title: Smart Card Pre-Personalization and Historical Bytes
body: <p>I had a Smart Card that it was not fused (I mean it was not pre-personalized). It has an ATR=<code>3B F9 13 00 00 81 31 FE 45 4A 43 4F 50 32 34 32 52 33 A2</code>.</p>
  
  <p><strong>Q1: What/where is the historical byte of my card? How I can analyse them?</strong></p>
  
  <p><strong>Q2: Where I can find the model of my card? I searched for its ATR in the Internet, but I found nothing!</strong></p>
  
  <p>When you try to list applets of a really-blank card (I mean a card that not-fused) with a tool such as <em>GPJ</em>, you receive this output :</p>
  
  <pre><code>&gt;&gt; gpj -list
  
  &gt;&gt; java -jar gpj.jar -list
  Found terminals: [PC/SC terminal ACS CCID USB Reader 0]
  Found card in terminal: ACS CCID USB Reader 0
  
  ATR: 3B F9 13 00 00 81 31 FE 45 4A 43 4F 50 32 34 32 52 33 A2
  
  DEBUG: Command  APDU: 00 A4 04 00 07 A0 00 00 01 51 00 00
  DEBUG: Response APDU: 6A 82
  Failed to select Security Domain GP211 A0 00 00 01 51 00 00 , SW: 6A 82
  
  DEBUG: Command  APDU: 00 A4 04 00 08 A0 00 00 00 18 43 4D 00
  DEBUG: Response APDU: 6A 82
  Failed to select Security Domain GemaltoXpressPro A0 00 00 00 18 43 4D 00 , SW:6A 82
  
  DEBUG: Command  APDU: 00 A4 04 00 08 A0 00 00 00 03 00 00 00
  DEBUG: Response APDU: 6A 82
  Failed to select Security Domain OP201a A0 00 00 00 03 00 00 00 , SW: 6A 82
  
  DEBUG: Command  APDU: 00 A4 04 00 07 A0 00 00 00 03 00 00
  DEBUG: Response APDU: 6A 82
  Failed to select Security Domain OP201b A0 00 00 00 03 00 00 , SW: 6A 82
  
  net.sourceforge.gpj.cardservices.exceptions.GPSecurityDomainSelectionException:Could not select any of the known Security Domains!
  at net.sourceforge.gpj.cardservices.GlobalPlatformService.open(Unknown Source)
  at net.sourceforge.gpj.cardservices.GlobalPlatformService.main(Unknown Source)
  </code></pre>
  
  <p>The above output means that the tools couldn't find any SC to select. </p>
  
  <p>I searched a lot in the Internet and finally find out that I need a key (<em>Transport-Key</em>) for <em>Pre-Personalization</em> procedure.</p>
  
  <p>Let me to share some knowledge!</p>
  
  <p>The pre-personalization procedure is as below(for JCOP): </p>
  
  <ol>
  <li>Request of ATR</li>
  <li>Select command to select the Root Applet (Transport-Key is AID of this applet)</li>
  <li>Boot Command</li>
  <li>As many Read, WRITE, ADMINEXEC, SB_NAT_APPLET_INSTRUCTION, and AUTH commands as needed are possible</li>
  <li>PROTECT command</li>
  <li>Fuse the command</li>
  <li>Reset the card.</li>
  </ol>
  
  <p>In the step 4, we initialize the IC with default settings(configuring IC desired Life Cycle, defining communications behavior, ATR and/or ATS parameters or preload Applets).</p>
  
  <p>BTW, 
  I did the first two steps (1 &amp; 2) and then I reset the card and I tried to list the applets again : </p>
  
  <pre><code>&gt;&gt; gpj -list
  
  &gt;&gt; java -jar gpj.jar -list
  Found terminals: [PC/SC terminal ACS CCID USB Reader 0]
  Found card in terminal: ACS CCID USB Reader 0
  
