PC/SC, CrazyWriter HSP, TwistyWriter HSP, CSB HSP) and our NFC readers/encoders (H512, NFC’Roll).

This SDK is also available on GitHub.

This SDK contains a new version of MemoryCardTool, a new tool called “scriptorxv” and a serie of basic projects for beginners.

Using Mifare Classic EV1 with SpringCard PC/SC readers

NXP has recently started shipping a new generation of Mifare Classic chips, called Mifare Classic EV1 (part numbers MF1S50yyX/V1 for Mifare Classic EV1 1K and MF1S70yyX/V1 for Mifare Classic EV1 4K).

The chips are 100% compliant with earlier Mifare Classic 1K and 4K, with 2 subtle differences:

  • the kind of protocol-level ID to be used must be configured once for all during the pre-personalisation step. Possible choices are 7-byte UID, 4-byte fixed but non-unique ID, and 4-byte random ID,
  • the load modulation level could be set to ‘high’ or ‘low’.

In this short article we’ll show how to configure both the kind of ID and the load modulation.

Personalize UID usage

This command can be only issued once. The choosen configuration is then locked forever. If you have ordered Mifare Classic EV1 with a specific configuration, the command has been issued in factory and will always fail adterwards.

The Mifare Classic EV1′ “personalize UID usage” allows to select one of four different modes:

  1. UIDF0 (value 0x00): anti-collision and selection with the 7-B UID
  2. UIDF1 (value 0x40): anti-collision and selection with the 7-B UID plus a possible shortcut (select only the 4 first bytes and read block 0, bypassing the second step of the selection)
  3. UIDF2 (value 0x20): anti-collision and selection with a 4-B random ID
  4. UIDF3 (value 0x60): anti-collision and selection with a 4-B non-unique ID (calculated out of the 7-B UID)

The command code is 0x40 and must be sent in a CRYPTO1-ciphered stream, after a successfull authentication on sector 0.

To do so, here’s the sequence of commands that must be send to the reader in a SCardTransmit stream (you may for instance write a script for csScriptor). We assume that the card is in transport condition, i.e. that the key A of sector 0 (as well as all other sectors) is the transport key FF FF FF FF FF FF and gives full access to the sector.

# Load the transport key in the reader's volatile memory
FF 82 00 00 06 FF FF FF FF FF FF

# Get authenticated over sector 0 using the transport key as key A
FF 86 00 00 05 01 00 03 60 00

# Check that the authentication is OK by reading block 0
FF B0 00 00 10

# Send the 'personalize UID' command within an ENCAPSULATE APDU
# P1 = 0x01 -> ISO 14443-3
# P2 = 0x08 -> timeout = 125ms
# The last byte is the value to be set, here we choose 0x60 for UIDF3
FF FE 01 08 02 40 60

The reader returns 90 00 if the card acknowledges the command.

If you receive 6F 02 instead (CRC error), it is likely that the card has sent a NACK, meaning that the configuration has already been set and is therefore locked.

Set modulation strength

The Mifare Classic EV1’s “set modulation strength” command allows configuring the chip for either the strong modulation strength (default, value 0x01), or the weak modulation strength (value 0x00).

The command code is 0x43 and must be sent in a CRYPTO1-ciphered stream, after a successfull authentication on sector 0.

To do so, here’s the sequence of commands that must be send to the reader in a SCardTransmit stream (you may for instance write a script for csScriptor). We assume that the card is in transport condition, i.e. that the key A of sector 0 (as well as all other sectors) is the transport key FF FF FF FF FF FF and gives full access to the sector.

# Load the transport key in the reader's volatile memory
FF 82 00 00 06 FF FF FF FF FF FF

# Get authenticated over sector 0 using the transport key as key A
FF 86 00 00 05 01 00 03 60 00

# Check that the authentication is OK by reading block 0
FF B0 00 00 10

# Send the 'set modulation strength' command within an ENCAPSULATE APDU
# P1 = 0x01 -> ISO 14443-3
# P2 = 0x08 -> timeout = 125ms
# The last byte is the value to be set, here we choose 0x00 for weak strength
FF FE 01 08 02 43 00

Reading and writing data in a Mifare UltraLight Card, with a Prox’N’Roll

DOWNLOAD AND READ THE DOCUMENTATIONS

First thing to do is to obtain the documentation of the card from the manufacturer (NXP in this case) and the Prox’N’Roll developer’s reference manual.

