Reading Chase Visa PayPass Credit Cards

On occasion I use a VivoPay 3500 for reading RFID enabled cards, usually for demos. Well, recently, the VivoPay went missing and I was looking for something to read the data from a Chase Visa PayPass/Blink card. There is ChAP.py from RFIDIOt (http://rfidiot.org/) but it stumbled reading the Chase card. So I took ChAP.py and slimmed it down to work specifically with the Chase card. The one think I noticed is that i cant seem to identify the Expiration date.

Nonetheless here it is, at the moment it can pull name and card number (thanks goes to samy from the proxmark forums for the query command).

Usage:

./ChasePayPassBlink.py -h

ChasePayPassBlink.py
usage:

 ChasePayPassBlink.py [options]

By Brad A. - Completely stripped down version of ChAP.py
             from rfidiot.org

Options:

        -d              Debug - Show PC/SC APDU data
        -h              Print detailed help message
        -r              Raw output - do not interpret EMV data
        -v              Verbose on
        -u              UnHide CC info
        -m              Minimal Info (just CC)




Source:

root@bt:/work# cat ChasePayPassBlink.py
#! /usr/bin/env python
"""
This is a modified ChAP.py from RFIDIOt
-Brad Antoniewicz

Script that tries to select the EMV Payment Systems Directory on all inserted cards.

Original Copyright 2008 RFIDIOt
Author: Adam Laurie, mailto:adam@algroup.co.uk
        http://rfidiot.org/ChAP.py
"""

from smartcard.CardType import AnyCardType
from smartcard.CardRequest import CardRequest
from smartcard.CardConnection import CardConnection
from smartcard.CardConnectionObserver import ConsoleCardConnectionObserver
from smartcard.Exceptions import CardRequestTimeoutException
from smartcard.Exceptions import CardConnectionException

import getopt
import sys
import string
import binascii
from operator import *
import time
# default global options
TryCommand= False
Debug= False
Protocol= CardConnection.T0_protocol
Verbose= False
HideCC= True
MinInfo= False
AID = [0xa0,0x00,0x00,0x00,0x03]

# define the apdus used in this script
GET_RESPONSE = [0x00, 0xC0, 0x00, 0x00 ]
SELECT = [0x00, 0xA4, 0x04, 0x00]
CMD = [0x00, 0xB2, 0x01, 0x0C, 0x00]

# define SW1 return values
SW1_RESPONSE_BYTES= 0x61
SW1_WRONG_LENGTH= 0x6c
SW12_OK= [0x90,0x00]
SW12_NOT_SUPORTED= [0x6a,0x81]
SW12_NOT_FOUND= [0x6a,0x82]
SW12_COND_NOT_SAT= [0x69,0x85]          # conditions of use not satisfied

def printhelp():
        print '\nChasePayPassBlink.py'
        print 'usage:\n\n ChasePayPassBlink.py [options]'
        print
        print 'By Brad A. - Completely stripped down version of ChAP.py'
        print '             from rfidiot.org'
        print '\nOptions:\n'
        print '\t-d\t\tDebug - Show PC/SC APDU data'
        print '\t-h\t\tPrint detailed help message'
        print '\t-r\t\tRaw output - do not interpret EMV data'
        print '\t-v\t\tVerbose on'
        print '\t-u\t\tUnHide CC info'
        print '\t-m\t\tMinimal Info (just CC)'
        print


def hexprint(data):
        index= 0

        while index < len(data):
                print '%02x' % data[index],
                index += 1
        print


def textprint(data):
        index= 0
        out= ''

        while index < len(data):
                if data[index] >= 0x20 and data[index] < 0x7f:
                        out += chr(data[index])
                else:
                        out += '.'
                index += 1
        print out

def try_cmd(cardservice):
        le= 0x00
        apdu = CMD
        response, sw1, sw2 = send_apdu(cardservice,apdu)
        if response:
                if Verbose:
                        print '\t[VERBOSE] Got Response!'
                return response
        else:
                print '\t[ERROR] No Response'
                return False, 0, ''


def parse_ccdata(response2):
        OFFSET_HDR= 3
        OFFSET_CC= 4
        OFFSET_NAMEFIELD= 23
        OFFSET_NAMELEN= 26
        print "Response:"
        if not MinInfo:
                print "\tHeader: ",
                index=0
                while index <= len(response2[:OFFSET_HDR]):
                        print '%02x' % response2[index],
                        print "(%d)" % response2[index],
                        index += 1
                print

        print "\tCard Number: ",
        index=0
        ccnum=""
        count=0
        while index < len(response2[OFFSET_CC:OFFSET_CC + 8]):
                if HideCC:
                        if count<6:
                                ccnum += '**'
                        else:
                                ccnum += '%02x' % response2[OFFSET_CC + index]
                else:
                        ccnum += '%02x' % response2[OFFSET_CC + index]
                index +=1
                count +=1
        print ccnum