  ATR: 3B F9 13 00 00 81 31 FE 45 4A 43 4F 50 32 34 32 52 33 A2
  
  DEBUG: Command  APDU: 00 A4 04 00 07 A0 00 00 01 51 00 00
  DEBUG: Response APDU: 6F 64 84 08 A0 00 00 01 51 00 00 00 A5 58 9F 65 01 FF 9F 6E 06 47 91 23 47 41 00 73 49 06 07 2A 86 48 86 FC 6B 01 60 0B 06 09 2A 86 48 86 FC 6B 02 02 02 63 09 06 07 2A 86 48 86 FC 6B 03 64 0B 06 09 2A 86 48 86 FC 6B 04 02 55 65 0B 06 09 2B 85 10 86 48 64 02 01 03 66 0C 06 0A 2B 06 01 04 01 2A 02 6E 01 02 90 00
  Successfully selected Security Domain GP211 A0 00 00 01 51 00 00
  
  DEBUG: Command  APDU: 80 50 00 00 08 E7 41 23 4E F5 3B EB E3
  DEBUG: Response APDU: 00 00 41 98 00 17 14 97 42 48 FF 02 00 00 BA FF B1 51 C8 BD F1 69 59 8D 80 D6 72 66 90 00
  
  javax.smartcardio.CardException: Card cryptogram invalid.at net.sourceforge.gpj.cardservices.GlobalPlatformService.openSecureChannel(Unknown Source)
  at net.sourceforge.gpj.cardservices.GlobalPlatformService.main
  (Unknown Source)
  </code></pre>
  
  <p>As you see an applets appear with AID=<code>A0 00 00 01 51 00 00</code>. But I couldn't do <em>EXTERNAL AUTHENTCAT</em> command succesfully!</p>
  
  <p><strong>Q3: Why External Authentication failed? Because I didn't set SD Keys?</strong></p>
  
  <p>I tried to select this applet using <em>OpenSC Tool</em> :</p>
  
  <pre><code>&gt;&gt; opensc-tool -s 00A4040007A0000001510000
  
  Using reader with a card: ACS CCID USB Reader 0
  Sending: 00 A4 04 00 07 A0 00 00 01 51 00 00
  Received (SW1=0x90, SW2=0x00):
  6F 64 84 08 A0 00 00 01 51 00 00 00 A5 58 9F 65 od......Q....X.e
  01 FF 9F 6E 06 47 91 23 47 41 00 73 49 06 07 2A ...n.G.#GA.sI..*
  86 48 86 FC 6B 01 60 0B 06 09 2A 86 48 86 FC 6B .H..k.`...*.H..k
  02 02 02 63 09 06 07 2A 86 48 86 FC 6B 03 64 0B ...c...*.H..k.d.
  06 09 2A 86 48 86 FC 6B 04 02 55 65 0B 06 09 2B ..*.H..k..Ue...+
  85 10 86 48 64 02 01 03 66 0C 06 0A 2B 06 01 04 ...Hd...f...+...
  01 2A 02 6E 01 02                               .*.n..
  </code></pre>
  
  <p><strong>Q4: What is the meaning of this output?</strong></p>
  
  <p>In the below you can see the output of <em>GP Shell</em> after <em>get-data</em> script also :</p>
  
  <pre><code>.:: gpshell get_data.txt
  
  establish_context
  enable_trace
  enable_timer
  card_connect
  command time: 281 ms
  get_data -identifier 9F7F
  Command --&gt; 80CA9F7F00
  Wrapped command --&gt; 80CA9F7F00
  Response &lt;-- 9F7F2A4790507547912347410041980017149742484812420500000000143E24303
  137313400000000000000009000
  9F7F2A4790507547912347410041980017149742484812420500000000143E243031373134000000
  0000000000
  command time: 62 ms
  get_data -identifier 66
  Command --&gt; 80CA006600
  Wrapped command --&gt; 80CA006600
  Response &lt;-- 664B734906072A864886FC6B01600B06092A864886FC6B020202630906072A86488
  6FC6B03640B06092A864886FC6B040255650B06092B8510864864020103660C060A2B060104012A0
  26E01029000
  664B734906072A864886FC6B01600B06092A864886FC6B020202630906072A864886FC6B03640B06
  092A864886FC6B040255650B06092B8510864864020103660C060A2B060104012A026E0102
  command time: 47 ms
  card_disconnect
  command time: 141 ms
  release_context
  command time: 0 ms
  
  .::
  </code></pre>
  
  <p><strong>Q5: What is the meaning of this output? How I can Analyse it?</strong></p>