From the card’s functional specifications, we can see that the memory is structured in 16 pages of 4 bytes. The four first pages (0-3) contain special bytes: so, we’ll only cover pages 4 to 16.

STEP BY STEP PROCEDURE

The goal is to read and write the card memory.

READ BINARY

In the developer’s reference manual, the READ BINARY instruction is described in §2.2.4 at the time of this writing.

The APDU is :

  • CLA: FF
  • INS: B0
  • P1: Address MSB
  • P2: Address LSB
  • Lc: not needed
  • Data in: not needed
  • Le: number of bytes to be read

The specifics to read Mifare Ultralight cards are detailed in §4.3.3.a (at the time of this writing).
Here, we can see that :

  • P1 must be 00
  • P2 is the address of the first page to be read
  • Le must a multiple of 4.

We want to read the whole memory, starting from page 4: this means we want to read 12 pages of 4 bytes, so 48 bytes (ie: 30 in hexadecimal).
So the APDU is :
FF B0 00 04 30

To send this APDU, please use our PC/SC Diagnostic tool, available on our main site (QuickStart for PC/SC).

Put the card on the reader: its ATR prints. To understand what this means, you can check §4.1.2 (at the time of this writing) in the developer’s reference manual.

ATRNow, double-clic on the line corresponding to the reader and enter the above-mentioned APDU :

read_capduClic on Transmit, or press “Enter”: the APDU is sent to the card and its response is printed in the bottom.

read_rapduThe card has obviously been previously written and the ASCII translation is provided: “Mifare Ultralight card, used with Prox’N’Roll”.
Please note that the card’s reponse ends with “90 00”, which means success.

UPDATE BINARY

In the developer’s reference manual, the UPDATE BINARY instruction is described in §2.2.5 at the time of this writing.

The APDU is :

  • CLA: FF
  • INS: D6
  • P1: Address MSB
  • P2: Address LSB
  • Lc: Lenght of Data In
  • Data in: Bytes to be written
  • Le: not needed

The specifics to write Mifare Ultralight cards are detailed in §4.3.3.b (at the time of this writing).
Here, we can see that :

  • P1 must be 00
  • P2 is the address of the unique page to be written
  • Le must be 4.

We want to replace “Prox’N’Roll” by “SpringCard” in the card memory, so we first have to determine which pages must be updated. Remember that Le must be 4 : this means that we can write exactely 4 bytes at a time (one page), no more, no less.

To determine the content of each page, just use the READ BINARY APDU.
For example, for page 12, the APDU should be : FF B0 00 0C 04

read_single_pageUsing those commands, we can see that:

  • content of page 12 (0x0C) is 68 20 50 72 (in ASCII : “h Pr”)
  • content of page 13 (0x0D) is 6F 78 27 4E (in ASCII: “ox’N”)
  • content of page 14 (0x0E) is 27 52 6F 6C (in ASCII: “‘Rol”)
  • content of page 15 (0x0F) is 6C 00 00 00 (in ASCII: “l” followed by invalid characters)

So, we’ll need to change 4 pages : pages 12, 13, 14 and 15.

SpringCard in ASCII is : “53 70 72 69 6E 67 43 61 72 64”

The 4 APDUs (one for each page) should be:

  • page 12: FF D6 00 0C 04 68 20 53 70 (the first two bytes remain unchanged)
  • page 13: FF D6 00 0D 04 72 69 6E 67
  • page 14: FF D6 00 0E 04 43 61 72 64
  • page 15: FF D6 00 0F 04 00 00 00 00 (we replace the first byte)

Enter those APDUs and click on “Transmit” :

write_single_pageOperation is successful if the card answers 90 00.

Now, you can read back the whole memory, using FF B0 00 04 0C:

final_readWe can see that “Prox’N’Roll” has been replaced by “SpringCard” in the card memory.