        if not MinInfo:
                print "\tStuff: ",
                index=0
                while index < len(response2[OFFSET_CC + 8:OFFSET_NAMEFIELD]):
                        print '%02x' % response2[OFFSET_CC + 8 + index],
                        print '(%d)' % response2[OFFSET_CC + 8 + index],
                        index +=1
                print

        if response2[OFFSET_NAMEFIELD] == 0x5f and response2[OFFSET_NAMEFIELD + 1] == 0x20:
                if Verbose:
                        print "\tName Field Code Found!: %02x" % response2[OFFSET_NAMEFIELD],
                        print "%02x" % response2[OFFSET_NAMEFIELD + 1]
        else:
                print "\t[WARNING]Could not find Name Field Code!! Something might not be good"


        length = '%d' % response2[OFFSET_NAMEFIELD + 2]
        if Verbose:
                print "\t[VERBOSE] Length:",length,"(",int(length),") %02x" % response2[OFFSET_NAMEFIELD + 2]

        print "\tName:",
        textprint(response2[OFFSET_NAMEFIELD+3:OFFSET_NAMEFIELD+3+int(length)])
        if Verbose:
                print "\t[VERBOSE] Name (Hex):",
                index=0
                while index < len(response2[OFFSET_NAMEFIELD+3:OFFSET_NAMEFIELD+3+int(length)]):
                        print '%02x' % response2[OFFSET_NAMEFIELD + 3 + index],
                        print '(%s)' % chr(response2[OFFSET_NAMEFIELD + 3 + index]),
                        index +=1
                print

        if not MinInfo:
                print "\tThe Rest: ",
                index=0
                while index < len(response2[OFFSET_NAMEFIELD + 3 + int(length):]):
                        print '%02x' % response2[OFFSET_NAMEFIELD + 3 + int(length) + index],
                        print '(%d)' % response2[OFFSET_NAMEFIELD + 3 + int(length) + index],
                        index += 1
                print


def check_return(sw1,sw2):
        if [sw1,sw2] == SW12_OK:
                return True
        return False

def send_apdu(cardservice,apdu):
        # send apdu and get additional data if required
        response, sw1, sw2 = cardservice.connection.transmit( apdu, Protocol )
        if sw1 == SW1_WRONG_LENGTH:
                # command used wrong length. retry with correct length.
                apdu= apdu[:len(apdu) - 1] + [sw2]
                return send_apdu(apdu)
        if sw1 == SW1_RESPONSE_BYTES:
                # response bytes available.
                apdu = GET_RESPONSE + [sw2]
                response, sw1, sw2 = cardservice.connection.transmit( apdu, Protocol )
        return response, sw1, sw2

def select_aid(cardservice,aid):
        # select an AID and return True/False plus additional data
        apdu = SELECT + [len(aid)] + aid + [0x00]
        #apdu = SELECT
        response, sw1, sw2= send_apdu(cardservice,apdu)
        if check_return(sw1,sw2):
                return True, response, sw1, sw2
        else:
                return False, [], sw1,sw2
def waitforcard():
        while(1):
                # request any card type
                cardtype = AnyCardType()
                # request card insertion
                print 'Waiting for a Card to enter the reader\'s field...'
                # cardrequest = CardRequest( timeout=10, cardType=cardtype )
                cardrequest = CardRequest(timeout=None, cardType=cardtype )
                cardservice = cardrequest.waitforcard()

                # attach the console tracer
                if Debug:
                        observer=ConsoleCardConnectionObserver()
                        cardservice.connection.addObserver( observer )

                # connect to the card
                cardservice.connection.connect(Protocol)


                print 'Connecting with AID:  ',
                hexprint(AID)
                selected, response, sw1, sw2= select_aid(cardservice,AID)
                if selected:
                        print "\tSuccess!"
                        print "Response: \n\t",
                        textprint(response)

                        if Verbose:
                                print "\t[VERBOSE]: ",
                                hexprint(response)
                        if not MinInfo:
                                print '\nRequesting Track Info: \n\t',
                                hexprint(CMD)
                        response2 = try_cmd(cardservice)
                        if Verbose:
                                print "\t[VERBOSE]: ",
                                hexprint(response2)
                                print "\t[VERBOSE]: ",
                                textprint(response2)
                        parse_ccdata(response2)


# main loop

try:
        # 'args' will be set to remaining arguments (if any)
        opts, args  = getopt.getopt(sys.argv[1:],'dtvum')
        for o, a in opts:
                if o == '-d':
                        Debug= True
                if o == '-t':
                        Protocol= CardConnection.T1_protocol
                if o == '-v':
                        Verbose= True
                if o == '-u':
                        HideCC= False
                if o == '-m':
                        MinInfo= True

except getopt.GetoptError:
        # -h will cause an exception as it doesn't exist!
        printhelp()
        sys.exit(True)


try:
        waitforcard()
except CardConnectionException:
        print 'Wait what happened? Did you remove the card from the field?'
        time.sleep(2)
        waitforcard()

except KeyboardInterrupt:
        print 'Quiting'