Spanish ID 3.0

[joanbono]

Hi all!

I'm from Spain and I own a new Spanish ID Card, which uses NFC.

So reading the specifications, it uses a CAN (Card Access Number) to read the owner information (Name, Surname, Photo, Birth Date and so on). So there's a photo of the card:

In the photo, at the right-bottom corner, the CAN appears (123456). I was testing with my PM3 and I was wondering if there is a command to extract this information.

---

hf search

I got really confused when I did the hf search command. The output gives my a different UID each time 😕

pm3 --> hf search

 UID    : E4 35 02 07
 ATQB   : E1 F3 5E 11 77 81 A1
 CHIPID : 00
      App Data: E1 F3 5E 11
      Protocol: 77 81 A1
      Bit Rate: 212 kbit/s PICC -> PCD supported
      Bit Rate: 424 kbit/s PICC -> PCD supported
      Bit Rate: 847 kbit/s PICC -> PCD supported
      Bit Rate: 212 kbit/s PICC <- PCD supported
      Bit Rate: 424 kbit/s PICC <- PCD supported
      Bit Rate: 847 kbit/s PICC <- PCD supported
Max Frame Size: 256 bytes
 Protocol Type: Protocol is compliant with ISO/IEC 14443-4
Frame Wait Integer: 10 - 32768 ETUs | 309248 us
 App Data Code: Application is Proprietary
 Frame Options: NAD is not supported
 Frame Options: CID is supported
Tag :
  Max Buf Length: 0 (MBLI) chained frames not supported
  CDI : 0

Valid ISO14443-B Tag Found - Quiting Search

And next time:

pm3 --> hf search

 UID    : EA B9 5D 95
 ATQB   : E1 F3 5E 11 77 81 A1
 CHIPID : 00
      App Data: E1 F3 5E 11
      Protocol: 77 81 A1
      Bit Rate: 212 kbit/s PICC -> PCD supported
      Bit Rate: 424 kbit/s PICC -> PCD supported
      Bit Rate: 847 kbit/s PICC -> PCD supported
      Bit Rate: 212 kbit/s PICC <- PCD supported
      Bit Rate: 424 kbit/s PICC <- PCD supported
      Bit Rate: 847 kbit/s PICC <- PCD supported
Max Frame Size: 256 bytes
 Protocol Type: Protocol is compliant with ISO/IEC 14443-4
Frame Wait Integer: 10 - 32768 ETUs | 309248 us
 App Data Code: Application is Proprietary
 Frame Options: NAD is not supported
 Frame Options: CID is supported
Tag :
  Max Buf Length: 0 (MBLI) chained frames not supported
  CDI : 0

Valid ISO14443-B Tag Found - Quiting Search

So it will be really nice to implement something to "attack" the card, or even a Lua script. I'll work on it, but I need some help and orientation.

Regards!! 😃