 

 

PC/SC Troubleshooting on Windows

Following our PC/SC installation guide on Windows, you’ve installed the appropriate driver, and made sure the “Smart Card” service is running on your Windows computer.
But still, your PC/SC reader doens’t appear on PC/SC Diagnostic.

Please first check in your device manager that your SpringCard PC/SC reader is properly installed (it should appear under Smart Card Reader).

Now, if the drivers are properly installed, the “Smart Card” service is running, but the reader doesn’t show up on the diagnostic tool, the reason must be one of the following :

  1. A third party security-related software or single-login solution takes full control over the PC/SC subsystem
  2. The computer is either running in a virtual machine or in a remote session on a terminal server
  3. Access to PC/SC readers has been disabled by the corporate administrators through a group policy
  4. A driver from one of our competitors has corrupted the registry

For reasons 1 and 2, SpringCard cannot offer any help.

For reason 3 : you should try to run a copy of our PC/SC Diagnostic tool, located on the C: drive, being logged in as Administrator. If this works, your reader is properly installed.

For reason 4, the problem is in the registry permission for LOCAL_SERVICE :
Open the registry editor (“regedit”) :

  1. Right-click on the key HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Cryptography/Calais and select Permissions…
  2. Click Add.
  3. Click Advanced.
  4. Click Locations.
  5. Click on the computer name and click OK.
  6. In the window ‘Select user or groups’, click on Find now.
  7. Select LOCAL SERVICE.
  8. Click OK.
  9. In the window ‘Select user or groups’, click OK.
  10. In the window ‘Permissions for Calais’, click on LOCAL SERVICE and make sure ‘Full control’ , ‘Read’ and ‘special permissions’ are allowed.
  11. In the window “Advance Security Settings for Calais”, deactivate the options “Inherit from parent the permission entries that apply to child objects…”
  12. When the window “Security” appears, click Copy.
  13. In the window “Advance Security Settings for Calais”, activate the option “Replace permission entries on all child objects with entries shown here that apply to child objects” and click OK.
  14. In the window “Security” click Yes
  15. In the window “Permissions for Calais”, click OK.

Restart the computer.

Accessing Reader’s configuration from command line and in batch mode

All SpringCard PC/SC Readers feature a set of Configuration Registers that allow to alter the Reader behaviour to match a particular hardware setup or end-user requirement.

Editing the configuration is easy thanks to MultiConf, the new versatile configuration tool that covers all SpringCard products. But MultiConf is a GUI-application. When it comes to configuring numerous readers at once (with the same settings of course), a command-line tool, suitable to operate in batch mode, could be preferred.

This is typically the aim of pcscconf, a simple command-line utility (targetting Windows systems).

Getting started with pcscconf

Download pcscconf (and its companion tool pcscinfo) (ZIP)

Extract the ZIP archive in the directory of the choice. There are 3 files in the archive:

  • pcscconf.exe, the tool we’ll be using
  • pcscinfo.exe, a software to retrieve all information regarding the connected readers (version, serial numbers, etc)
  • pcsctool.dll, the library that makes both software work.

Open a command-line box in the directory where you’ve extracted the archive, and at the prompt enter

pcscconf

pcscconf-1
pcscconf-2

Reading current configuration

Enter

pcscconf -d

to dump the current configuration.

pcscconf-3

It is also possible to enter

pcscconf -d <Filename>

to dump the configuration to a file. pcscconf uses the same file format as MultiConf.

If the file already exists, use

pcscconf -df <Filename>

to force the overwrite.

Changing a configuration register

Use syntax

pcscconf -s <RegisterAddress>=<RegisterValue>

 

pcscconf-4

To erase a register (i.e. restore product’s default value), use syntax

pcscconf -s <RegisterAddress>

Applying a new configuration from a file

Use syntax

pcscconf -u <Filename>

to upload the configuration from the file into the reader.

There’s no confirmation prompt or ‘Are you sure’ dialog box. Be sure to double-check the content of your file before uploading it into the reader.

pcscconf-5

Do not forget…

Changing a reader’s configuration will change its behaviour! You’re using this software at one risk. Always refer to the reader’s detailed Developer’s Guide or use MultiConf to choose the appropriate values.

