Scam Documentation

Tim TimeWaster <tim@cuba.xs4all.nl>

Scam Tutorial

To run SCAM in interactive mode, start the program without any options:

$ ./scam
         SCAM comes with ABSOLUTELY NO WARRANTY.
         For details on distribution type "help copyright".
 ___________
|___|    ___|  SCAM: Smart Card Analyser and Manipulator
|___|   |___|              version 3.0 beta
|___|   |___|  (c) 1997-1998 by TLA <tim@cuba.xs4all.nl>
|___|___|___|
                          type help for help
0>

You will see a banner and a prompt, waiting for your commands.

First you have got to specify what reader you want to use. The notion of a reader is taken very general here, as there even exists a reader for the T=1 protocol which is independent from the actual smart card reader.

We can select a reader (in this case a Dumb Mouse reader) with the reader command:

0> reader dumbmouse

It is possible to specify certain parameters for a reader. Suppose you would like to use odd parity, inverse convention and a character waiting time of 300 etu. You would then say:

0> reader dumbmouse(parity=odd, conv=inverse, wait_etu=300)

To find out what the current values for these parameters are, type the settings command:

1> settings
Dumb Mouse settings
  device   = /dev/cua1
  baud     = 9600
  parity   = e
  wait_etu = 12
  wait_us  = 1250
  conv     = direct

It is also possible to change some of these parameters with reader-specific commands. Type help rcommands to find out about these commands. Now we are ready to communicate with the card. So insert a card into the reader and type reset:

2> reset
3b e2 00 00 40 20 49 03

We have resetted the card and got back the card's ATR. To send data to your card, use the send command:

3> send c0 a4 0 0 2 .
a4 
4> send 3f 00 .
61 14 
5> send c0 c0 0 0 14 .

6>

We have selected the MF on this card, but it seems that the reader does not respond to the ``get response'' command on line 5. This is because the waiting time that is used (12 etu) is too short for this card. To get the response after all, use the dump command:

6> dump
c0 00 00 00 00 3f 00 38 ff 4f 44 44 01 09 00 02 04 02 00 8a 8a 90 00

Of course, it is better to set the correct waiting time, especially if SCAM is run with a script. The correct waiting time can usually be determined from the ATR.