Some registers play a special role and are therefore protected before delivery. This is the case of registers C0 and F0 to FF. Trying to write in one of these registers will always fail.

pcscconf targets the SpringCard PC/SC Readers only (and not the RFID Scanners, /RDR family and access control readers, nor the Legacy products).

pcscconf is able to work with only one PC/SC Reader at once. If you run pcscconf with two readers or more connected to your computer, the software will issue a warning and exit.

Firmware release 1.75 for H512 and NFC’Roll

A new firmware version (release 1.75.2) has just been published for SpringCard H512 and NFC’Roll.

This firmware improves the behaviour in card emulation and peer-to-peer (initiator) mode, allowing more reliable exchanges with most smartphones running either in reader or peer-to-peer (target) mode.

The same version will be released very soon for H663 and Prox’N’Roll PC/SC.

NFC’Roll

The new firmware is here: https://files.springcard.com/firmwares/springprox/1-75/2212_pn512_nfcroll-10_1-75.mot

The firmware upgrade procedure is here: https://tech.springcard.com/firmware-upgrade/csb6-firmware-upgrade/

H512

The new firmware is here: https://files.springcard.com/firmwares/springprox/1-75/uc3b0256_pn512_h512_1-75.hex

The firmware upgrade procedure is here: https://tech.springcard.com/firmware-upgrade/h663-h512-firmware-upgrade/

Using SCardControl under Linux and from a Java program

SCardControl is the PC/SC function that makes it possible for the application to invoke ‘proprietary’ functions, implemented either in the PC/SC reader itself (CSB6Prox’N’Roll PC/SCEasyFinger or CrazyWriter) , or in its driver running on the PC, or in the PC/SC middleware.

The prototype is:

LONG SCardControl(
  SCARDHANDLE hCard,
  DWORD dwControlCode,
  LPCVOID lpInBuffer,
  DWORD nInBufferSize,
  LPVOID lpOutBuffer,
  DWORD nOutBufferSize,
  LPDWORD lpBytesReturned
);

(see http://pcsclite.alioth.debian.org/api/group__API.html for the PCSC-Lite documentation, and http://msdn.microsoft.com/en-us/library/windows/desktop/aa379474%28v=vs.85%29.aspx for Microsoft’s version).

The lpInbuffer / nInBufferSize parameters hold the command buffer that will be processed by either target -reader, driver, or PC/SC middleware-.

SpringCard PC/SC Readers do provide a few ‘proprietary’ functions (called ‘Escape commands’ in the USB CCID specification). For instance, an application would send the command 58 1E 01 00 to switch the reader’s red LED ON. A question remains: what must the value of dwControlCode be, when the application wants to send the command right to the reader, bypassing both the PC/SC middleware and the driver? The answer varies with the operating system, which doesn’t help implementing portable code.

Differences between Windows and PCSC-Lite implementations

Windows

In Microsoft’s CCID driver (http://msdn.microsoft.com/en-us/library/windows/hardware/gg487509.aspx), the dwControlCode for the Escape command is defined as follows:

#define IOCTL_CCID_ESCAPE SCARD_CTL_CODE(3500)

SpringCard PC/SC Readers follow the CCID specification. SpringCard’s CCID driver (SDD480) uses the same dwControlCode as Microsoft’s.

Therefore, on Windows, the application would switch the red LED on this way:

#include <windows.h>
#include <winscard.h>

#define IOCTL_CCID_ESCAPE SCARD_CTL_CODE(3500)

(...)

const BYTE SET_RED_LED_ON[4] = { 0x58, 0x1E, 0x01, 0x00 };

SCARDCONTEXT hContext;
SCARDHANDLE hCard;
DWORD dwProtocol;
BYTE abResponse[256];
DWORD dwRespLen;
LONG rc;

(...)

/* Instanciate the winscard.dll library */
rc = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL, &amp;hContext);
if (rc != SCARD_S_SUCCESS) { /* TODO: handle error */ }

/* Get a direct connection to the reader (we don't need a card to send Escape commands) */
rc = SCardConnect(hContext, szReader, SCARD_SHARE_DIRECT, 0, &amp;hCard, &amp;dwProtocol);
if (rc != SCARD_S_SUCCESS) { /* TODO: handle error */ }

/* Send the command */
rc = SCardControl(hCard, IOCTL_CCID_ESCAPE, SET_RED_LED_ON, sizeof(SET_RED_LED_ON), abResponse, sizeof(abResponse), &amp;dwRespLen);
if (rc != SCARD_S_SUCCESS) { /* TODO: handle error */ }

SCardDisconnect(hCard, SCARD_LEAVE_CARD);
SCardReleaseContext(hContext);

 

Important notes:

Working with MS’ CCID driver

With Microsoft’s CCID driver, the Escape feature is disabled by default.

In order to send or receive an Escape command to a reader, the DWORD registry value EscapeCommandEnable must be added and set to a non-zero value under one of the following keys.

  • HKLM\SYSTEM\CCS\Enum\USB\Vid*Pid*\*\Device Parameters (prior to Windows 7).
  • HKLM\SYSTEM\CCS\Enum\USB\Vid*Pid*\*\Device Parameters\WUDFUsbccidDriver (Windows 7 and later).

This is clearly explained in the Developer’s Manual for every PC/SC reader.

Using SpringCard’s SDD480 CCID driver shall be preferred.

Early versions of SDD480

Branch -Ax of SpringCard’s SDD480 CCID driver uses a different value for the dwControlCode parameter.

#define IOCTL_CCID_ESCAPE SCARD_CTL_CODE(2048)

Switching to the latest version of SpringCard’s SDD480 CCID driver (branch -Bx and onwards) shall be preferred.

Linux, MacOS and other Unix*

In Ludovic Rousseau’s open-source CCID driver (http://pcsclite.alioth.debian.org/ccid.html), the dwControlCode for the Escape command is defined as follows:

#define IOCTL_CCID_ESCAPE SCARD_CTL_CODE(1)

(See http://anonscm.debian.org/viewvc/pcsclite/trunk/Drivers/ccid/SCARDCONTOL.txt?view=markup for details)

Therefore, when working with PCSC-Lite, the application would switch the red LED on this way:

#ifdef __APPLE__
#include <pcsc/winscard.h>
#include <pcsc/wintypes.h>
#else
#include <winscard.h>
#endif

#define IOCTL_CCID_ESCAPE SCARD_CTL_CODE(1)

(...)

const BYTE SET_RED_LED_ON[4] = { 0x58, 0x1E, 0x01, 0x00 };

SCARDCONTEXT hContext;
SCARDHANDLE hCard;
DWORD dwProtocol;
BYTE abResponse[256];
DWORD dwRespLen;
LONG rc;

(...)

/* Instanciate the winscard.dll library */
rc = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL, &hContext);
if (rc != SCARD_S_SUCCESS) { /* TODO: handle error */ }

/* Get a direct connection to the reader (we don't need a card to send Escape commands) */
rc = SCardConnect(hContext, szReader, SCARD_SHARE_DIRECT, 0, &hCard, &dwProtocol);
if (rc != SCARD_S_SUCCESS) { /* TODO: handle error */ }

/* Send the command */
rc = SCardControl(hCard, IOCTL_CCID_ESCAPE, SET_RED_LED_ON, sizeof(SET_RED_LED_ON), abResponse, sizeof(abResponse), &dwRespLen);
if (rc != SCARD_S_SUCCESS) { /* TODO: handle error */ }

SCardDisconnect(hCard, SCARD_LEAVE_CARD);
SCardReleaseContext(hContext);

Enabling the Escape commands

With this CCID driver, the Escape feature is also disabled by default.

You’ll have to edit the CCID driver’s Info.plist file to enable this feature:

  • Open /usr/local/lib/pcsc/drivers/ccid/Info.plist in edit mode with root priviledge,
  • Locate the line <key>ifdDriverOptions</key>,
  • The following line is typically <string>0000</string>,
  • Define the new value: <string>0001</string>,
  • Save the file and restard pcscd.

(More details on http://ludovicrousseau.blogspot.fr/2011/10/featureccidesccommand.html)

Writing portable code

The idea is only to use a #ifdef to compile the correct value:

#ifdef WIN32
#define IOCTL_CCID_ESCAPE SCARD_CTL_CODE(3500)
#else
#define IOCTL_CCID_ESCAPE SCARD_CTL_CODE(1)
#endif

Java

The javax.smartcardio API provides Java methods that are stricly bound to the underlying PC/SC subsystem. The Card.transmitControlCommand method is the wrapper for SCardControl. The prototype is coherent:

public abstract byte[] transmitControlCommand(
  int controlCode,
  byte[] command)
    throws CardException

Now the same question: what must the value of controlCode be? The answer is short: it depends on the PC/SC stack! SCARD_CTL_CODE(3500) for Windows, and SCARD_CTL_CODE(1) for PCSC-Lite. But with another difference: the macro SCARD_CTL_CODE is not computed the same way between both systems!

 

As a consequence, the Java application must detect the OS, and compute the controlCode parameter accordingly.

Same example to switch the red LED on:

import javax.smartcardio.*;

(...)

static boolean isWindows()
{
  String os_name = System.getProperty("os.name").toLowerCase();
  if (os_name.indexOf("windows") > -1) return true;
  return false;
}

static int SCARD_CTL_CODE(int code)
{
  int ioctl;
  if (isWindows())
  {
    ioctl = (0x31 < < 16 | (code) << 2);
  } else
  {
    ioctl = 0x42000000 + (code);
  }
  return ioctl;
}

static int IOCTL_CCID_ESCAPE()
{
  if (isWindows())
  {
    return SCARD_CTL_CODE(3500);
  } else
  {
    return SCARD_CTL_CODE(1);
  }
}

static final byte[] SET_RED_LED_ON = { (byte) 0x58, (byte) 0x1E, (byte) 0x01, (byte) 0x00 };

(...)

String readerName;

/* Note that the reader's name vary with the OS too!!! */
if (isWindows())
  readerName = "SpringCard Prox'N'Roll Contactless 0";
else
  readerName = "SpringCard Prox'N'Roll (00000000) 00 00";

CardTerminal terminal = CardTerminals.getTerminal(readerName);

Card virtualCard = terminal.connect("DIRECT");

virtualCard.transmitControlCommand(IOCTL_CCID_ESCAPE(), SET_RED_LED_ON);

virtualCard.disconnect(false);

Of course this code works only if the Escape feature is enable by the underlying CCID driver, as seen above.

SpringCard H663 and H512 families are a group of NFC devices / contactless smartcard readers. This document explains how to upgrade their firmware, using the new SpringCard Firmware Upgrade Utility.

At the date of writing, this document refers to the products listed below:

  • H663A and H663S ‘bare’ modules, H663-USB module plus antenna,
  • CrazyWriter-HSP,
  • CSB-HSP,
  • H663A and H512S ‘bare’ modules, H512-USB module plus antenna,

Please read the datasheet of every product for specifications and the detailed list of features.

Important disclaimer:

Please note that SpringCard is not responsible for any procedure that end user performs. Please note that not products can be recovered from improper firmware upgrade or mis-configuration !! YOU’RE FOLLOWING THIS PROCEDURE AT YOUR OWN RISK.

Non-Windows OS

Linux/Mac/Unix users are welcomed to use the open-source DFU-Programmer provided by Atmel and contributors and available at http://dfu-programmer.sourceforge.net/ . SpringCard H663 and H512 use the at32uc3b0256 chip.

The syntax is:

dfu-programmer at32uc3b0256 erase
dfu-programmer at32uc3b0256 flash --suppress-bootloader-mem
dfu-programmer at32uc3b0256 start

Getting started

Requirements

The SpringCard Firmware Utility 2013 works on Windows XP/Vista/7/8, on both x86 and x64 releases.

Download and install SpringCard SU13168 package

Download

Download the SU13168 installation package at address

Installation

Double-click the downloaded executable.

Make sure you install those 2 components:

  • “SpringCard Firmware Upgrade Utility”
  • “DFU USB Driver for Atmel CPUs”

Notes regarding the DFU USB Driver

The microcontroller used by SpringCard H663 and H512 families is an Atmel AVR32 (AT320UC3B0256). This microcontroller is upgradeable on the field, through its USB link. A driver is provided by Atmel to connect the microcontroller through USB, using the USB DFU (Device Firmware Upgrade) standard.

The SpringCard SU13168 package contains release 1.2.2 of Atmel USB Driver for DFU. For any issue related to the driver itself, please visit http://dfu-programmer.sourceforge.net/ and http://sourceforge.net/projects/dfu-programmer/ do download a newer version or to look for support.

Open-source components

The FUU software make uses of pieces of source code released under various open-source licences, including the GNU Public Licence (GPL).

To comply with the GPL, the FUU software it itself released under the GPL.

Check “source code to the open-source components” during install to get the source code.

Locate and download the firmware for your reader

PC/SC readers

The firmware files for the PC/SC Readers are located under https://files.springcard.com/firmwares/springprox/

The subdirectories are named after the version (for instance https://files.springcard.com/firmwares/springprox/1-74 stores all the firmware in the 1.74 branch).

In every subdirectory, the files targeting these families of products are named

  • uc3b0256_rc663_h663_(version).hex for H663 group
  • uc3b0256_pn512_h512_(version).hex for H512 group

Download the firmware you want to use and save it locally on your hard drive.

Quickly download latest firmware’s version

The links below will enable you to download directly the latest version of each firmware :

Working with SpringCard Firmware Upgrade Utility (FUU)

Create your 1st project

When you launch the software for the first time, the list of Existing Projects is empty.

fuu-1

Check Create a new Project, and click OK.

fuu-2

Check Product group: H663/H512. The software opens a dialog box to let you select the firmware you want to put into the product (click Browse if the dialog box doesn’t open automatically).

Browse to the folder where you have downloaded the firmware earlier, and select the firmware file (extension is .HEX).

fuu-3

Back to the “Firmware Upgrade Settings” box, note that a Project Name has been generated from the name of the firmware file.

fuu-4

You may change the name, or just proceed by clicking OK.

Flash your device

Put the device into Flash Mode (see below for a detailed procedure, depending on the hardware). Wait until the USB driver “Atmel DFU for AT32UC3B” is installed and activated by Windows.

fuu-5

fuu-6

Click Flash under the File menu.

fuu-7

The procedure takes less than 20 seconds to terminate.

fuu-8

Don’t forget to put the reader back into operation mode!

Troubleshooting

In case the software says “No DFU device found”, please open Windows’ Device Manager, and check that your device is listed as “Atmel USB” and without error mark.

  • If the device is not listed at all –> check hardware (cable, ower supply etc)
  • If the device is listed as PC/SC reader, RFID Scanner, or other SpringCard, device –> make sur the device is in Flash Mode and reset it until it boots on its DFU bootloader,
  • If an error mark is present –> check the DFU USB Driver version, contact developers of the driver for support.

Open an Existing Project

Once a Project has been created, FUU allows you to re-open it later on.

fuu-9

Make sure the Existing Projects box is checked, select the Project in the list and click OK.

You may also double-click the Project you want in the list.

Putting your device into Flash Mode

Bare H663 or H512 modules

Tie the /FLASH pin to GND before resetting (or powering up) the device to make it starts on its DFU bootloader.

For the H512, you can use a simple cable like this (connect the second pin to the reader’s housing) :

How to flash the H512

If a switch is available, you can use it (set to ON for firmware update):

twisty-writer-hsp

Modules on antennas

Use the method depicted below for the bare modules, or shunt pins 1 and 7 on the JST connector.

CrazyWriter-HSP

Locate the 4 configuration switches and set them to ON ON ON OFF to load the firmware.

Remember to put the switches back to normal position ON OFF ON OFF afterwards.

crazywriter-hsp_switches

CSB-HSP

Remove the 4 screws to open the product’s shell.

Locate the 4 configuration switches and set them to ON ON ON OFF to load the firmware.

Remember to put the switches back to normal position ON OFF ON OFF afterwards.

CSB HSP

Pay attention when closing the shell that the screws at the front are shorter than the screws at the back!